Can I completely remove a node from the editor?

Core Development
1

For security reasons, I don't want to give access to the user to use the node exec.
Can I set node-red files to not show the exec node? Thanks.
I can also accept technical answers...like edit/delete lines of code/files etc. etc.
Thanks.

2

You can disable an individual node from the Palette Manager - but that is only useful if your users don't have access to the editor.

It would be possible to delete an individual node but you would have to repeat the process every time Node-RED was updated. To delete a node manually, find its 2 files (.html and .js) and delete them, also remove the appropriate entry from the parent package.json file.

Depending on the server platform, it might be more effective to give each user their own instance of Node-RED running under their own user ID. Then you could control exactly what they can do at the OS level.

1 Like
3

Or docker containers...

1 Like
4

Good point.

1 Like
5

Here? /home/example/.npm/@node-red/nodes/1.0.5/package/core/function
Here I deleted exec.js and exec.html. But still there is exec node on editor...
Where is the package.json I have to edit?
Yes, sure, I'll use a Docker image, so I'll be able to do it as I want.
Thanks for your replying!

6

As exec is in the code nodes set, just look up the folder structure to find the appropriate package.json

1 Like
7

But if you could manage to remove the exec node, your users could (via manage palette) e.g. install my node-red-contrib-xterm node... And then the gates are open... But I assume that would all be no problem when they have only access to their Docker container?

2 Likes
8

Yes, absolutely, the security is the first thing on the list.
All yours advices are welcome :slightly_smiling_face:

9

Unfortunately that is as far as my knowledge goes, so can't help you further... Think Julian is right that you need to setup your permissions somehow outside of Node-RED. A finer grained editor permission model is on the Node-RED backlog, but that won't be available soon...

10

You can tell the runtime to not load a node using the nodeExcludes option in the settings file.

Set it to an array of the node files you want it to ignore.

For example: https://github.com/IBM/node-red-app/blob/0c91c709a4dfa09fa5baa9fb8ff882adfc34fa19/bluemix-settings.js#L54

4 Likes
11

Thanks!! :grinning:

12

And if you want to disable the palette manager so the user can't install extra nodes, you can do that under the editorTheme setting...

editorTheme: {
   palette: {
        editable: false
   }
}
5 Likes
13

What are you wanting to achieve by doing this? Depending on the answer to that they may be better alternatives.

1 Like
14

What alternatives are you thinking of to prevent a node appearing in the palette? nodesExcludes is the ideal way to do that if you have control of the settings file.

1 Like
15

Argh! I was trying to find that. Missing from the docs?

1 Like
16

I was wondering what the purpose was. If the purpose is to prevent the user messing with the system a better way may be to lock down the node-red user so it can't do anything undesirable. Then even if the user started writing functions that could mess with the systems he would not be able to.

2 Likes
17

Exactly what I was saying in the first post.

18

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.