@@ -769,11 +769,13 @@ async function destroyAccount(username) {
769769 var data = await storage . downloadFile ( `user-${ username } .json` ) ;
770770 var json = JSON . parse ( data ) ;
771771
772- json . destroyed = true ;
773- json . color = "#d40000" ;
774- json . displayName = "[DEACTIVATED]" ;
775- json . password = "" ;
776- json . sessions = [ ] ;
772+ json = {
773+ destroyed : true ,
774+ color : "#d40000" ,
775+ displayName : "[DEACTIVATED]" ,
776+ password : "" ,
777+ sessions : [ ] ,
778+ } ;
777779
778780 await storage . uploadFile (
779781 `user-${ username } .json` ,
@@ -3854,7 +3856,164 @@ const server = http.createServer(async function (req, res) {
38543856 }
38553857 return ;
38563858 }
3859+ if ( urlsplit [ 2 ] == "myuserlist" && req . method == "GET" ) {
3860+ if ( decryptedUserdata ) {
3861+ try {
3862+ var stuff = await validateUserCookie ( decryptedUserdata ) ;
3863+ if ( ! stuff . valid ) {
3864+ runStaticStuff ( req , res , {
3865+ status : 403 ,
3866+ } ) ;
3867+ return ;
3868+ }
3869+ try {
3870+ var userListFile = `userlist-${ decryptedUserdata . username } .json` ;
3871+ var userListRawText = await storage . downloadFile ( userListFile ) ;
3872+ var json = JSON . parse ( userListRawText . toString ( ) ) ;
3873+ res . end (
3874+ JSON . stringify ( {
3875+ users : json . map ( ( usr ) => usr . username ) ,
3876+ } )
3877+ ) ;
3878+ } catch ( e ) {
3879+ res . end (
3880+ JSON . stringify ( {
3881+ users : [ ] ,
3882+ } )
3883+ ) ;
3884+ return ;
3885+ }
3886+ } catch ( e ) {
3887+ runStaticStuff ( req , res , {
3888+ status : 500 ,
3889+ } ) ;
3890+ }
3891+ } else {
3892+ runStaticStuff ( req , res , {
3893+ status : 403 ,
3894+ } ) ;
3895+ }
3896+ return ;
3897+ }
3898+ if ( urlsplit [ 2 ] == "adduserlist" && req . method == "POST" ) {
3899+ if ( decryptedUserdata ) {
3900+ try {
3901+ var body = await waitForBody ( req ) ;
3902+ var bodyJson = JSON . parse ( body . toString ( ) ) ;
3903+ if ( typeof bodyJson . username !== "string" ) {
3904+ res . statusCode = 400 ;
3905+ res . end ( "Username property must be type of string." ) ;
3906+ return ;
3907+ }
3908+ var stuff = await validateUserCookie ( decryptedUserdata ) ;
3909+ if ( ! stuff . valid ) {
3910+ runStaticStuff ( req , res , {
3911+ status : 403 ,
3912+ } ) ;
3913+ return ;
3914+ }
3915+ var userListFile = `userlist-${ decryptedUserdata . username } .json` ;
3916+ try {
3917+ var userListRawText = await storage . downloadFile ( userListFile ) ;
3918+ } catch ( e ) {
3919+ var userListRawText = "[]" ;
3920+ }
3921+ var json = JSON . parse ( userListRawText . toString ( ) ) ;
3922+ var safeUsername = bodyJson . username . trim ( ) . toLowerCase ( ) ;
3923+ if (
3924+ ! (
3925+ checkUsername ( safeUsername ) &&
3926+ ( await doesUsernameExist ( safeUsername ) )
3927+ )
3928+ ) {
3929+ res . statusCode = 404 ;
3930+ res . end ( "Username doesn't exist or invalid" ) ;
3931+ return ;
3932+ }
3933+ if ( safeUsername == decryptedUserdata . username ) {
3934+ res . statusCode = 400 ;
3935+ res . end ( "You can't add yourself!" ) ;
3936+ return ;
3937+ }
3938+ if ( ! json . find ( ( usr ) => usr . username == safeUsername ) ) {
3939+ json . push ( { username : safeUsername } ) ;
3940+ }
3941+ if ( json . length > cons . MAX_USERLIST_SIZE ) {
3942+ res . statusCode = 400 ;
3943+ res . end (
3944+ "Too many trusted usernames stored, remove some to add more."
3945+ ) ;
3946+ return ;
3947+ }
3948+ await storage . uploadFile (
3949+ userListFile ,
3950+ JSON . stringify ( json ) ,
3951+ "application/json"
3952+ ) ;
3953+ res . end ( "" ) ;
3954+ } catch ( e ) {
3955+ runStaticStuff ( req , res , {
3956+ status : 500 ,
3957+ } ) ;
3958+ }
3959+ } else {
3960+ runStaticStuff ( req , res , {
3961+ status : 403 ,
3962+ } ) ;
3963+ }
3964+ return ;
3965+ }
3966+ if ( urlsplit [ 2 ] == "removeuserlist" && req . method == "POST" ) {
3967+ if ( decryptedUserdata ) {
3968+ try {
3969+ var body = await waitForBody ( req ) ;
3970+ var bodyJson = JSON . parse ( body . toString ( ) ) ;
3971+ if ( typeof bodyJson . username !== "string" ) {
3972+ res . statusCode = 400 ;
3973+ res . end ( "Username property must be type of string." ) ;
3974+ return ;
3975+ }
3976+ var stuff = await validateUserCookie ( decryptedUserdata ) ;
3977+ if ( ! stuff . valid ) {
3978+ runStaticStuff ( req , res , {
3979+ status : 403 ,
3980+ } ) ;
3981+ return ;
3982+ }
3983+ var userListFile = `userlist-${ decryptedUserdata . username } .json` ;
3984+ try {
3985+ var userListRawText = await storage . downloadFile ( userListFile ) ;
3986+ } catch ( e ) {
3987+ var userListRawText = "[]" ;
3988+ }
3989+ var json = JSON . parse ( userListRawText . toString ( ) ) ;
3990+ var safeUsername = bodyJson . username . trim ( ) . toLowerCase ( ) ;
38573991
3992+ if ( ! checkUsername ( safeUsername ) ) {
3993+ res . statusCode = 404 ;
3994+ res . end ( "Username isn't invalid" ) ;
3995+ return ;
3996+ }
3997+
3998+ json = json . filter ( ( usr ) => usr . username !== safeUsername ) ;
3999+ await storage . uploadFile (
4000+ userListFile ,
4001+ JSON . stringify ( json ) ,
4002+ "application/json"
4003+ ) ;
4004+ res . end ( "" ) ;
4005+ } catch ( e ) {
4006+ runStaticStuff ( req , res , {
4007+ status : 500 ,
4008+ } ) ;
4009+ }
4010+ } else {
4011+ runStaticStuff ( req , res , {
4012+ status : 403 ,
4013+ } ) ;
4014+ }
4015+ return ;
4016+ }
38584017 if ( urlsplit [ 2 ] == "myrooms" && req . method == "GET" ) {
38594018 if ( decryptedUserdata ) {
38604019 try {
0 commit comments