@frangoteam/fuxa-min 1.2.11 → 1.3.1

package/runtime/users/usrstorage.js

@@ -15,6 +15,18 @@ var settings        // Application settings
 var logger;         // Application logger
 var db_usr;         // Database of users
 
+function _run(sql, params = []) {
+    return new Promise((resolve, reject) => {
+        db_usr.run(sql, params, function (err) {
+            if (err) {
+                reject(err);
+            } else {
+                resolve(this);
+            }
+        });
+    });
+}
+
 /**
  * Init and bind the database resource
  * @param {*} _settings
@@ -96,16 +108,13 @@ function _checkUpdate(columnsToAdd) {
  */
 function setDefault() {
     return new Promise(function (resolve, reject) {
-        // prepare query
-        var sql = "";
-        sql += "INSERT OR REPLACE INTO users (username, fullname, password, groups) VALUES('admin', 'Administrator Account', '" + bcrypt.hashSync('123456', 10) + "','-1');";
-        db_usr.exec(sql, function (err) {
-            if (err) {
-                logger.error(`usrstorage.set failed! ${err}`);
-                reject();
-            } else {
-                resolve();
-            }
+        const sql = "INSERT OR REPLACE INTO users (username, fullname, password, groups) VALUES(?, ?, ?, ?)";
+        const params = ['admin', 'Administrator Account', bcrypt.hashSync('123456', 10), -1];
+        _run(sql, params).then(() => {
+            resolve();
+        }).catch((err) => {
+            logger.error(`usrstorage.set failed! ${err}`);
+            reject();
         });
     });
 }
@@ -136,33 +145,33 @@ function getUsers(user) {
  */
 function setUser(usr, fullname, pwd, groups, info) {
     return new Promise(function (resolve, reject) {
-        // prepare query
-        var exist = false;
         getUsers({ username: usr }).then(function (data) {
-            if (data && data.length) {
-                exist = true;
-            }
-            var sql = "";
+            const exist = data && data.length;
+            let sql = '';
+            let params = [];
             if (pwd) {
-                sql = "INSERT OR REPLACE INTO users (username, fullname, password, groups, info) VALUES('" + usr + "','" + fullname + "','" + bcrypt.hashSync(pwd, 10) + "','" + groups + "','" + info + "');";
+                const hashedPwd = bcrypt.hashSync(pwd, 10);
                 if (exist) {
-                    sql = "UPDATE users SET password = '" + bcrypt.hashSync(pwd, 10) + "', info = '" + info + "', groups = '" + groups + "', fullname = '" + fullname + "' WHERE username = '" + usr + "';";
+                    sql = "UPDATE users SET password = ?, info = ?, groups = ?, fullname = ? WHERE username = ?";
+                    params = [hashedPwd, info, groups, fullname, usr];
+                } else {
+                    sql = "INSERT OR REPLACE INTO users (username, fullname, password, groups, info) VALUES(?, ?, ?, ?, ?)";
+                    params = [usr, fullname, hashedPwd, groups, info];
                 }
+            } else if (exist) {
+                sql = "UPDATE users SET groups = ?, info = ?, fullname = ? WHERE username = ?";
+                params = [groups, info, fullname, usr];
             } else {
-                sql = "INSERT OR REPLACE INTO users (username, fullname, groups, info) VALUES('" + usr + "','" + fullname + "','" + groups + "','" + info + "');";
-                if (exist) {
-                    sql = "UPDATE users SET groups = '" + groups + "', info = '" + info + "', fullname = '" + fullname + "' WHERE username = '" + usr + "';";
-                }
+                sql = "INSERT OR REPLACE INTO users (username, fullname, groups, info) VALUES(?, ?, ?, ?)";
+                params = [usr, fullname, groups, info];
             }
-            db_usr.exec(sql, function (err) {
-                if (err) {
-                    logger.error(`usrstorage.set failed! ${err}`);
-                    reject();
-                } else {
-                    resolve();
-                }
+            _run(sql, params).then(() => {
+                resolve();
+            }).catch((err) => {
+                logger.error(`usrstorage.set failed! ${err}`);
+                reject();
             });
-        }).catch(function (err) {
+        }).catch(function () {
             reject();
         });
     });
@@ -173,15 +182,12 @@ function setUser(usr, fullname, pwd, groups, info) {
  */
 function removeUser(usr) {
     return new Promise(function (resolve, reject) {
-        // prepare query
-        var sql = "DELETE FROM users WHERE username = '" + usr + "'";
-        db_usr.exec(sql, function (err) {
-            if (err) {
-                logger.error(`usrstorage.remove failed! ${err}`);
-                reject();
-            } else {
-                resolve();
-            }
+        var sql = "DELETE FROM users WHERE username = ?";
+        _run(sql, [usr]).then(() => {
+            resolve();
+        }).catch((err) => {
+            logger.error(`usrstorage.remove failed! ${err}`);
+            reject();
         });
     });
 }
@@ -207,18 +213,17 @@ function getRoles() {
  */
 function setRoles(roles) {
     return new Promise(async function (resolve, reject) {
-        for (var i = 0; i < roles.length; i++) {
-            const role = roles[i];
-            var value = JSON.stringify(role).replace(/\'/g,"''");
-            var sql = "INSERT OR REPLACE INTO roles (name, value) VALUES('" + role.id + "','"+ value + "');";
-            await db_usr.exec(sql, function (err) {
-                if (err) {
-                    logger.error(`usrstorage.set role failed! ${err}`);
-                    reject();
-                }
-            });
+        try {
+            const sql = "INSERT OR REPLACE INTO roles (name, value) VALUES(?, ?)";
+            for (const role of roles) {
+                const value = JSON.stringify(role);
+                await _run(sql, [role.id, value]);
+            }
+            resolve();
+        } catch (err) {
+            logger.error(`usrstorage.set role failed! ${err}`);
+            reject();
         }
-        resolve();
     });
 }
 
@@ -227,17 +232,16 @@ function setRoles(roles) {
  */
 function removeRoles(roles) {
     return new Promise(async function (resolve, reject) {
-        for (var i = 0; i < roles.length; i++) {
-            const role = roles[i];
-            var sql = "DELETE FROM roles WHERE name = '" + role.id + "'";
-            await db_usr.exec(sql, function (err) {
-                if (err) {
-                    logger.error(`usrstorage.remove role failed! ${err}`);
-                    reject();
-                }
-            });
+        try {
+            const sql = "DELETE FROM roles WHERE name = ?";
+            for (const role of roles) {
+                await _run(sql, [role.id]);
+            }
+            resolve();
+        } catch (err) {
+            logger.error(`usrstorage.remove role failed! ${err}`);
+            reject();
         }
-        resolve();
     });
 }
 
@@ -260,4 +264,4 @@ module.exports = {
     getRoles: getRoles,
     setRoles: setRoles,
     removeRoles: removeRoles
-};
+};

package/runtime/utils.js

@@ -1,5 +1,6 @@
 const os = require('os');
 const ip = require('ip');
+const crypto = require('crypto');
 
 'use strict';
 var utils = module.exports = {
@@ -361,5 +362,9 @@ var utils = module.exports = {
             }
         }
         return target;
+    },
+
+    generateSecretCode: function(byteLength = 32) {
+        return crypto.randomBytes(byteLength).toString('hex');
     }
 }

package/settings.default.js

@@ -6,6 +6,9 @@ module.exports = {
     // Standard language (editor)
     language: 'en',
 
+    // Hide the editor onboarding wizard when entering editor mode
+    hideEditorOnboarding: false,
+
     // The tcp port that the FUXA web server is listening on
     uiPort: process.env.PORT || 1881,
 
@@ -24,6 +27,7 @@ module.exports = {
     // - 'common': Less detailed than 'combined', omitting the referrer and user-agent.
     // - 'short': Shorter format that includes the remote address and request details.
     // - 'tiny': Minimalist format, showing just the method, URL, status, response length, and response time.
+	// - 'none': Completely disables HTTP request logging to clean the console for custom debugging scripts and reduce I/O overhead.
     //
     // Default Value:
     // - 'combined': By default, logApiLevel is set to 'combined', providing detailed logs suitable for thorough tracking and analysis.
@@ -91,8 +95,10 @@ module.exports = {
 
     // Used to enable security, authentication and authorization and crypt Token
     //secureEnabled: true,
-    //secretCode: 'frangoteam751',
-    //tokenExpiresIn: '1h'  // '1h'=1hour, 60=60seconds, '1d'=1day
+    //secretCode: '<set-a-strong-random-secret>',
+    //tokenExpiresIn: '1h',  // '1h'=1hour, 60=60seconds, '1d'=1day
+    //enableRefreshCookieAuth: false, // if true, use refresh token HttpOnly cookie flow
+    //refreshTokenExpiresIn: '7d' // '7d'=7days, 12h=12hours, 3600=3600seconds
 
     // Heartbeat interval in seconds (1-20)
     heartbeatIntervalSec: 10,