@saltcorn/server 0.7.4-beta.3 → 0.7.4

package/routes/utils.js

@@ -113,37 +113,62 @@ const get_tenant_from_req = (req) => {
 };
 
 /**
+ * middleware to extract the tenant domain and call runWithtenant()
  * @param {object} req
  * @param {object} res
  * @param {function} next
  */
 const setTenant = (req, res, next) => {
   if (db.is_it_multi_tenant()) {
-    const other_domain = get_other_domain_tenant(req.hostname);
-    if (other_domain) {
-      const state = getTenant(other_domain);
-      if (!state) {
-        setLanguage(req, res);
-        next();
-      } else {
-        db.runWithTenant(other_domain, () => {
-          setLanguage(req, res, state);
-          state.log(5, `${req.method} ${req.originalUrl}`);
+    // for a saltcorn mobile request use 'req.user.tenant'
+    if (req.smr) {
+      if (
+        req.user?.tenant &&
+        req.user.tenant !== db.connectObj.default_schema
+      ) {
+        const state = getTenant(req.user.tenant);
+        if (!state) {
+          setLanguage(req, res);
           next();
-        });
+        } else {
+          db.runWithTenant(req.user.tenant, () => {
+            setLanguage(req, res, state);
+            state.log(5, `${req.method} ${req.originalUrl}`);
+            next();
+          });
+        }
       }
-    } else {
-      const ten = get_tenant_from_req(req);
-      const state = getTenant(ten);
-      if (!state) {
+      else {
         setLanguage(req, res);
         next();
+      }
+    } else {
+      const other_domain = get_other_domain_tenant(req.hostname);
+      if (other_domain) {
+        const state = getTenant(other_domain);
+        if (!state) {
+          setLanguage(req, res);
+          next();
+        } else {
+          db.runWithTenant(other_domain, () => {
+            setLanguage(req, res, state);
+            state.log(5, `${req.method} ${req.originalUrl}`);
+            next();
+          });
+        }
       } else {
-        db.runWithTenant(ten, () => {
-          setLanguage(req, res, state);
-          state.log(5, `${req.method} ${req.originalUrl}`);
+        const ten = get_tenant_from_req(req);
+        const state = getTenant(ten);
+        if (!state) {
+          setLanguage(req, res);
           next();
-        });
+        } else {
+          db.runWithTenant(ten, () => {
+            setLanguage(req, res, state);
+            state.log(5, `${req.method} ${req.originalUrl}`);
+            next();
+          });
+        }
       }
     }
   } else {
@@ -232,6 +257,20 @@ const getSessionStore = () => {
   }
 };
 
+/**
+ * appends 'req.query.on_done_redirect' to 'oldPath' if it exists
+ * @param {string} oldPath path without 'on_done_redirect'
+ * @param {any} req express request
+ * @returns a new string with or without on_done_redirect=...
+ */
+const addOnDoneRedirect = (oldPath, req) => {
+  const separator = oldPath.indexOf("?") > -1 ? "&" : "?";
+  if (req.query.on_done_redirect) {
+    return `${oldPath}${separator}on_done_redirect=${req.query.on_done_redirect}`;
+  }
+  return oldPath;
+};
+
 module.exports = {
   sqlsanitize,
   csrfField,
@@ -243,5 +282,6 @@ module.exports = {
   getGitRevision,
   getSessionStore,
   setTenant,
-  get_tenant_from_req
+  get_tenant_from_req,
+  addOnDoneRedirect,
 };

package/routes/viewedit.js

@@ -16,6 +16,7 @@ const {
   post_dropdown_item,
   renderBuilder,
   settingsDropdown,
+  alert
 } = require("@saltcorn/markup");
 const {
   //span,
@@ -30,7 +31,7 @@ const {
 } = require("@saltcorn/markup/tags");
 
 const { getState } = require("@saltcorn/data/db/state");
-const { isAdmin, error_catcher } = require("./utils.js");
+const { isAdmin, error_catcher, addOnDoneRedirect } = require("./utils.js");
 const { setTableRefs, viewsList } = require("./common_lists");
 const Form = require("@saltcorn/data/models/form");
 const Field = require("@saltcorn/data/models/field");
@@ -76,6 +77,20 @@ router.get(
 
     const viewMarkup = await viewsList(views, req);
     const tables = await Table.find();
+    const viewAccessWarning = view => {
+      const table = tables.find(t => t.name === view.table)
+      if (!table) return false
+      if (table.ownership_field_id || table.ownership_formula) return false
+
+      return table.min_role_read < view.min_role
+    }
+    const hasAccessWarning = views.filter(viewAccessWarning)
+    const accessWarning = hasAccessWarning.length > 0
+      ? alert("danger", `<p>You have views with a role to access lower than the table role to read, 
+      with no table ownership. In the next version of Saltcorn, this may cause a
+      denial of access. Users will need to have table read access to any data displayed.</p> 
+      Views potentially affected: ${hasAccessWarning.map(v => v.name).join(", ")}`)
+      : ''
     res.sendWrap(req.__(`Views`), {
       above: [
         {
@@ -87,17 +102,18 @@ router.get(
           class: "mt-0",
           title: req.__("Your views"),
           contents: [
+            accessWarning,
             viewMarkup,
             tables.length > 0
               ? a(
-                  { href: `/viewedit/new`, class: "btn btn-primary" },
-                  req.__("Create view")
-                )
+                { href: `/viewedit/new`, class: "btn btn-primary" },
+                req.__("Create view")
+              )
               : p(
-                  req.__(
-                    "You must create at least one table before you can create views."
-                  )
-                ),
+                req.__(
+                  "You must create at least one table before you can create views."
+                )
+              ),
           ],
         },
       ],
@@ -129,7 +145,7 @@ const viewForm = async (req, tableOptions, roles, pages, values) => {
     .map(([k, v]) => k);
   const slugOptions = await Table.allSlugOptions();
   return new Form({
-    action: "/viewedit/save",
+    action: addOnDoneRedirect("/viewedit/save", req),
     submitLabel: req.__("Configure") + " &raquo;",
     blurb: req.__("First, please give some basic information about the view."),
     fields: [
@@ -209,15 +225,15 @@ const viewForm = async (req, tableOptions, roles, pages, values) => {
       }),
       ...(isEdit
         ? [
-          new Field({
-            name: "viewtemplate",
-            input_type: "hidden",
-          }),
-          new Field({
-            name: "table_name",
-            input_type: "hidden",
-          }),
-        ]
+            new Field({
+              name: "viewtemplate",
+              input_type: "hidden",
+            }),
+            new Field({
+              name: "table_name",
+              input_type: "hidden",
+            }),
+          ]
         : []),
     ],
     values,
@@ -337,7 +353,6 @@ router.post(
     const pages = await Page.find();
     const form = await viewForm(req, tableOptions, roles, pages);
     const result = form.validate(req.body);
-
     const sendForm = (form) => {
       res.sendWrap(req.__(`Edit view`), {
         above: [
@@ -397,7 +412,12 @@ router.post(
           else v.configuration = {};
           await View.create(v);
         }
-        res.redirect(`/viewedit/config/${encodeURIComponent(v.name)}`);
+        res.redirect(
+          addOnDoneRedirect(
+            `/viewedit/config/${encodeURIComponent(v.name)}`,
+            req
+          )
+        );
       }
     } else {
       sendForm(form);