Skip to content
GitLab
You need to sign in or sign up before continuing.
Commit 2343ad07 authored by Matthias Betz's avatar Matthias Betz
Browse files

fix sql injections and path traversals

parent c5370b1e
Expand all Hide whitespace changes
Inline Side-by-side
functions/methods.ts
View file @ 2343ad07
......@@ -66,7 +66,7 @@ var methods = {
},
getUserByEmail: async function(email:any) {
try {
let rows:any = await dbconn.user.promise().query('SELECT id, verificationStatus, salutation, title, firstname, lastname, industry, organisation, speciality, m4lab_idp FROM user WHERE email = "' +email+'"')
let rows:any = await dbconn.user.promise().query('SELECT id, verificationStatus, salutation, title, firstname, lastname, industry, organisation, speciality, m4lab_idp FROM user WHERE email = ?', [email])
if (rows[0][0]) {
return rows[0][0]
}
......@@ -78,7 +78,7 @@ var methods = {
},
getUserEmailById: async function(userId:number) {
try {
let rows:any = await dbconn.user.promise().query('SELECT email FROM user WHERE id = ' +userId)
let rows:any = await dbconn.user.promise().query('SELECT email FROM user WHERE id = ?', [userId])
if (rows[0][0]) {
return rows[0][0].email
}
......@@ -90,7 +90,7 @@ var methods = {
},
checkUserEmail: async function(email:any) {
try {
let rows:any = await dbconn.user.promise().query('SELECT id, email FROM user WHERE email = "' +email+'"')
let rows:any = await dbconn.user.promise().query('SELECT id, email FROM user WHERE email = ?', [email])
if (rows[0][0]) {
return rows[0][0]
}
......@@ -102,8 +102,7 @@ var methods = {
},
getUserByToken: async function(token:any) {
try {
let rows:any = await dbconn.user.promise().query('SELECT t1.user_id, t2.email FROM userdb.credential AS t1 INNER JOIN userdb.user AS t2 ON t1.user_id = t2.id AND t1.resetPasswordToken = "'
+token+'" and resetPasswordExpires > '+Date.now())
let rows:any = await dbconn.user.promise().query('SELECT t1.user_id, t2.email FROM userdb.credential AS t1 INNER JOIN userdb.user AS t2 ON t1.user_id = t2.id AND t1.resetPasswordToken = ? and resetPasswordExpires > ?', [token, Date.now()])
if (rows[0][0]) {
return rows[0][0]
}
......@@ -115,7 +114,7 @@ var methods = {
},
updateUserById: async function(userId:number, userData:any) {
try {
let result:any = await dbconn.user.promise().query('UPDATE user SET ? WHERE id = ' +userId, userData)
let result:any = await dbconn.user.promise().query('UPDATE user SET ? WHERE id = ?', [userData, userId])
return result
} catch (err) {
console.error(err)
......@@ -124,7 +123,7 @@ var methods = {
},
updateCredential: async function(data:any) {
try {
let result:any = await dbconn.user.promise().query('UPDATE credential SET ? WHERE user_id = ' +data.user_id, data)
let result:any = await dbconn.user.promise().query('UPDATE credential SET ? WHERE user_id = ?', [data, data.user_id])
return result
} catch (err) {
console.error(err)
......@@ -139,7 +138,7 @@ var methods = {
},
getVerificationTokenByUserId: async function(userId:number) {
try {
let rows:any = await dbconn.user.promise().query('SELECT token FROM verification WHERE user_id = "' +userId+'"')
let rows:any = await dbconn.user.promise().query('SELECT token FROM verification WHERE user_id = ?', [userId])
if (rows[0][0]) {
return rows[0][0].token
}
......@@ -151,7 +150,7 @@ var methods = {
},
getUserIdByVerificationToken: async function(token:any) {
try {
let rows:any = await dbconn.user.promise().query('SELECT user_id FROM verification WHERE token = "' +token+'"')
let rows:any = await dbconn.user.promise().query('SELECT user_id FROM verification WHERE token = ?', [token])
if (rows[0][0]) {
return rows[0][0].user_id
}
......@@ -168,12 +167,12 @@ var methods = {
thisconn.beginTransaction(function(err:any) { // START TRANSACTION
if (err) { throw err }
// update user status
thisconn.query('UPDATE user SET ? WHERE id =' +userData.id, userData, function (err:any, rows:any, fields:any) {
thisconn.query('UPDATE user SET ? WHERE id = ?', [userData, userData.id], function (err:any, rows:any, fields:any) {
if (err) {
return thisconn.rollback(function() { throw err })
}
// delete verification token
thisconn.query('DELETE FROM verification WHERE user_id = '+userData.id, function (err:any, rows:any, fields:any) {
thisconn.query('DELETE FROM verification WHERE user_id = ?', [userData.id], function (err:any, rows:any, fields:any) {
if (err) {
return thisconn.rollback(function() { throw err })
}
......@@ -192,7 +191,7 @@ var methods = {
/* ===== GitLab ===== */
getGitlabId: async function(userId:number) {
try {
let rows:any = await dbconn.user.promise().query('SELECT gu.gitlab_userId FROM user_gitlab gu, user u WHERE u.id = "' +userId+'" and gu.user_id = u.id')
let rows:any = await dbconn.user.promise().query('SELECT gu.gitlab_userId FROM user_gitlab gu, user u WHERE u.id = ? and gu.user_id = u.id', [userId])
if (rows[0][0]) {
return rows[0][0].gitlab_userId
} else {
......
package-lock.json
View file @ 2343ad07
This diff is collapsed.
package.json
View file @ 2343ad07
......@@ -44,7 +44,8 @@
"nodemailer-ntlm-auth": "^1.0.1",
"passport": "0.3.2",
"passport-saml": "^2.1.0",
"pug": "^3.0.2"
"pug": "^3.0.2",
"uuid": "^10.0.0"
},
"devDependencies": {
"@types/async": "^3.2.6",
......
routes/account.ts
View file @ 2343ad07
......@@ -2,6 +2,7 @@ import fs from 'fs'
import async from 'async'
import bcrypt from 'bcryptjs'
import * as passportSaml from 'passport-saml'
import {v4 as uuidv4} from 'uuid';
import dbconn from '../config/dbconn'
import methods from '../functions/methods'
import gitlab from '../functions/gitlab'
......@@ -299,7 +300,7 @@ export = function (app:any, config:any, passport:any, lang:string) {
let newPwd = req.body.inputNewPwd
let retypePwd = req.body.inputConfirm
dbconn.user.query('SELECT password FROM credential WHERE user_id='+loggedInUser.getId(), function (err:any, rows:any) {
dbconn.user.query('SELECT password FROM credential WHERE user_id= ?', [loggedInUser.getId()], function (err:any, rows:any) {
if (err) {
console.error(err)
res.status(500).render(lang+'/500', { error: err })
......@@ -435,8 +436,9 @@ export = function (app:any, config:any, passport:any, lang:string) {
if (!req.files) {
callback(null, newLogoFile)
} else {
newLogoFile.mv(logoDir + newLogoFile.name, function(err:any) {
newLogoFile = logoDir+newLogoFile.name
let fileName = uuidv4();
newLogoFile.mv(logoDir + fileName, function(err:any) {
newLogoFile = logoDir + fileName
callback(err, newLogoFile)
})
}
......@@ -530,8 +532,9 @@ export = function (app:any, config:any, passport:any, lang:string) {
callback(null, newLogoFile)
} else {
newLogoFile = req.files.logo
newLogoFile.mv(logoDir + newLogoFile.name, function(err:any) {
newLogoFile = logoDir + newLogoFile.name
let fileName = uuidv4();
newLogoFile.mv(logoDir + fileName, function(err:any) {
newLogoFile = logoDir + fileName
callback(err, newLogoFile)
})
}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

Dies ist die Gitlab-Instanz des Transferportals der Hochschule für Technik Stuttgart. Hier geht es zurück zum Portal