@galadrim/galadmin 0.1.235 → 0.2.6

package/src/api.ts

@@ -8,7 +8,7 @@ import * as mime from "mime";
 import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { Storage } from "@google-cloud/storage";
-import sizeOf from "image-size";
+import { getImageDimensions } from "./utils/imageDimensions";
 import * as serializeJs from "serialize-javascript";
 import * as SftpClient from "ssh2-sftp-client";
 
@@ -18,12 +18,189 @@ import resolve from "@rollup/plugin-node-resolve";
 import axios from "axios";
 import { v4 as uuidv4 } from "uuid";
 
-function generateUniqueIdForObject(obj) {
+import { quoteIdentifier } from "./utils/dbManager";
+
+export function generateUniqueIdForObject(obj) {
   const str = JSON.stringify(obj);
   const hash = crypto.createHash("sha256").update(str).digest("hex");
   return hash;
 }
 
+// ---------------------------------------------------------------------------
+// SECURITY: server-side authorization.
+//
+// The config-filtering middleware below only decides which views the *client*
+// is shown, and sets canEdit/canCreate/canDelete flags on that served config.
+// Nothing enforced those decisions server-side, so a session with the lowest
+// role could POST directly to /updateRecord, /deleteRecord, /customQuery, …
+// and act on any view — including read-only ones — as the DB user (root).
+// This block re-checks every sensitive route against the view's declared roles.
+// ---------------------------------------------------------------------------
+export const ROOT_ROLE = "root";
+export const roleOf = (req) =>
+  req.session && req.session.user && req.session.user.role;
+// Write access = the view's `roles` (root always allowed).
+export const canWriteView = (view, role) =>
+  role === ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
+
+export const viewFromRequest = (req) => {
+  const idx =
+    req.body && req.body.viewIndex !== undefined
+      ? req.body.viewIndex
+      : req.query && req.query.viewIndex !== undefined
+        ? req.query.viewIndex
+        : undefined;
+  if (idx === undefined || !req.config || !req.config.views) return undefined;
+  return req.config.views[idx];
+};
+
+// Routes that mutate data and reference their target view via viewIndex
+// (body for POST bodies, query for /uploadFile). Import routes carry the
+// viewIndex inside a multipart body and are guarded inline in their handlers.
+export const MUTATING_VIEW_ROUTES = new Set([
+  "/updateRecord",
+  "/createRecord",
+  "/deleteRecord",
+  "/deleteRecords",
+  "/deleteRecordFromPanel",
+  "/customAction",
+  "/uploadFile",
+]);
+// /duplicateRecord references its table via req.body.table (not a viewIndex),
+// so it is guarded inline in its handler instead of by the generic middleware.
+
+// Column names are interpolated into INSERT/UPDATE statements; only accept plain
+// SQL identifiers so a crafted key cannot break out of the column list.
+export const areSafeColumnNames = (data) =>
+  !data || Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
+
+// Tables the current role is allowed to write, gathered from its writable views
+// and their creatable panels — used to bound /duplicateRecord's target table.
+export const writableTables = (req) => {
+  const role = roleOf(req);
+  const tables = new Set<string>();
+  for (const view of req.config?.views || []) {
+    if (!canWriteView(view, role)) continue;
+    if (view.tableName) tables.add(view.tableName);
+    for (const panel of view.recordViewPanels || []) {
+      if (panel.tableName) tables.add(panel.tableName);
+      if (panel.createConfig?.tableName)
+        tables.add(panel.createConfig.tableName);
+    }
+  }
+  return tables;
+};
+
+// Reject client-supplied SQL fragments (the `filters` array is concatenated
+// raw into the WHERE clause). With multipleStatements off this already blocks
+// stacked writes; the pattern also blocks UNION/comment/file exfil breakouts.
+export const looksLikeSqlBreakout = (frag) =>
+  typeof frag === "string" &&
+  /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(
+    frag,
+  );
+
+export function sqlAnd(conditions) {
+  const existingConditions = [];
+  for (const condition of conditions) {
+    if (condition && condition.length > 0) {
+      existingConditions.push(condition);
+    }
+  }
+  if (existingConditions.length <= 1) {
+    return existingConditions[0] || null;
+  } else {
+    let result = "";
+    for (let i = 0; i < existingConditions.length; i++) {
+      if (i > 0) {
+        result += " AND ";
+      }
+      result += "(" + existingConditions[i] + ")";
+    }
+    return result;
+  }
+}
+
+export async function getFormattedValue(column, record) {
+  let value;
+  try {
+    record.options = column.options;
+    if (column.formatValueForExport) {
+      value = await column.formatValueForExport(record);
+    } else if (column.formattedValue) {
+      value = evalExpression(column.formattedValue, record);
+    } else if (column.formatValue) {
+      value = await column.formatValue(record);
+    } else if (column.dataType == "tinyint") {
+      value = record[column.name] == 1 ? "Oui" : "Non";
+    } else {
+      value = record[column.name];
+    }
+    return value === null || typeof value == "undefined" ? "" : value;
+  } catch (err) {
+    return value || "";
+  }
+}
+
+export function evalExpression(expression, data) {
+  let varString = "";
+  let statement = "";
+
+  try {
+    for (let key in data) {
+      statement =
+        "var " +
+        key +
+        " = " +
+        (typeof data[key] === "string"
+          ? "'" +
+            data[key]
+              .replace(/'/g, "\\'")
+              .replace(/\n/g, "")
+              .replace(/\r/g, "") +
+            "'"
+          : typeof data[key] === "object"
+            ? JSON.stringify(data[key])
+            : data[key]) +
+        ";";
+      varString += statement;
+    }
+    const result = eval(varString + expression);
+    return result;
+  } catch (e) {
+    console.log("Problème d'évaluation de l'expression", statement);
+    console.error(e);
+    return "Error";
+  }
+}
+
+export function formatValueForInsertion(value: any, dbType: string) {
+  if (value !== 0 && !value) {
+    return "NULL";
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (typeof value === "string") {
+    if (dbType === "POSTGRESQL") {
+      return "'" + value.replace(/'/g, "''") + "'";
+    } else {
+      return "'" + value.replace(/'/g, "\\'") + "'";
+    }
+  }
+  if (typeof value === "object") {
+    return "'" + JSON.stringify(value).replace(/'/g, "\\'") + "'";
+  }
+  if (typeof value === "boolean") {
+    return value ? "TRUE" : "FALSE";
+  }
+  if (typeof value === "number") {
+    return value;
+  }
+
+  return value;
+}
+
 declare global {
   namespace Express {
     interface Request {
@@ -39,34 +216,47 @@ export default (db, config) => {
     req.config = {
       ...config,
       views: config.views
-        .filter(x => !x.roles
-          || (req.session.user && ([...(x.roles || []), ...(x.readRoles || [])].includes(req.session.user.role)))
+        .filter(
+          (x) =>
+            !x.roles ||
+            (req.session.user &&
+              [...(x.roles || []), ...(x.readRoles || [])].includes(
+                req.session.user.role,
+              )),
         )
-        .map(view => {
-          const readOnly = req.session.user && view.roles && !view.roles.includes(req.session.user.role)
+        .map((view) => {
+          const readOnly =
+            req.session.user &&
+            view.roles &&
+            !view.roles.includes(req.session.user.role);
           if (readOnly) {
             return {
               ...view,
               canEdit: false,
               canCreate: false,
               canDelete: false,
-              clickToEdit: false
-            }
+              clickToEdit: false,
+            };
           } else {
             return view;
           }
         })
-        .map(view => {
+        .map((view) => {
           if (view.type === "table") {
             return {
               ...view,
-              columns: view.columns.filter(column => !column.roles || (req.session.user && column.roles.includes(req.session.user.role)))
-            }
+              columns: view.columns.filter(
+                (column) =>
+                  !column.roles ||
+                  (req.session.user &&
+                    column.roles.includes(req.session.user.role)),
+              ),
+            };
           } else {
             return view;
           }
-        })
-    }
+        }),
+    };
     next();
   });
 
@@ -78,77 +268,10 @@ export default (db, config) => {
   });
 
   // ---------------------------------------------------------------------------
-  // SECURITY: server-side authorization.
-  //
-  // The config-filtering middleware above only decides which views the *client*
-  // is shown, and sets canEdit/canCreate/canDelete flags on that served config.
-  // Nothing enforced those decisions server-side, so a session with the lowest
-  // role could POST directly to /updateRecord, /deleteRecord, /customQuery, …
-  // and act on any view — including read-only ones — as the DB user (root).
-  // This block re-checks every sensitive route against the view's declared roles.
+  // SECURITY: server-side authorization — see the helpers above (exported at
+  // module scope for testability): roleOf, canWriteView, viewFromRequest,
+  // MUTATING_VIEW_ROUTES, areSafeColumnNames, writableTables, looksLikeSqlBreakout.
   // ---------------------------------------------------------------------------
-  const ROOT_ROLE = "root";
-  const roleOf = (req) => req.session && req.session.user && req.session.user.role;
-  // Write access = the view's `roles` (root always allowed).
-  const canWriteView = (view, role) =>
-    role === ROOT_ROLE || !view || !view.roles || view.roles.includes(role);
-
-  const viewFromRequest = (req) => {
-    const idx =
-      req.body && req.body.viewIndex !== undefined
-        ? req.body.viewIndex
-        : req.query && req.query.viewIndex !== undefined
-        ? req.query.viewIndex
-        : undefined;
-    if (idx === undefined || !req.config || !req.config.views) return undefined;
-    return req.config.views[idx];
-  };
-
-  // Routes that mutate data and reference their target view via viewIndex
-  // (body for POST bodies, query for /uploadFile). Import routes carry the
-  // viewIndex inside a multipart body and are guarded inline in their handlers.
-  const MUTATING_VIEW_ROUTES = new Set([
-    "/updateRecord",
-    "/createRecord",
-    "/deleteRecord",
-    "/deleteRecords",
-    "/deleteRecordFromPanel",
-    "/customAction",
-    "/uploadFile",
-  ]);
-  // /duplicateRecord references its table via req.body.table (not a viewIndex),
-  // so it is guarded inline in its handler instead of by the generic middleware.
-
-  // Column names are interpolated into INSERT/UPDATE statements; only accept plain
-  // SQL identifiers so a crafted key cannot break out of the column list.
-  const areSafeColumnNames = (data) =>
-    !data ||
-    Object.keys(data).every((k) => /^[A-Za-z0-9_]+$/.test(k));
-
-  // Tables the current role is allowed to write, gathered from its writable views
-  // and their creatable panels — used to bound /duplicateRecord's target table.
-  const writableTables = (req) => {
-    const role = roleOf(req);
-    const tables = new Set<string>();
-    for (const view of req.config?.views || []) {
-      if (!canWriteView(view, role)) continue;
-      if (view.tableName) tables.add(view.tableName);
-      for (const panel of view.recordViewPanels || []) {
-        if (panel.tableName) tables.add(panel.tableName);
-        if (panel.createConfig?.tableName) tables.add(panel.createConfig.tableName);
-      }
-    }
-    return tables;
-  };
-
-  // Reject client-supplied SQL fragments (the `filters` array is concatenated
-  // raw into the WHERE clause). With multipleStatements off this already blocks
-  // stacked writes; the pattern also blocks UNION/comment/file exfil breakouts.
-  const looksLikeSqlBreakout = (frag) =>
-    typeof frag === "string" &&
-    /(;|--|\/\*|\bunion\b|\binto\s+(out|dump)file\b|\bsleep\s*\(|\bbenchmark\s*\(|\bload_file\s*\()/i.test(
-      frag
-    );
 
   app.use((req, res, next) => {
     const role = roleOf(req);
@@ -198,10 +321,17 @@ export default (db, config) => {
           } else if (columns[i].name) {
             queryString += columns[i].name
               .split(".")
-              .map((x) => (db.dbType === "POSTGRESQL" ? x : "`" + x + "`"))
+              .map((x) => quoteIdentifier(x, db.dbType))
               .join(".");
           }
-          queryString += " LIKE '%" + params.query.replace(/'/g, "\\'") + "%'";
+          // SECURITY: escape the user query per dialect — PostgreSQL does not
+          // treat backslashes as escapes inside standard strings, so a `\'`
+          // would terminate the literal early.
+          const searchEscaped =
+            db.dbType === "POSTGRESQL"
+              ? params.query.replace(/'/g, "''")
+              : params.query.replace(/'/g, "\\'");
+          queryString += " LIKE '%" + searchEscaped + "%'";
           isNewCondition = false;
         }
       }
@@ -210,16 +340,16 @@ export default (db, config) => {
     const limit = params.allRecords ? 999999 : parseInt(params.limit);
     const query =
       params.customQuery ||
-      `SELECT 
-            ${params.selectExpression || "*"} 
-        FROM ${params.table} 
-        ${params.join || ""} 
-        ${queryString} 
-        ${params.groupBy ? "GROUP BY " + params.groupBy : ""} 
-        ${params.having ? " HAVING " + params.having : ""} 
+      `SELECT
+            ${params.selectExpression || "*"}
+        FROM ${params.table}
+        ${params.join || ""}
+        ${queryString}
+        ${params.groupBy ? "GROUP BY " + params.groupBy : ""}
+        ${params.having ? " HAVING " + params.having : ""}
         ${params.orderBy || params.primaryId ? " ORDER BY " + (params.orderBy || `${params.table}.${params.primaryId}`) : ""}`;
     const { err, rows } = await db.query(
-      `${query} LIMIT ${limit} OFFSET ${Math.max((params.page - 1) * limit, 0)}`
+      `${query} LIMIT ${limit} OFFSET ${Math.max((params.page - 1) * limit, 0)}`,
     );
     if (err) {
       console.error(err);
@@ -230,7 +360,7 @@ export default (db, config) => {
     let count = undefined;
     if (computeCount) {
       const { err: countErr, rows: countRows } = await db.query(
-        `SELECT COUNT(*) AS count FROM (${query}) s`
+        `SELECT COUNT(*) AS count FROM (${query}) s`,
       );
       if (countErr) {
         const { rows: allRows } = await db.query(query);
@@ -256,7 +386,7 @@ export default (db, config) => {
       Object.assign(params, {
         page: parseInt(params.position) + parseInt(params.offset),
         limit: 1,
-      })
+      }),
     );
   }
 
@@ -277,15 +407,15 @@ export default (db, config) => {
       const pkg = JSON.parse(
         fs.readFileSync(
           path.join(__dirname, "../src/front/package.json"),
-          "utf-8"
-        )
+          "utf-8",
+        ),
       );
       const external = Object.keys(pkg.dependencies || {});
       const bundle = await rollup.rollup({
         input: path.join(
           __dirname,
           "../../",
-          req.query.componentPath as string
+          req.query.componentPath as string,
         ),
         plugins: [
           resolve(),
@@ -303,6 +433,7 @@ export default (db, config) => {
       res.send(output[0].code);
     } catch (err) {
       console.error(err);
+      res.sendStatus(500);
     }
   });
 
@@ -317,27 +448,6 @@ export default (db, config) => {
     });
   });
 
-  const sqlAnd = (conditions) => {
-    const existingConditions = [];
-    for (const condition of conditions) {
-      if (condition && condition.length > 0) {
-        existingConditions.push(condition);
-      }
-    }
-    if (existingConditions.length <= 1) {
-      return existingConditions[0] || null;
-    } else {
-      let result = "";
-      for (let i = 0; i < existingConditions.length; i++) {
-        if (i > 0) {
-          result += " AND ";
-        }
-        result += "(" + existingConditions[i] + ")";
-      }
-      return result;
-    }
-  };
-
   app.post("/foreignSelectRecords", async (req, res, next) => {
     const view = req.config.views[req.body.viewIndex];
     const column = [
@@ -360,7 +470,10 @@ export default (db, config) => {
           ? `${column.searchableName} LIKE '${column.wholeSearch ? "%" : ""}${queryEscaped}%'`
           : null,
         column.filtersFromUser
-          ? column.filtersFromUser(req.session.user.userId, req.session.user.role)
+          ? column.filtersFromUser(
+              req.session.user.userId,
+              req.session.user.role,
+            )
           : null,
       ]),
       join: column.join,
@@ -388,7 +501,7 @@ export default (db, config) => {
           value,
           label,
         };
-      })
+      }),
     );
     res.send(options);
   });
@@ -415,7 +528,10 @@ export default (db, config) => {
           subview?.filters,
           ...req.body.filters,
           view.filtersFromUser
-            ? view.filtersFromUser(req.session.user.userId, req.session.user.role)
+            ? view.filtersFromUser(
+                req.session.user.userId,
+                req.session.user.role,
+              )
             : null,
         ]),
         having: subview?.having,
@@ -434,7 +550,7 @@ export default (db, config) => {
         columns: view.columns,
         limit: view.limit || 10,
       },
-      true
+      true,
     );
     if (error) {
       return res.status(500).send(error);
@@ -457,86 +573,6 @@ export default (db, config) => {
 
   const formattedValueToFunction = {};
 
-  async function getFormattedValue(column, record) {
-    let value;
-    try {
-      record.options = column.options;
-      if (column.formatValueForExport) {
-        value = await column.formatValueForExport(record);
-      } else if (column.formattedValue) {
-        value = evalExpression(column.formattedValue, record);
-      } else if (column.formatValue) {
-        value = await column.formatValue(record);
-      } else if (column.dataType == "tinyint") {
-        value = record[column.name] == 1 ? "Oui" : "Non";
-      } else {
-        value = record[column.name];
-      }
-      return value === null || typeof value == "undefined" ? "" : value;
-    } catch (err) {
-      return value || "";
-    }
-  }
-
-  function evalExpression(expression, data) {
-    let varString = "";
-    let statement = "";
-
-    try {
-      for (let key in data) {
-        statement =
-          "var " +
-          key +
-          " = " +
-          (typeof data[key] === "string"
-            ? "'" +
-            data[key]
-              .replace(/'/g, "\\'")
-              .replace(/\n/g, "")
-              .replace(/\r/g, "") +
-            "'"
-            : typeof data[key] === "object"
-              ? JSON.stringify(data[key])
-              : data[key]) +
-          ";";
-        varString += statement;
-      }
-      const result = eval(varString + expression);
-      return result;
-    } catch (e) {
-      console.log("Problème d'évaluation de l'expression", statement);
-      console.error(e);
-      return "Error";
-    }
-  }
-
-  function formatValueForInsertion(value: any, dbType: string) {
-    if (value !== 0 && !value) {
-      return "NULL";
-    }
-    if (value instanceof Date) {
-      return value.toISOString();
-    }
-    if (typeof value === "string") {
-      if (dbType === "POSTGRESQL") {
-        return "'" + value.replace(/'/g, "''") + "'";
-      } else {
-        return "'" + value.replace(/'/g, "\\'") + "'";
-      }
-    }
-    if (typeof value === "object") {
-      return "'" + JSON.stringify(value).replace(/'/g, "\\'") + "'";
-    }
-    if (typeof value === "boolean") {
-      return value ? "TRUE" : "FALSE";
-    }
-    if (typeof value === "number") {
-      return value;
-    }
-
-    return value;
-  }
-
   app.post("/recordsExport", async function (req, res) {
     const view = req.config.views[req.body.viewIndex];
     const orderBy = req.body.orderBy || view.orderBy;
@@ -549,7 +585,19 @@ export default (db, config) => {
       table: view.tableName,
       page: 1,
       allRecords: true,
-      filters: sqlAnd([view.filters, subview?.filters, req.body.filters]),
+      filters: sqlAnd([
+        view.filters,
+        subview?.filters,
+        req.body.filters,
+        // SECURITY: scope the export exactly like the list view, otherwise a
+        // user could download rows their filtersFromUser clause hides.
+        view.filtersFromUser
+          ? view.filtersFromUser(
+              req.session.user.userId,
+              req.session.user.role,
+            )
+          : null,
+      ]),
       having: subview?.having,
       customQuery: view.customQuery,
       join: view.join,
@@ -601,11 +649,16 @@ export default (db, config) => {
       }
       // Get viewIndex in fields
       const view = req.config.views[fields.viewIndex[0]];
+      // SECURITY: the generic write-guard cannot see a viewIndex buried in a
+      // multipart body, so imports enforce the view's write roles here.
+      if (!view || !canWriteView(view, roleOf(req))) {
+        return res.sendStatus(403);
+      }
       if (typeof view.parseImportFile !== "function") {
         return res
           .status(500)
           .send(
-            '"parseImportFile" doit être défini dans la configuration de la vue.'
+            '"parseImportFile" doit être défini dans la configuration de la vue.',
           );
       }
 
@@ -628,7 +681,7 @@ export default (db, config) => {
 
         let queryString;
         if (db.dbType === "POSTGRESQL") {
-          queryString = `INSERT INTO ?? (${columns.map((x) => `"${x}"`).join(", ")}) VALUES`;
+          queryString = `INSERT INTO ?? (${columns.map((x) => quoteIdentifier(x, db.dbType)).join(", ")}) VALUES`;
 
           for (let record of records) {
             const valuesList = columns
@@ -641,12 +694,12 @@ export default (db, config) => {
             ` ON CONFLICT (${view.importFileUniqueField}) DO UPDATE SET `;
 
           for (let column of columns) {
-            queryString += `"${column}" = EXCLUDED."${column}",`;
+            queryString += `${quoteIdentifier(column, db.dbType)} = EXCLUDED.${quoteIdentifier(column, db.dbType)},`;
           }
         } else {
           queryString =
             "INSERT INTO ?? (" +
-            columns.map((x) => "`" + x + "`").join(", ") +
+            columns.map((x) => quoteIdentifier(x, db.dbType)).join(", ") +
             ") VALUES";
           for (let record of records) {
             queryString +=
@@ -658,7 +711,7 @@ export default (db, config) => {
           }
           queryString = queryString.slice(0, -1) + " ON DUPLICATE KEY UPDATE";
           for (let column of columns) {
-            queryString += " `" + column + "` = VALUES(`" + column + "`),";
+            queryString += ` ${quoteIdentifier(column, db.dbType)} = VALUES(${quoteIdentifier(column, db.dbType)}),`;
           }
         }
         queryString = queryString.slice(0, -1); // Remove the trailing comma
@@ -692,25 +745,37 @@ export default (db, config) => {
       }
       // Get viewIndex and panelIndex in fields
       const view = req.config.views[fields.viewIndex[0]];
-      const panel = view.recordViewPanels[fields.panelIndex[0]];
+      const panel = view
+        ? view.recordViewPanels[fields.panelIndex[0]]
+        : undefined;
+      // SECURITY: same write-guard as /recordsImport, plus the panel's own
+      // roles when it declares any.
+      if (
+        !view ||
+        !canWriteView(view, roleOf(req)) ||
+        !panel ||
+        !canWriteView(panel, roleOf(req))
+      ) {
+        return res.sendStatus(403);
+      }
       if (typeof panel.parseImportFile !== "function") {
         return res
           .status(500)
           .send(
-            '"parseImportFile" doit être défini dans la configuration du panneau.'
+            '"parseImportFile" doit être défini dans la configuration du panneau.',
           );
       }
       if (!Boolean(panel.createConfig)) {
         return res
           .status(500)
           .send(
-            '"createConfig" doit être défini dans la configuration du panneau.'
+            '"createConfig" doit être défini dans la configuration du panneau.',
           );
       }
 
       const records = await panel.parseImportFile(
         files.data[0],
-        fields.recordId[0]
+        fields.recordId[0],
       );
       const columns = [];
       if (records.length === 0) {
@@ -729,10 +794,10 @@ export default (db, config) => {
         }
 
         let queryString =
-          "INSERT IGNORE INTO ?? (`" +
-          panel.createConfig.recordIdKey +
-          "`, " +
-          columns.map((x) => "`" + x + "`").join(", ") +
+          "INSERT IGNORE INTO ?? (" +
+          quoteIdentifier(panel.createConfig.recordIdKey, db.dbType) +
+          ", " +
+          columns.map((x) => quoteIdentifier(x, db.dbType)).join(", ") +
           ") VALUES";
         for (let record of records) {
           queryString +=
@@ -746,7 +811,7 @@ export default (db, config) => {
         }
         queryString = queryString.slice(0, -1) + " ON DUPLICATE KEY UPDATE";
         for (let column of columns) {
-          queryString += " `" + column + "` = VALUES(`" + column + "`),";
+          queryString += ` ${quoteIdentifier(column, db.dbType)} = VALUES(${quoteIdentifier(column, db.dbType)}),`;
         }
         const { err, rows: r } = await db.query(queryString.slice(0, -1), [
           panel.tableName,
@@ -775,15 +840,15 @@ export default (db, config) => {
     const view = req.config.views[req.query.viewIndex as string];
     const { err, rows } = await db.query(
       "SELECT " +
-      (view.selectExpression || "*") +
-      " FROM ?? " +
-      (view.join || "") +
-      " WHERE ?? = ?",
+        (view.selectExpression || "*") +
+        " FROM ?? " +
+        (view.join || "") +
+        " WHERE ?? = ?",
       [
         view.tableName,
         view.tableName + "." + view.primaryId,
         req.query.recordId,
-      ]
+      ],
     );
     if (err) {
       return res.status(500).send(err);
@@ -820,10 +885,10 @@ export default (db, config) => {
       return res.sendStatus(200);
     }
     const queryExpression = Object.keys(req.body.data)
-      .map((x) => `${x} = ?`)
+      .map((x) => `${quoteIdentifier(x, db.dbType)} = ?`)
       .join(", ");
     const queryParameters = Object.keys(req.body.data).map(
-      (x) => req.body.data[x]
+      (x) => req.body.data[x],
     );
     const { err } = await db.query(
       `UPDATE ?? SET ${queryExpression} WHERE ?? = ?`,
@@ -832,7 +897,7 @@ export default (db, config) => {
         ...queryParameters,
         view.primaryId,
         req.body.primaryValue,
-      ]
+      ],
     );
     if (err) {
       return res.status(500).send(err);
@@ -844,7 +909,7 @@ export default (db, config) => {
           data: req.body.data,
           previousData: req.body.previousData,
         });
-      } catch (e) { }
+      } catch (e) {}
     }
     if (view.editCallbackFunction) {
       await view.editCallbackFunction({
@@ -862,14 +927,17 @@ export default (db, config) => {
       try {
         const { rows } = await db.query(
           "SELECT " +
-          (view.selectExpression || "*") +
-          " FROM ?? " +
-          (view.join || "") +
-          " WHERE ?? = ?",
-          [view.tableName, view.tableName + "." + view.primaryId, recordId]
+            (view.selectExpression || "*") +
+            " FROM ?? " +
+            (view.join || "") +
+            " WHERE ?? = ?",
+          [view.tableName, view.tableName + "." + view.primaryId, recordId],
         );
         const record = rows[0];
-        const actionResult = await action.action(record, req.session.user.userId);
+        const actionResult = await action.action(
+          record,
+          req.session.user.userId,
+        );
         if (actionResult) {
           return res.send({
             success: true,
@@ -894,15 +962,15 @@ export default (db, config) => {
     const view = req.config.views[req.body.viewIndex];
     const { rows, err: err2 } = await db.query(
       "SELECT " +
-      (view.selectExpression || "*") +
-      " FROM ?? " +
-      (view.join || "") +
-      " WHERE ?? = ?",
+        (view.selectExpression || "*") +
+        " FROM ?? " +
+        (view.join || "") +
+        " WHERE ?? = ?",
       [
         view.tableName,
         view.tableName + "." + view.primaryId,
         req.body.primaryValue,
-      ]
+      ],
     );
     if (err2) {
       return res.status(500).send(err2);
@@ -924,7 +992,7 @@ export default (db, config) => {
         await axios.post(view.deleteCallback, {
           id: req.body.primaryValue,
         });
-      } catch (e) { }
+      } catch (e) {}
     }
     if (view.deleteCallbackFunction) {
       await view.deleteCallbackFunction({
@@ -938,11 +1006,11 @@ export default (db, config) => {
   app.post("/deleteRecordFromPanel", async function (req, res) {
     const view = req.config.views[req.body.viewIndex];
     const panel = view.recordViewPanels.find(
-      (x) => x.__id__ === req.body.panelId
+      (x) => x.__id__ === req.body.panelId,
     );
     const { rows, err: err2 } = await db.query(
       "SELECT * FROM ?? WHERE ?? = ?",
-      [panel.tableName, panel.primaryId, req.body.primaryValue]
+      [panel.tableName, panel.primaryId, req.body.primaryValue],
     );
     if (err2) {
       return res.status(500).send(err2);
@@ -961,7 +1029,7 @@ export default (db, config) => {
         await axios.post(panel.deleteCallback, {
           id: req.body.primaryValue,
         });
-      } catch (e) { }
+      } catch (e) {}
     }
     if (panel.deleteCallbackFunction) {
       await panel.deleteCallbackFunction({
@@ -974,9 +1042,12 @@ export default (db, config) => {
 
   app.post("/deleteRecords", async function (req, res, next) {
     const view = req.config.views[req.body.viewIndex];
+    // SECURITY: bind the primary values as parameters instead of interpolating
+    // them into the IN() list (quote-bearing values could break out).
+    const placeholders = req.body.primaryValues.map(() => "?").join(", ");
     const { err } = await db.query(
-      `DELETE FROM ?? WHERE ?? IN(${req.body.primaryValues.map((x) => "'" + x + "'").join(",")})`,
-      [view.tableName, view.primaryId]
+      `DELETE FROM ?? WHERE ?? IN(${placeholders})`,
+      [view.tableName, view.primaryId, ...req.body.primaryValues],
     );
     if (err) {
       return res.status(500).send(err);
@@ -1044,7 +1115,7 @@ export default (db, config) => {
     }
     const { err: err2, rows: r } = await db.query(
       "INSERT IGNORE INTO ?? SET ?",
-      [req.body.table, data]
+      [req.body.table, data],
     );
     if (err2) {
       return res.status(500).send(err);
@@ -1074,9 +1145,11 @@ export default (db, config) => {
 
   app.post("/createRecord", async function (req, res, next) {
     const view = req.config.views[req.body.viewIndex];
-    const panel = req.body.panelIndex
-      ? view.recordViewPanels[req.body.panelIndex]
-      : null;
+    // panelIndex arrives as a string from the front-end but a numeric caller
+    // may send 0 — only null/undefined mean "no panel".
+    const hasPanel =
+      req.body.panelIndex !== undefined && req.body.panelIndex !== null;
+    const panel = hasPanel ? view.recordViewPanels[req.body.panelIndex] : null;
     try {
       for (let key in req.body.data) {
         if (
@@ -1090,7 +1163,7 @@ export default (db, config) => {
         req.body.data[panel.createConfig.recordIdKey] = req.body.recordId;
       }
       const primaryColumn = (view || panel)?.columns?.find(
-        (x) => x.name === (view || panel).primaryId
+        (x) => x.name === (view || panel).primaryId,
       );
       if (primaryColumn?.dataType == "uuid") {
         req.body.data[primaryColumn.name] = uuidv4();
@@ -1108,16 +1181,18 @@ export default (db, config) => {
       if (!areSafeColumnNames(createPayload)) {
         return res.status(400).send({ error: "Invalid column name" });
       }
-      const queryExpression = Object.keys(createPayload).join(", ");
+      const queryExpression = Object.keys(createPayload)
+        .map((x) => quoteIdentifier(x, db.dbType))
+        .join(", ");
       const queryPlaceholders = Object.keys(createPayload)
         .map((x) => "?")
         .join(", ");
       const queryParameters = Object.keys(createPayload).map(
-        (x) => createPayload[x]
+        (x) => createPayload[x],
       );
       const { err, rows: r } = await db.query(
         `INSERT INTO ?? (${queryExpression}) VALUES(${queryPlaceholders})`,
-        [panel ? panel.tableName : view.tableName, ...queryParameters]
+        [panel ? panel.tableName : view.tableName, ...queryParameters],
       );
       if (err) {
         console.error(err);
@@ -1135,15 +1210,22 @@ export default (db, config) => {
             id: r.insertId,
             data: req.body.data,
           });
-        } catch (e) { }
+        } catch (e) {}
       }
       if (panel ? panel.createCallbackFunction : view.createCallbackFunction) {
-        await (
-          panel ? panel.createCallbackFunction : view.createCallbackFunction
-        )({
-          id: r.insertId,
-          data: req.body.data,
-        });
+        // The insert is already committed: a failing callback must not turn
+        // into a 500 that invites a client retry (which would duplicate the
+        // row). Log and answer 200.
+        try {
+          await (
+            panel ? panel.createCallbackFunction : view.createCallbackFunction
+          )({
+            id: r.insertId,
+            data: req.body.data,
+          });
+        } catch (callbackErr) {
+          console.error(callbackErr);
+        }
       }
       res.send({
         id: r.insertId,
@@ -1157,27 +1239,6 @@ export default (db, config) => {
     }
   });
 
-  // Collect every SQL template declared anywhere in the (role-filtered) config:
-  // panel `query`, `autocompleteListQuery`, etc. customQuery may only run a
-  // template that already exists in the config the caller is allowed to see —
-  // so it can never be turned into an arbitrary read/write primitive.
-  function collectAllowedQueries(node, acc = new Set<string>()) {
-    if (!node || typeof node !== "object") return acc;
-    if (Array.isArray(node)) {
-      for (const item of node) collectAllowedQueries(item, acc);
-      return acc;
-    }
-    for (const key of Object.keys(node)) {
-      const value = node[key];
-      if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
-        acc.add(value.trim());
-      } else if (value && typeof value === "object") {
-        collectAllowedQueries(value, acc);
-      }
-    }
-    return acc;
-  }
-
   // Attack-surface reduction: only expose /customQuery at all when the config
   // actually declares SQL templates (panels, autocomplete lists, …). If nothing
   // uses it, the route is replaced by an explicit "disabled" stub so the raw-SQL
@@ -1188,7 +1249,8 @@ export default (db, config) => {
     app.get("/customQuery", (req, res) => res.sendStatus(404));
   } else {
     app.get("/customQuery", async function (req, res, next) {
-      const template = typeof req.query.query === "string" ? req.query.query : "";
+      const template =
+        typeof req.query.query === "string" ? req.query.query : "";
       // SECURITY: only run whitelisted, read-only templates, and bind the record id
       // as a parameter instead of substituting it into the SQL string.
       const allowed = collectAllowedQueries(req.config.views);
@@ -1196,7 +1258,9 @@ export default (db, config) => {
         return res.status(403).send({ error: "Query not allowed" });
       }
       if (!/^\s*\(?\s*(select|with)\b/i.test(template) || /;/.test(template)) {
-        return res.status(400).send({ error: "Only read-only queries are allowed" });
+        return res
+          .status(400)
+          .send({ error: "Only read-only queries are allowed" });
       }
       const placeholderCount = (template.match(/\?/g) || []).length;
       const params = new Array(placeholderCount).fill(req.query.primaryValue);
@@ -1207,7 +1271,7 @@ export default (db, config) => {
       if (req.query.viewIndex && req.query.panelIndex) {
         const panel =
           req.config.views[req.query.viewIndex as string].recordViewPanels[
-          req.query.panelIndex as string
+            req.query.panelIndex as string
           ];
         if (panel.formatValue) {
           for (const row of rows) {
@@ -1224,7 +1288,7 @@ export default (db, config) => {
   function uploadFile(column, fileParamName, req, res) {
     if (column.s3Config || column.gcpConfig) {
       const form = new multiparty.Form();
-      form.parse(req, function (err, fields, files) {
+      form.parse(req, async function (err, fields, files) {
         if (err) {
           return res.status(500).send(err);
         }
@@ -1235,12 +1299,20 @@ export default (db, config) => {
         const extension = originalFilename.match(/(?:\.([^.]+))?$/)[1];
         let aspectRatio = null;
         if (["png", "jpeg", "jpg", "gif"].includes(extension)) {
-          const dimensions = sizeOf(files[fileParamName][0].path);
-          aspectRatio = dimensions.height / dimensions.width;
+          try {
+            const dimensions = await getImageDimensions(
+              files[fileParamName][0].path,
+            );
+            if (dimensions) {
+              aspectRatio = dimensions.height / dimensions.width;
+            }
+          } catch {
+            // malformed image data: leave aspectRatio null rather than crash
+          }
         }
         const originalFilenameWithoutExtension = originalFilename.replace(
           "." + extension,
-          ""
+          "",
         );
 
         if (column.gcpConfig) {
@@ -1302,7 +1374,7 @@ export default (db, config) => {
                 Key: path,
                 ContentType: contentType,
               }),
-              { expiresIn: 150 }
+              { expiresIn: 150 },
             )
               .then((signedUrl) =>
                 axios.put(
@@ -1314,8 +1386,8 @@ export default (db, config) => {
                     headers: {
                       "Content-Type": contentType,
                     },
-                  }
-                )
+                  },
+                ),
               )
               .then(() => {
                 res.status(200).send({
@@ -1337,7 +1409,7 @@ export default (db, config) => {
                 ContentType: contentType,
                 ACL: "public-read",
                 Key: path,
-              })
+              }),
             )
               .then(() => {
                 res.send({
@@ -1377,9 +1449,9 @@ export default (db, config) => {
           await sftp.fastPut(
             files[fileParamName][0].path,
             column.publicPath +
-            (column.subdirectory ? "/" + column.subdirectory : "") +
-            "/" +
-            filename
+              (column.subdirectory ? "/" + column.subdirectory : "") +
+              "/" +
+              filename,
           );
           await sftp.end();
           res.send({
@@ -1409,11 +1481,18 @@ export default (db, config) => {
   app.post(
     "/uploadFileFromBetterRichTextInput",
     async function (req, res, next) {
+      // SECURITY: the upload target comes entirely from the client header and
+      // this route carries no viewIndex, so gate it on the caller being able
+      // to write at least one view (read-only roles are rejected outright).
+      const role = roleOf(req);
+      if (!req.config.views.some((view) => canWriteView(view, role))) {
+        return res.sendStatus(403);
+      }
       const fileUploadProperties = JSON.parse(
-        req.headers["file-upload-properties"] as string
+        req.headers["file-upload-properties"] as string,
       );
       uploadFile(fileUploadProperties, "upload", req, res);
-    }
+    },
   );
 
   app.post("/uploadFile", async function (req, res, next) {
@@ -1438,12 +1517,12 @@ export default (db, config) => {
             where: `denominationunitelegale LIKE '${processedQuery}*' OR siret LIKE '${processedQuery}*'`,
             limit: 100,
           },
-        }
+        },
       );
       const results = response.data.results
         .filter(
           (etablissement) =>
-            etablissement.etatadministratifetablissement === "Actif"
+            etablissement.etatadministratifetablissement === "Actif",
         )
         .map((etablissement) => ({
           id: Math.random().toString().slice(2),
@@ -1465,10 +1544,31 @@ export default (db, config) => {
   return app;
 };
 
-async function enrichConfig(config, db) {
+// Collect every SQL template declared anywhere in the (role-filtered) config:
+// panel `query`, `autocompleteListQuery`, etc. customQuery may only run a
+// template that already exists in the config the caller is allowed to see —
+// so it can never be turned into an arbitrary read/write primitive.
+export function collectAllowedQueries(node, acc = new Set<string>()) {
+  if (!node || typeof node !== "object") return acc;
+  if (Array.isArray(node)) {
+    for (const item of node) collectAllowedQueries(item, acc);
+    return acc;
+  }
+  for (const key of Object.keys(node)) {
+    const value = node[key];
+    if (typeof value === "string" && (key === "query" || /Query$/.test(key))) {
+      acc.add(value.trim());
+    } else if (value && typeof value === "object") {
+      collectAllowedQueries(value, acc);
+    }
+  }
+  return acc;
+}
+
+export async function enrichConfig(config, db) {
   const { rows: info, err } = await db.query(
     "SELECT * FROM information_schema.columns WHERE table_schema = ?",
-    [config.mysql?.database || config.postgresql?.database]
+    [config.mysql?.database || config.postgresql?.database],
   );
   if (err) {
     console.error(err);
@@ -1512,12 +1612,12 @@ async function enrichConfig(config, db) {
   config.enriched = true;
 }
 
-function enrichColumn(column, tableName, info) {
+export function enrichColumn(column, tableName, info) {
   if (!column.__id__) {
     column.__id__ = generateUniqueIdForObject(column);
   }
   const infoEl = info.find(
-    (x) => x.TABLE_NAME == tableName && x.COLUMN_NAME == column.name
+    (x) => x.TABLE_NAME == tableName && x.COLUMN_NAME == column.name,
   );
   if (
     infoEl?.IS_NULLABLE == "NO" &&
@@ -1534,7 +1634,7 @@ function enrichColumn(column, tableName, info) {
       column.options = JSON.parse(
         infoEl.COLUMN_TYPE.replace("enum(", "[")
           .replace(")", "]")
-          .replace(/'/g, '"')
+          .replace(/'/g, '"'),
       );
     }
   }