forest_liana 7.2.0 → 7.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9661846cededb74e730dcd16808b9a34f13e4094467efad90d069c3eccb89e31
-  data.tar.gz: 7c7da61924546e78660f9e6674ddc15fb787432793fca4866e53681a0b4d463c
+  metadata.gz: 405d3a1e9d2b0dfd72036f751715645466617e357d3e76b0dea25b0294593fa6
+  data.tar.gz: c3109221aa1285a715790dccd479644ed577c063a291084e9bbacbc422b8ab2d
 SHA512:
-  metadata.gz: 602f195379f0e5175aaccd55eff08a49da25a6f720a68cca54fce1a40cc46d3b2e878b42fa85512a43b2de94fba9fe9476e01d6a267a572c6a4f2d73e4b182d3
-  data.tar.gz: 5dac79fb17eaddc9bece92948109934cf043e61a6afb0e697b423419e45c7ffac05b4cb6575650eceb9b3cdcd006c334ab984954e01b37a836047dd0c1f0f493
+  metadata.gz: 724439058016194576a6cc2436090b2ba0e2f04345373357410908891e8546a30bcf161a2e382b5bda6ba6bd0ad05918542ad551a6b6b5f4001137f2e43c6d9c
+  data.tar.gz: 849c567d87d937404ff555dbbadfae882f4c67c54640ce27910956b5620d58114c93464b06d691ed82a089ab904203de2e3b5bb285e052d936de42245a281687

data/app/services/forest_liana/permissions_checker.rb

@@ -159,9 +159,16 @@ module ForestLiana
 
     def segment_query_allowed?
       segments_queries_permissions = get_segments_in_permissions
-
+      # NOTICE: The segmentQuery should be in the segments_queries_permissions
       return false unless segments_queries_permissions
 
+      # Handle UNION queries made by the FRONT to display available actions on details view
+      unionQueries = @collection_list_parameters[:segmentQuery].split('/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION ');
+      if unionQueries.length > 1
+        # Are unionQueries all included only in the allowed queries
+        return unionQueries.all? { |unionQuery| segments_queries_permissions.select { |query| query.gsub(/;\s*/i, '') === unionQuery }.length > 0 };
+      end
+
       # NOTICE: @query_request_info matching an existing segment query
       return segments_queries_permissions.include? @collection_list_parameters[:segmentQuery]
     end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "7.2.0"
+  VERSION = "7.2.1"
 end

data/spec/services/forest_liana/permissions_checker_acl_disabled_spec.rb

@@ -481,6 +481,14 @@ module ForestLiana
               end
             end
 
+            context 'when user has no segments and param segmentQuery is there' do
+              let(:segmentQuery) { 'SELECT * FROM products;' }
+              let(:collection_list_parameters) { { :user_id => "1", :segmentQuery => segmentQuery } }
+              it 'should be authorized' do
+                expect(subject.is_authorized?).to be false
+              end
+            end
+
             context 'when segments are defined' do
               let(:segments_permissions) { ['SELECT * FROM products;', 'SELECT * FROM sellers;'] }
               let(:collection_list_parameters) { { :user_id => "1", :segmentQuery => segmentQuery } }
@@ -499,6 +507,26 @@ module ForestLiana
                 end
               end
 
+              context 'when received union segments NOT passing validation' do
+                let(:segmentQuery) { 'SELECT * FROM sellers/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION SELECT column_name(s) FROM table1 UNION SELECT column_name(s) FROM table2' }
+                it 'should return false' do
+                  expect(subject.is_authorized?).to be false
+                end
+              end
+
+              context 'when received union segments passing validation' do
+                let(:segmentQuery) { 'SELECT * FROM sellers/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION SELECT * FROM products' }
+                it 'should return true' do
+                  expect(subject.is_authorized?).to be true
+                end
+              end
+              context 'when received union segments with UNION inside passing validation' do
+                let(:segmentQuery) { 'SELECT COUNT(*) AS value FROM products/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION SELECT column_name(s) FROM table1 UNION SELECT column_name(s) FROM table2' }
+                let(:segments_permissions) { ['SELECT COUNT(*) AS value FROM products;', 'SELECT column_name(s) FROM table1 UNION SELECT column_name(s) FROM table2;', 'SELECT * FROM products;', 'SELECT * FROM sellers;'] }
+                it 'should return true' do
+                  expect(subject.is_authorized?).to be true
+                end
+              end
             end
 
             context 'when user has not the required permission' do

data/spec/services/forest_liana/permissions_checker_acl_enabled_spec.rb

@@ -458,6 +458,14 @@ module ForestLiana
               end
             end
 
+            context 'when user has no segments queries permissions and param segmentQuery is there' do
+              let(:segmentQuery) { 'SELECT * FROM products;' }
+              let(:collection_list_parameters) { { :user_id => "1", :segmentQuery => segmentQuery } }
+              it 'should be authorized' do
+                expect(subject.is_authorized?).to be false
+              end
+            end
+
             context 'when segments are defined' do
               let(:default_rendering_id) { 1 }
               let(:segments_permissions) {
@@ -484,6 +492,36 @@ module ForestLiana
                   expect(subject.is_authorized?).to be false
                 end
               end
+
+              context 'when received union segments NOT passing validation' do
+                let(:segmentQuery) { 'SELECT * FROM sellers/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION SELECT column_name(s) FROM table1 UNION SELECT column_name(s) FROM table2' }
+                it 'should return false' do
+                  expect(subject.is_authorized?).to be false
+                end
+              end
+
+              context 'when received union segments passing validation' do
+                let(:segmentQuery) { 'SELECT * FROM sellers/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION SELECT * FROM products' }
+                it 'should return true' do
+                  expect(subject.is_authorized?).to be true
+                end
+              end
+
+              context 'when received union segments with UNION inside passing validation' do
+                let(:segmentQuery) { 'SELECT COUNT(*) AS value FROM products/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION SELECT column_name(s) FROM table1 UNION SELECT column_name(s) FROM table2' }
+                let(:segments_permissions) {
+                  {
+                    default_rendering_id => {
+                      collection_name => {
+                        'segments' => ['SELECT COUNT(*) AS value FROM products;', 'SELECT column_name(s) FROM table1 UNION SELECT column_name(s) FROM table2;', 'SELECT * FROM products;', 'SELECT * FROM sellers;']
+                      }
+                    }
+                  }
+                }
+                it 'should return true' do
+                  expect(subject.is_authorized?).to be true
+                end
+              end
             end
           end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 7.2.0
+  version: 7.2.1
 platform: ruby
 authors:
 - Sandro Munda
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-09-10 00:00:00.000000000 Z
+date: 2021-09-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -509,171 +509,171 @@ signing_key:
 specification_version: 4
 summary: Official Rails Liana for Forest
 test_files:
-- test/services/forest_liana/operator_date_interval_parser_test.rb
-- test/services/forest_liana/schema_adapter_test.rb
-- test/forest_liana_test.rb
 - test/routing/route_test.rb
-- test/dummy/bin/rake
-- test/dummy/bin/bundle
-- test/dummy/bin/setup
-- test/dummy/bin/rails
-- test/dummy/config/boot.rb
-- test/dummy/config/secrets.yml
+- test/forest_liana_test.rb
+- test/fixtures/belongs_to_field.yml
+- test/fixtures/owner.yml
+- test/fixtures/has_one_field.yml
+- test/fixtures/serialize_field.yml
+- test/fixtures/string_field.yml
+- test/fixtures/has_many_through_field.yml
+- test/fixtures/reference.yml
+- test/fixtures/has_many_field.yml
+- test/fixtures/tree.yml
+- test/dummy/README.rdoc
+- test/dummy/public/404.html
+- test/dummy/public/422.html
+- test/dummy/public/500.html
+- test/dummy/public/favicon.ico
+- test/dummy/Rakefile
+- test/dummy/config/application.rb
 - test/dummy/config/routes.rb
+- test/dummy/config/environments/production.rb
 - test/dummy/config/environments/test.rb
 - test/dummy/config/environments/development.rb
-- test/dummy/config/environments/production.rb
-- test/dummy/config/locales/en.yml
-- test/dummy/config/initializers/inflections.rb
-- test/dummy/config/initializers/cookies_serializer.rb
-- test/dummy/config/initializers/wrap_parameters.rb
-- test/dummy/config/initializers/mime_types.rb
+- test/dummy/config/database.yml
+- test/dummy/config/initializers/backtrace_silencers.rb
 - test/dummy/config/initializers/assets.rb
-- test/dummy/config/initializers/session_store.rb
+- test/dummy/config/initializers/wrap_parameters.rb
 - test/dummy/config/initializers/filter_parameter_logging.rb
-- test/dummy/config/initializers/backtrace_silencers.rb
-- test/dummy/config/application.rb
-- test/dummy/config/database.yml
+- test/dummy/config/initializers/session_store.rb
+- test/dummy/config/initializers/inflections.rb
+- test/dummy/config/initializers/mime_types.rb
+- test/dummy/config/initializers/cookies_serializer.rb
+- test/dummy/config/locales/en.yml
 - test/dummy/config/environment.rb
-- test/dummy/Rakefile
-- test/dummy/db/schema.rb
-- test/dummy/db/migrate/20150608131430_create_integer_field.rb
-- test/dummy/db/migrate/20181111162121_create_references_table.rb
-- test/dummy/db/migrate/20160628173505_add_timestamps.rb
-- test/dummy/db/migrate/20150608130516_create_date_field.rb
-- test/dummy/db/migrate/20150608131610_create_float_field.rb
-- test/dummy/db/migrate/20150608132159_create_boolean_field.rb
-- test/dummy/db/migrate/20150623115554_create_has_many_class_name_field.rb
-- test/dummy/db/migrate/20150608131603_create_decimal_field.rb
-- test/dummy/db/migrate/20150609114636_create_belongs_to_class_name_field.rb
-- test/dummy/db/migrate/20150616150629_create_polymorphic_field.rb
-- test/dummy/db/migrate/20170614141921_create_serialize_field.rb
-- test/dummy/db/migrate/20150814081918_create_has_many_through_field.rb
-- test/dummy/db/migrate/20150608133038_create_belongs_to_field.rb
-- test/dummy/db/migrate/20150608133044_create_has_one_field.rb
-- test/dummy/db/migrate/20150608132621_create_string_field.rb
-- test/dummy/db/migrate/20160627172810_create_owner.rb
-- test/dummy/db/migrate/20150608150016_create_has_many_field.rb
-- test/dummy/db/migrate/20150612112520_create_has_and_belongs_to_many_field.rb
-- test/dummy/db/migrate/20160627172951_create_tree.rb
-- test/dummy/public/500.html
-- test/dummy/public/422.html
-- test/dummy/public/404.html
-- test/dummy/public/favicon.ico
-- test/dummy/config.ru
-- test/dummy/app/models/reference.rb
+- test/dummy/config/secrets.yml
+- test/dummy/config/boot.rb
+- test/dummy/app/models/has_many_through_field.rb
+- test/dummy/app/models/tree.rb
 - test/dummy/app/models/belongs_to_field.rb
-- test/dummy/app/models/has_many_class_name_field.rb
+- test/dummy/app/models/belongs_to_class_name_field.rb
+- test/dummy/app/models/polymorphic_field.rb
+- test/dummy/app/models/reference.rb
+- test/dummy/app/models/date_field.rb
 - test/dummy/app/models/decimal_field.rb
 - test/dummy/app/models/owner.rb
-- test/dummy/app/models/integer_field.rb
-- test/dummy/app/models/boolean_field.rb
-- test/dummy/app/models/date_field.rb
-- test/dummy/app/models/serialize_field.rb
 - test/dummy/app/models/has_many_field.rb
-- test/dummy/app/models/tree.rb
-- test/dummy/app/models/belongs_to_class_name_field.rb
+- test/dummy/app/models/boolean_field.rb
 - test/dummy/app/models/has_and_belongs_to_many_field.rb
+- test/dummy/app/models/serialize_field.rb
+- test/dummy/app/models/integer_field.rb
 - test/dummy/app/models/float_field.rb
-- test/dummy/app/models/has_one_field.rb
-- test/dummy/app/models/polymorphic_field.rb
+- test/dummy/app/models/has_many_class_name_field.rb
 - test/dummy/app/models/string_field.rb
-- test/dummy/app/models/has_many_through_field.rb
-- test/dummy/app/assets/config/manifest.js
-- test/dummy/app/assets/stylesheets/application.css
+- test/dummy/app/models/has_one_field.rb
+- test/dummy/app/views/layouts/application.html.erb
 - test/dummy/app/assets/javascripts/application.js
+- test/dummy/app/assets/stylesheets/application.css
+- test/dummy/app/assets/config/manifest.js
 - test/dummy/app/controllers/application_controller.rb
-- test/dummy/app/views/layouts/application.html.erb
 - test/dummy/app/helpers/application_helper.rb
-- test/dummy/README.rdoc
-- test/fixtures/has_many_through_field.yml
-- test/fixtures/has_many_field.yml
-- test/fixtures/string_field.yml
-- test/fixtures/owner.yml
-- test/fixtures/has_one_field.yml
-- test/fixtures/tree.yml
-- test/fixtures/serialize_field.yml
-- test/fixtures/belongs_to_field.yml
-- test/fixtures/reference.yml
+- test/dummy/config.ru
+- test/dummy/db/migrate/20150608131603_create_decimal_field.rb
+- test/dummy/db/migrate/20150616150629_create_polymorphic_field.rb
+- test/dummy/db/migrate/20160628173505_add_timestamps.rb
+- test/dummy/db/migrate/20181111162121_create_references_table.rb
+- test/dummy/db/migrate/20150623115554_create_has_many_class_name_field.rb
+- test/dummy/db/migrate/20150608131610_create_float_field.rb
+- test/dummy/db/migrate/20160627172951_create_tree.rb
+- test/dummy/db/migrate/20150612112520_create_has_and_belongs_to_many_field.rb
+- test/dummy/db/migrate/20150608132159_create_boolean_field.rb
+- test/dummy/db/migrate/20150608131430_create_integer_field.rb
+- test/dummy/db/migrate/20150608133044_create_has_one_field.rb
+- test/dummy/db/migrate/20150609114636_create_belongs_to_class_name_field.rb
+- test/dummy/db/migrate/20150814081918_create_has_many_through_field.rb
+- test/dummy/db/migrate/20150608130516_create_date_field.rb
+- test/dummy/db/migrate/20170614141921_create_serialize_field.rb
+- test/dummy/db/migrate/20150608133038_create_belongs_to_field.rb
+- test/dummy/db/migrate/20150608150016_create_has_many_field.rb
+- test/dummy/db/migrate/20160627172810_create_owner.rb
+- test/dummy/db/migrate/20150608132621_create_string_field.rb
+- test/dummy/db/schema.rb
+- test/dummy/bin/rails
+- test/dummy/bin/rake
+- test/dummy/bin/bundle
+- test/dummy/bin/setup
+- test/services/forest_liana/operator_date_interval_parser_test.rb
+- test/services/forest_liana/schema_adapter_test.rb
 - test/test_helper.rb
-- spec/services/forest_liana/has_many_getter_spec.rb
-- spec/services/forest_liana/permissions_formatter_spec.rb
-- spec/services/forest_liana/filters_parser_spec.rb
-- spec/services/forest_liana/permissions_checker_acl_enabled_spec.rb
-- spec/services/forest_liana/value_stat_getter_spec.rb
-- spec/services/forest_liana/pie_stat_getter_spec.rb
-- spec/services/forest_liana/permissions_checker_acl_disabled_spec.rb
-- spec/services/forest_liana/smart_action_field_validator_spec.rb
-- spec/services/forest_liana/schema_adapter_spec.rb
-- spec/services/forest_liana/permissions_getter_spec.rb
-- spec/services/forest_liana/resources_getter_spec.rb
-- spec/services/forest_liana/line_stat_getter_spec.rb
-- spec/services/forest_liana/apimap_sorter_spec.rb
-- spec/services/forest_liana/ip_whitelist_checker_spec.rb
-- spec/services/forest_liana/resource_updater_spec.rb
-- spec/services/forest_liana/permissions_checker_live_queries_spec.rb
-- spec/services/forest_liana/scope_manager_spec.rb
-- spec/config/initializers/logger_spec.rb
-- spec/requests/resources_spec.rb
-- spec/requests/stats_spec.rb
-- spec/requests/actions_controller_spec.rb
-- spec/requests/authentications_spec.rb
 - spec/spec_helper.rb
+- spec/config/initializers/logger_spec.rb
 - spec/lib/forest_liana/schema_file_updater_spec.rb
 - spec/lib/forest_liana/bootstrapper_spec.rb
 - spec/rails_helper.rb
-- spec/dummy/bin/rake
-- spec/dummy/bin/bundle
-- spec/dummy/bin/setup
-- spec/dummy/bin/rails
-- spec/dummy/config/boot.rb
-- spec/dummy/config/secrets.yml
+- spec/dummy/README.rdoc
+- spec/dummy/Rakefile
+- spec/dummy/config/application.rb
 - spec/dummy/config/routes.rb
+- spec/dummy/config/environments/production.rb
 - spec/dummy/config/environments/test.rb
 - spec/dummy/config/environments/development.rb
-- spec/dummy/config/environments/production.rb
-- spec/dummy/config/initializers/inflections.rb
-- spec/dummy/config/initializers/forest_liana.rb
-- spec/dummy/config/initializers/cookies_serializer.rb
-- spec/dummy/config/initializers/wrap_parameters.rb
-- spec/dummy/config/initializers/mime_types.rb
+- spec/dummy/config/database.yml
+- spec/dummy/config/initializers/backtrace_silencers.rb
 - spec/dummy/config/initializers/assets.rb
-- spec/dummy/config/initializers/session_store.rb
+- spec/dummy/config/initializers/wrap_parameters.rb
 - spec/dummy/config/initializers/filter_parameter_logging.rb
-- spec/dummy/config/initializers/backtrace_silencers.rb
-- spec/dummy/config/application.rb
-- spec/dummy/config/database.yml
+- spec/dummy/config/initializers/session_store.rb
+- spec/dummy/config/initializers/forest_liana.rb
+- spec/dummy/config/initializers/inflections.rb
+- spec/dummy/config/initializers/mime_types.rb
+- spec/dummy/config/initializers/cookies_serializer.rb
 - spec/dummy/config/environment.rb
-- spec/dummy/Rakefile
-- spec/dummy/db/schema.rb
-- spec/dummy/db/migrate/20190716135241_add_type_to_user.rb
-- spec/dummy/db/migrate/20210511141752_create_owners.rb
-- spec/dummy/db/migrate/20190226172951_create_user.rb
-- spec/dummy/db/migrate/20190716130830_add_age_to_tree.rb
-- spec/dummy/db/migrate/20210326140855_create_locations.rb
-- spec/dummy/db/migrate/20210326110524_create_references.rb
-- spec/dummy/db/migrate/20210526084712_create_products.rb
-- spec/dummy/db/migrate/20190226173051_create_isle.rb
-- spec/dummy/db/migrate/20190226174951_create_tree.rb
-- spec/dummy/config.ru
-- spec/dummy/lib/forest_liana/collections/location.rb
-- spec/dummy/lib/forest_liana/collections/user.rb
+- spec/dummy/config/secrets.yml
+- spec/dummy/config/boot.rb
 - spec/dummy/lib/forest_liana/collections/island.rb
-- spec/dummy/app/config/routes.rb
+- spec/dummy/lib/forest_liana/collections/user.rb
+- spec/dummy/lib/forest_liana/collections/location.rb
+- spec/dummy/app/models/tree.rb
+- spec/dummy/app/models/island.rb
 - spec/dummy/app/models/reference.rb
+- spec/dummy/app/models/owner.rb
 - spec/dummy/app/models/product.rb
-- spec/dummy/app/models/location.rb
 - spec/dummy/app/models/user.rb
-- spec/dummy/app/models/island.rb
-- spec/dummy/app/models/owner.rb
-- spec/dummy/app/models/tree.rb
-- spec/dummy/app/assets/config/manifest.js
-- spec/dummy/app/assets/stylesheets/application.css
+- spec/dummy/app/models/location.rb
+- spec/dummy/app/views/layouts/application.html.erb
+- spec/dummy/app/config/routes.rb
 - spec/dummy/app/assets/javascripts/application.js
-- spec/dummy/app/controllers/forest/islands_controller.rb
+- spec/dummy/app/assets/stylesheets/application.css
+- spec/dummy/app/assets/config/manifest.js
 - spec/dummy/app/controllers/application_controller.rb
-- spec/dummy/app/views/layouts/application.html.erb
+- spec/dummy/app/controllers/forest/islands_controller.rb
 - spec/dummy/app/helpers/application_helper.rb
-- spec/dummy/README.rdoc
-- spec/helpers/forest_liana/schema_helper_spec.rb
+- spec/dummy/config.ru
+- spec/dummy/db/migrate/20190226173051_create_isle.rb
+- spec/dummy/db/migrate/20190226172951_create_user.rb
+- spec/dummy/db/migrate/20190716130830_add_age_to_tree.rb
+- spec/dummy/db/migrate/20210326110524_create_references.rb
+- spec/dummy/db/migrate/20190226174951_create_tree.rb
+- spec/dummy/db/migrate/20210526084712_create_products.rb
+- spec/dummy/db/migrate/20210326140855_create_locations.rb
+- spec/dummy/db/migrate/20190716135241_add_type_to_user.rb
+- spec/dummy/db/migrate/20210511141752_create_owners.rb
+- spec/dummy/db/schema.rb
+- spec/dummy/bin/rails
+- spec/dummy/bin/rake
+- spec/dummy/bin/bundle
+- spec/dummy/bin/setup
+- spec/services/forest_liana/apimap_sorter_spec.rb
+- spec/services/forest_liana/smart_action_field_validator_spec.rb
+- spec/services/forest_liana/resource_updater_spec.rb
+- spec/services/forest_liana/has_many_getter_spec.rb
+- spec/services/forest_liana/scope_manager_spec.rb
+- spec/services/forest_liana/permissions_checker_acl_disabled_spec.rb
+- spec/services/forest_liana/ip_whitelist_checker_spec.rb
+- spec/services/forest_liana/permissions_formatter_spec.rb
+- spec/services/forest_liana/value_stat_getter_spec.rb
+- spec/services/forest_liana/line_stat_getter_spec.rb
+- spec/services/forest_liana/filters_parser_spec.rb
+- spec/services/forest_liana/permissions_checker_live_queries_spec.rb
+- spec/services/forest_liana/permissions_getter_spec.rb
+- spec/services/forest_liana/pie_stat_getter_spec.rb
+- spec/services/forest_liana/permissions_checker_acl_enabled_spec.rb
+- spec/services/forest_liana/schema_adapter_spec.rb
+- spec/services/forest_liana/resources_getter_spec.rb
+- spec/requests/authentications_spec.rb
+- spec/requests/actions_controller_spec.rb
+- spec/requests/stats_spec.rb
+- spec/requests/resources_spec.rb
 - spec/helpers/forest_liana/query_helper_spec.rb
+- spec/helpers/forest_liana/schema_helper_spec.rb