mirror of
https://github.com/MichMich/MagicMirror.git
synced 2026-05-08 13:48:34 +00:00
## Release Notes Thanks to: @cgillinger, @khassel, @KristjanESPERANTO, @sonnyb9 > ⚠️ This release needs nodejs version >=22.21.1 <23 || >=24 (no change to previous release) [Compare to previous Release v2.35.0](https://github.com/MagicMirrorOrg/MagicMirror/compare/v2.35.0...v2.36.0) This release falls outside the quarterly schedule. We opted for an early release due to: - Security fix for the internal cors proxy - API change of the weather provider smi - Several bug fixes ### Breaking Changes The cors proxy is now disabled by default. If required, it must be explicitly enabled in the `config.js` file. See the [documentation](https://docs.magicmirror.builders/configuration/cors.html). ### ⚠️ Security You can find several publicly accessible MagicMirror² instances. This should never be done. Doing so makes your entire configuration, including secrets and API keys, publicly visible. Furthermore, it allows attackers to target the host; this is only prevented beginning with this release. Public MagicMirror² instances should always run behind a reverse proxy with authentication. ### [core] - Prepare Release 2.36.0 (#4126) - Allow HTTPFetcher to pass through 304 responses (#4120) - fix(http-fetcher): fall back to reloadInterval after retries exhausted (#4113) - config endpoint must handle functions in module configs (#4106) - fix replaceSecretPlaceholder (#4104) - restrict replaceSecretPlaceholder to cors with allowWhitelist (#4102) - fix: prevent crash when config is undefined in socket handler (#4096) - fix cors function for alpine linux (#4091) - fix(cors): prevent SSRF via DNS rebinding (#4090) - add option to disable or restrict cors endpoint (#4087) - fix: prevent SSRF via /cors endpoint by blocking private/reserved IPs (#4084) - chore: add permissions section to enforce pull-request rules workflow (#4079) - update version for develop ### [dependencies] - update dependencies (#4124) - chore: update dependencies (#4088) - refactor: enable ESLint rule "no-unused-vars" and handle related issues (#4080) ### [modules/newsfeed] - fix(newsfeed): prevent duplicate parse error callback when using pipeline (#4083) ### [modules/updatenotification] - fix(updatenotification): harden git command execution + simplify checkUpdates (#4115) - fix(tests): correct import path for git_helper module in updatenotification tests (#4078) ### [modules/weather] - fix(weather): use nearest openmeteo hourly data (#4123) - fix(weather): avoid loading state after reconnect (#4121) - weather: fix UV index display and add WeatherFlow precipitation (#4108) - fix(weather): restore OpenWeatherMap v2.5 support (#4101) - fix(weather): use stable instanceId to prevent duplicate fetchers (#4092) - SMHI: migrate to SNOW1gv1 API (replace deprecated PMP3gv2) (#4082) ### [testing] - ci(actions): set explicit token permissions (#4114) - fix(http_fetcher): use undici.fetch when dispatcher is present (#4097) - ci(codeql): also scan develop branch on push and PR (#4086) - refactor: replace implicit global config with explicit global.config (#4085) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: sam detweiler <sdetweil@gmail.com> Co-authored-by: Kristjan ESPERANTO <35647502+KristjanESPERANTO@users.noreply.github.com> Co-authored-by: Veeck <github@veeck.de> Co-authored-by: veeck <gitkraken@veeck.de> Co-authored-by: Magnus <34011212+MagMar94@users.noreply.github.com> Co-authored-by: Ikko Eltociear Ashimine <eltociear@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: DevIncomin <56730075+Developer-Incoming@users.noreply.github.com> Co-authored-by: Nathan <n8nyoung@gmail.com> Co-authored-by: mixasgr <mixasgr@users.noreply.github.com> Co-authored-by: Savvas Adamtziloglou <savvas-gr@greeklug.gr> Co-authored-by: Konstantinos <geraki@gmail.com> Co-authored-by: OWL4C <124401812+OWL4C@users.noreply.github.com> Co-authored-by: BugHaver <43462320+bughaver@users.noreply.github.com> Co-authored-by: BugHaver <43462320+lsaadeh@users.noreply.github.com> Co-authored-by: Bugsounet - Cédric <github@bugsounet.fr> Co-authored-by: Koen Konst <koenspero@gmail.com> Co-authored-by: Koen Konst <c.h.konst@avisi.nl> Co-authored-by: dathbe <github@beffa.us> Co-authored-by: Marcel <m-idler@users.noreply.github.com> Co-authored-by: Kevin G. <crazylegstoo@gmail.com> Co-authored-by: Jboucly <33218155+jboucly@users.noreply.github.com> Co-authored-by: Jboucly <contact@jboucly.fr> Co-authored-by: Jarno <54169345+jarnoml@users.noreply.github.com> Co-authored-by: Jordan Welch <JordanHWelch@gmail.com> Co-authored-by: Blackspirits <blackspirits@gmail.com> Co-authored-by: Samed Ozdemir <samed@xsor.io> Co-authored-by: in-voker <58696565+in-voker@users.noreply.github.com> Co-authored-by: Andrés Vanegas Jiménez <142350+angeldeejay@users.noreply.github.com> Co-authored-by: cgillinger <christian.gillinger@gmail.com> Co-authored-by: Sonny B <43247590+sonnyb9@users.noreply.github.com> Co-authored-by: sonnyb9 <sonnyb9@users.noreply.github.com>
141 lines
3.7 KiB
JavaScript
141 lines
3.7 KiB
JavaScript
const express = require("express");
|
|
const Log = require("logger");
|
|
const Class = require("./class");
|
|
const { replaceSecretPlaceholder } = require("#server_functions");
|
|
|
|
const NodeHelper = Class.extend({
|
|
init () {
|
|
Log.log("Initializing new module helper ...");
|
|
},
|
|
|
|
loaded () {
|
|
Log.log(`Module helper loaded: ${this.name}`);
|
|
},
|
|
|
|
start () {
|
|
Log.log(`Starting module helper: ${this.name}`);
|
|
},
|
|
|
|
/**
|
|
* Called when the MagicMirror² server receives a `SIGINT`
|
|
* Close any open connections, stop any sub-processes and
|
|
* gracefully exit the module.
|
|
*/
|
|
stop () {
|
|
Log.log(`Stopping module helper: ${this.name}`);
|
|
},
|
|
|
|
/**
|
|
* This method is called when a socket notification arrives.
|
|
* @param {string} notification The identifier of the notification.
|
|
* @param {object} payload The payload of the notification.
|
|
*/
|
|
socketNotificationReceived (notification, payload) {
|
|
Log.log(`${this.name} received a socket notification: ${notification} - Payload: ${payload}`);
|
|
},
|
|
|
|
/**
|
|
* Set the module name.
|
|
* @param {string} name Module name.
|
|
*/
|
|
setName (name) {
|
|
this.name = name;
|
|
},
|
|
|
|
/**
|
|
* Set the module path.
|
|
* @param {string} path Module path.
|
|
*/
|
|
setPath (path) {
|
|
this.path = path;
|
|
},
|
|
|
|
/*
|
|
* sendSocketNotification(notification, payload)
|
|
* Send a socket notification to the node helper.
|
|
*
|
|
* argument notification string - The identifier of the notification.
|
|
* argument payload mixed - The payload of the notification.
|
|
*/
|
|
sendSocketNotification (notification, payload) {
|
|
this.io.of(this.name).emit(notification, payload);
|
|
},
|
|
|
|
/*
|
|
* setExpressApp(app)
|
|
* Sets the express app object for this module.
|
|
* This allows you to host files from the created webserver.
|
|
*
|
|
* argument app Express app - The Express app object.
|
|
*/
|
|
setExpressApp (app) {
|
|
this.expressApp = app;
|
|
|
|
app.use(`/${this.name}`, express.static(`${this.path}/public`));
|
|
},
|
|
|
|
/*
|
|
* setSocketIO(io)
|
|
* Sets the socket io object for this module.
|
|
* Binds message receiver.
|
|
*
|
|
* argument io Socket.io - The Socket io object.
|
|
*/
|
|
setSocketIO (io) {
|
|
this.io = io;
|
|
|
|
Log.log(`Connecting socket for: ${this.name}`);
|
|
|
|
io.of(this.name).on("connection", (socket) => {
|
|
// register catch all.
|
|
socket.onAny((notification, payload) => {
|
|
if (config?.hideConfigSecrets && payload && typeof payload === "object") {
|
|
try {
|
|
const payloadStr = replaceSecretPlaceholder(JSON.stringify(payload));
|
|
this.socketNotificationReceived(notification, JSON.parse(payloadStr));
|
|
} catch (e) {
|
|
Log.error("Error substituting variables in payload: ", e);
|
|
this.socketNotificationReceived(notification, payload);
|
|
}
|
|
} else {
|
|
this.socketNotificationReceived(notification, payload);
|
|
}
|
|
});
|
|
});
|
|
}
|
|
});
|
|
|
|
NodeHelper.checkFetchStatus = function (response) {
|
|
// response.status >= 200 && response.status < 300
|
|
if (response.ok) {
|
|
return response;
|
|
} else {
|
|
throw Error(response.statusText);
|
|
}
|
|
};
|
|
|
|
/**
|
|
* Look at the specified error and return an appropriate error type, that
|
|
* can be translated to a detailed error message
|
|
* @param {Error} error the error from fetching something
|
|
* @returns {string} the string of the detailed error message in the translations
|
|
*/
|
|
NodeHelper.checkFetchError = function (error) {
|
|
let error_type = "MODULE_ERROR_UNSPECIFIED";
|
|
if (error.code === "EAI_AGAIN") {
|
|
error_type = "MODULE_ERROR_NO_CONNECTION";
|
|
} else {
|
|
const message = typeof error.message === "string" ? error.message.toLowerCase() : "";
|
|
if (message.includes("unauthorized") || message.includes("http 401") || message.includes("http 403")) {
|
|
error_type = "MODULE_ERROR_UNAUTHORIZED";
|
|
}
|
|
}
|
|
return error_type;
|
|
};
|
|
|
|
NodeHelper.create = function (moduleDefinition) {
|
|
return NodeHelper.extend(moduleDefinition);
|
|
};
|
|
|
|
module.exports = NodeHelper;
|