@saltcorn/server 1.6.0-beta.11 → 1.6.0-beta.13

package/routes/page.js

@@ -15,6 +15,7 @@ const {
   scan_for_page_title,
   isAdmin,
   sendHtmlFile,
+  sendHtmlStringWithGlobals,
   getEligiblePage,
   getRandomPage,
 } = require("../routes/utils.js");
@@ -74,25 +75,7 @@ const runPage = async (page, req, res, tic) => {
     }
     if (contents.html_file) await sendHtmlFile(req, res, contents.html_file);
     else if (contents.html_string) {
-      res.set("Content-Type", "text/html");
-      const state = getState();
-      const version_tag = db.connectObj.version_tag;
-      const locale = req.getLocale?.();
-      const scGlobals =
-        `<script>var _sc_globalCsrf = ${JSON.stringify(req.csrfToken())}` +
-        `, _sc_version_tag = ${JSON.stringify(version_tag)}` +
-        (locale ? `, _sc_locale = ${JSON.stringify(locale)}` : "") +
-        `, _sc_pageloadtag = Math.floor(Math.random() * 16777215).toString(16)` +
-        (req?.user?.role_id === 1 ? `, _sc_is_admin = true` : "") +
-        `;</script>`;
-      const normalized = contents.html_string.replace(
-        /\/static_assets\/[a-f0-9]+\//g,
-        `/static_assets/${version_tag}/`
-      );
-      const html = normalized.includes("</head>")
-        ? normalized.replace("</head>", `${scGlobals}</head>`)
-        : scGlobals + normalized;
-      await res.send(html);
+      await sendHtmlStringWithGlobals(req, res, contents.html_string);
     } else
       res.sendWrap(
         {
@@ -109,7 +92,11 @@ const runPage = async (page, req, res, tic) => {
                 role,
                 title: page.name,
                 what: req.__("Page"),
-                url: `/pageedit/edit/${encodeURIComponent(page.name)}?on_done_redirect=${encodeURIComponent(req.originalUrl.replace("/", ""))}&${objectToQueryString(req.query)}`,
+                url: `/pageedit/edit/${encodeURIComponent(
+                  page.name
+                )}?on_done_redirect=${encodeURIComponent(
+                  req.originalUrl.replace("/", "")
+                )}&${objectToQueryString(req.query)}`,
                 contents,
               }),
           resultCollector

package/routes/pageedit.js

@@ -71,6 +71,7 @@ const pagePropertiesForm = async (req, isNew) => {
     {
       mime_super: "text",
       mime_sub: "html",
+      ext: "html",
     },
     { recursive: true }
   );
@@ -230,6 +231,7 @@ const pageBuilderData = async (req, context) => {
     const table = Table.findOne(view.table_id || view.exttable_name);
     if (table) view.table_name = table.name;
     const fs = await view.get_state_fields();
+    let added_fields = new Set();
     for (const frec of fs) {
       const f = new Field(frec);
       if (f.input_type === "hidden") continue;
@@ -239,7 +241,9 @@ const pageBuilderData = async (req, context) => {
       if (f.type && f.type.name === "Bool") f.fieldview = "tristate";
 
       //await f.fill_fkey_options(true);
-      fixed_state_fields[view.name].push(f);
+      if (added_fields.has(f.name)) continue;
+      added_fields.add(f.name);
+      fixed_state_fields[view.name].push(f.toBuilder);
       if (table.name === "users" && f.primary_key)
         fixed_state_fields[view.name].push(
           new Field({
@@ -247,7 +251,7 @@ const pageBuilderData = async (req, context) => {
             label: req.__("Preset %s", f.label),
             type: "String",
             attributes: { options: ["LoggedIn"] },
-          })
+          }).toBuilder
         );
       if (f.presets) {
         fixed_state_fields[view.name].push(
@@ -256,7 +260,7 @@ const pageBuilderData = async (req, context) => {
             label: req.__("Preset %s", f.label),
             type: "String",
             attributes: { options: Object.keys(f.presets) },
-          })
+          }).toBuilder
         );
       }
     }

package/routes/tables.js

@@ -824,10 +824,14 @@ router.get(
 
     const statusBadge = (status) => {
       switch (status) {
-        case "match": return badge("success", req.__("Match"));
-        case "ghost": return badge("danger", req.__("Ghost"));
-        case "orphan": return badge("primary", req.__("Orphan"));
-        default: return "";
+        case "match":
+          return badge("success", req.__("Match"));
+        case "ghost":
+          return badge("danger", req.__("Ghost"));
+        case "orphan":
+          return badge("primary", req.__("Orphan"));
+        default:
+          return "";
       }
     };
 
@@ -839,7 +843,10 @@ router.get(
           action: `/table/rescan-delete/${table.id}`,
         },
         input({ type: "hidden", name: "_csrf", value: req.csrfToken() }),
-        h4({ class: "text-danger" }, req.__("Ghost fields (in Saltcorn, not in DB)")),
+        h4(
+          { class: "text-danger" },
+          req.__("Ghost fields (in Saltcorn, not in DB)")
+        ),
         mkTable(
           [
             {
@@ -877,7 +884,10 @@ router.get(
           action: `/table/rescan-import/${table.id}`,
         },
         input({ type: "hidden", name: "_csrf", value: req.csrfToken() }),
-        h4({ class: "text-primary" }, req.__("Orphan columns (in DB, not in Saltcorn)")),
+        h4(
+          { class: "text-primary" },
+          req.__("Orphan columns (in DB, not in Saltcorn)")
+        ),
         mkTable(
           [
             {
@@ -938,10 +948,31 @@ router.get(
             { text: req.__("Rescan fields") },
           ],
         },
-        allMatch && { type: "card", title: req.__("All fields match"), contents: p(req.__("All Saltcorn fields match the database columns.")) + a({ href: `/table/${table.id}`, class: "btn btn-primary" }, req.__("Back to table")) },
-        ghosts.length > 0 && { type: "card", title: req.__("Ghosts (%d)", ghosts.length), contents: ghostForm },
-        orphans.length > 0 && { type: "card", title: req.__("Orphans (%d)", orphans.length), contents: orphanForm },
-        matches.length > 0 && { type: "card", title: req.__("Matches"), contents: matchCard },
+        allMatch && {
+          type: "card",
+          title: req.__("All fields match"),
+          contents:
+            p(req.__("All Saltcorn fields match the database columns.")) +
+            a(
+              { href: `/table/${table.id}`, class: "btn btn-primary" },
+              req.__("Back to table")
+            ),
+        },
+        ghosts.length > 0 && {
+          type: "card",
+          title: req.__("Ghosts (%d)", ghosts.length),
+          contents: ghostForm,
+        },
+        orphans.length > 0 && {
+          type: "card",
+          title: req.__("Orphans (%d)", orphans.length),
+          contents: orphanForm,
+        },
+        matches.length > 0 && {
+          type: "card",
+          title: req.__("Matches"),
+          contents: matchCard,
+        },
       ].filter(Boolean),
     });
   })
@@ -977,9 +1008,7 @@ router.post(
     let removed = 0;
 
     for (const fname of fieldNames) {
-      const field = fields.find(
-        (f) => f.name === fname
-      );
+      const field = fields.find((f) => f.name === fname);
       if (field) {
         await db.deleteWhere("_sc_fields", { id: field.id });
         removed++;
@@ -1051,9 +1080,7 @@ router.post(
           }
         }
       } else {
-        const { rows } = await db.query(
-          `PRAGMA table_info("${table.name}")`
-        );
+        const { rows } = await db.query(`PRAGMA table_info("${table.name}")`);
         const col = rows.find((r) => r.name === colName);
         if (col) {
           const type = findType(col.type) || "String";
@@ -1070,7 +1097,9 @@ router.post(
         // Insert directly into _sc_fields — the physical column already exists,
         // so we must NOT use Field.create (which does ALTER TABLE ADD COLUMN).
         const typeName =
-          typeof fieldCfg.type === "string" ? fieldCfg.type : fieldCfg.type?.name;
+          typeof fieldCfg.type === "string"
+            ? fieldCfg.type
+            : fieldCfg.type?.name;
         await db.insert("_sc_fields", {
           table_id: table.id,
           name: fieldCfg.name,
@@ -1087,7 +1116,9 @@ router.post(
     }
 
     await getState().refresh_tables(true);
-    const msgs = [req.__("Imported %d orphan column(s) into Saltcorn", imported)];
+    const msgs = [
+      req.__("Imported %d orphan column(s) into Saltcorn", imported),
+    ];
     if (skipped.length)
       msgs.push(
         req.__(
@@ -3093,16 +3124,38 @@ const standardFieldForm = (table, req, existingNames = new Set()) => {
   const defs = standardFieldDefs(req).filter(
     (def) => !existingNames.has(def.name)
   );
+  const default_labels = getState().getConfig(
+    "default_standard_field_labels",
+    {}
+  );
   return new Form({
     submitLabel: req.__("Create fields"),
     action: `/table/create-standard-fields/${table.id}`,
     formStyle: "vert",
-    fields: defs.map((def) => ({
-      type: "Bool",
-      label: `${def.label} (${def.type})`,
-      name: def.name,
-      default: true,
-    })),
+    fields: [
+      ...defs
+        .map((def) => [
+          {
+            type: "Bool",
+            label: `${def.label} (${def.type})`,
+            name: def.name,
+            default: true,
+          },
+          {
+            type: "String",
+            label: `${def.label} field label`,
+            name: `${def.name}_label`,
+            default: default_labels[def.name] || def.label,
+            showIf: { set_custom_labels: true, [def.name]: true },
+          },
+        ])
+        .flat(1),
+      {
+        name: "set_custom_labels",
+        label: req.__("Set custom labels"),
+        type: "Bool",
+      },
+    ],
   });
 };
 
@@ -3146,10 +3199,21 @@ router.post(
       return;
     }
     const defs = standardFieldDefs(req);
+    const default_labels = getState().getConfig(
+      "default_standard_field_labels",
+      {}
+    );
+    const new_defaults = {};
     await db.withTransaction(async () => {
       for (const def of defs) {
         if (!form.values[def.name]) continue;
         if (existingNames.has(def.name)) continue;
+        const custom_label_value = form.values[`${def.name}_label`];
+        if (form.values.set_custom_labels && custom_label_value) {
+          def.label = custom_label_value;
+          if (custom_label_value !== default_labels[def.name])
+            new_defaults[def.name] = custom_label_value;
+        }
         await Field.create({
           table_id: table.id,
           name: def.name,
@@ -3164,6 +3228,12 @@ router.post(
         });
       }
     });
+    if (Object.keys(new_defaults).length)
+      await getState().setConfig("default_standard_field_labels", {
+        ...default_labels,
+        ...new_defaults,
+      });
+
     await getState().refresh_tables();
     res.redirect(`/table/${table.id}`);
   })

package/routes/utils.js

@@ -66,7 +66,15 @@ const get_sys_info = async () => {
  * @returns {void}
  */
 function loggedIn(req, res, next) {
-  if (req.user && req.user.id && req.user.tenant === db.getTenantSchema()) {
+  if (req.user && req.user.id) {
+    // Reject tenant drift so a session authenticated elsewhere cannot be reused here.
+    if (
+      req.user.tenant !== undefined &&
+      req.user.tenant !== db.getTenantSchema()
+    ) {
+      req.logout?.(() => {});
+      return res.status(403).json({ error: "Session tenant mismatch" });
+    }
     next();
   } else {
     req.flash("danger", req.__("Must be logged in first"));
@@ -85,7 +93,12 @@ function loggedIn(req, res, next) {
 function isAdmin(req, res, next) {
   const cur_tenant = db.getTenantSchema();
   //console.log({ cur_tenant, user: req.user });
-  if (req.user && req.user.role_id === 1 && req.user.tenant === cur_tenant) {
+  if (req.user && req.user.role_id === 1) {
+    // Reject tenant drift before honoring elevated privileges in this schema.
+    if (req.user.tenant !== undefined && req.user.tenant !== cur_tenant) {
+      req.logout?.(() => {});
+      return res.status(403).json({ error: "Session tenant mismatch" });
+    }
     next();
   } else {
     req.flash("danger", req.__("Must be admin"));
@@ -145,6 +158,20 @@ const setLanguage = (req, res, state) => {
   set_custom_http_headers(res, req, state);
 };
 
+const applyUserLocale = (req, res, next) => {
+  if (req.user) {
+    if (req.user.language) {
+      req.setLocale(req.user.language);
+      const rtlLanguages = ["ar", "he", "fa", "ur", "yi"];
+      req.isRTL = rtlLanguages.some((lang) =>
+        req.user.language.startsWith(lang)
+      );
+    }
+    Object.freeze(req.user);
+  }
+  next();
+};
+
 /**
  * Sets Custom HTTP headers using data from "custom_http_headers" config variable
  * @param {object} res
@@ -178,6 +205,19 @@ const set_custom_http_headers = (res, req, state) => {
   }
 };
 
+/**
+ * Validates the raw Host header before any tenant parsing happens.
+ * @param {object} req
+ * @returns {boolean}
+ */
+const validateHostAuthority = (req) => {
+  const host = req.headers?.["host"];
+  if (typeof host !== "string") return false;
+  if (host.includes(",") || /\s|\x00/.test(host)) return false;
+  const hostname = host.split(":")[0];
+  return /^[a-zA-Z0-9._\-[\]]+$/.test(hostname);
+};
+
 /**
  * Tries to recognize tenant from HTTP Request
  * @param {object} req
@@ -207,6 +247,11 @@ const get_tenant_from_req = (req, hostPartsOffset) => {
  * @param {function} next
  */
 const setTenant = (req, res, next) => {
+  // Reject malformed authority values before subdomain parsing can switch tenant context.
+  if (!validateHostAuthority(req)) {
+    res.status(400).json({ error: "Invalid Host header" });
+    return;
+  }
   // for a saltcorn mobile request use 'req.user.tenant'
   if (req.smr) {
     if (req.user?.tenant && req.user.tenant !== db.connectObj.default_schema) {
@@ -491,6 +536,72 @@ const admin_config_route = ({
   );
 };
 
+/**
+ * Send an HTML string response with injected Saltcorn globals (CSRF token,
+ * version tag, locale, page-load tag, admin flag) and normalised static-asset paths.
+ * @param {any} req
+ * @param {any} res
+ * @param {string} html_string
+ * @returns
+ */
+const sendHtmlStringWithGlobals = (req, res, html_string) => {
+  res.set("Content-Type", "text/html");
+  const state = getState();
+  const version_tag = db.connectObj.version_tag;
+  const locale = req.getLocale?.();
+  const scGlobals =
+    `<script>var _sc_globalCsrf = ${JSON.stringify(req.csrfToken())}` +
+    `, _sc_version_tag = ${JSON.stringify(version_tag)}` +
+    (locale ? `, _sc_locale = ${JSON.stringify(locale)}` : "") +
+    `, _sc_pageloadtag = Math.floor(Math.random() * 16777215).toString(16)` +
+    (req?.user?.role_id === 1 ? `, _sc_is_admin = true` : "") +
+    `;</script>`;
+  const normalized = html_string.replace(
+    /\/static_assets\/[a-f0-9]+\//g,
+    `/static_assets/${version_tag}/`
+  );
+  const assetBase = `/static_assets/${version_tag}`;
+
+  // CSS and scGlobals go into <head>; scripts go before </body> (after jQuery).
+  // Core scripts (dayjs, socket.io) come before plugin scripts from state.headers.
+  let headInject = scGlobals;
+  if (!normalized.includes("saltcorn.css"))
+    headInject += `<link rel="stylesheet" href="${assetBase}/saltcorn.css">`;
+  if (!normalized.includes("saltcorn.js"))
+    headInject += `<script src="${assetBase}/saltcorn.js"></script>`;
+
+  let bodyInject = "";
+  for (const fname of ["dayjs.min.js", "socket.io.min.js"]) {
+    if (!normalized.includes(fname))
+      bodyInject += `<script src="${assetBase}/${fname}"></script>`;
+  }
+  if (locale && !normalized.includes(`dayjslocales/${locale}.js`))
+    bodyInject += `<script src="${assetBase}/dayjslocales/${locale}.js"></script>`;
+  if (!normalized.includes("dynamic_updates_cfg")) {
+    const dynamic_updates_enabled = state.getConfig("enable_dynamic_updates", false);
+    bodyInject += `<script>var dynamic_updates_cfg = ${JSON.stringify({ enabled: dynamic_updates_enabled })};</script>`;
+  }
+
+  const stateHeaders = Array.isArray(state.headers)
+    ? state.headers
+    : Object.values(state.headers || {}).flat();
+  for (const h of stateHeaders) {
+    if (h.css && !normalized.includes(h.css))
+      headInject += `<link rel="stylesheet" href="${h.css}">`;
+    else if (h.script && !normalized.includes(h.script))
+      bodyInject += `<script src="${h.script}"></script>`;
+  }
+
+  let html = normalized.includes("</head>")
+    ? normalized.replace("</head>", `${headInject}</head>`)
+    : headInject + normalized;
+  if (bodyInject)
+    html = html.includes("</body>")
+      ? html.replace("</body>", `${bodyInject}</body>`)
+      : html + bodyInject;
+  return res.send(html);
+};
+
 /**
  * Send HTML file to client without any menu
  * @param {any} req
@@ -652,6 +763,8 @@ module.exports = {
   scan_for_page_title,
   getGitRevision,
   getSessionStore,
+  validateHostAuthority,
+  applyUserLocale,
   setTenant,
   get_tenant_from_req,
   addOnDoneRedirect,
@@ -662,6 +775,7 @@ module.exports = {
   get_sys_info,
   admin_config_route,
   sendHtmlFile,
+  sendHtmlStringWithGlobals,
   setRole,
   getEligiblePage,
   getRandomPage,

package/tests/tenant.test.js

@@ -99,3 +99,39 @@ describe("tenant routes", () => {
     });
   }
 });
+
+describe("session-tenant isolation", () => {
+  if (!db.isSQLite) {
+    const TENANT = "secauth";
+
+    beforeAll(async () => {
+      db.enable_multi_tenant();
+      await getState().setConfig("role_to_create_tenant", "100");
+      await db.query(`drop schema if exists ${TENANT} cascade`);
+      const app = await getApp({ disableCsrf: true });
+      await request(app)
+        .post("/tenant/create")
+        .send(`subdomain=${TENANT}`)
+        .expect(toInclude("Success"));
+    });
+
+    afterAll(async () => {
+      await db.query(`drop schema if exists ${TENANT} cascade`);
+    });
+
+    it("rejects cross-tenant session reuse", async () => {
+      const loginCookie = await getAdminLoginCookie();
+      const app = await getApp({ disableCsrf: true });
+      const res = await request(app)
+        .get("/auth/settings")
+        .set("Cookie", loginCookie)
+        .set("Host", `${TENANT}.example.com`);
+      expect(res.status).toBe(403);
+      expect(res.body.error).toBe("Session tenant mismatch");
+    });
+  } else {
+    it("does not support tenants on SQLite", () => {
+      expect(db.isSQLite).toBe(true);
+    });
+  }
+});