@saltcorn/server 1.6.0-beta.12 → 1.6.0-beta.14

package/routes/utils.js

@@ -66,7 +66,15 @@ const get_sys_info = async () => {
  * @returns {void}
  */
 function loggedIn(req, res, next) {
-  if (req.user && req.user.id && req.user.tenant === db.getTenantSchema()) {
+  if (req.user && req.user.id) {
+    // Reject tenant drift so a session authenticated elsewhere cannot be reused here.
+    if (
+      req.user.tenant !== undefined &&
+      req.user.tenant !== db.getTenantSchema()
+    ) {
+      req.logout?.(() => {});
+      return res.status(403).json({ error: "Session tenant mismatch" });
+    }
     next();
   } else {
     req.flash("danger", req.__("Must be logged in first"));
@@ -85,7 +93,12 @@ function loggedIn(req, res, next) {
 function isAdmin(req, res, next) {
   const cur_tenant = db.getTenantSchema();
   //console.log({ cur_tenant, user: req.user });
-  if (req.user && req.user.role_id === 1 && req.user.tenant === cur_tenant) {
+  if (req.user && req.user.role_id === 1) {
+    // Reject tenant drift before honoring elevated privileges in this schema.
+    if (req.user.tenant !== undefined && req.user.tenant !== cur_tenant) {
+      req.logout?.(() => {});
+      return res.status(403).json({ error: "Session tenant mismatch" });
+    }
     next();
   } else {
     req.flash("danger", req.__("Must be admin"));
@@ -145,6 +158,20 @@ const setLanguage = (req, res, state) => {
   set_custom_http_headers(res, req, state);
 };
 
+const applyUserLocale = (req, res, next) => {
+  if (req.user) {
+    if (req.user.language) {
+      req.setLocale(req.user.language);
+      const rtlLanguages = ["ar", "he", "fa", "ur", "yi"];
+      req.isRTL = rtlLanguages.some((lang) =>
+        req.user.language.startsWith(lang)
+      );
+    }
+    Object.freeze(req.user);
+  }
+  next();
+};
+
 /**
  * Sets Custom HTTP headers using data from "custom_http_headers" config variable
  * @param {object} res
@@ -178,6 +205,19 @@ const set_custom_http_headers = (res, req, state) => {
   }
 };
 
+/**
+ * Validates the raw Host header before any tenant parsing happens.
+ * @param {object} req
+ * @returns {boolean}
+ */
+const validateHostAuthority = (req) => {
+  const host = req.headers?.["host"];
+  if (typeof host !== "string") return false;
+  if (host.includes(",") || /\s|\x00/.test(host)) return false;
+  const hostname = host.split(":")[0];
+  return /^[a-zA-Z0-9._\-[\]]+$/.test(hostname);
+};
+
 /**
  * Tries to recognize tenant from HTTP Request
  * @param {object} req
@@ -207,6 +247,11 @@ const get_tenant_from_req = (req, hostPartsOffset) => {
  * @param {function} next
  */
 const setTenant = (req, res, next) => {
+  // Reject malformed authority values before subdomain parsing can switch tenant context.
+  if (!validateHostAuthority(req)) {
+    res.status(400).json({ error: "Invalid Host header" });
+    return;
+  }
   // for a saltcorn mobile request use 'req.user.tenant'
   if (req.smr) {
     if (req.user?.tenant && req.user.tenant !== db.connectObj.default_schema) {
@@ -718,6 +763,8 @@ module.exports = {
   scan_for_page_title,
   getGitRevision,
   getSessionStore,
+  validateHostAuthority,
+  applyUserLocale,
   setTenant,
   get_tenant_from_req,
   addOnDoneRedirect,

package/routes/viewedit.js

@@ -922,6 +922,25 @@ router.post(
   })
 );
 
+router.get(
+  "/getlayout/:id",
+  isAdminOrHasConfigMinRole("min_role_edit_views"),
+  error_catcher(async (req, res) => {
+    const { id } = req.params;
+
+    if (id) {
+      const view = await View.findOne({ id });
+      if (!view) {
+        res.json({ error: req.__("No view") });
+        return;
+      }
+      res.json({ success: "ok", layout: view.configuration.layout });
+    } else {
+      res.json({ error: req.__("No view") });
+    }
+  })
+);
+
 /**
  * @name post/saveconfig/:id
  * @function

package/tests/tenant.test.js

@@ -99,3 +99,39 @@ describe("tenant routes", () => {
     });
   }
 });
+
+describe("session-tenant isolation", () => {
+  if (!db.isSQLite) {
+    const TENANT = "secauth";
+
+    beforeAll(async () => {
+      db.enable_multi_tenant();
+      await getState().setConfig("role_to_create_tenant", "100");
+      await db.query(`drop schema if exists ${TENANT} cascade`);
+      const app = await getApp({ disableCsrf: true });
+      await request(app)
+        .post("/tenant/create")
+        .send(`subdomain=${TENANT}`)
+        .expect(toInclude("Success"));
+    });
+
+    afterAll(async () => {
+      await db.query(`drop schema if exists ${TENANT} cascade`);
+    });
+
+    it("rejects cross-tenant session reuse", async () => {
+      const loginCookie = await getAdminLoginCookie();
+      const app = await getApp({ disableCsrf: true });
+      const res = await request(app)
+        .get("/auth/settings")
+        .set("Cookie", loginCookie)
+        .set("Host", `${TENANT}.example.com`);
+      expect(res.status).toBe(403);
+      expect(res.body.error).toBe("Session tenant mismatch");
+    });
+  } else {
+    it("does not support tenants on SQLite", () => {
+      expect(db.isSQLite).toBe(true);
+    });
+  }
+});

package/wrapper.js

@@ -342,7 +342,11 @@ module.exports = (version_tag) =>
               },
             ]
           : [];
-
+      if (req.user)
+        res.header(
+          "Cache-Control",
+          "private, no-cache, no-store, must-revalidate"
+        );
       res.send(
         layout.wrap({
           title,