@galadrim/galadmin 0.1.230 → 0.1.232

package/dist/utils/dbManager.js

@@ -74,7 +74,7 @@ class dbManager {
                 port: config.mysql.port || 3306,
                 charset: 'UTF8MB4_GENERAL_CI',
                 dateStrings: true,
-                multipleStatements: true
+                multipleStatements: config.mysql.multipleStatements === true
             });
             this.dbType = "MYSQL";
         }

package/dist/utils/dbManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"dbManager.js","sourceRoot":"","sources":["../../src/utils/dbManager.ts"],"names":[],"mappings":";;AAAA,+BAA+B;AAC/B,iCAAiC;AACjC,yBAAyB;AAEzB,SAAS,YAAY,CAAC,UAAU,EAAE,MAAM;IACpC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAEnF,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,SAAS,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;YAE9C,OAAO,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9B,SAAS,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,SAAS,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO;QACP,QAAQ;KACX,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK;IAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAE9d,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,SAAQ;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,QAAQ,GAAG,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAEjI,CAAC;aAAM,CAAC;YACJ,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACX,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC3B,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAA;QACjG,CAAC;IACL,CAAC;IAED,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAExD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAqB,SAAS;IAI1B,IAAI,CAAC,MAAM;QACP,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;gBACtD,eAAe,EAAE,EAAE;gBACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI;gBAC/B,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,IAAI;gBACjB,kBAAkB,EAAE,IAAI;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI;gBACpC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC/C,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC3C,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACtC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,EAAE,MAAM,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,EAAE,CAAC,CAAA;gBACzD,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AA/CD,4BA+CC"}
+{"version":3,"file":"dbManager.js","sourceRoot":"","sources":["../../src/utils/dbManager.ts"],"names":[],"mappings":";;AAAA,+BAA+B;AAC/B,iCAAiC;AACjC,yBAAyB;AAEzB,SAAS,YAAY,CAAC,UAAU,EAAE,MAAM;IACpC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAEnF,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,SAAS,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;YAE9C,OAAO,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9B,SAAS,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,SAAS,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO;QACP,QAAQ;KACX,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK;IAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAE9d,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,SAAQ;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,QAAQ,GAAG,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAEjI,CAAC;aAAM,CAAC;YACJ,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACX,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC3B,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAA;QACjG,CAAC;IACL,CAAC;IAED,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAExD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAqB,SAAS;IAI1B,IAAI,CAAC,MAAM;QACP,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;gBACtD,eAAe,EAAE,EAAE;gBACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI;gBAC/B,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,IAAI;gBAIjB,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,IAAI;aAC/D,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI;gBACpC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC/C,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC3C,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACtC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,EAAE,MAAM,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,EAAE,CAAC,CAAA;gBACzD,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAlDD,4BAkDC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galadrim/galadmin",
-  "version": "0.1.230",
+  "version": "0.1.232",
   "main": "dist/index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",

package/src/api.ts

@@ -76,6 +76,100 @@ export default (db, config) => {
     next();
   });
 
+  // ---------------------------------------------------------------------------
+  // SECURITY: server-side authorization.
+  //
+  // The config-filtering middleware above only decides which views the *client*
+  // is shown, and sets canEdit/canCreate/canDelete flags on that served config.
+  // Nothing enforced those decisions server-side, so a session with the lowest
+  // role could POST directly to /updateRecord, /deleteRecord, /customQuery, …
+  // and act on any view — including read-only ones — as the DB user (root).
+  // This block re-checks every sensitive route against the view's declared roles.
+  // ---------------------------------------------------------------------------
+  const ROOT_ROLE = "root";
+  const roleOf = (req) => req.session && req.session.user && req.session.user.role;
+  // Write access = the view's `roles` (root always allowed).
+  const canWriteView = (view, role) =>
+    role === ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
+
+  const viewFromRequest = (req) => {
+    const idx =
+      req.body && req.body.viewIndex !== undefined
+        ? req.body.viewIndex
+        : req.query && req.query.viewIndex !== undefined
+        ? req.query.viewIndex
+        : undefined;
+    if (idx === undefined || !req.config || !req.config.views) return undefined;
+    return req.config.views[idx];
+  };
+
+  // Routes that mutate data and reference their target view via viewIndex
+  // (body for POST bodies, query for /uploadFile). Import routes carry the
+  // viewIndex inside a multipart body and are guarded inline in their handlers.
+  const MUTATING_VIEW_ROUTES = new Set([
+    "/updateRecord",
+    "/createRecord",
+    "/deleteRecord",
+    "/deleteRecords",
+    "/deleteRecordFromPanel",
+    "/customAction",
+    "/uploadFile",
+  ]);
+  // /duplicateRecord references its table via req.body.table (not a viewIndex),
+  // so it is guarded inline in its handler instead of by the generic middleware.
+
+  // Column names are interpolated into INSERT/UPDATE statements; only accept plain
+  // SQL identifiers so a crafted key cannot break out of the column list.
+  const areSafeColumnNames = (data) =>
+    !data ||
+    Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
+
+  // Tables the current role is allowed to write, gathered from its writable views
+  // and their creatable panels — used to bound /duplicateRecord's target table.
+  const writableTables = (req) => {
+    const role = roleOf(req);
+    const tables = new Set<string>();
+    for (const view of req.config?.views || []) {
+      if (!canWriteView(view, role)) continue;
+      if (view.tableName) tables.add(view.tableName);
+      for (const panel of view.recordViewPanels || []) {
+        if (panel.tableName) tables.add(panel.tableName);
+        if (panel.createConfig?.tableName) tables.add(panel.createConfig.tableName);
+      }
+    }
+    return tables;
+  };
+
+  // Reject client-supplied SQL fragments (the `filters` array is concatenated
+  // raw into the WHERE clause). With multipleStatements off this already blocks
+  // stacked writes; the pattern also blocks UNION/comment/file exfil breakouts.
+  const looksLikeSqlBreakout = (frag) =>
+    typeof frag === "string" &&
+    /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(
+      frag
+    );
+
+  app.use((req, res, next) => {
+    const role = roleOf(req);
+
+    // 1) Validate any raw filter fragments on read endpoints.
+    if (req.body && Array.isArray(req.body.filters)) {
+      if (req.body.filters.some(looksLikeSqlBreakout)) {
+        return res.status(400).send({ error: "Invalid filter" });
+      }
+    }
+
+    // 2) Enforce write authorization on mutating routes.
+    if (MUTATING_VIEW_ROUTES.has(req.path)) {
+      const view = viewFromRequest(req);
+      if (!view || !canWriteView(view, role)) {
+        return res.sendStatus(403);
+      }
+    }
+
+    next();
+  });
+
   async function getRecords(params, computeCount = false) {
     let queryString = "";
     if (params.filters) {
@@ -709,6 +803,9 @@ export default (db, config) => {
 
   app.post("/updateRecord", async function (req, res, next) {
     const view = req.config.views[req.body.viewIndex];
+    if (!areSafeColumnNames(req.body.data)) {
+      return res.status(400).send({ error: "Invalid column name" });
+    }
     for (let key in req.body.data) {
       if (
         req.body.data[key] == "NULL" ||
@@ -921,6 +1018,15 @@ export default (db, config) => {
   });
 
   app.post("/duplicateRecord", async function (req, res, next) {
+    // SECURITY: bound the (client-supplied) target table to tables the role may write.
+    const allowedTables = writableTables(req);
+    const requestedTables = [
+      req.body.table,
+      ...(req.body.duplicateConfig?.foreignTables || []).map((t) => t.table),
+    ];
+    if (requestedTables.some((t) => !allowedTables.has(t))) {
+      return res.sendStatus(403);
+    }
     const primaryId = req.body.duplicateConfig.primaryId;
     const { err, rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [
       req.body.table,
@@ -998,6 +1104,9 @@ export default (db, config) => {
           delete createPayload[key];
         }
       }
+      if (!areSafeColumnNames(createPayload)) {
+        return res.status(400).send({ error: "Invalid column name" });
+      }
       const queryExpression = Object.keys(createPayload).join(", ");
       const queryPlaceholders = Object.keys(createPayload)
         .map((x) => "?")
@@ -1047,30 +1156,69 @@ export default (db, config) => {
     }
   });
 
-  app.get("/customQuery", async function (req, res, next) {
-    const query = (req.query.query as string).replace(
-      /\?/g,
-      req.query.primaryValue as string
-    );
-    const { err, rows } = await db.query(query);
-    if (err) {
-      return res.status(500).send(err);
+  // Collect every SQL template declared anywhere in the (role-filtered) config:
+  // panel `query`, `autocompleteListQuery`, etc. customQuery may only run a
+  // template that already exists in the config the caller is allowed to see —
+  // so it can never be turned into an arbitrary read/write primitive.
+  function collectAllowedQueries(node, acc = new Set<string>()) {
+    if (!node || typeof node !== "object") return acc;
+    if (Array.isArray(node)) {
+      for (const item of node) collectAllowedQueries(item, acc);
+      return acc;
+    }
+    for (const key of Object.keys(node)) {
+      const value = node[key];
+      if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
+        acc.add(value.trim());
+      } else if (value && typeof value === "object") {
+        collectAllowedQueries(value, acc);
+      }
     }
-    if (req.query.viewIndex && req.query.panelIndex) {
-      const panel =
-        req.config.views[req.query.viewIndex as string].recordViewPanels[
-        req.query.panelIndex as string
-        ];
-      if (panel.formatValue) {
-        for (const row of rows) {
-          for (const key in panel.formatValue) {
-            row[key] = await panel.formatValue[key](row);
+    return acc;
+  }
+
+  // Attack-surface reduction: only expose /customQuery at all when the config
+  // actually declares SQL templates (panels, autocomplete lists, …). If nothing
+  // uses it, the route is replaced by an explicit "disabled" stub so the raw-SQL
+  // sink simply does not exist for that deployment.
+  const CONFIG_USES_CUSTOM_QUERY = collectAllowedQueries(config.views).size > 0;
+
+  if (!CONFIG_USES_CUSTOM_QUERY) {
+    app.get("/customQuery", (req, res) => res.sendStatus(404));
+  } else {
+    app.get("/customQuery", async function (req, res, next) {
+      const template = typeof req.query.query === "string" ? req.query.query : "";
+      // SECURITY: only run whitelisted, read-only templates, and bind the record id
+      // as a parameter instead of substituting it into the SQL string.
+      const allowed = collectAllowedQueries(req.config.views);
+      if (!allowed.has(template.trim())) {
+        return res.status(403).send({ error: "Query not allowed" });
+      }
+      if (!/^\s*\(?\s*(select|with)\b/i.test(template) || /;/.test(template)) {
+        return res.status(400).send({ error: "Only read-only queries are allowed" });
+      }
+      const placeholderCount = (template.match(/\?/g) || []).length;
+      const params = new Array(placeholderCount).fill(req.query.primaryValue);
+      const { err, rows } = await db.query(template, params);
+      if (err) {
+        return res.status(500).send(err);
+      }
+      if (req.query.viewIndex && req.query.panelIndex) {
+        const panel =
+          req.config.views[req.query.viewIndex as string].recordViewPanels[
+          req.query.panelIndex as string
+          ];
+        if (panel.formatValue) {
+          for (const row of rows) {
+            for (const key in panel.formatValue) {
+              row[key] = await panel.formatValue[key](row);
+            }
           }
         }
       }
-    }
-    res.send(rows);
-  });
+      res.send(rows);
+    });
+  }
 
   function uploadFile(column, fileParamName, req, res) {
     if (column.s3Config || column.gcpConfig) {

package/src/index.ts

@@ -130,7 +130,11 @@ export default (config: Config): any => {
                 // we check that the user still exists
                 let stillExists = false;
                 for (const authRole of config.authRoles) {
-                    const { rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [authRole.table, authRole.idField, req.session.user.userId]);
+                    // Re-apply the role's `filters` here too, so an account that becomes
+                    // ineligible (e.g. deactivated) has its existing session invalidated
+                    // on its next request — not just blocked at login time.
+                    const filters = authRole.filters ? `AND ${authRole.filters}` : "";
+                    const { rows } = await db.query(`SELECT * FROM ?? WHERE ?? = ? ${filters}`, [authRole.table, authRole.idField, req.session.user.userId]);
                     if (rows.length > 0) {
                         stillExists = true;
                         break;

package/src/utils/dbManager.ts

@@ -89,7 +89,10 @@ export default class dbManager {
                 port: config.mysql.port || 3306,
                 charset: 'UTF8MB4_GENERAL_CI',
                 dateStrings: true,
-                multipleStatements: true
+                // SECURITY: multi-statement queries let any SQL-injection escalate to stacked
+                // writes / DROP. Keep OFF by default; opt in explicitly only if a config truly
+                // relies on `;`-separated statements (none of galadmin's internal queries do).
+                multipleStatements: config.mysql.multipleStatements === true
             });
             this.dbType = "MYSQL";
         } else if (config.postgresql) {

package/src/front/ckeditor5-build/node_modules/.bin/semver

@@ -1,12 +0,0 @@
-#!/bin/sh
-basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
-
-case `uname` in
-    *CYGWIN*|*MINGW*|*MSYS*) basedir=`cygpath -w "$basedir"`;;
-esac
-
-if [ -x "$basedir/node" ]; then
-  exec "$basedir/node"  "$basedir/../semver/bin/semver.js" "$@"
-else 
-  exec node  "$basedir/../semver/bin/semver.js" "$@"
-fi

package/src/front/ckeditor5-build/node_modules/.bin/semver.cmd

@@ -1,17 +0,0 @@
-@ECHO off
-GOTO start
-:find_dp0
-SET dp0=%~dp0
-EXIT /b
-:start
-SETLOCAL
-CALL :find_dp0
-
-IF EXIST "%dp0%\node.exe" (
-  SET "_prog=%dp0%\node.exe"
-) ELSE (
-  SET "_prog=node"
-  SET PATHEXT=%PATHEXT:;.JS;=;%
-)
-
-endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\..\semver\bin\semver.js" %*

package/src/front/ckeditor5-build/node_modules/.bin/semver.ps1

@@ -1,28 +0,0 @@
-#!/usr/bin/env pwsh
-$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent
-
-$exe=""
-if ($PSVersionTable.PSVersion -lt "6.0" -or $IsWindows) {
-  # Fix case when both the Windows and Linux builds of Node
-  # are installed in the same directory
-  $exe=".exe"
-}
-$ret=0
-if (Test-Path "$basedir/node$exe") {
-  # Support pipeline input
-  if ($MyInvocation.ExpectingInput) {
-    $input | & "$basedir/node$exe"  "$basedir/../semver/bin/semver.js" $args
-  } else {
-    & "$basedir/node$exe"  "$basedir/../semver/bin/semver.js" $args
-  }
-  $ret=$LASTEXITCODE
-} else {
-  # Support pipeline input
-  if ($MyInvocation.ExpectingInput) {
-    $input | & "node$exe"  "$basedir/../semver/bin/semver.js" $args
-  } else {
-    & "node$exe"  "$basedir/../semver/bin/semver.js" $args
-  }
-  $ret=$LASTEXITCODE
-}
-exit $ret