From e2775adcc3a4c26777f4d40bb7b5d50139212d1d Mon Sep 17 00:00:00 2001
From: Master-Guy <566429+Master-Guy@users.noreply.github.com>
Date: Sat, 20 Jul 2019 15:52:47 +0200
Subject: [PATCH] /api/rconPasswords fix & /api/slaves security fix (#179)

Fix for /api/slaves to not send rconPasswords
Fix for /api/rconPasswords to work properly and send partial information
---
 master.js | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/master.js b/master.js
index 4ae98038..f92e3dd8 100644
--- a/master.js
+++ b/master.js
@@ -465,8 +465,8 @@ app.get("/api/slaves", function(req, res) {
 	res.header("Access-Control-Allow-Origin", "*");
 	res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
 	let slaveCache = getSlaves();
-	for(key in slaveCache) {
-		slaveCache[key].rconPassword = "hidden";
+	for(key in slaveCache.cache) {
+		slaveCache.cache[key].rconPassword = "hidden";
 	}
 	res.send(slaveCache.cache);
 });
@@ -481,9 +481,11 @@ app.post("/api/rconPasswords", authenticate.middleware, function(req, res) {
     res.header("Access-Control-Allow-Origin", "*");
     res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
     let slaveCache = getSlaves();
-    let serverInfo = [];
-    serverInfo[key] = {id: key, rconPassword: slaveCache[key].rconPassword};
-    res.send(serverInfo);
+    let validKeys = ['rconPort', 'rconPassword', 'publicIP'];
+    for(key in slaveCache.cache) {
+        slaveCache.cache[key] = {'publicIP': slaveCache.cache[key].publicIP, 'rconPort': slaveCache.cache[key].rconPort, 'rconPassword': slaveCache.cache[key].rconPassword};
+    }
+    res.send(slaveCache.cache);
 });
 /*
 var recievedItemStatistics = new averagedTimeSeries({