@galadrim/galadmin 0.1.235 → 0.2.6

package/dist/api.js

@@ -11,6 +11,15 @@ var __rest = (this && this.__rest) || function (s, e) {
     return t;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.looksLikeSqlBreakout = exports.writableTables = exports.areSafeColumnNames = exports.MUTATING_VIEW_ROUTES = exports.viewFromRequest = exports.canWriteView = exports.roleOf = exports.ROOT_ROLE = void 0;
+exports.generateUniqueIdForObject = generateUniqueIdForObject;
+exports.sqlAnd = sqlAnd;
+exports.getFormattedValue = getFormattedValue;
+exports.evalExpression = evalExpression;
+exports.formatValueForInsertion = formatValueForInsertion;
+exports.collectAllowedQueries = collectAllowedQueries;
+exports.enrichConfig = enrichConfig;
+exports.enrichColumn = enrichColumn;
 const express = require("express");
 const multiparty = require("multiparty");
 const fs = require("fs");
@@ -20,7 +29,7 @@ const mime = require("mime");
 const client_s3_1 = require("@aws-sdk/client-s3");
 const s3_request_presigner_1 = require("@aws-sdk/s3-request-presigner");
 const storage_1 = require("@google-cloud/storage");
-const image_size_1 = require("image-size");
+const imageDimensions_1 = require("./utils/imageDimensions");
 const serializeJs = require("serialize-javascript");
 const SftpClient = require("ssh2-sftp-client");
 const rollup = require("rollup");
@@ -28,19 +37,175 @@ const plugin_babel_1 = require("@rollup/plugin-babel");
 const plugin_node_resolve_1 = require("@rollup/plugin-node-resolve");
 const axios_1 = require("axios");
 const uuid_1 = require("uuid");
+const dbManager_1 = require("./utils/dbManager");
 function generateUniqueIdForObject(obj) {
     const str = JSON.stringify(obj);
     const hash = crypto.createHash("sha256").update(str).digest("hex");
     return hash;
 }
+exports.ROOT_ROLE = "root";
+const roleOf = (req) => req.session && req.session.user && req.session.user.role;
+exports.roleOf = roleOf;
+const canWriteView = (view, role) => role === exports.ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
+exports.canWriteView = canWriteView;
+const viewFromRequest = (req) => {
+    const idx = req.body && req.body.viewIndex !== undefined
+        ? req.body.viewIndex
+        : req.query && req.query.viewIndex !== undefined
+            ? req.query.viewIndex
+            : undefined;
+    if (idx === undefined || !req.config || !req.config.views)
+        return undefined;
+    return req.config.views[idx];
+};
+exports.viewFromRequest = viewFromRequest;
+exports.MUTATING_VIEW_ROUTES = new Set([
+    "/updateRecord",
+    "/createRecord",
+    "/deleteRecord",
+    "/deleteRecords",
+    "/deleteRecordFromPanel",
+    "/customAction",
+    "/uploadFile",
+]);
+const areSafeColumnNames = (data) => !data || Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
+exports.areSafeColumnNames = areSafeColumnNames;
+const writableTables = (req) => {
+    var _a, _b;
+    const role = (0, exports.roleOf)(req);
+    const tables = new Set();
+    for (const view of ((_a = req.config) === null || _a === void 0 ? void 0 : _a.views) || []) {
+        if (!(0, exports.canWriteView)(view, role))
+            continue;
+        if (view.tableName)
+            tables.add(view.tableName);
+        for (const panel of view.recordViewPanels || []) {
+            if (panel.tableName)
+                tables.add(panel.tableName);
+            if ((_b = panel.createConfig) === null || _b === void 0 ? void 0 : _b.tableName)
+                tables.add(panel.createConfig.tableName);
+        }
+    }
+    return tables;
+};
+exports.writableTables = writableTables;
+const looksLikeSqlBreakout = (frag) => typeof frag === "string" &&
+    /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(frag);
+exports.looksLikeSqlBreakout = looksLikeSqlBreakout;
+function sqlAnd(conditions) {
+    const existingConditions = [];
+    for (const condition of conditions) {
+        if (condition && condition.length > 0) {
+            existingConditions.push(condition);
+        }
+    }
+    if (existingConditions.length <= 1) {
+        return existingConditions[0] || null;
+    }
+    else {
+        let result = "";
+        for (let i = 0; i < existingConditions.length; i++) {
+            if (i > 0) {
+                result += " AND ";
+            }
+            result += "(" + existingConditions[i] + ")";
+        }
+        return result;
+    }
+}
+async function getFormattedValue(column, record) {
+    let value;
+    try {
+        record.options = column.options;
+        if (column.formatValueForExport) {
+            value = await column.formatValueForExport(record);
+        }
+        else if (column.formattedValue) {
+            value = evalExpression(column.formattedValue, record);
+        }
+        else if (column.formatValue) {
+            value = await column.formatValue(record);
+        }
+        else if (column.dataType == "tinyint") {
+            value = record[column.name] == 1 ? "Oui" : "Non";
+        }
+        else {
+            value = record[column.name];
+        }
+        return value === null || typeof value == "undefined" ? "" : value;
+    }
+    catch (err) {
+        return value || "";
+    }
+}
+function evalExpression(expression, data) {
+    let varString = "";
+    let statement = "";
+    try {
+        for (let key in data) {
+            statement =
+                "var " +
+                    key +
+                    " = " +
+                    (typeof data[key] === "string"
+                        ? "'" +
+                            data[key]
+                                .replace(/'/g, "\\'")
+                                .replace(/\n/g, "")
+                                .replace(/\r/g, "") +
+                            "'"
+                        : typeof data[key] === "object"
+                            ? JSON.stringify(data[key])
+                            : data[key]) +
+                    ";";
+            varString += statement;
+        }
+        const result = eval(varString + expression);
+        return result;
+    }
+    catch (e) {
+        console.log("Problème d'évaluation de l'expression", statement);
+        console.error(e);
+        return "Error";
+    }
+}
+function formatValueForInsertion(value, dbType) {
+    if (value !== 0 && !value) {
+        return "NULL";
+    }
+    if (value instanceof Date) {
+        return value.toISOString();
+    }
+    if (typeof value === "string") {
+        if (dbType === "POSTGRESQL") {
+            return "'" + value.replace(/'/g, "''") + "'";
+        }
+        else {
+            return "'" + value.replace(/'/g, "\\'") + "'";
+        }
+    }
+    if (typeof value === "object") {
+        return "'" + JSON.stringify(value).replace(/'/g, "\\'") + "'";
+    }
+    if (typeof value === "boolean") {
+        return value ? "TRUE" : "FALSE";
+    }
+    if (typeof value === "number") {
+        return value;
+    }
+    return value;
+}
 exports.default = (db, config) => {
     const app = express();
     app.use((req, res, next) => {
         req.config = Object.assign(Object.assign({}, config), { views: config.views
-                .filter(x => !x.roles
-                || (req.session.user && ([...(x.roles || []), ...(x.readRoles || [])].includes(req.session.user.role))))
-                .map(view => {
-                const readOnly = req.session.user && view.roles && !view.roles.includes(req.session.user.role);
+                .filter((x) => !x.roles ||
+                (req.session.user &&
+                    [...(x.roles || []), ...(x.readRoles || [])].includes(req.session.user.role)))
+                .map((view) => {
+                const readOnly = req.session.user &&
+                    view.roles &&
+                    !view.roles.includes(req.session.user.role);
                 if (readOnly) {
                     return Object.assign(Object.assign({}, view), { canEdit: false, canCreate: false, canDelete: false, clickToEdit: false });
                 }
@@ -48,9 +213,11 @@ exports.default = (db, config) => {
                     return view;
                 }
             })
-                .map(view => {
+                .map((view) => {
                 if (view.type === "table") {
-                    return Object.assign(Object.assign({}, view), { columns: view.columns.filter(column => !column.roles || (req.session.user && column.roles.includes(req.session.user.role))) });
+                    return Object.assign(Object.assign({}, view), { columns: view.columns.filter((column) => !column.roles ||
+                            (req.session.user &&
+                                column.roles.includes(req.session.user.role))) });
                 }
                 else {
                     return view;
@@ -64,60 +231,16 @@ exports.default = (db, config) => {
         }
         next();
     });
-    const ROOT_ROLE = "root";
-    const roleOf = (req) => req.session && req.session.user && req.session.user.role;
-    const canWriteView = (view, role) => role === ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
-    const viewFromRequest = (req) => {
-        const idx = req.body && req.body.viewIndex !== undefined
-            ? req.body.viewIndex
-            : req.query && req.query.viewIndex !== undefined
-                ? req.query.viewIndex
-                : undefined;
-        if (idx === undefined || !req.config || !req.config.views)
-            return undefined;
-        return req.config.views[idx];
-    };
-    const MUTATING_VIEW_ROUTES = new Set([
-        "/updateRecord",
-        "/createRecord",
-        "/deleteRecord",
-        "/deleteRecords",
-        "/deleteRecordFromPanel",
-        "/customAction",
-        "/uploadFile",
-    ]);
-    const areSafeColumnNames = (data) => !data ||
-        Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
-    const writableTables = (req) => {
-        var _a, _b;
-        const role = roleOf(req);
-        const tables = new Set();
-        for (const view of ((_a = req.config) === null || _a === void 0 ? void 0 : _a.views) || []) {
-            if (!canWriteView(view, role))
-                continue;
-            if (view.tableName)
-                tables.add(view.tableName);
-            for (const panel of view.recordViewPanels || []) {
-                if (panel.tableName)
-                    tables.add(panel.tableName);
-                if ((_b = panel.createConfig) === null || _b === void 0 ? void 0 : _b.tableName)
-                    tables.add(panel.createConfig.tableName);
-            }
-        }
-        return tables;
-    };
-    const looksLikeSqlBreakout = (frag) => typeof frag === "string" &&
-        /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(frag);
     app.use((req, res, next) => {
-        const role = roleOf(req);
+        const role = (0, exports.roleOf)(req);
         if (req.body && Array.isArray(req.body.filters)) {
-            if (req.body.filters.some(looksLikeSqlBreakout)) {
+            if (req.body.filters.some(exports.looksLikeSqlBreakout)) {
                 return res.status(400).send({ error: "Invalid filter" });
             }
         }
-        if (MUTATING_VIEW_ROUTES.has(req.path)) {
-            const view = viewFromRequest(req);
-            if (!view || !canWriteView(view, role)) {
+        if (exports.MUTATING_VIEW_ROUTES.has(req.path)) {
+            const view = (0, exports.viewFromRequest)(req);
+            if (!view || !(0, exports.canWriteView)(view, role)) {
                 return res.sendStatus(403);
             }
         }
@@ -150,10 +273,13 @@ exports.default = (db, config) => {
                     else if (columns[i].name) {
                         queryString += columns[i].name
                             .split(".")
-                            .map((x) => (db.dbType === "POSTGRESQL" ? x : "`" + x + "`"))
+                            .map((x) => (0, dbManager_1.quoteIdentifier)(x, db.dbType))
                             .join(".");
                     }
-                    queryString += " LIKE '%" + params.query.replace(/'/g, "\\'") + "%'";
+                    const searchEscaped = db.dbType === "POSTGRESQL"
+                        ? params.query.replace(/'/g, "''")
+                        : params.query.replace(/'/g, "\\'");
+                    queryString += " LIKE '%" + searchEscaped + "%'";
                     isNewCondition = false;
                 }
             }
@@ -161,13 +287,13 @@ exports.default = (db, config) => {
         }
         const limit = params.allRecords ? 999999 : parseInt(params.limit);
         const query = params.customQuery ||
-            `SELECT 
-            ${params.selectExpression || "*"} 
-        FROM ${params.table} 
-        ${params.join || ""} 
-        ${queryString} 
-        ${params.groupBy ? "GROUP BY " + params.groupBy : ""} 
-        ${params.having ? " HAVING " + params.having : ""} 
+            `SELECT
+            ${params.selectExpression || "*"}
+        FROM ${params.table}
+        ${params.join || ""}
+        ${queryString}
+        ${params.groupBy ? "GROUP BY " + params.groupBy : ""}
+        ${params.having ? " HAVING " + params.having : ""}
         ${params.orderBy || params.primaryId ? " ORDER BY " + (params.orderBy || `${params.table}.${params.primaryId}`) : ""}`;
         const { err, rows } = await db.query(`${query} LIMIT ${limit} OFFSET ${Math.max((params.page - 1) * limit, 0)}`);
         if (err) {
@@ -238,6 +364,7 @@ exports.default = (db, config) => {
         }
         catch (err) {
             console.error(err);
+            res.sendStatus(500);
         }
     });
     app.post("/adjacentRecordId", async function (req, res, next) {
@@ -250,27 +377,6 @@ exports.default = (db, config) => {
             recordId: recordId,
         });
     });
-    const sqlAnd = (conditions) => {
-        const existingConditions = [];
-        for (const condition of conditions) {
-            if (condition && condition.length > 0) {
-                existingConditions.push(condition);
-            }
-        }
-        if (existingConditions.length <= 1) {
-            return existingConditions[0] || null;
-        }
-        else {
-            let result = "";
-            for (let i = 0; i < existingConditions.length; i++) {
-                if (i > 0) {
-                    result += " AND ";
-                }
-                result += "(" + existingConditions[i] + ")";
-            }
-            return result;
-        }
-    };
     app.post("/foreignSelectRecords", async (req, res, next) => {
         var _a, _b, _c, _d, _e;
         const view = req.config.views[req.body.viewIndex];
@@ -375,88 +481,6 @@ exports.default = (db, config) => {
         });
     });
     const formattedValueToFunction = {};
-    async function getFormattedValue(column, record) {
-        let value;
-        try {
-            record.options = column.options;
-            if (column.formatValueForExport) {
-                value = await column.formatValueForExport(record);
-            }
-            else if (column.formattedValue) {
-                value = evalExpression(column.formattedValue, record);
-            }
-            else if (column.formatValue) {
-                value = await column.formatValue(record);
-            }
-            else if (column.dataType == "tinyint") {
-                value = record[column.name] == 1 ? "Oui" : "Non";
-            }
-            else {
-                value = record[column.name];
-            }
-            return value === null || typeof value == "undefined" ? "" : value;
-        }
-        catch (err) {
-            return value || "";
-        }
-    }
-    function evalExpression(expression, data) {
-        let varString = "";
-        let statement = "";
-        try {
-            for (let key in data) {
-                statement =
-                    "var " +
-                        key +
-                        " = " +
-                        (typeof data[key] === "string"
-                            ? "'" +
-                                data[key]
-                                    .replace(/'/g, "\\'")
-                                    .replace(/\n/g, "")
-                                    .replace(/\r/g, "") +
-                                "'"
-                            : typeof data[key] === "object"
-                                ? JSON.stringify(data[key])
-                                : data[key]) +
-                        ";";
-                varString += statement;
-            }
-            const result = eval(varString + expression);
-            return result;
-        }
-        catch (e) {
-            console.log("Problème d'évaluation de l'expression", statement);
-            console.error(e);
-            return "Error";
-        }
-    }
-    function formatValueForInsertion(value, dbType) {
-        if (value !== 0 && !value) {
-            return "NULL";
-        }
-        if (value instanceof Date) {
-            return value.toISOString();
-        }
-        if (typeof value === "string") {
-            if (dbType === "POSTGRESQL") {
-                return "'" + value.replace(/'/g, "''") + "'";
-            }
-            else {
-                return "'" + value.replace(/'/g, "\\'") + "'";
-            }
-        }
-        if (typeof value === "object") {
-            return "'" + JSON.stringify(value).replace(/'/g, "\\'") + "'";
-        }
-        if (typeof value === "boolean") {
-            return value ? "TRUE" : "FALSE";
-        }
-        if (typeof value === "number") {
-            return value;
-        }
-        return value;
-    }
     app.post("/recordsExport", async function (req, res) {
         const view = req.config.views[req.body.viewIndex];
         const orderBy = req.body.orderBy || view.orderBy;
@@ -468,7 +492,14 @@ exports.default = (db, config) => {
             table: view.tableName,
             page: 1,
             allRecords: true,
-            filters: sqlAnd([view.filters, subview === null || subview === void 0 ? void 0 : subview.filters, req.body.filters]),
+            filters: sqlAnd([
+                view.filters,
+                subview === null || subview === void 0 ? void 0 : subview.filters,
+                req.body.filters,
+                view.filtersFromUser
+                    ? view.filtersFromUser(req.session.user.userId, req.session.user.role)
+                    : null,
+            ]),
             having: subview === null || subview === void 0 ? void 0 : subview.having,
             customQuery: view.customQuery,
             join: view.join,
@@ -520,6 +551,9 @@ exports.default = (db, config) => {
                 return res.status(500).send(err);
             }
             const view = req.config.views[fields.viewIndex[0]];
+            if (!view || !(0, exports.canWriteView)(view, (0, exports.roleOf)(req))) {
+                return res.sendStatus(403);
+            }
             if (typeof view.parseImportFile !== "function") {
                 return res
                     .status(500)
@@ -542,7 +576,7 @@ exports.default = (db, config) => {
                 }
                 let queryString;
                 if (db.dbType === "POSTGRESQL") {
-                    queryString = `INSERT INTO ?? (${columns.map((x) => `"${x}"`).join(", ")}) VALUES`;
+                    queryString = `INSERT INTO ?? (${columns.map((x) => (0, dbManager_1.quoteIdentifier)(x, db.dbType)).join(", ")}) VALUES`;
                     for (let record of records) {
                         const valuesList = columns
                             .map((x) => formatValueForInsertion(record[x], db.dbType))
@@ -553,13 +587,13 @@ exports.default = (db, config) => {
                         queryString.slice(0, -1) +
                             ` ON CONFLICT (${view.importFileUniqueField}) DO UPDATE SET `;
                     for (let column of columns) {
-                        queryString += `"${column}" = EXCLUDED."${column}",`;
+                        queryString += `${(0, dbManager_1.quoteIdentifier)(column, db.dbType)} = EXCLUDED.${(0, dbManager_1.quoteIdentifier)(column, db.dbType)},`;
                     }
                 }
                 else {
                     queryString =
                         "INSERT INTO ?? (" +
-                            columns.map((x) => "`" + x + "`").join(", ") +
+                            columns.map((x) => (0, dbManager_1.quoteIdentifier)(x, db.dbType)).join(", ") +
                             ") VALUES";
                     for (let record of records) {
                         queryString +=
@@ -571,7 +605,7 @@ exports.default = (db, config) => {
                     }
                     queryString = queryString.slice(0, -1) + " ON DUPLICATE KEY UPDATE";
                     for (let column of columns) {
-                        queryString += " `" + column + "` = VALUES(`" + column + "`),";
+                        queryString += ` ${(0, dbManager_1.quoteIdentifier)(column, db.dbType)} = VALUES(${(0, dbManager_1.quoteIdentifier)(column, db.dbType)}),`;
                     }
                 }
                 queryString = queryString.slice(0, -1);
@@ -603,7 +637,15 @@ exports.default = (db, config) => {
                 return res.status(500).send(err);
             }
             const view = req.config.views[fields.viewIndex[0]];
-            const panel = view.recordViewPanels[fields.panelIndex[0]];
+            const panel = view
+                ? view.recordViewPanels[fields.panelIndex[0]]
+                : undefined;
+            if (!view ||
+                !(0, exports.canWriteView)(view, (0, exports.roleOf)(req)) ||
+                !panel ||
+                !(0, exports.canWriteView)(panel, (0, exports.roleOf)(req))) {
+                return res.sendStatus(403);
+            }
             if (typeof panel.parseImportFile !== "function") {
                 return res
                     .status(500)
@@ -629,10 +671,10 @@ exports.default = (db, config) => {
                         }
                     }
                 }
-                let queryString = "INSERT IGNORE INTO ?? (`" +
-                    panel.createConfig.recordIdKey +
-                    "`, " +
-                    columns.map((x) => "`" + x + "`").join(", ") +
+                let queryString = "INSERT IGNORE INTO ?? (" +
+                    (0, dbManager_1.quoteIdentifier)(panel.createConfig.recordIdKey, db.dbType) +
+                    ", " +
+                    columns.map((x) => (0, dbManager_1.quoteIdentifier)(x, db.dbType)).join(", ") +
                     ") VALUES";
                 for (let record of records) {
                     queryString +=
@@ -646,7 +688,7 @@ exports.default = (db, config) => {
                 }
                 queryString = queryString.slice(0, -1) + " ON DUPLICATE KEY UPDATE";
                 for (let column of columns) {
-                    queryString += " `" + column + "` = VALUES(`" + column + "`),";
+                    queryString += ` ${(0, dbManager_1.quoteIdentifier)(column, db.dbType)} = VALUES(${(0, dbManager_1.quoteIdentifier)(column, db.dbType)}),`;
                 }
                 const { err, rows: r } = await db.query(queryString.slice(0, -1), [
                     panel.tableName,
@@ -701,7 +743,7 @@ exports.default = (db, config) => {
     });
     app.post("/updateRecord", async function (req, res, next) {
         const view = req.config.views[req.body.viewIndex];
-        if (!areSafeColumnNames(req.body.data)) {
+        if (!(0, exports.areSafeColumnNames)(req.body.data)) {
             return res.status(400).send({ error: "Invalid column name" });
         }
         for (let key in req.body.data) {
@@ -715,7 +757,7 @@ exports.default = (db, config) => {
             return res.sendStatus(200);
         }
         const queryExpression = Object.keys(req.body.data)
-            .map((x) => `${x} = ?`)
+            .map((x) => `${(0, dbManager_1.quoteIdentifier)(x, db.dbType)} = ?`)
             .join(", ");
         const queryParameters = Object.keys(req.body.data).map((x) => req.body.data[x]);
         const { err } = await db.query(`UPDATE ?? SET ${queryExpression} WHERE ?? = ?`, [
@@ -853,7 +895,8 @@ exports.default = (db, config) => {
     });
     app.post("/deleteRecords", async function (req, res, next) {
         const view = req.config.views[req.body.viewIndex];
-        const { err } = await db.query(`DELETE FROM ?? WHERE ?? IN(${req.body.primaryValues.map((x) => "'" + x + "'").join(",")})`, [view.tableName, view.primaryId]);
+        const placeholders = req.body.primaryValues.map(() => "?").join(", ");
+        const { err } = await db.query(`DELETE FROM ?? WHERE ?? IN(${placeholders})`, [view.tableName, view.primaryId, ...req.body.primaryValues]);
         if (err) {
             return res.status(500).send(err);
         }
@@ -889,7 +932,7 @@ exports.default = (db, config) => {
     });
     app.post("/duplicateRecord", async function (req, res, next) {
         var _a;
-        const allowedTables = writableTables(req);
+        const allowedTables = (0, exports.writableTables)(req);
         const requestedTables = [
             req.body.table,
             ...(((_a = req.body.duplicateConfig) === null || _a === void 0 ? void 0 : _a.foreignTables) || []).map((t) => t.table),
@@ -941,9 +984,8 @@ exports.default = (db, config) => {
     app.post("/createRecord", async function (req, res, next) {
         var _a, _b, _c;
         const view = req.config.views[req.body.viewIndex];
-        const panel = req.body.panelIndex
-            ? view.recordViewPanels[req.body.panelIndex]
-            : null;
+        const hasPanel = req.body.panelIndex !== undefined && req.body.panelIndex !== null;
+        const panel = hasPanel ? view.recordViewPanels[req.body.panelIndex] : null;
         try {
             for (let key in req.body.data) {
                 if (req.body.data[key] == "NULL" ||
@@ -966,10 +1008,12 @@ exports.default = (db, config) => {
                     delete createPayload[key];
                 }
             }
-            if (!areSafeColumnNames(createPayload)) {
+            if (!(0, exports.areSafeColumnNames)(createPayload)) {
                 return res.status(400).send({ error: "Invalid column name" });
             }
-            const queryExpression = Object.keys(createPayload).join(", ");
+            const queryExpression = Object.keys(createPayload)
+                .map((x) => (0, dbManager_1.quoteIdentifier)(x, db.dbType))
+                .join(", ");
             const queryPlaceholders = Object.keys(createPayload)
                 .map((x) => "?")
                 .join(", ");
@@ -994,10 +1038,15 @@ exports.default = (db, config) => {
                 catch (e) { }
             }
             if (panel ? panel.createCallbackFunction : view.createCallbackFunction) {
-                await (panel ? panel.createCallbackFunction : view.createCallbackFunction)({
-                    id: r.insertId,
-                    data: req.body.data,
-                });
+                try {
+                    await (panel ? panel.createCallbackFunction : view.createCallbackFunction)({
+                        id: r.insertId,
+                        data: req.body.data,
+                    });
+                }
+                catch (callbackErr) {
+                    console.error(callbackErr);
+                }
             }
             res.send({
                 id: r.insertId,
@@ -1011,25 +1060,6 @@ exports.default = (db, config) => {
             });
         }
     });
-    function collectAllowedQueries(node, acc = new Set()) {
-        if (!node || typeof node !== "object")
-            return acc;
-        if (Array.isArray(node)) {
-            for (const item of node)
-                collectAllowedQueries(item, acc);
-            return acc;
-        }
-        for (const key of Object.keys(node)) {
-            const value = node[key];
-            if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
-                acc.add(value.trim());
-            }
-            else if (value && typeof value === "object") {
-                collectAllowedQueries(value, acc);
-            }
-        }
-        return acc;
-    }
     const CONFIG_USES_CUSTOM_QUERY = collectAllowedQueries(config.views).size > 0;
     if (!CONFIG_USES_CUSTOM_QUERY) {
         app.get("/customQuery", (req, res) => res.sendStatus(404));
@@ -1042,7 +1072,9 @@ exports.default = (db, config) => {
                 return res.status(403).send({ error: "Query not allowed" });
             }
             if (!/^\s*\(?\s*(select|with)\b/i.test(template) || /;/.test(template)) {
-                return res.status(400).send({ error: "Only read-only queries are allowed" });
+                return res
+                    .status(400)
+                    .send({ error: "Only read-only queries are allowed" });
             }
             const placeholderCount = (template.match(/\?/g) || []).length;
             const params = new Array(placeholderCount).fill(req.query.primaryValue);
@@ -1066,7 +1098,7 @@ exports.default = (db, config) => {
     function uploadFile(column, fileParamName, req, res) {
         if (column.s3Config || column.gcpConfig) {
             const form = new multiparty.Form();
-            form.parse(req, function (err, fields, files) {
+            form.parse(req, async function (err, fields, files) {
                 if (err) {
                     return res.status(500).send(err);
                 }
@@ -1075,8 +1107,14 @@ exports.default = (db, config) => {
                 const extension = originalFilename.match(/(?:\.([^.]+))?$/)[1];
                 let aspectRatio = null;
                 if (["png", "jpeg", "jpg", "gif"].includes(extension)) {
-                    const dimensions = (0, image_size_1.default)(files[fileParamName][0].path);
-                    aspectRatio = dimensions.height / dimensions.width;
+                    try {
+                        const dimensions = await (0, imageDimensions_1.getImageDimensions)(files[fileParamName][0].path);
+                        if (dimensions) {
+                            aspectRatio = dimensions.height / dimensions.width;
+                        }
+                    }
+                    catch (_a) {
+                    }
                 }
                 const originalFilenameWithoutExtension = originalFilename.replace("." + extension, "");
                 if (column.gcpConfig) {
@@ -1227,6 +1265,10 @@ exports.default = (db, config) => {
         }
     }
     app.post("/uploadFileFromBetterRichTextInput", async function (req, res, next) {
+        const role = (0, exports.roleOf)(req);
+        if (!req.config.views.some((view) => (0, exports.canWriteView)(view, role))) {
+            return res.sendStatus(403);
+        }
         const fileUploadProperties = JSON.parse(req.headers["file-upload-properties"]);
         uploadFile(fileUploadProperties, "upload", req, res);
     });
@@ -1269,6 +1311,25 @@ exports.default = (db, config) => {
     });
     return app;
 };
+function collectAllowedQueries(node, acc = new Set()) {
+    if (!node || typeof node !== "object")
+        return acc;
+    if (Array.isArray(node)) {
+        for (const item of node)
+            collectAllowedQueries(item, acc);
+        return acc;
+    }
+    for (const key of Object.keys(node)) {
+        const value = node[key];
+        if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
+            acc.add(value.trim());
+        }
+        else if (value && typeof value === "object") {
+            collectAllowedQueries(value, acc);
+        }
+    }
+    return acc;
+}
 async function enrichConfig(config, db) {
     var _a, _b;
     const { rows: info, err } = await db.query("SELECT * FROM information_schema.columns WHERE table_schema = ?", [((_a = config.mysql) === null || _a === void 0 ? void 0 : _a.database) || ((_b = config.postgresql) === null || _b === void 0 ? void 0 : _b.database)]);