When view only user shares view link, there is only black screen

[exander77]

When a non-admin user with share only rights makes a share link, there is only black screen.

[si458]

You haven't followed the bug template report so how can we help you?

[si458]

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Server Software (please complete the following information):

• OS: [e.g. Ubuntu]
• Virtualization: [e.g. Docker]
• Network: [e.g. LAN/WAN, reverse proxy, cloudflare, ssl offload, etc...]
• Version: [e.g. 1.0.43]
• Node: [e.g. 18.4.0]

Client Device (please complete the following information):

• Device: [e.g. Laptop]
• OS: [e.g. Ubuntu]
• Network: [e.g. Local to Meshcentral, Remote over WAN]
• Browser: [e.g. Google Chrome]
• MeshCentralRouter Version: [if applicable]

Remote Device (please complete the following information):

• Device: [e.g. Laptop]
• OS: [e.g. Windows 10 21H2]
• Network: [e.g. Local to Meshcentral, Remote over WAN]
• Current Core Version (if known): [HINT: Go to a device then console Tab then type info]

Additional context
Add any other context about the problem here.

Your config.json file

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are ignored. Edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "_cert": "myserver.mydomain.com",
    "_WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "_port": 443,
    "_aliasPort": 443,
    "_redirPort": 80,
    "_redirAliasPort": 80
  },
  "domains": {
    "": {
      "_title": "MyServer",
      "_title2": "Servername",
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true
    }
  },
  "_letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "myemail@mydomain.com",
    "names": "myserver.mydomain.com",
    "production": false
  }
}

[exander77]

@si458 There is nothing relevant and most of it cannot be answered except by exhaustive list.

I can screenshot, but there is nothing but black.
No error in browser console.
I have tested multiple browsers and operating systems. I can make a list, but it works nowhere. I tried two different locations.
I tried several versions of Node.js without any change at all.
Virtualization changes nothing.

It works for admin, so this is not browser related at all, We can rule that out. It is not related to architecture, platform, virtualization, version of Node.js, access location... Because it doesn't work for view only user with guest sharing, I assume this is pure application error/bug that is present in user/group permissions to this feature.

Default config does this as well.

It does it in latest git version as well.

To summarize it: If I have a user that has only a view access right and guest sharing, then opening the share link produced by that user only shows a black screen, under all conditions I have tested.

[si458]

All the information is relevant

Like for example what version of meshcentral are u running? U could be running an old version and a fix might already be in a newer version?

What nodejs version are u using because older nodejs are no longer supported and might not work with newer modules...

This is why we have the template so we can replicate ur exact environment and fix the issue if the is an issue

Are u using cloudflare at all too? Because cloudflare generated blackscreens on connect

And also same with mac osx it can generate backscreens from time to time too

Do u use a reverse proxy in between the Internet and meshcentral?

[exander77]

Do you understand that the feature works fine for admin user and only doesn't work for view only user? So this is not a bug report of feature not working, but feature not working depending on user/group rights set within the application?

[si458]

@exander77 so it's a bug then... and for us to help replicate the issue, we need ur environment as everybody's is different...

But I will have a little look tomorrow when I'm in the office n stationary

[exander77]

@exander77 so it's a bug then... and for us to help replicate the issue, we need ur environment as everybody's is different...

But I will have a little look tomorrow when I'm in the office n stationary

I would like to give you more info, but it doesn't work on Windows, Mac and Linux, I don't think versions are really relevant. You can assume any. This is some application issue.
Enabling/disabling proxy doesn't change the issue. This is not environment related. I just can't make it work under any conditions.

I can reproduce this issue on my oldest instance as well.
So anything from 1.0.85 to 1.1.21.

Only thing is I hadn't tried is to try to go back to a point when it starts to work. It may have never worked. As 1.0.85 is mid 2022.

To add, database backend also changes nothing, tried with nedb and mongo. Also tried with standard users and users authenticated through SSO. The list is way shorter if I tell you what I haven't tried. :)

[exander77]

Only thing that could be of relevance is exact permisison settings of the affected user/device combination:

[si458]

just want clarification so i can try and replicate this issue
user1 has those permissions listed in screenshot above,
user 1 watches a remote computer (no control just view) perfectly fine
then user 1 shares a view link with anonymous user 2
and anonymous user 2 sees the black screen?
so they at least load up the page, its just when you connect its a black page?

[exander77]

No, the page is just black, there is not even a connection menu. Just an entirely black page. I would say it loaded fine as there is no error in the console. But there is nothing to interact with, just the black background.

You can verify this in like a minute. Create user and give him View Only and Guest Share permission, as described above, let him create a link and use the link (you can use it directly by that user, there is no need to involve a second user at all). The link will load just an entirely black page.

[exander77]

@si458 So, I made connection menu visible and when I do that and try to connect I get:

ERR: Invalid protocol usage

On the server.

Which leads me to this code in meshrelay.js:

                // Limit what this relay connection can do
                if (typeof cookie.p == 'number') {
                    var usages = [];
                    if (cookie.p & 1) { usages.push(1); usages.push(6); usages.push(8); usages.push(9); } // Terminal
                    if (cookie.p & 2) { usages.push(2); } // Desktop
                    if (cookie.p & 4) { usages.push(5); usages.push(10); } // Files
                    command.soptions.usages = usages;
                }
                if (usages.indexOf(parseInt(obj.req.query.p)) < 0) { console.log('ERR: Invalid protocol usage', cookie.p, obj.req.query.p); 

cookie.p is 0, so most likely some permissions are not set right.

[si458]

right ok just looked at it and i can replicate it,
i have no idea why its adding background-colour: black?
so need to investigate it

[si458]

ok found the bug, the issue is when you create the URL, it was for some reason, resetting what access you had back to 0 ?

can you try for me plz before i push fix?
change line 4307 in meshuser.js to
if ((rights != MESHRIGHT_ADMIN) && ((rights & MESHRIGHT_REMOTEVIEWONLY) != 0)) { command.viewOnly = true; }

[exander77]

That fixed it!

One question, can I somehow disable confirmation/notification (User Consent) when using sharing? The user has no confirmation/notification required, but when the link is shared it has to have one or the other.

[si458]

no that is hard coded for security, the is an open issue about that, i will link it once i find it