@frangoteam/fuxa-min 1.3.0 → 1.3.1

package/runtime/devices/odbc/index.js

@@ -263,12 +263,12 @@ function ODBCclient(_data, _logger, _events) {
  * Return tables list
  */
 function getTables(endpoint, fncGetProperty, packagerManager) {
-    return new Promise( async function (resolve, reject) {
-        if (loadOdbcLib(packagerManager)) { 
+    return new Promise(async function (resolve, reject) {
+        if (loadOdbcLib(packagerManager)) {
             var connection;
             try {
                 var security
-                await fncGetProperty({query: 'security', name: endpoint.id}).then((result, error) => {
+                await fncGetProperty({ query: 'security', name: endpoint.id }).then((result, error) => {
                     if (result) {
                         security = utils.JsonTryToParse(result.value);
                     }
@@ -286,7 +286,12 @@ function getTables(endpoint, fncGetProperty, packagerManager) {
                     loginTimeout: 10,
                 }
                 connection = await odbc.connect(connectionConfig)
-                var tables = await connection.tables(null, 'dbo', null, null);
+                var tables = [];
+
+                try {
+                    tables = await connection.tables(null, 'dbo', null, null);
+                } catch (err) { }
+
                 if (tables.length <= 0) {
                     tables = await connection.tables(null, null, null, null);
                 }

package/runtime/devices/s7/index.js

@@ -348,7 +348,7 @@ function S7client(_data, _logger, _events, _runtime) {
                         type: items[itemidx].type,
                         daq: items[itemidx].daq,
                         changed: changed,
-                        tagref: items[itemidx]
+                        tagref: data.tags[items[itemidx].id] // <--- Passes full tag config including scaling
                     };
                     someval = true;
                 }
@@ -701,4 +701,4 @@ function DbItems(dbnum) {
     this.DBNumber = dbnum;
     this.MaxSize = 0;
     this.Items = {};
-}
+}

package/runtime/notificator/notifystorage.js

@@ -13,6 +13,18 @@ var settings            // Application settings
 var logger;             // Application logger
 var db_notifications;   // Database of notifications
 
+function _run(sql, params = []) {
+    return new Promise((resolve, reject) => {
+        db_notifications.run(sql, params, function (err) {
+            if (err) {
+                reject(err);
+            } else {
+                resolve(this);
+            }
+        });
+    });
+}
+
 /**
  * Init and bind the database resource
  * @param {*} _settings 
@@ -120,23 +132,24 @@ function getNotifications() {
  */
 function setNotification(notification) {
     return new Promise(function (resolve, reject) {
-        // prepare query
         if (notification) {
-            var sql = "";
-            //is notification is changed insert or update record
-            // sql += "INSERT OR REPLACE INTO notifications (id, name, type, ontime, notifytime, notifytype) VALUES('" + notification.id + "','" + 
-            //         notification.type + "','" + notification.name + "','" + notification.ontime + "','" + notification.notifytime + "','" + notification.notifytype + "');";
-            sql += "INSERT OR REPLACE INTO chronicle (id, name, type, receiver, text, notifytime, notifytype) VALUES('" +
-                notification.id + "','" + notification.name + "','" + notification.type + "','" + notification.receiver + "','" + 
-                notification.text + "','" + notification.notifytime + "','" + notification.notifytype + "');";
-            db_notifications.exec(sql, function (err) {
-                if (err) {
-                    logger.error('notifystorage.failed-to-set: ' + err);
-                    reject();
-                } else {
-                    resolve();
-                }
+            const sql = "INSERT OR REPLACE INTO chronicle (id, name, type, receiver, text, notifytime, notifytype) VALUES(?, ?, ?, ?, ?, ?, ?)";
+            _run(sql, [
+                notification.id,
+                notification.name,
+                notification.type,
+                notification.receiver,
+                notification.text,
+                notification.notifytime,
+                notification.notifytype
+            ]).then(function () {
+                resolve();
+            }).catch(function (err) {
+                logger.error('notifystorage.failed-to-set: ' + err);
+                reject();
             });
+        } else {
+            resolve();
         }
     });
 }
@@ -156,14 +169,12 @@ function close() {
  function removeNotification(notification) {
     return new Promise(function (resolve, reject) {
         // prepare query
-        var sql = "DELETE FROM notifications WHERE id = '" + notification.id + "'";
-        db_notifications.exec(sql, function (err) {
-            if (err) {
-                logger.error('notificationsstorage.failed-to-remove: ' + err);
-                reject();
-            } else {
-                resolve();
-            }
+        var sql = "DELETE FROM notifications WHERE id = ?";
+        _run(sql, [notification.id]).then(function () {
+            resolve();
+        }).catch(function (err) {
+            logger.error('notificationsstorage.failed-to-remove: ' + err);
+            reject();
         });
     });
 }

package/runtime/project/index.js

@@ -928,6 +928,22 @@ function _filterProjectPermission(userPermission) {
         // from device remove the not used (no permission)
         // delete result.devices;
         delete result.server;
+        if (Array.isArray(result.scripts)) {
+            // Keep only scripts authorised for the current user. For authorised
+            // server-side scripts, retain just the metadata needed for event
+            // bindings and execution requests; do not expose source code.
+            result.scripts = result.scripts.filter(script => {
+                return script && runtime.scriptsMgr.isAuthorised(script, userPermission);
+            }).map(script => {
+                delete script.permission;
+                delete script.permissionRoles;
+                if (script.mode === 'CLIENT') {
+                    return script;
+                }
+                delete script.code;
+                return script;
+            });
+        }
         // check navigation permission
         if (result.hmi.layout && result.hmi.layout.navigation.items) {
             for (var i = result.hmi.layout.navigation.items.length - 1; i >= 0; i--) {

package/runtime/project/prjstorage.js

@@ -13,6 +13,38 @@ var settings        // Application settings
 var logger;         // Application logger
 var db_prj;         // Database of project
 
+function _run(sql, params = []) {
+    return new Promise((resolve, reject) => {
+        db_prj.run(sql, params, function (err) {
+            if (err) {
+                reject(err);
+            } else {
+                resolve(this);
+            }
+        });
+    });
+}
+
+function _all(sql, params = []) {
+    return new Promise((resolve, reject) => {
+        db_prj.all(sql, params, function (err, rows) {
+            if (err) {
+                reject(err);
+            } else {
+                resolve(rows);
+            }
+        });
+    });
+}
+
+function _ensureValidTable(table) {
+    const tables = Object.values(TableType);
+    if (!tables.includes(table)) {
+        throw new Error(`invalid table '${table}'`);
+    }
+    return table;
+}
+
 /**
  * Init and bind the database resource
  * @param {*} _settings
@@ -83,21 +115,23 @@ function setDefault() {
  * @param {*} sections
  */
 function setSections(sections) {
-    return new Promise(function (resolve, reject) {
-        // prepare query
-        var sql = "";
-        for(var i = 0; i < sections.length; i++) {
-            var value = JSON.stringify(sections[i].value).replace(/\'/g,"''");
-            sql += "INSERT OR REPLACE INTO " + sections[i].table + " (name, value) VALUES('" + sections[i].name + "','"+ value + "');";
-        }
-        db_prj.exec(sql, function (err) {
-            if (err) {
-                logger.error(`prjstorage.set failed! ${err}`);
-                reject();
-            } else {
-                resolve();
+    return new Promise(async function (resolve, reject) {
+        try {
+            await _run('BEGIN TRANSACTION');
+            for (var i = 0; i < sections.length; i++) {
+                var table = _ensureValidTable(sections[i].table);
+                var value = JSON.stringify(sections[i].value);
+                await _run(`INSERT OR REPLACE INTO ${table} (name, value) VALUES(?, ?)`, [sections[i].name, value]);
             }
-        });
+            await _run('COMMIT');
+            resolve();
+        } catch (err) {
+            try {
+                await _run('ROLLBACK');
+            } catch (_) {}
+            logger.error(`prjstorage.set failed! ${err}`);
+            reject();
+        }
     });
 }
 
@@ -108,16 +142,19 @@ function setSections(sections) {
  */
 function setSection(section) {
     return new Promise(function (resolve, reject) {
-        var value = JSON.stringify(section.value).replace(/\'/g,"''");
-        var sql = "INSERT OR REPLACE INTO " + section.table + " (name, value) VALUES('" + section.name + "','"+ value + "');";
-        db_prj.exec(sql, function (err) {
-            if (err) {
+        try {
+            var table = _ensureValidTable(section.table);
+            var value = JSON.stringify(section.value);
+            _run(`INSERT OR REPLACE INTO ${table} (name, value) VALUES(?, ?)`, [section.name, value]).then(function () {
+                resolve();
+            }).catch(function (err) {
                 logger.error(`prjstorage.set failed! ${err}`);
                 reject();
-            } else {
-                resolve();
-            }
-        });
+            });
+        } catch (err) {
+            logger.error(`prjstorage.set failed! ${err}`);
+            reject();
+        }
     });
 }
 
@@ -129,17 +166,18 @@ function setSection(section) {
  */
 function getSection(table, name) {
     return new Promise(function (resolve, reject) {
-        var sql = "SELECT name, value FROM " + table;
-        if (name) {
-            sql += " WHERE name = '" + name + "'";
-        }
-        db_prj.all(sql, function (err, rows) {
-            if (err) {
-                reject(err);
-            } else {
-                resolve(rows);
+        try {
+            var safeTable = _ensureValidTable(table);
+            var sql = `SELECT name, value FROM ${safeTable}`;
+            var params = [];
+            if (name) {
+                sql += " WHERE name = ?";
+                params.push(name);
             }
-        });
+            _all(sql, params).then(resolve).catch(reject);
+        } catch (err) {
+            reject(err);
+        }
     });
 }
 
@@ -150,14 +188,14 @@ function getSection(table, name) {
  */
 function deleteSection(section) {
     return new Promise(function (resolve, reject) {
-        var sql = "DELETE FROM " + section.table + " WHERE name = '" + section.name + "'";
-        db_prj.run(sql, function (err, rows) {
-            if (err) {
-                reject(err);
-            } else {
+        try {
+            var table = _ensureValidTable(section.table);
+            _run(`DELETE FROM ${table} WHERE name = ?`, [section.name]).then(function () {
                 resolve();
-            }
-        });
+            }).catch(reject);
+        } catch (err) {
+            reject(err);
+        }
     });
 }
 
@@ -222,4 +260,4 @@ module.exports = {
     deleteSection: deleteSection,
     setDefault: setDefault,
     TableType: TableType,
-};
+};

package/runtime/scripts/index.js

@@ -88,6 +88,10 @@ function ScriptsManager(_runtime) {
             const st = scriptModule.getScript(_script);
             var admin = (permission === -1 || permission === 255) ? true : false;
             if (runtime.settings.userRole) {
+                admin = admin || permission?.groups === -1 || permission?.groups === 255;
+                if (admin) {
+                    return true;
+                }
                 if (!st.permissionRoles || !st.permissionRoles.enabled) {
                     return true;
                 }
@@ -106,7 +110,7 @@ function ScriptsManager(_runtime) {
     this.isAuthorisedByScriptName = function (scriptName, permission) {
         const script = scriptModule.getScriptByName(scriptName);
         if (!script) {
-            return true;
+            return false;
         }
         return this.isAuthorised(script, permission);
     }
@@ -366,4 +370,4 @@ const ScriptSchedulingMode = {
 const SchedulerType = {
     weekly: 0,
     date: 1,
-}
+}

package/runtime/storage/calculator.js

@@ -1,5 +1,5 @@
 /**
- *  Calculator for DAQ value array (integrale, max, min, average...) 
+ *  Calculator for DAQ value array (integrale, max, min, average...)
  */
 
 'use strict';
@@ -19,11 +19,11 @@ function getFunctionValues(values, fromts, tots, fnc, interval, format) {
 }
 
 /**
- * 
- * @param {*} values 
- * @param {*} fnc 
- * @param {*} intervalType hour / day 
- * @returns 
+ *
+ * @param {*} values
+ * @param {*} fnc
+ * @param {*} intervalType hour / day
+ * @returns
  */
 function getMin(timeserie, fromts, tots, intervalType) {
     let result = getInterval(fromts, tots, intervalType, Number.MAX_VALUE);
@@ -39,7 +39,7 @@ function getMin(timeserie, fromts, tots, intervalType) {
             intervals[intervalIndex] = value;
         }
     }
-    
+
     for (let i = 0; i < sorted.length; i++) {
         let intervalIndex = getIntervalTime(sorted[i].dt, intervalType, false).getTime();
         addToInterval(result, intervalIndex, utils.parseFloat(sorted[i].value, 5));
@@ -61,7 +61,7 @@ function getMax(timeserie, fromts, tots, intervalType) {
             intervals[intervalIndex] = value;
         }
     }
-    
+
     for (let i = 0; i < sorted.length; i++) {
         let intervalIndex = getIntervalTime(sorted[i].dt, intervalType, false).getTime();
         addToInterval(result, intervalIndex, utils.parseFloat(sorted[i].value, 5));
@@ -85,7 +85,7 @@ function getAverage(timeserie, fromts, tots, intervalType, format) {
         }
         counters[intervalIndex]++;
     }
-    
+
     for (let i = 0; i < sorted.length; i++) {
         let intervalIndex = getIntervalTime(sorted[i].dt, intervalType, false).getTime();
         addToInterval(result, counts, intervalIndex, parseFloat(sorted[i].value));
@@ -96,7 +96,7 @@ function getAverage(timeserie, fromts, tots, intervalType, format) {
             result[k] = utils.parseFloat(result[k] / counts[k], format || 5);
         }
     });
-    return result; 
+    return result;
 }
 
 function getSum(timeserie, fromts, tots, intervalType) {
@@ -114,12 +114,12 @@ function getSum(timeserie, fromts, tots, intervalType) {
             intervals[intervalIndex] = utils.parseFloat(intervals[intervalIndex], 5)
         }
     }
-    
+
     for (let i = 0; i < sorted.length; i++) {
         let intervalIndex = getIntervalTime(sorted[i].dt, intervalType, false).getTime();
         addToInterval(result, intervalIndex, parseFloat(sorted[i].value));
     }
-    return result;    
+    return result;
 }
 
 
@@ -137,7 +137,7 @@ function getIntegral(timeserie, fromts, tots, intervalType) {
             intervals[intervalIndex] += value;
         }
     }
-    
+
     let lastRecord = null;// : TimeValue { dt: number, value: number };
     let lastIntervalIndex = null;
     for (let i = 0; i < sorted.length; i++) {
@@ -191,6 +191,10 @@ function getStepDate(ts, type, toadd) {
         dtRange = new Date(dt.getFullYear(), dt.getMonth(), dt.getDate(), dt.getHours(), 0, 0);
         var minutesRange = parseInt(dt.getMinutes() / 30);
         dtRange.setMinutes((minutesRange + toadd) * 30);
+    } else if (type === ReportIntervalType.min15) {
+        dtRange = new Date(dt.getFullYear(), dt.getMonth(), dt.getDate(), dt.getHours(), 0, 0);
+        var minutesRange = parseInt(dt.getMinutes() / 15);
+        dtRange.setMinutes((minutesRange + toadd) * 15);
     } else if (type === ReportIntervalType.min10) {
         dtRange = new Date(dt.getFullYear(), dt.getMonth(), dt.getDate(), dt.getHours(), 0, 0);
         var minutesRange = parseInt(dt.getMinutes() / 10);

package/runtime/storage/influxdb/index.js

@@ -12,6 +12,10 @@ var { InfluxDB, Point, flux } = require('@influxdata/influxdb-client');
 const VERSION_18_FLUX = '1.8-flux';
 const VERSION_20 = '2.0';
 
+function escapeInfluxIdentifier(value) {
+    return String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
 function Influx(_settings, _log, _currentStorate) {
 
     var settings = _settings;               // Application settings
@@ -157,7 +161,8 @@ function Influx(_settings, _log, _currentStorate) {
                 if (influxdbVersion === VERSION_18_FLUX) {
                     fromts *= 1000000;
                     tots *= 1000000;
-                    const query = `SELECT * FROM "${tagid}" WHERE time >= ${fromts} AND time <= ${tots}`;
+                    const measurement = escapeInfluxIdentifier(tagid);
+                    const query = `SELECT * FROM "${measurement}" WHERE time >= ${Number(fromts)} AND time <= ${Number(tots)}`;
                     client.query(query).then((result) => {
                         resolve(result.map(row => {
                             return {
@@ -171,7 +176,7 @@ function Influx(_settings, _log, _currentStorate) {
                         reject(error);
                     });
                 } else {
-                    const query = flux`from(bucket: "${settings.daqstore.bucket}") |> range(start: ${new Date(fromts)}, stop: ${new Date(tots)}) |> filter(fn: (r) => r.id == "${tagid}")`;
+                    const query = flux`from(bucket: ${settings.daqstore.bucket}) |> range(start: ${new Date(fromts)}, stop: ${new Date(tots)}) |> filter(fn: (r) => r.id == ${String(tagid)})`;
                     var result = [];
                     queryApi.queryRows(query, {
                         next(row, tableMeta) {
@@ -234,4 +239,4 @@ module.exports = {
 var InfluxDBStatusEnum = {
     OPEN: 'open',
     CLOSE: 'close',
-}
+}

package/runtime/storage/questdb/index.js

@@ -71,7 +71,7 @@ function QuestDB(_settings, _log, _currentStorage) {
                         .symbol('device_id', row.deviceId)
                         .stringColumn('device_name', row.deviceName);
                     if (!utils.isNullOrUndefined(row.unsPath)) {
-                        line = line.stringColumn('uns_path', row.unsPath);
+                        line = line.symbol('uns_path', row.unsPath);
                     }
 
                     if (!utils.isNullOrUndefined(parsedValue.numberValue)) {

package/runtime/storage/sqlite/index.js

@@ -227,14 +227,14 @@ function DaqNode(_settings, _log, _id, _currentStorate) {
                         _checkDataWorking(false);
                     });
                 } 
-                // check function to add daq data            
+                // check function to add daq data
                 if (addDaqfnc.length > 0) {
                     if (_checkDataWorking(true)) {
                         Promise.all(addDaqfnc).then(result => {
                             // check db tokenizer after inserted
                             var lastts = 0 || result[0];
                             if (daqNextToken && daqNextToken < lastts) {
-                                // close data DB, open and bind the new db, rename and move the closed db 
+                                // close data DB, open and bind the new db, rename and move the closed db
                                 db_daqdata.close(function () {
                                     var suffix = _getDateTimeSuffix(new Date());
                                     var oldfile = db_daqdata_file;
@@ -262,6 +262,9 @@ function DaqNode(_settings, _log, _id, _currentStorate) {
                             }
                             _checkDataWorking(false);
                         });
+                    } else {
+                        // overload: attach no-op catch handlers to prevent UnhandledPromiseRejection
+                        addDaqfnc.forEach(function (p) { p.catch(function () {}); });
                     }
                 }
                 if (dataToRestore.length && currentStorage) {
@@ -554,8 +557,8 @@ function DaqNode(_settings, _log, _id, _currentStorate) {
 
     function _insertTagToMap(tagid, name, type) {
         return new Promise(function (resolve, reject) {
-            var sqlRequest = "INSERT INTO data (id, name, type) ";
-            db_daqmap.run(sqlRequest + "VALUES('" + tagid + "','" + name + "','" + type + "'); SELECT last_insert_rowid() FROM data", function (err) {
+            var sqlRequest = "INSERT INTO data (id, name, type) VALUES (?, ?, ?)";
+            db_daqmap.run(sqlRequest, [tagid, name, type], function (err) {
                 if (err !== null) {
                     reject(err);
                 } else {
@@ -615,10 +618,10 @@ function DaqNode(_settings, _log, _id, _currentStorate) {
     function _insertTagValue(mapid, value) {
         return new Promise(function (resolve, reject) {
             var ts = new Date().getTime();
-            var sqlRequest = "INSERT INTO data (dt, id, value) ";
-            db_daqdata.run(sqlRequest + "VALUES('" + ts + "','" + mapid + "','" + value + "')", function (err) {
+            var sqlRequest = "INSERT INTO data (dt, id, value) VALUES (?, ?, ?)";
+            db_daqdata.run(sqlRequest, [ts, mapid, value], function (err) {
                 if (err !== null) {
-                    reject();
+                    reject(err);
                 }
                 else {
                     resolve(ts);
@@ -692,4 +695,4 @@ module.exports = {
         return new DaqNode(data, logger, id, currentStorate);
     },
     checkRetention: checkRetention
-};
+};

package/runtime/storage/tdengine/index.js

@@ -3,11 +3,20 @@
 let { options, connect } = require("@tdengine/rest");
 let utils = require('../../utils');
 
+function quoteTdIdentifier(value) {
+    return '`' + String(value).replace(/`/g, '``') + '`';
+}
+
+function escapeTdString(value) {
+    return String(value).replace(/'/g, "''");
+}
+
 function TDengine(_settings, _log, _currentStorage) {
     let settings = _settings;               // Application settings
     const logger = _log;                      // Application logger
     const currentStorage = _currentStorage;  // Database to set the last value (current)
     const database = settings.daqstore.database || 'fuxa';
+    const databaseRef = quoteTdIdentifier(database);
     let conn;
 
     this.setCall = function (_fncGetProp) {
@@ -25,8 +34,8 @@ function TDengine(_settings, _log, _currentStorage) {
         const cursor = conn.cursor();
         try {
             //TODO add retention
-            let res = await cursor.query(`CREATE DATABASE IF NOT EXISTS ${database} `);
-            res = await cursor.query(`CREATE STABLE IF NOT EXISTS ${database}.meters (dt TIMESTAMP,tag_id VARCHAR(200), tag_value BINARY(20)) TAGS (device_id VARCHAR(200),device_name BINARY(256) )`);
+            let res = await cursor.query(`CREATE DATABASE IF NOT EXISTS ${databaseRef} `);
+            res = await cursor.query(`CREATE STABLE IF NOT EXISTS ${databaseRef}.meters (dt TIMESTAMP,tag_id VARCHAR(200), tag_value BINARY(20)) TAGS (device_id VARCHAR(200),device_name BINARY(256) )`);
 
         } catch (error) {
             console.error(error);
@@ -47,8 +56,13 @@ function TDengine(_settings, _log, _currentStorage) {
                     continue;
                 }
             }
-            let insertSql = `INSERT INTO ${database}.\`${deviceId}\` USING ${database}.meters TAGS('${deviceId}','${deviceName}')
-                             VALUES (NOW, '${tagid}', '${tag.value}')`;
+            const safeDeviceId = quoteTdIdentifier(deviceId);
+            const safeDeviceTag = escapeTdString(deviceId);
+            const safeDeviceName = escapeTdString(deviceName);
+            const safeTagId = escapeTdString(tagid);
+            const safeTagValue = escapeTdString(tag.value);
+            let insertSql = `INSERT INTO ${databaseRef}.${safeDeviceId} USING ${databaseRef}.meters TAGS('${safeDeviceTag}','${safeDeviceName}')
+                             VALUES (NOW, '${safeTagId}', '${safeTagValue}')`;
             //async
 
             cursor.query(insertSql).then((rst) => {
@@ -71,11 +85,12 @@ function TDengine(_settings, _log, _currentStorage) {
             const cursor = conn.cursor()
             let data = []
             //add by J, the tagid is missed in the sql, should be one of the filter condition
+            const safeTagId = escapeTdString(tagid);
             cursor.query(`SELECT CAST(dt as BIGINT) as dt, tag_value
-                          FROM ${database}.meters
-                            WHERE tag_id = '${tagid}' 
-                            and dt >= ${fromts}
-                            and dt < ${tots} `).then((result) => {
+                          FROM ${databaseRef}.meters
+                            WHERE tag_id = '${safeTagId}'
+                            and dt >= ${Number(fromts)}
+                            and dt < ${Number(tots)} `).then((result) => {
                 // logger.debug(result)
                 result.getData().forEach((row) => {
                     data.push({ dt: row[0], value: row[1] })
@@ -105,4 +120,4 @@ module.exports = {
     create: function (data, logger, currentStorage) {
         return new TDengine(data, logger, currentStorage);
     }
-};
+};