logoutCleanup does not need to send whole user object when called #18183
Description
Description:
When a user logs out of Rocket Chat, a message is sent upstream via the web socket that includes the entire User object payload. After investigation, all current listeners do not take the user object and ignore it.
For security based installations of Rocket Chat the amount of data is hard to inspect and validate.
Steps to reproduce:
- Logout of Rocket Chat
- Inspect Web Socket traffic and see the whole user object get sent with the method logoutCleanup.
- The server side logic invokes post logout callbacks that ignore the provided user object.
Expected behaviour:
The user object is not required in this call.
Actual behavior:
app/ui-utils/client/lib/RoomManager.js
callbacks.add('afterLogoutCleanUp', () => RoomManager.closeAllRooms()
app/ui-master/client/main.js
callbacks.add('afterLogoutCleanUp', () => customScriptsOnLogout()
app/ui-utils/client/lib/popout.js
callbacks.add('afterLogoutCleanUp', () => popout.close(), callbacks.priority.MEDIUM, 'popout-close-after-logout-cleanup');
app/ui/client/lib/iframeCommands.js
Notice here how callbacks.run('afterLogoutCleanUp', user); is called but Meteor.call('logoutCleanUp', user); calls the same function internally too.
'logout'() {
const user = Meteor.user();
Meteor.logout(() => {
callbacks.run('afterLogoutCleanUp', user);
Meteor.call('logoutCleanUp', user);
return FlowRouter.go('home');
});
},
Server Setup Information:
- Version of Rocket.Chat Server: 3.2.2
- Operating System: Mac OS / Docker
- Deployment Method: k8s/docker
- Number of Running Instances: 1
- DB Replicaset Oplog:
- NodeJS Version:
- MongoDB Version:
Client Setup Information
- Desktop App or Browser Version: Chrome 83.0.4103.116
- Operating System: Catalina Mac OS
Additional context
N/A
Relevant logs:
N/A