@frangoteam/fuxa-min 1.2.11 → 1.3.1

package/runtime/apikeys/apiKeysStorage.js

@@ -13,6 +13,18 @@ var settings        // Application settings
 var logger;         // Application logger
 var db_apikeys;     // Database of apikeys
 
+function _run(sql, params = []) {
+    return new Promise((resolve, reject) => {
+        db_apikeys.run(sql, params, function (err) {
+            if (err) {
+                reject(err);
+            } else {
+                resolve(this);
+            }
+        });
+    });
+}
+
 /**
  * Init and bind the database resource
  * @param {*} _settings
@@ -73,18 +85,18 @@ function getApiKeys() {
  */
 function setApiKeys(apiKeys) {
     return new Promise(async function (resolve, reject) {
-        for (var i = 0; i < apiKeys.length; i++) {
-            const apiKey = apiKeys[i];
-            var value = JSON.stringify(apiKey).replace(/\'/g,"''");
-            var sql = "INSERT OR REPLACE INTO apikeys (name, value) VALUES('" + apiKey.id + "','"+ value + "');";
-            await db_apikeys.exec(sql, function (err) {
-                if (err) {
-                    logger.error(`apiKeysStorage.set apikeys failed! ${err}`);
-                    reject();
-                }
-            });
+        try {
+            const sql = "INSERT OR REPLACE INTO apikeys (name, value) VALUES(?, ?)";
+            for (var i = 0; i < apiKeys.length; i++) {
+                const apiKey = apiKeys[i];
+                var value = JSON.stringify(apiKey);
+                await _run(sql, [apiKey.id, value]);
+            }
+            resolve();
+        } catch (err) {
+            logger.error(`apiKeysStorage.set apikeys failed! ${err}`);
+            reject();
         }
-        resolve();
     });
 }
 
@@ -93,17 +105,17 @@ function setApiKeys(apiKeys) {
  */
 function removeApiKeys(apiKeys) {
     return new Promise(async function (resolve, reject) {
-        for (var i = 0; i < apiKeys.length; i++) {
-            const apiKey = apiKeys[i];
-            var sql = "DELETE FROM apikeys WHERE name = '" + apiKey.id + "'";
-            await db_apikeys.exec(sql, function (err) {
-                if (err) {
-                    logger.error(`apiKeysStorage.remove apikeys failed! ${err}`);
-                    reject();
-                }
-            });
+        try {
+            const sql = "DELETE FROM apikeys WHERE name = ?";
+            for (var i = 0; i < apiKeys.length; i++) {
+                const apiKey = apiKeys[i];
+                await _run(sql, [apiKey.id]);
+            }
+            resolve();
+        } catch (err) {
+            logger.error(`apiKeysStorage.remove apikeys failed! ${err}`);
+            reject();
         }
-        resolve();
     });
 }
 
@@ -122,4 +134,4 @@ module.exports = {
     getApiKeys: getApiKeys,
     setApiKeys: setApiKeys,
     removeApiKeys: removeApiKeys
-};
+};

package/runtime/devices/adsclient/index.js

@@ -26,7 +26,7 @@ function ADSclient(_data, _logger, _events, _runtime) {
      * initialize the device type
      */
     this.init = function (_type) {
-        console.error('Not supported!');
+        console.error('Not supported! (adsclient.init)');
     }
 
     /**

package/runtime/devices/ethernetip/index.js

@@ -28,7 +28,7 @@ function EthernetIPclient(_data, _logger, _events, _runtime) {
      * initialize the device type
      */
     this.init = function (_type) {
-        console.error('Not supported!');
+        console.error('Not supported! (ethernetip.init)');
     }
 
     /**

package/runtime/devices/gpio/index.js

@@ -198,7 +198,7 @@ function GpioClient(_data, _logger, _events, _runtime) {
      */
     this.lastReadTimestamp = () => {
         return lastTimestampValue;
-        console.error('Not supported!');
+        console.error('Not supported! (gpio.lastReadTimestamp)');
     }
 
     /**

package/runtime/devices/odbc/index.js

@@ -24,7 +24,7 @@ function ODBCclient(_data, _logger, _events) {
      * initialize the device type 
      */
     this.init = function (_type) {
-        console.error('Not supported!');
+        console.error('Not supported! (odbc.init)');
     }
 
     /**
@@ -165,14 +165,14 @@ function ODBCclient(_data, _logger, _events) {
      * Return Tags values array { id: <name>, value: <value> }
      */
     this.getValues = function () {
-        console.error('Not supported!');
+        console.error('Not supported! (odbc.getValues)');
     }
 
     /**
      * Return Tag value { id: <name>, value: <value>, ts: <lastTimestampValue> }
      */
     this.getValue = function (tagid) {
-        console.error('Not supported!');
+        console.error(`Not supported! (odbc.getValue) (TagID: ${tagid})`);
     }
 
     /**
@@ -186,14 +186,14 @@ function ODBCclient(_data, _logger, _events) {
      * Return Tag property to show in frontend
      */
     this.getTagProperty = function (tagid) {
-        console.error('Not supported!');
+        console.error(`Not supported! (odbc.getTagProperty) (TagID: ${tagid})`);
     }
 
     /**
      * Set the Tag value to device
      */
     this.setValue = function (tagid, value) {
-        console.error('Not supported!');
+        console.error(`Not supported! (odbc.setValue) (TagID: ${tagid}, Value: ${value})`);
     }
 
     /**
@@ -263,12 +263,12 @@ function ODBCclient(_data, _logger, _events) {
  * Return tables list
  */
 function getTables(endpoint, fncGetProperty, packagerManager) {
-    return new Promise( async function (resolve, reject) {
-        if (loadOdbcLib(packagerManager)) { 
+    return new Promise(async function (resolve, reject) {
+        if (loadOdbcLib(packagerManager)) {
             var connection;
             try {
                 var security
-                await fncGetProperty({query: 'security', name: endpoint.id}).then((result, error) => {
+                await fncGetProperty({ query: 'security', name: endpoint.id }).then((result, error) => {
                     if (result) {
                         security = utils.JsonTryToParse(result.value);
                     }
@@ -286,7 +286,12 @@ function getTables(endpoint, fncGetProperty, packagerManager) {
                     loginTimeout: 10,
                 }
                 connection = await odbc.connect(connectionConfig)
-                var tables = await connection.tables(null, 'dbo', null, null);
+                var tables = [];
+
+                try {
+                    tables = await connection.tables(null, 'dbo', null, null);
+                } catch (err) { }
+
                 if (tables.length <= 0) {
                     tables = await connection.tables(null, null, null, null);
                 }

package/runtime/devices/s7/index.js

@@ -348,7 +348,7 @@ function S7client(_data, _logger, _events, _runtime) {
                         type: items[itemidx].type,
                         daq: items[itemidx].daq,
                         changed: changed,
-                        tagref: items[itemidx]
+                        tagref: data.tags[items[itemidx].id] // <--- Passes full tag config including scaling
                     };
                     someval = true;
                 }
@@ -701,4 +701,4 @@ function DbItems(dbnum) {
     this.DBNumber = dbnum;
     this.MaxSize = 0;
     this.Items = {};
-}
+}

package/runtime/devices/template/index.js

@@ -14,7 +14,7 @@ function DeviceTemplate(_data, _logger, _events) {
      * initialize the device type 
      */
     this.init = function (_type) {
-        console.error('Not supported!');
+        console.error('Not supported! (template.init)');
     }
 
     /**
@@ -22,7 +22,7 @@ function DeviceTemplate(_data, _logger, _events) {
      * Emit connection status to clients, clear all Tags values
      */
     this.connect = function () {
-        console.error('Not supported!');
+        console.error('Not supported! (template.connect)');
         // events.emit('device-status:changed', { id: data.id, status: 'connect-ok' });
         // events.emit('device-status:changed', { id: data.id, status: 'connect-error' });
     }
@@ -33,7 +33,7 @@ function DeviceTemplate(_data, _logger, _events) {
      * Emit connection status to clients, clear all Tags values
      */
     this.disconnect = function () {
-        console.error('Not supported!');
+        console.error('Not supported! (template.disconnect)');
         // events.emit('device-status:changed', { id: data.id, status: 'connect-off' });
     }
 
@@ -42,7 +42,7 @@ function DeviceTemplate(_data, _logger, _events) {
      * Update the tags values list, save in DAQ if value changed or in interval and emit values to clients
      */
     this.polling = async function () {
-        console.error('Not supported!');
+        console.error('Not supported! (template.polling)');
         // events.emit('device-value:changed', { id: data.name, values: values });
     }
 
@@ -50,49 +50,49 @@ function DeviceTemplate(_data, _logger, _events) {
      * Load Tags attribute to read with polling
      */
     this.load = function (_data) {
-        console.error('Not supported!');
+        console.error(`Not supported! (template.load) (Data: ${_data})`);
     }
 
     /**
      * Return Tags values array { id: <name>, value: <value> }
      */
     this.getValues = function () {
-        console.error('Not supported!');
+        console.error('Not supported! (template.getValues)');
     }
 
     /**
      * Return Tag value { id: <name>, value: <value>, ts: <lastTimestampValue> }
      */
     this.getValue = function (tagid) {
-        console.error('Not supported!');
+        console.error(`Not supported! (template.getValue) (TagID: ${tagid})`);
     }
 
     /**
      * Return connection status 'connect-off', 'connect-ok', 'connect-error', 'connect-busy'
      */
     this.getStatus = function () {
-        console.error('Not supported!');
+        console.error('Not supported! (template.getStatus)');
     }
 
     /**
      * Return Tag property to show in frontend
      */
     this.getTagProperty = function (tagid) {
-        console.error('Not supported!');
+        console.error(`Not supported! (template.getTagProperty) (TagID: ${tagid})`);
     }
 
     /**
      * Set the Tag value to device
      */
     this.setValue = function (tagid, value) {
-        console.error('Not supported!');
+        console.error(`Not supported! (template.setValue) (TagID: ${tagid}, Value: ${value})`);
     }
 
     /**
      * Return if device is connected
      */
     this.isConnected = function () {
-        console.error('Not supported!');
+        console.error('Not supported! (template.isConnected)');
     }
 
     /**
@@ -107,7 +107,7 @@ function DeviceTemplate(_data, _logger, _events) {
      * @returns 
      */
     this.lastReadTimestamp = () => {
-        console.error('Not supported!');
+        console.error('Not supported! (template.lastReadTimestamp)');
     }
 
     /**
@@ -115,7 +115,7 @@ function DeviceTemplate(_data, _logger, _events) {
      * @returns 
      */
     this.getTagDaqSettings = (tagId) => {
-        console.error('Not supported!');
+        console.error(`Not supported! (template.getTagDaqSettings) (TagID: ${tagId})`);
     }
 
     /**
@@ -123,7 +123,7 @@ function DeviceTemplate(_data, _logger, _events) {
      * @returns 
      */
     this.setTagDaqSettings = (tagId, settings) => {
-        console.error('Not supported!');
+        console.error(`Not supported! (template.setTagDaqSettings) (TagID: ${tagId}, Settings: ${settings})`);
     }
 }
 

package/runtime/notificator/notifystorage.js

@@ -13,6 +13,18 @@ var settings            // Application settings
 var logger;             // Application logger
 var db_notifications;   // Database of notifications
 
+function _run(sql, params = []) {
+    return new Promise((resolve, reject) => {
+        db_notifications.run(sql, params, function (err) {
+            if (err) {
+                reject(err);
+            } else {
+                resolve(this);
+            }
+        });
+    });
+}
+
 /**
  * Init and bind the database resource
  * @param {*} _settings 
@@ -120,23 +132,24 @@ function getNotifications() {
  */
 function setNotification(notification) {
     return new Promise(function (resolve, reject) {
-        // prepare query
         if (notification) {
-            var sql = "";
-            //is notification is changed insert or update record
-            // sql += "INSERT OR REPLACE INTO notifications (id, name, type, ontime, notifytime, notifytype) VALUES('" + notification.id + "','" + 
-            //         notification.type + "','" + notification.name + "','" + notification.ontime + "','" + notification.notifytime + "','" + notification.notifytype + "');";
-            sql += "INSERT OR REPLACE INTO chronicle (id, name, type, receiver, text, notifytime, notifytype) VALUES('" +
-                notification.id + "','" + notification.name + "','" + notification.type + "','" + notification.receiver + "','" + 
-                notification.text + "','" + notification.notifytime + "','" + notification.notifytype + "');";
-            db_notifications.exec(sql, function (err) {
-                if (err) {
-                    logger.error('notifystorage.failed-to-set: ' + err);
-                    reject();
-                } else {
-                    resolve();
-                }
+            const sql = "INSERT OR REPLACE INTO chronicle (id, name, type, receiver, text, notifytime, notifytype) VALUES(?, ?, ?, ?, ?, ?, ?)";
+            _run(sql, [
+                notification.id,
+                notification.name,
+                notification.type,
+                notification.receiver,
+                notification.text,
+                notification.notifytime,
+                notification.notifytype
+            ]).then(function () {
+                resolve();
+            }).catch(function (err) {
+                logger.error('notifystorage.failed-to-set: ' + err);
+                reject();
             });
+        } else {
+            resolve();
         }
     });
 }
@@ -156,14 +169,12 @@ function close() {
  function removeNotification(notification) {
     return new Promise(function (resolve, reject) {
         // prepare query
-        var sql = "DELETE FROM notifications WHERE id = '" + notification.id + "'";
-        db_notifications.exec(sql, function (err) {
-            if (err) {
-                logger.error('notificationsstorage.failed-to-remove: ' + err);
-                reject();
-            } else {
-                resolve();
-            }
+        var sql = "DELETE FROM notifications WHERE id = ?";
+        _run(sql, [notification.id]).then(function () {
+            resolve();
+        }).catch(function (err) {
+            logger.error('notificationsstorage.failed-to-remove: ' + err);
+            reject();
         });
     });
 }

package/runtime/project/index.js

@@ -928,6 +928,22 @@ function _filterProjectPermission(userPermission) {
         // from device remove the not used (no permission)
         // delete result.devices;
         delete result.server;
+        if (Array.isArray(result.scripts)) {
+            // Keep only scripts authorised for the current user. For authorised
+            // server-side scripts, retain just the metadata needed for event
+            // bindings and execution requests; do not expose source code.
+            result.scripts = result.scripts.filter(script => {
+                return script && runtime.scriptsMgr.isAuthorised(script, userPermission);
+            }).map(script => {
+                delete script.permission;
+                delete script.permissionRoles;
+                if (script.mode === 'CLIENT') {
+                    return script;
+                }
+                delete script.code;
+                return script;
+            });
+        }
         // check navigation permission
         if (result.hmi.layout && result.hmi.layout.navigation.items) {
             for (var i = result.hmi.layout.navigation.items.length - 1; i >= 0; i--) {

package/runtime/project/prjstorage.js

@@ -13,6 +13,38 @@ var settings        // Application settings
 var logger;         // Application logger
 var db_prj;         // Database of project
 
+function _run(sql, params = []) {
+    return new Promise((resolve, reject) => {
+        db_prj.run(sql, params, function (err) {
+            if (err) {
+                reject(err);
+            } else {
+                resolve(this);
+            }
+        });
+    });
+}
+
+function _all(sql, params = []) {
+    return new Promise((resolve, reject) => {
+        db_prj.all(sql, params, function (err, rows) {
+            if (err) {
+                reject(err);
+            } else {
+                resolve(rows);
+            }
+        });
+    });
+}
+
+function _ensureValidTable(table) {
+    const tables = Object.values(TableType);
+    if (!tables.includes(table)) {
+        throw new Error(`invalid table '${table}'`);
+    }
+    return table;
+}
+
 /**
  * Init and bind the database resource
  * @param {*} _settings
@@ -83,21 +115,23 @@ function setDefault() {
  * @param {*} sections
  */
 function setSections(sections) {
-    return new Promise(function (resolve, reject) {
-        // prepare query
-        var sql = "";
-        for(var i = 0; i < sections.length; i++) {
-            var value = JSON.stringify(sections[i].value).replace(/\'/g,"''");
-            sql += "INSERT OR REPLACE INTO " + sections[i].table + " (name, value) VALUES('" + sections[i].name + "','"+ value + "');";
-        }
-        db_prj.exec(sql, function (err) {
-            if (err) {
-                logger.error(`prjstorage.set failed! ${err}`);
-                reject();
-            } else {
-                resolve();
+    return new Promise(async function (resolve, reject) {
+        try {
+            await _run('BEGIN TRANSACTION');
+            for (var i = 0; i < sections.length; i++) {
+                var table = _ensureValidTable(sections[i].table);
+                var value = JSON.stringify(sections[i].value);
+                await _run(`INSERT OR REPLACE INTO ${table} (name, value) VALUES(?, ?)`, [sections[i].name, value]);
             }
-        });
+            await _run('COMMIT');
+            resolve();
+        } catch (err) {
+            try {
+                await _run('ROLLBACK');
+            } catch (_) {}
+            logger.error(`prjstorage.set failed! ${err}`);
+            reject();
+        }
     });
 }
 
@@ -108,16 +142,19 @@ function setSections(sections) {
  */
 function setSection(section) {
     return new Promise(function (resolve, reject) {
-        var value = JSON.stringify(section.value).replace(/\'/g,"''");
-        var sql = "INSERT OR REPLACE INTO " + section.table + " (name, value) VALUES('" + section.name + "','"+ value + "');";
-        db_prj.exec(sql, function (err) {
-            if (err) {
+        try {
+            var table = _ensureValidTable(section.table);
+            var value = JSON.stringify(section.value);
+            _run(`INSERT OR REPLACE INTO ${table} (name, value) VALUES(?, ?)`, [section.name, value]).then(function () {
+                resolve();
+            }).catch(function (err) {
                 logger.error(`prjstorage.set failed! ${err}`);
                 reject();
-            } else {
-                resolve();
-            }
-        });
+            });
+        } catch (err) {
+            logger.error(`prjstorage.set failed! ${err}`);
+            reject();
+        }
     });
 }
 
@@ -129,17 +166,18 @@ function setSection(section) {
  */
 function getSection(table, name) {
     return new Promise(function (resolve, reject) {
-        var sql = "SELECT name, value FROM " + table;
-        if (name) {
-            sql += " WHERE name = '" + name + "'";
-        }
-        db_prj.all(sql, function (err, rows) {
-            if (err) {
-                reject(err);
-            } else {
-                resolve(rows);
+        try {
+            var safeTable = _ensureValidTable(table);
+            var sql = `SELECT name, value FROM ${safeTable}`;
+            var params = [];
+            if (name) {
+                sql += " WHERE name = ?";
+                params.push(name);
             }
-        });
+            _all(sql, params).then(resolve).catch(reject);
+        } catch (err) {
+            reject(err);
+        }
     });
 }
 
@@ -150,14 +188,14 @@ function getSection(table, name) {
  */
 function deleteSection(section) {
     return new Promise(function (resolve, reject) {
-        var sql = "DELETE FROM " + section.table + " WHERE name = '" + section.name + "'";
-        db_prj.run(sql, function (err, rows) {
-            if (err) {
-                reject(err);
-            } else {
+        try {
+            var table = _ensureValidTable(section.table);
+            _run(`DELETE FROM ${table} WHERE name = ?`, [section.name]).then(function () {
                 resolve();
-            }
-        });
+            }).catch(reject);
+        } catch (err) {
+            reject(err);
+        }
     });
 }
 
@@ -222,4 +260,4 @@ module.exports = {
     deleteSection: deleteSection,
     setDefault: setDefault,
     TableType: TableType,
-};
+};

package/runtime/scripts/index.js

@@ -88,6 +88,10 @@ function ScriptsManager(_runtime) {
             const st = scriptModule.getScript(_script);
             var admin = (permission === -1 || permission === 255) ? true : false;
             if (runtime.settings.userRole) {
+                admin = admin || permission?.groups === -1 || permission?.groups === 255;
+                if (admin) {
+                    return true;
+                }
                 if (!st.permissionRoles || !st.permissionRoles.enabled) {
                     return true;
                 }
@@ -106,7 +110,7 @@ function ScriptsManager(_runtime) {
     this.isAuthorisedByScriptName = function (scriptName, permission) {
         const script = scriptModule.getScriptByName(scriptName);
         if (!script) {
-            return true;
+            return false;
         }
         return this.isAuthorised(script, permission);
     }
@@ -366,4 +370,4 @@ const ScriptSchedulingMode = {
 const SchedulerType = {
     weekly: 0,
     date: 1,
-}
+}