@websy/websy-designs 1.12.0 → 1.12.2

package/dist/server/helpers/v1/pgHelper.js

@@ -79,7 +79,7 @@ class PGHelper {
     this.pool = pool
     this.onReadyAuthCallbackFn = null
     this.onReadyShopCallbackFn = null
-    this.options = { entityConfig: {}, fieldValueSeparator: ':' }    
+    this.options = { entityConfig: {}, fieldValueSeparator: ':', whereValueSeparator: ';' }    
     this.updateIgnores = [
       'id',
       'create_date'
@@ -294,6 +294,8 @@ class PGHelper {
     return sql
   }
   buildWhere (input, entity) {   
+    // console.log('building where', input)
+    
     if (typeof input === 'undefined' || input.trim() === '') {
       return '1=1'
     }
@@ -306,17 +308,19 @@ class PGHelper {
       }
       // console.log('where input', input)
       // console.log('splitter is', this.options.fieldValueSeparator)
-      let list = input.split(';').map(d => {
-        let parts = d.split(this.options.fieldValueSeparator)             
+      // console.log('splitter is', this.options.whereValueSeparator)
+      let list = input.split(this.options.whereValueSeparator).map(d => {
+        let parts = d.split(this.options.fieldValueSeparator)    
+        // console.log(parts)
         if (parts.length === 2) {
           let partValues = parts[1]
           partValues = partValues.split('|')
-          if (partValues.length === 1) {
-            if (parts[1].indexOf('>') !== -1) {
-              return `${entity ? entity + '.' : ''}${parts[0]} > '${parts[1].replace('>', '')}'`
+          if (partValues.length === 1) {            
+            if (parts[1].indexOf('_gt') !== -1) {
+              return `${entity ? entity + '.' : ''}${parts[0]} > '${parts[1].replace('_gt', '')}'`
             }
-            else if (parts[1].indexOf('<') !== -1) {
-              return `${entity ? entity + '.' : ''}${parts[0]} < '${parts[1].replace('<', '')}'`
+            else if (parts[1].indexOf('_lt') !== -1) {
+              return `${entity ? entity + '.' : ''}${parts[0]} < '${parts[1].replace('_lt', '')}'`
             }
             else if (parts[1].indexOf('%') !== -1) {
               return `LOWER(${entity ? entity + '.' : ''}${parts[0]}) LIKE '${parts[1]}'`
@@ -335,7 +339,9 @@ class PGHelper {
             return `${entity ? entity + '.' : ''}${parts[0]} <> '${parts[1]}'`
           }
         }              
-      })      
+      })   
+      // console.log(list)
+         
       return `
         ${list.length > 0 ? list.join(' AND ') : ''}
       `
@@ -432,6 +438,7 @@ class PGHelper {
     })
   }
   execute (query) {
+    console.log(query)    
     return new Promise((resolve, reject) => {
       // console.log(query)
       if (query !== null) {

package/dist/server/websy-designs-server.js

@@ -3,7 +3,6 @@ const bodyParser = require('body-parser')
 const cookieParser = require('cookie-parser')
 const expressSession = require('express-session')
 const sanitizer = require('perfect-express-sanitizer')
-
 module.exports = function (options) {
   return new Promise((resolve, reject) => {
     const unless = function (middleware) {
@@ -47,16 +46,24 @@ module.exports = function (options) {
       res.header('Access-Control-Allow-Credentials', true)
       res.header('Access-Control-Allow-Headers', 'Access-Control-Allow-Origin, Access-Control-Allow-Credentials, Content-Type, Authorization, X-Requested-With, Set-Cookie')
       next()
-    }    
+    }  
+    const checkReferrer = (req, res, next) => {
+      if (typeof req.headers.referer === 'undefined') {
+        res.status(403)   
+        res.send('Forbidden')     
+        return
+      }
+      next()
+    }  
     // IMPLEMENT SESSION LOGIC HERE
     app.use(allowCrossDomain)
-    app.use(
-      sanitizer.clean({
-        xss: true,
-        noSql: true,
-        sql: true
-      })
-    )
+    // app.use(
+    //   sanitizer.clean({
+    //     xss: true,
+    //     noSql: true,
+    //     sql: true
+    //   })
+    // )
     app.get('/health', (req, res) => {
       res.json('OK')
     })
@@ -158,24 +165,17 @@ module.exports = function (options) {
               }              
             } 
             else {
-              let excludedRoutes = process.env.EXCLUDED_ROUTES.split(',')
-              console.log('secure routes', secureRoutes)
-              console.log('excluded routes', excludedRoutes)
-              console.log('path', req.path)
-              console.log('index of', excludedRoutes.indexOf(req.path))  
+              let excludedRoutes = process.env.EXCLUDED_ROUTES.split(',')              
               if (secureRoutes === true) {
                 excludedRoutes.push('/resources', '/scripts', '/styles', '/external', '/templates', '/fonts')
               } 
-              if (secureRoutes === false && excludedRoutes.indexOf('/' + req.path.split('/')[1]) !== -1) {         
-                console.log('in condition A')       
+              if (secureRoutes === false && excludedRoutes.indexOf('/' + req.path.split('/')[1]) !== -1) {                         
                 app.authHelper.isLoggedIn(req, res, next)
               }
-              else if (secureRoutes === true && excludedRoutes.indexOf('/' + req.path.split('/')[1]) === -1) {
-                console.log('in condition B')
+              else if (secureRoutes === true && excludedRoutes.indexOf('/' + req.path.split('/')[1]) === -1) {                
                 app.authHelper.isLoggedIn(req, res, next)
               }
-              else {
-                console.log('in condition C')
+              else {                
                 next()
               }
               // secureRoutes === false && excludedRoutes.indexOf(req.path) !== -1 && app.authHelper.isLoggedIn(req, res, next)
@@ -188,7 +188,14 @@ module.exports = function (options) {
         }
         app.use(protectedRoutes)
         if (options.useAPI === true) {
-          app.use('/api', protectedRoutes, require(`./routes/${version}/api`)(dbHelper, app.authHelper)) 
+          console.log('allowed keys', options.allowedKeys)
+          
+          app.use('/api', sanitizer.clean({
+            xss: true,
+            noSql: true,
+            sql: true,
+            allowedKeys: options.allowedKeys || []
+          }), checkReferrer, protectedRoutes, require(`./routes/${version}/api`)(dbHelper, app.authHelper)) 
         }
         if (options.useShop === true) {
           app.use('/shop', protectedRoutes, require(`./routes/${version}/shop`)(dbHelper, options.dbEngine, app))

package/dist/websy-designs-es6.debug.js

@@ -35,7 +35,8 @@ class APIService {
   constructor (baseUrl = '', options = {}) {
     this.baseUrl = baseUrl    
     this.options = Object.assign({}, {
-      fieldValueSeparator: ':'
+      fieldValueSeparator: ':',
+      whereValueSeparator: ';'
     }, options)
   }
   add (entity, data, options = {}) {
@@ -49,7 +50,7 @@ class APIService {
     if (id) {
       query.push(`id${this.options.fieldValueSeparator}${id}`)
     }    
-    return `${this.baseUrl}/${entity}${query.length > 0 ? `${entity.indexOf('?') === -1 ? '?' : '&'}where=${query.join(';')}` : ''}`
+    return `${this.baseUrl}/${entity}${query.length > 0 ? `${entity.indexOf('?') === -1 ? '?' : '&'}where=${query.join(this.options.whereValueSeparator)}` : ''}`
   }
   delete (entity, id) {
     const url = this.buildUrl(entity, id)

package/dist/websy-designs-es6.js

@@ -57,7 +57,8 @@ var APIService = /*#__PURE__*/function () {
     _classCallCheck(this, APIService);
     this.baseUrl = baseUrl;
     this.options = _extends({}, {
-      fieldValueSeparator: ':'
+      fieldValueSeparator: ':',
+      whereValueSeparator: ';'
     }, options);
   }
   _createClass(APIService, [{
@@ -76,7 +77,7 @@ var APIService = /*#__PURE__*/function () {
       if (id) {
         query.push("id".concat(this.options.fieldValueSeparator).concat(id));
       }
-      return "".concat(this.baseUrl, "/").concat(entity).concat(query.length > 0 ? "".concat(entity.indexOf('?') === -1 ? '?' : '&', "where=").concat(query.join(';')) : '');
+      return "".concat(this.baseUrl, "/").concat(entity).concat(query.length > 0 ? "".concat(entity.indexOf('?') === -1 ? '?' : '&', "where=").concat(query.join(this.options.whereValueSeparator)) : '');
     }
   }, {
     key: "delete",