@galadrim/galadmin 0.1.230 → 0.1.233

package/dist/utils/dbManager.js

@@ -74,7 +74,7 @@ class dbManager {
                 port: config.mysql.port || 3306,
                 charset: 'UTF8MB4_GENERAL_CI',
                 dateStrings: true,
-                multipleStatements: true
+                multipleStatements: config.mysql.multipleStatements === true
             });
             this.dbType = "MYSQL";
         }

package/dist/utils/dbManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"dbManager.js","sourceRoot":"","sources":["../../src/utils/dbManager.ts"],"names":[],"mappings":";;AAAA,+BAA+B;AAC/B,iCAAiC;AACjC,yBAAyB;AAEzB,SAAS,YAAY,CAAC,UAAU,EAAE,MAAM;IACpC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAEnF,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,SAAS,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;YAE9C,OAAO,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9B,SAAS,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,SAAS,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO;QACP,QAAQ;KACX,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK;IAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAE9d,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,SAAQ;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,QAAQ,GAAG,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAEjI,CAAC;aAAM,CAAC;YACJ,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACX,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC3B,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAA;QACjG,CAAC;IACL,CAAC;IAED,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAExD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAqB,SAAS;IAI1B,IAAI,CAAC,MAAM;QACP,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;gBACtD,eAAe,EAAE,EAAE;gBACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI;gBAC/B,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,IAAI;gBACjB,kBAAkB,EAAE,IAAI;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI;gBACpC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC/C,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC3C,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACtC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,EAAE,MAAM,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,EAAE,CAAC,CAAA;gBACzD,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AA/CD,4BA+CC"}
+{"version":3,"file":"dbManager.js","sourceRoot":"","sources":["../../src/utils/dbManager.ts"],"names":[],"mappings":";;AAAA,+BAA+B;AAC/B,iCAAiC;AACjC,yBAAyB;AAEzB,SAAS,YAAY,CAAC,UAAU,EAAE,MAAM;IACpC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAEnF,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,SAAS,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;YAE9C,OAAO,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9B,SAAS,EAAE,CAAC;QAChB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,SAAS,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO;QACH,OAAO;QACP,QAAQ;KACX,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAK;IAC7B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAE9d,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,SAAQ;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,QAAQ,GAAG,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAEjI,CAAC;aAAM,CAAC;YACJ,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACX,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBAC3B,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,cAAc,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAA;QACjG,CAAC;IACL,CAAC;IAED,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAExD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAqB,SAAS;IAI1B,IAAI,CAAC,MAAM;QACP,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;gBACtD,eAAe,EAAE,EAAE;gBACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;gBACvB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;gBAC/B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI;gBAC/B,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,IAAI;gBAIjB,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,IAAI;aAC/D,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI;gBAC5B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;gBACpC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI;gBACpC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC/C,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC1B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC3C,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACtC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,EAAE,MAAM,EAAE,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,EAAE,CAAC,CAAA;gBACzD,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAlDD,4BAkDC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galadrim/galadmin",
-  "version": "0.1.230",
+  "version": "0.1.233",
   "main": "dist/index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1",
@@ -16,8 +16,9 @@
     "@google-cloud/storage": "^7.17.2",
     "@rollup/plugin-babel": "^5.3.0",
     "@rollup/plugin-node-resolve": "^13.0.4",
+    "@aws-sdk/client-s3": "^3.1114.0",
+    "@aws-sdk/s3-request-presigner": "^3.1114.0",
     "argon2": "^0.31.2",
-    "aws-sdk": "^2.958.0",
     "axios": "^0.28.1",
     "bcryptjs": "^2.4.3",
     "connect-pg-simple": "^9.0.1",

package/src/api.ts

@@ -5,7 +5,8 @@ import * as path from "path";
 import * as crypto from "crypto";
 import * as mime from "mime";
 
-import { S3, Endpoint } from "aws-sdk";
+import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { Storage } from "@google-cloud/storage";
 import sizeOf from "image-size";
 import * as serializeJs from "serialize-javascript";
@@ -76,6 +77,100 @@ export default (db, config) => {
     next();
   });
 
+  // ---------------------------------------------------------------------------
+  // SECURITY: server-side authorization.
+  //
+  // The config-filtering middleware above only decides which views the *client*
+  // is shown, and sets canEdit/canCreate/canDelete flags on that served config.
+  // Nothing enforced those decisions server-side, so a session with the lowest
+  // role could POST directly to /updateRecord, /deleteRecord, /customQuery, …
+  // and act on any view — including read-only ones — as the DB user (root).
+  // This block re-checks every sensitive route against the view's declared roles.
+  // ---------------------------------------------------------------------------
+  const ROOT_ROLE = "root";
+  const roleOf = (req) => req.session && req.session.user && req.session.user.role;
+  // Write access = the view's `roles` (root always allowed).
+  const canWriteView = (view, role) =>
+    role === ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
+
+  const viewFromRequest = (req) => {
+    const idx =
+      req.body && req.body.viewIndex !== undefined
+        ? req.body.viewIndex
+        : req.query && req.query.viewIndex !== undefined
+        ? req.query.viewIndex
+        : undefined;
+    if (idx === undefined || !req.config || !req.config.views) return undefined;
+    return req.config.views[idx];
+  };
+
+  // Routes that mutate data and reference their target view via viewIndex
+  // (body for POST bodies, query for /uploadFile). Import routes carry the
+  // viewIndex inside a multipart body and are guarded inline in their handlers.
+  const MUTATING_VIEW_ROUTES = new Set([
+    "/updateRecord",
+    "/createRecord",
+    "/deleteRecord",
+    "/deleteRecords",
+    "/deleteRecordFromPanel",
+    "/customAction",
+    "/uploadFile",
+  ]);
+  // /duplicateRecord references its table via req.body.table (not a viewIndex),
+  // so it is guarded inline in its handler instead of by the generic middleware.
+
+  // Column names are interpolated into INSERT/UPDATE statements; only accept plain
+  // SQL identifiers so a crafted key cannot break out of the column list.
+  const areSafeColumnNames = (data) =>
+    !data ||
+    Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
+
+  // Tables the current role is allowed to write, gathered from its writable views
+  // and their creatable panels — used to bound /duplicateRecord's target table.
+  const writableTables = (req) => {
+    const role = roleOf(req);
+    const tables = new Set<string>();
+    for (const view of req.config?.views || []) {
+      if (!canWriteView(view, role)) continue;
+      if (view.tableName) tables.add(view.tableName);
+      for (const panel of view.recordViewPanels || []) {
+        if (panel.tableName) tables.add(panel.tableName);
+        if (panel.createConfig?.tableName) tables.add(panel.createConfig.tableName);
+      }
+    }
+    return tables;
+  };
+
+  // Reject client-supplied SQL fragments (the `filters` array is concatenated
+  // raw into the WHERE clause). With multipleStatements off this already blocks
+  // stacked writes; the pattern also blocks UNION/comment/file exfil breakouts.
+  const looksLikeSqlBreakout = (frag) =>
+    typeof frag === "string" &&
+    /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(
+      frag
+    );
+
+  app.use((req, res, next) => {
+    const role = roleOf(req);
+
+    // 1) Validate any raw filter fragments on read endpoints.
+    if (req.body && Array.isArray(req.body.filters)) {
+      if (req.body.filters.some(looksLikeSqlBreakout)) {
+        return res.status(400).send({ error: "Invalid filter" });
+      }
+    }
+
+    // 2) Enforce write authorization on mutating routes.
+    if (MUTATING_VIEW_ROUTES.has(req.path)) {
+      const view = viewFromRequest(req);
+      if (!view || !canWriteView(view, role)) {
+        return res.sendStatus(403);
+      }
+    }
+
+    next();
+  });
+
   async function getRecords(params, computeCount = false) {
     let queryString = "";
     if (params.filters) {
@@ -709,6 +804,9 @@ export default (db, config) => {
 
   app.post("/updateRecord", async function (req, res, next) {
     const view = req.config.views[req.body.viewIndex];
+    if (!areSafeColumnNames(req.body.data)) {
+      return res.status(400).send({ error: "Invalid column name" });
+    }
     for (let key in req.body.data) {
       if (
         req.body.data[key] == "NULL" ||
@@ -921,6 +1019,15 @@ export default (db, config) => {
   });
 
   app.post("/duplicateRecord", async function (req, res, next) {
+    // SECURITY: bound the (client-supplied) target table to tables the role may write.
+    const allowedTables = writableTables(req);
+    const requestedTables = [
+      req.body.table,
+      ...(req.body.duplicateConfig?.foreignTables || []).map((t) => t.table),
+    ];
+    if (requestedTables.some((t) => !allowedTables.has(t))) {
+      return res.sendStatus(403);
+    }
     const primaryId = req.body.duplicateConfig.primaryId;
     const { err, rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [
       req.body.table,
@@ -998,6 +1105,9 @@ export default (db, config) => {
           delete createPayload[key];
         }
       }
+      if (!areSafeColumnNames(createPayload)) {
+        return res.status(400).send({ error: "Invalid column name" });
+      }
       const queryExpression = Object.keys(createPayload).join(", ");
       const queryPlaceholders = Object.keys(createPayload)
         .map((x) => "?")
@@ -1047,30 +1157,69 @@ export default (db, config) => {
     }
   });
 
-  app.get("/customQuery", async function (req, res, next) {
-    const query = (req.query.query as string).replace(
-      /\?/g,
-      req.query.primaryValue as string
-    );
-    const { err, rows } = await db.query(query);
-    if (err) {
-      return res.status(500).send(err);
+  // Collect every SQL template declared anywhere in the (role-filtered) config:
+  // panel `query`, `autocompleteListQuery`, etc. customQuery may only run a
+  // template that already exists in the config the caller is allowed to see —
+  // so it can never be turned into an arbitrary read/write primitive.
+  function collectAllowedQueries(node, acc = new Set<string>()) {
+    if (!node || typeof node !== "object") return acc;
+    if (Array.isArray(node)) {
+      for (const item of node) collectAllowedQueries(item, acc);
+      return acc;
     }
-    if (req.query.viewIndex && req.query.panelIndex) {
-      const panel =
-        req.config.views[req.query.viewIndex as string].recordViewPanels[
-        req.query.panelIndex as string
-        ];
-      if (panel.formatValue) {
-        for (const row of rows) {
-          for (const key in panel.formatValue) {
-            row[key] = await panel.formatValue[key](row);
+    for (const key of Object.keys(node)) {
+      const value = node[key];
+      if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
+        acc.add(value.trim());
+      } else if (value && typeof value === "object") {
+        collectAllowedQueries(value, acc);
+      }
+    }
+    return acc;
+  }
+
+  // Attack-surface reduction: only expose /customQuery at all when the config
+  // actually declares SQL templates (panels, autocomplete lists, …). If nothing
+  // uses it, the route is replaced by an explicit "disabled" stub so the raw-SQL
+  // sink simply does not exist for that deployment.
+  const CONFIG_USES_CUSTOM_QUERY = collectAllowedQueries(config.views).size > 0;
+
+  if (!CONFIG_USES_CUSTOM_QUERY) {
+    app.get("/customQuery", (req, res) => res.sendStatus(404));
+  } else {
+    app.get("/customQuery", async function (req, res, next) {
+      const template = typeof req.query.query === "string" ? req.query.query : "";
+      // SECURITY: only run whitelisted, read-only templates, and bind the record id
+      // as a parameter instead of substituting it into the SQL string.
+      const allowed = collectAllowedQueries(req.config.views);
+      if (!allowed.has(template.trim())) {
+        return res.status(403).send({ error: "Query not allowed" });
+      }
+      if (!/^\s*\(?\s*(select|with)\b/i.test(template) || /;/.test(template)) {
+        return res.status(400).send({ error: "Only read-only queries are allowed" });
+      }
+      const placeholderCount = (template.match(/\?/g) || []).length;
+      const params = new Array(placeholderCount).fill(req.query.primaryValue);
+      const { err, rows } = await db.query(template, params);
+      if (err) {
+        return res.status(500).send(err);
+      }
+      if (req.query.viewIndex && req.query.panelIndex) {
+        const panel =
+          req.config.views[req.query.viewIndex as string].recordViewPanels[
+          req.query.panelIndex as string
+          ];
+        if (panel.formatValue) {
+          for (const row of rows) {
+            for (const key in panel.formatValue) {
+              row[key] = await panel.formatValue[key](row);
+            }
           }
         }
       }
-    }
-    res.send(rows);
-  });
+      res.send(rows);
+    });
+  }
 
   function uploadFile(column, fileParamName, req, res) {
     if (column.s3Config || column.gcpConfig) {
@@ -1132,28 +1281,42 @@ export default (db, config) => {
             Math.random().toString().substr(2) +
             "." +
             extension;
-          const s3 = new S3({
-            endpoint: new Endpoint(s3Config.host),
-            accessKeyId: s3Config.accessKeyId,
-            secretAccessKey: s3Config.secretAccessKey,
+          const rawHost = String(s3Config.host || "");
+          const endpoint = /^https?:\/\//i.test(rawHost)
+            ? rawHost
+            : `https://${rawHost}`;
+          const s3 = new S3Client({
+            endpoint,
             region: s3Config.region,
-            signatureVersion: "v4",
+            credentials: {
+              accessKeyId: s3Config.accessKeyId,
+              secretAccessKey: s3Config.secretAccessKey,
+            },
+            forcePathStyle: false,
           });
           if (s3Config.signedUrlNeeded) {
-            const signedUrl = s3.getSignedUrl("putObject", {
-              Bucket: s3Config.bucket,
-              Key: path,
-              ContentType: contentType,
-              Expires: 150,
-            });
-            axios
-              .put(signedUrl, fs.readFileSync(files[fileParamName][0].path), {
-                maxContentLength: 100000000000,
-                maxBodyLength: 100000000000,
-                headers: {
-                  "Content-Type": contentType,
-                },
-              })
+            getSignedUrl(
+              s3,
+              new PutObjectCommand({
+                Bucket: s3Config.bucket,
+                Key: path,
+                ContentType: contentType,
+              }),
+              { expiresIn: 150 }
+            )
+              .then((signedUrl) =>
+                axios.put(
+                  signedUrl,
+                  fs.readFileSync(files[fileParamName][0].path),
+                  {
+                    maxContentLength: 100000000000,
+                    maxBodyLength: 100000000000,
+                    headers: {
+                      "Content-Type": contentType,
+                    },
+                  }
+                )
+              )
               .then(() => {
                 res.status(200).send({
                   path: s3Config.pathTransform
@@ -1167,16 +1330,16 @@ export default (db, config) => {
                 res.status(500).send(e);
               });
           } else {
-            s3.putObject(
-              {
+            s3.send(
+              new PutObjectCommand({
                 Body: fs.readFileSync(files[fileParamName][0].path),
                 Bucket: s3Config.bucket,
                 ContentType: contentType,
                 ACL: "public-read",
                 Key: path,
-              },
-              function (err, data) {
-                if (err) return res.status(500).send(err);
+              })
+            )
+              .then(() => {
                 res.send({
                   url: `https://${s3Config.host}/${s3Config.bucket}/${path}`,
                   path: s3Config.pathTransform
@@ -1185,8 +1348,8 @@ export default (db, config) => {
                   aspectRatio,
                   originalFilename,
                 });
-              }
-            );
+              })
+              .catch((err) => res.status(500).send(err));
           }
         }
       });

package/src/index.ts

@@ -130,7 +130,11 @@ export default (config: Config): any => {
                 // we check that the user still exists
                 let stillExists = false;
                 for (const authRole of config.authRoles) {
-                    const { rows } = await db.query("SELECT * FROM ?? WHERE ?? = ?", [authRole.table, authRole.idField, req.session.user.userId]);
+                    // Re-apply the role's `filters` here too, so an account that becomes
+                    // ineligible (e.g. deactivated) has its existing session invalidated
+                    // on its next request — not just blocked at login time.
+                    const filters = authRole.filters ? `AND ${authRole.filters}` : "";
+                    const { rows } = await db.query(`SELECT * FROM ?? WHERE ?? = ? ${filters}`, [authRole.table, authRole.idField, req.session.user.userId]);
                     if (rows.length > 0) {
                         stillExists = true;
                         break;

package/src/utils/dbManager.ts

@@ -89,7 +89,10 @@ export default class dbManager {
                 port: config.mysql.port || 3306,
                 charset: 'UTF8MB4_GENERAL_CI',
                 dateStrings: true,
-                multipleStatements: true
+                // SECURITY: multi-statement queries let any SQL-injection escalate to stacked
+                // writes / DROP. Keep OFF by default; opt in explicitly only if a config truly
+                // relies on `;`-separated statements (none of galadmin's internal queries do).
+                multipleStatements: config.mysql.multipleStatements === true
             });
             this.dbType = "MYSQL";
         } else if (config.postgresql) {