Simon Grüssing
81b1c326fc
- WebSocket Shell/RDP: Rollenprüfung statt nur JWT-Gültigkeit (war: jeder eingeloggte User konnte fremde Agents per Shell/RDP übernehmen) - JWT_SECRET: Server bricht ab statt mit unsicherem Default weiterzulaufen - Auth: Token läuft jetzt über httpOnly-Cookie statt localStorage (XSS-Schutz gegen Session-Diebstahl) - WS-Auth: Token nicht mehr als URL-Query-Param (landete in nginx-Logs), sondern als erste Message bzw. automatisch via Cookie - Frontend: toter Rollen-Check (isSuperAdmin/isAdmin ohne Funktionsaufruf) in AgentDetailPage gefixt - XSS: DOMPurify-Sanitizing für alle marked.parse()-Renderstellen (KI-Antworten, Kommentare, Knowledge Base) - E-Mail: HTML-Escaping für alle ticket-gesteuerten Felder (auch über öffentliche Ticket-Route erreichbar) - SSRF-Schutz beim Knowledge-Base-URL-Import (blockt private/Loopback-Adressen) - TV-Dashboard: Shared-Key statt komplett offenem Endpoint - Striktes Rate-Limit auf /login, must_change_password serverseitig erzwungen - Agent (C#) v2.7.0: RDP-Consent/Disconnect/Capture verlangen jetzt ein Pro-Session-Secret (war: jeder lokale Prozess konnte Consent vortäuschen), DataDir-ACL für agent.log/status.json - FIDO-PINs AES-256-GCM-verschlüsselt statt Klartext, Retention-Job für alte patch_commands/audit_log Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
95 lines
3.6 KiB
Plaintext
95 lines
3.6 KiB
Plaintext
#define MyAppName "IT Nexus Agent"
|
|
#define MyAppVersion "2.7.0"
|
|
#define MyAppPublisher "Cereda Systems GmbH"
|
|
#define MyAppURL "https://it-nexus.cereda-systems.de"
|
|
#define MyAppExeName "IT-Nexus-Agent.exe"
|
|
#define MyAppGUID "B3F7A2C1-4E8D-4F2A-9B1C-7D3E5F6A8B2C"
|
|
|
|
[Setup]
|
|
AppId={{{#MyAppGUID}}
|
|
AppName={#MyAppName}
|
|
AppVersion={#MyAppVersion}
|
|
AppVerName={#MyAppName} {#MyAppVersion}
|
|
AppPublisher={#MyAppPublisher}
|
|
AppPublisherURL={#MyAppURL}
|
|
AppSupportURL={#MyAppURL}
|
|
AppUpdatesURL={#MyAppURL}
|
|
DefaultDirName={autopf}\{#MyAppName}
|
|
DefaultGroupName={#MyAppName}
|
|
DisableProgramGroupPage=yes
|
|
DisableWelcomePage=no
|
|
OutputDir=..\installer
|
|
OutputBaseFilename=IT-Nexus-Agent-Setup-v{#MyAppVersion}
|
|
SetupIconFile=icon.ico
|
|
Compression=lzma2/max
|
|
SolidCompression=yes
|
|
WizardStyle=modern
|
|
WizardResizable=no
|
|
PrivilegesRequired=admin
|
|
MinVersion=10.0.17763
|
|
ArchitecturesInstallIn64BitMode=x64
|
|
UninstallDisplayIcon={app}\{#MyAppExeName}
|
|
UninstallDisplayName={#MyAppName} {#MyAppVersion}
|
|
VersionInfoVersion={#MyAppVersion}
|
|
VersionInfoCompany={#MyAppPublisher}
|
|
VersionInfoDescription={#MyAppName}
|
|
CloseApplications=yes
|
|
CloseApplicationsFilter=IT-Nexus-Agent.exe
|
|
|
|
[Languages]
|
|
Name: "german"; MessagesFile: "compiler:Languages\German.isl"
|
|
|
|
[Files]
|
|
Source: "publish\IT-Nexus-Agent.exe"; DestDir: "{app}"; Flags: ignoreversion
|
|
Source: "icon.ico"; DestDir: "{app}"; Flags: ignoreversion
|
|
Source: "config.template.json"; DestDir: "{commonappdata}\IT Nexus Agent"; DestName: "config.json"; Flags: onlyifdoesntexist uninsneveruninstall
|
|
|
|
[Icons]
|
|
; Kein Start-Menü-Icon und kein Desktop-Icon — Agent läuft unsichtbar im Hintergrund
|
|
|
|
[Registry]
|
|
; Kein Autostart-Eintrag — Dashboard wird NICHT automatisch gestartet
|
|
|
|
[Run]
|
|
Filename: "{app}\{#MyAppExeName}"; Parameters: "--install"; Flags: runhidden waituntilterminated; StatusMsg: "Installiere Windows Service..."
|
|
|
|
[UninstallRun]
|
|
Filename: "{app}\{#MyAppExeName}"; Parameters: "--uninstall"; Flags: runhidden waituntilterminated
|
|
|
|
[UninstallDelete]
|
|
Type: files; Name: "{commonappdata}\IT Nexus Agent\status.json"
|
|
Type: files; Name: "{commonappdata}\IT Nexus Agent\agent.log"
|
|
|
|
[Code]
|
|
procedure CurStepChanged(CurStep: TSetupStep);
|
|
var
|
|
ResultCode: Integer;
|
|
AppData: String;
|
|
begin
|
|
if CurStep = ssInstall then begin
|
|
// Service stoppen (neue Architektur)
|
|
Exec('net.exe', 'stop "IT Nexus Agent"', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
|
|
Sleep(1500);
|
|
|
|
// Verwaiste Prozesse hart killen (überlebt Service-Stop manchmal, z.B. Consent/Capture-Helper)
|
|
Exec('taskkill.exe', '/F /IM IT-Nexus-Agent.exe /T', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
|
|
Sleep(1000);
|
|
|
|
// Reste eines laufenden Self-Update-Zyklus entfernen (update.cmd + heruntergeladener Installer)
|
|
AppData := ExpandConstant('{commonappdata}\IT Nexus Agent');
|
|
if FileExists(AppData + '\update.cmd') then
|
|
DeleteFile(AppData + '\update.cmd');
|
|
if FileExists(AppData + '\IT-Nexus-Agent-Setup-Update.exe') then
|
|
DeleteFile(AppData + '\IT-Nexus-Agent-Setup-Update.exe');
|
|
|
|
// Alte Scheduled Tasks (v1.x PowerShell-Agent + RDP-Helper-Reste) entfernen
|
|
Exec('schtasks.exe', '/delete /tn "IT Nexus Agent" /f', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
|
|
Exec('schtasks.exe', '/delete /tn "IT Nexus Agent Watcher" /f', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
|
|
Exec('schtasks.exe', '/delete /tn "ITNexusAgent" /f', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
|
|
Exec('schtasks.exe', '/delete /tn "ITNexusAgentWatcher" /f', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
|
|
// Autostart-Eintrag aus vorheriger Version entfernen (falls vorhanden)
|
|
RegDeleteValue(HKCU, 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run', 'IT Nexus Agent');
|
|
Sleep(1500);
|
|
end;
|
|
end;
|