CalvinBackup/phishingclub
1
0
Fork 0
mirror of https://github.com/phishingclub/phishingclub.git synced 2026-07-14 07:47:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix perms

Browse Source 
Signed-off-by: Ronni Skansing <rskansing@gmail.com>
This commit is contained in:
Ronni Skansing
2026-05-14 11:46:41 +02:00
parent 1abb52c99e
commit 8870e95c16
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/controller/remoteBrowser.go
+15 -3
View File
@@ -688,10 +688,14 @@ func (m *RemoteBrowserController) sessionToInfo(sess *activeSession) liveSession
// ListLiveSessions returns all active victim sessions for the campaign, optionally
// filtered by campaignID query param.
func (m *RemoteBrowserController) ListLiveSessions(g *gin.Context) {
_, _, ok := m.handleSession(g)
session, _, ok := m.handleSession(g)
if !ok {
return
}
if authorized, err := service.IsAuthorized(session, data.PERMISSION_ALLOW_GLOBAL); err != nil || !authorized {
m.Response.Forbidden(g)
return
}
campaignFilter := g.Query("campaignID")
var sessions []liveSessionInfo
m.RemoteBrowserService.RangeSessions(func(_ string, val service.LiveSession) bool {
@@ -709,10 +713,14 @@ func (m *RemoteBrowserController) ListLiveSessions(g *gin.Context) {
// CloseLiveSession terminates an active victim session by cancelling its context.
func (m *RemoteBrowserController) CloseLiveSession(g *gin.Context) {
_, _, ok := m.handleSession(g)
session, _, ok := m.handleSession(g)
if !ok {
return
}
if authorized, err := service.IsAuthorized(session, data.PERMISSION_ALLOW_GLOBAL); err != nil || !authorized {
m.Response.Forbidden(g)
return
}
crID := g.Param("crID")
val, loaded := m.RemoteBrowserService.LoadAndDeleteSession(crID)
if !loaded {
@@ -727,10 +735,14 @@ func (m *RemoteBrowserController) CloseLiveSession(g *gin.Context) {
// the admin. When mode=control (query param) it also forwards mouse/keyboard
// input from the admin back into the browser.
func (m *RemoteBrowserController) StreamLiveSession(g *gin.Context) {
_, _, ok := m.handleSession(g)
session, _, ok := m.handleSession(g)
if !ok {
return
}
if authorized, err := service.IsAuthorized(session, data.PERMISSION_ALLOW_GLOBAL); err != nil || !authorized {
m.Response.Forbidden(g)
return
}
crIDStr := g.Param("crID")
val, exists := m.RemoteBrowserService.LoadSession(crIDStr)
if !exists {