@budibase/server 1.3.15-alpha.6 → 1.3.15-alpha.8

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@budibase/server",
   "email": "hi@budibase.com",
-  "version": "1.3.15-alpha.6",
+  "version": "1.3.15-alpha.8",
   "description": "Budibase Web Server",
   "main": "src/index.ts",
   "repository": {
@@ -77,11 +77,11 @@
   "license": "GPL-3.0",
   "dependencies": {
     "@apidevtools/swagger-parser": "10.0.3",
-    "@budibase/backend-core": "1.3.15-alpha.6",
-    "@budibase/client": "1.3.15-alpha.6",
-    "@budibase/pro": "1.3.15-alpha.5",
-    "@budibase/string-templates": "1.3.15-alpha.6",
-    "@budibase/types": "1.3.15-alpha.6",
+    "@budibase/backend-core": "1.3.15-alpha.8",
+    "@budibase/client": "1.3.15-alpha.8",
+    "@budibase/pro": "1.3.15-alpha.7",
+    "@budibase/string-templates": "1.3.15-alpha.8",
+    "@budibase/types": "1.3.15-alpha.8",
     "@bull-board/api": "3.7.0",
     "@bull-board/koa": "3.9.4",
     "@elastic/elasticsearch": "7.10.0",
@@ -199,5 +199,5 @@
   "optionalDependencies": {
     "oracledb": "5.3.0"
   },
-  "gitHead": "d511cc183ee3c3e6d084d7b4e121156c74ff03d8"
+  "gitHead": "cf446aa85b7200ab86289bfcedd7e9ca7a955d78"
 }

package/src/api/controllers/component.js

@@ -2,7 +2,6 @@ const { DocumentType, getPluginParams } = require("../../db/utils")
 const { getComponentLibraryManifest } = require("../../utilities/fileSystem")
 const { getAppDB } = require("@budibase/backend-core/context")
 const { getGlobalDB } = require("@budibase/backend-core/tenancy")
-const env = require("../../environment")
 
 exports.fetchAppComponentDefinitions = async function (ctx) {
   try {
@@ -33,26 +32,23 @@ exports.fetchAppComponentDefinitions = async function (ctx) {
       }
     }
 
-    // for now custom components only supported in self-host
-    if (env.SELF_HOSTED) {
-      // Add custom components
-      const globalDB = getGlobalDB()
-      const response = await globalDB.allDocs(
-        getPluginParams(null, {
-          include_docs: true,
-        })
-      )
-      response.rows
-        .map(row => row.doc)
-        .filter(plugin => plugin.schema.type === "component")
-        .forEach(plugin => {
-          const fullComponentName = `plugin/${plugin.name}`
-          definitions[fullComponentName] = {
-            component: fullComponentName,
-            ...plugin.schema.schema,
-          }
-        })
-    }
+    // Add custom components
+    const globalDB = getGlobalDB()
+    const response = await globalDB.allDocs(
+      getPluginParams(null, {
+        include_docs: true,
+      })
+    )
+    response.rows
+      .map(row => row.doc)
+      .filter(plugin => plugin.schema.type === "component")
+      .forEach(plugin => {
+        const fullComponentName = `plugin/${plugin.name}`
+        definitions[fullComponentName] = {
+          component: fullComponentName,
+          ...plugin.schema.schema,
+        }
+      })
 
     ctx.body = definitions
   } catch (err) {

package/src/api/controllers/plugin/index.ts

@@ -53,10 +53,6 @@ export async function upload(ctx: any) {
 export async function create(ctx: any) {
   const { source, url, headers, githubToken } = ctx.request.body
 
-  if (!env.SELF_HOSTED) {
-    ctx.throw(400, "Plugins not supported outside of self-host.")
-  }
-
   try {
     let metadata
     let directory
@@ -87,6 +83,13 @@ export async function create(ctx: any) {
 
     validate(metadata?.schema)
 
+    // Only allow components in cloud
+    if (!env.SELF_HOSTED && metadata?.schema?.type !== PluginType.COMPONENT) {
+      throw new Error(
+        "Only component plugins are supported outside of self-host"
+      )
+    }
+
     const doc = await storePlugin(metadata, directory, source)
 
     ctx.body = {
@@ -198,6 +201,7 @@ export async function storePlugin(
 
 export async function processPlugin(plugin: FileType, source?: string) {
   const { metadata, directory } = await fileUpload(plugin)
+  validate(metadata?.schema)
 
   // Only allow components in cloud
   if (!env.SELF_HOSTED && metadata?.schema?.type !== PluginType.COMPONENT) {

package/src/api/routes/application.ts

@@ -2,16 +2,27 @@ import Router from "@koa/router"
 import * as controller from "../controllers/application"
 import authorized from "../../middleware/authorized"
 import { BUILDER } from "@budibase/backend-core/permissions"
+import { applicationValidator } from "./utils/validators"
 
 const router = new Router()
 
 router
   .post("/api/applications/:appId/sync", authorized(BUILDER), controller.sync)
-  .post("/api/applications", authorized(BUILDER), controller.create)
+  .post(
+    "/api/applications",
+    authorized(BUILDER),
+    applicationValidator(),
+    controller.create
+  )
   .get("/api/applications/:appId/definition", controller.fetchAppDefinition)
   .get("/api/applications", controller.fetch)
   .get("/api/applications/:appId/appPackage", controller.fetchAppPackage)
-  .put("/api/applications/:appId", authorized(BUILDER), controller.update)
+  .put(
+    "/api/applications/:appId",
+    authorized(BUILDER),
+    applicationValidator(),
+    controller.update
+  )
   .post(
     "/api/applications/:appId/client/update",
     authorized(BUILDER),

package/src/api/routes/utils/validators.js

@@ -10,6 +10,7 @@ const Joi = require("joi")
 const OPTIONAL_STRING = Joi.string().optional().allow(null).allow("")
 const OPTIONAL_NUMBER = Joi.number().optional().allow(null)
 const OPTIONAL_BOOLEAN = Joi.boolean().optional().allow(null)
+const APP_NAME_REGEX = /^[\w\s]+$/
 
 exports.tableValidator = () => {
   // prettier-ignore
@@ -214,7 +215,7 @@ exports.applicationValidator = () => {
   return joiValidator.body(Joi.object({
     _id: OPTIONAL_STRING,
     _rev: OPTIONAL_STRING,
-    name: Joi.string().required(),
+    name: Joi.string().pattern(new RegExp(APP_NAME_REGEX)).required().error(new Error('App name must be letters, numbers and spaces only')),
     url: OPTIONAL_STRING,
     template: Joi.object({
       templateString: OPTIONAL_STRING,