From a69683183fc5611cdd55570f7840b974630356f7 Mon Sep 17 00:00:00 2001
From: Nick O'Leary <nick.oleary@gmail.com>
Date: Tue, 24 Jan 2017 22:50:40 +0000
Subject: [PATCH] Refuse to update a non-local node module

---
 editor/js/ui/palette-editor.js    | 14 +++++++++++---
 red/api/locales/en-US/editor.json |  3 +++
 red/api/nodes.js                  |  5 +++++
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/editor/js/ui/palette-editor.js b/editor/js/ui/palette-editor.js
index 51f272fe3..b0aa1718a 100644
--- a/editor/js/ui/palette-editor.js
+++ b/editor/js/ui/palette-editor.js
@@ -548,12 +548,20 @@ RED.palette.editor = (function() {
                         $("#palette-module-install-confirm").data('module',entry.name);
                         $("#palette-module-install-confirm").data('version',loadedIndex[entry.name].version);
                         $("#palette-module-install-confirm").data('shade',shade);
-                        $("#palette-module-install-confirm-body").html(RED._("palette.editor.confirm.update.body"));
+
+                        $("#palette-module-install-confirm-body").html(entry.local?
+                            RED._("palette.editor.confirm.update.body"):
+                            RED._("palette.editor.confirm.cannotUpdate.body")
+                        );
                         $(".palette-module-install-confirm-button-install").hide();
                         $(".palette-module-install-confirm-button-remove").hide();
-                        $(".palette-module-install-confirm-button-update").show();
+                        if (entry.local) {
+                            $(".palette-module-install-confirm-button-update").show();
+                        } else {
+                            $(".palette-module-install-confirm-button-update").hide();
+                        }
                         $("#palette-module-install-confirm")
-                            .dialog('option', 'title', RED._("palette.editor.confirm.update.title"))
+                            .dialog('option', 'title',RED._("palette.editor.confirm.update.title"))
                             .dialog('open');
                     })
 
diff --git a/red/api/locales/en-US/editor.json b/red/api/locales/en-US/editor.json
index 255c686e0..93e5c115a 100644
--- a/red/api/locales/en-US/editor.json
+++ b/red/api/locales/en-US/editor.json
@@ -314,6 +314,9 @@
                     "body":"Updating the node will require a restart of Node-RED to complete the update. This must be done manually.",
                     "title": "Update nodes"
                 },
+                "cannotUpdate": {
+                    "body":"An update for this node is available, but it is not installed in a location that the palette manager can update.<br/><br/>Please refer to the documentation for how to update this node."
+                },
                 "button": {
                     "review": "Open node information",
                     "install": "Install",
diff --git a/red/api/nodes.js b/red/api/nodes.js
index 106e845ab..842fe813b 100644
--- a/red/api/nodes.js
+++ b/red/api/nodes.js
@@ -57,6 +57,11 @@ module.exports = {
                     res.status(400).json({error:"module_already_loaded", message:"Module already loaded"});
                     return;
                 }
+                if (!module.local) {
+                    log.audit({event: "nodes.install",module:node.module, version:node.version, error:"module_not_local"},req);
+                    res.status(400).json({error:"module_not_local", message:"Module not locally installed"});
+                    return;
+                }
                 isUpgrade = true;
             }
             promise = redNodes.installModule(node.module,node.version);