directus 9.4.1 → 9.4.2

package/dist/app.js

@@ -27,6 +27,7 @@ const express_1 = __importDefault(require("express"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const path_1 = __importDefault(require("path"));
 const qs_1 = __importDefault(require("qs"));
+const helmet_1 = __importDefault(require("helmet"));
 const activity_1 = __importDefault(require("./controllers/activity"));
 const assets_1 = __importDefault(require("./controllers/assets"));
 const auth_1 = __importDefault(require("./controllers/auth"));
@@ -75,6 +76,8 @@ const webhooks_2 = require("./webhooks");
 const cache_2 = require("./cache");
 const auth_2 = require("./auth");
 const url_1 = require("./utils/url");
+const get_config_from_env_1 = require("./utils/get-config-from-env");
+const lodash_1 = require("lodash");
 async function createApp() {
     (0, validate_env_1.validateEnv)(['KEY', 'SECRET']);
     if (!new url_1.Url(env_1.default.PUBLIC_URL).isAbsolute()) {
@@ -96,8 +99,15 @@ async function createApp() {
     await extensionManager.initialize();
     const app = (0, express_1.default)();
     app.disable('x-powered-by');
-    app.set('trust proxy', true);
+    app.set('trust proxy', env_1.default.IP_TRUST_PROXY);
     app.set('query parser', (str) => qs_1.default.parse(str, { depth: 10 }));
+    app.use(helmet_1.default.contentSecurityPolicy((0, lodash_1.merge)({
+        useDefaults: true,
+        directives: {
+            // Unsafe-eval is required for vue3 / vue-i18n / app extensions
+            scriptSrc: ["'self'", "'unsafe-eval'"],
+        },
+    }, (0, get_config_from_env_1.getConfigFromEnv)('CONTENT_SECURITY_POLICY_'))));
     await emitter_1.default.emitInit('app.before', { app });
     await emitter_1.default.emitInit('middlewares.before', { app });
     app.use(logger_1.expressLogger);

package/dist/auth/drivers/ldap.js

@@ -26,6 +26,7 @@ exports.createLDAPAuthRouter = exports.LDAPAuthDriver = void 0;
 const express_1 = require("express");
 const ldapjs_1 = __importStar(require("ldapjs"));
 const ms_1 = __importDefault(require("ms"));
+const get_ip_from_req_1 = require("../../utils/get-ip-from-req");
 const joi_1 = __importDefault(require("joi"));
 const auth_1 = require("../auth");
 const exceptions_1 = require("../../exceptions");
@@ -292,7 +293,7 @@ function createLDAPAuthRouter(provider) {
     router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
         var _a, _b;
         const accountability = {
-            ip: req.ip,
+            ip: (0, get_ip_from_req_1.getIPFromReq)(req),
             userAgent: req.get('user-agent'),
             role: null,
         };

package/dist/auth/drivers/local.js

@@ -14,6 +14,7 @@ const async_handler_1 = __importDefault(require("../../utils/async-handler"));
 const env_1 = __importDefault(require("../../env"));
 const respond_1 = require("../../middleware/respond");
 const constants_1 = require("../../constants");
+const get_ip_from_req_1 = require("../../utils/get-ip-from-req");
 class LocalAuthDriver extends auth_1.AuthDriver {
     async getUserID(payload) {
         if (!payload.email) {
@@ -50,7 +51,7 @@ function createLocalAuthRouter(provider) {
     router.post('/', (0, async_handler_1.default)(async (req, res, next) => {
         var _a;
         const accountability = {
-            ip: req.ip,
+            ip: (0, get_ip_from_req_1.getIPFromReq)(req),
             userAgent: req.get('user-agent'),
             role: null,
         };

package/dist/auth/drivers/oauth2.js

@@ -17,6 +17,7 @@ const respond_1 = require("../../middleware/respond");
 const async_handler_1 = __importDefault(require("../../utils/async-handler"));
 const url_1 = require("../../utils/url");
 const logger_1 = __importDefault(require("../../logger"));
+const get_ip_from_req_1 = require("../../utils/get-ip-from-req");
 class OAuth2AuthDriver extends local_1.LocalAuthDriver {
     constructor(options, config) {
         super(options, config);
@@ -210,7 +211,7 @@ function createOAuth2AuthRouter(providerName) {
         const { verifier, redirect, prompt } = tokenData;
         const authenticationService = new services_1.AuthenticationService({
             accountability: {
-                ip: req.ip,
+                ip: (0, get_ip_from_req_1.getIPFromReq)(req),
                 userAgent: req.get('user-agent'),
                 role: null,
             },

package/dist/auth/drivers/openid.js

@@ -17,6 +17,7 @@ const respond_1 = require("../../middleware/respond");
 const async_handler_1 = __importDefault(require("../../utils/async-handler"));
 const url_1 = require("../../utils/url");
 const logger_1 = __importDefault(require("../../logger"));
+const get_ip_from_req_1 = require("../../utils/get-ip-from-req");
 class OpenIDAuthDriver extends local_1.LocalAuthDriver {
     constructor(options, config) {
         super(options, config);
@@ -212,7 +213,7 @@ function createOpenIDAuthRouter(providerName) {
         const { verifier, redirect, prompt } = tokenData;
         const authenticationService = new services_1.AuthenticationService({
             accountability: {
-                ip: req.ip,
+                ip: (0, get_ip_from_req_1.getIPFromReq)(req),
                 userAgent: req.get('user-agent'),
                 role: null,
             },

package/dist/cache.js

@@ -49,9 +49,7 @@ function getConfig(store = 'memory', ttl, namespaceSuffix = '') {
     };
     if (store === 'redis') {
         const KeyvRedis = require('@keyv/redis');
-        config.store = new KeyvRedis(env_1.default.CACHE_REDIS || (0, get_config_from_env_1.getConfigFromEnv)('CACHE_REDIS_'), {
-            commandTimeout: 500,
-        });
+        config.store = new KeyvRedis(env_1.default.CACHE_REDIS || (0, get_config_from_env_1.getConfigFromEnv)('CACHE_REDIS_'));
     }
     if (store === 'memcache') {
         const KeyvMemcache = require('keyv-memcache');

package/dist/controllers/activity.js

@@ -12,6 +12,7 @@ const validate_batch_1 = require("../middleware/validate-batch");
 const services_1 = require("../services");
 const types_1 = require("../types");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const get_ip_from_req_1 = require("../utils/get-ip-from-req");
 const router = express_1.default.Router();
 router.use((0, use_collection_1.default)('directus_activity'));
 const readHandler = (0, async_handler_1.default)(async (req, res, next) => {
@@ -72,7 +73,7 @@ router.post('/comment', (0, async_handler_1.default)(async (req, res, next) => {
         ...req.body,
         action: types_1.Action.COMMENT,
         user: (_a = req.accountability) === null || _a === void 0 ? void 0 : _a.user,
-        ip: req.ip,
+        ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         user_agent: req.get('user-agent'),
     });
     try {

package/dist/controllers/auth.js

@@ -14,6 +14,7 @@ const get_auth_providers_1 = require("../utils/get-auth-providers");
 const logger_1 = __importDefault(require("../logger"));
 const drivers_1 = require("../auth/drivers");
 const constants_1 = require("../constants");
+const get_ip_from_req_1 = require("../utils/get-ip-from-req");
 const router = (0, express_1.Router)();
 const authProviders = (0, get_auth_providers_1.getAuthProviders)();
 for (const authProvider of authProviders) {
@@ -44,7 +45,7 @@ if (!env_1.default.AUTH_DISABLE_DEFAULT) {
 router.post('/refresh', (0, async_handler_1.default)(async (req, res, next) => {
     var _a;
     const accountability = {
-        ip: req.ip,
+        ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
         role: null,
     };
@@ -79,7 +80,7 @@ router.post('/refresh', (0, async_handler_1.default)(async (req, res, next) => {
 router.post('/logout', (0, async_handler_1.default)(async (req, res, next) => {
     var _a;
     const accountability = {
-        ip: req.ip,
+        ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
         role: null,
     };
@@ -107,7 +108,7 @@ router.post('/password/request', (0, async_handler_1.default)(async (req, res, n
         throw new exceptions_1.InvalidPayloadException(`"email" field is required.`);
     }
     const accountability = {
-        ip: req.ip,
+        ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
         role: null,
     };
@@ -134,7 +135,7 @@ router.post('/password/reset', (0, async_handler_1.default)(async (req, res, nex
         throw new exceptions_1.InvalidPayloadException(`"password" field is required.`);
     }
     const accountability = {
-        ip: req.ip,
+        ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
         role: null,
     };

package/dist/database/index.js

@@ -88,6 +88,9 @@ function getDatabase() {
         // act the same
         (0, lodash_1.merge)(knexConfig, { connection: { options: { useUTC: false } } });
     }
+    if (env_1.default.DB_CLIENT === 'mysql' && !env_1.default.DB_CHARSET) {
+        logger_1.default.warn(`DB_CHARSET hasn't been set. Please make sure DB_CHARSET matches your database's collation.`);
+    }
     database = (0, knex_1.knex)(knexConfig);
     const times = {};
     database

package/dist/database/migrations/20211230A-add-project-descriptor.d.ts

@@ -0,0 +1,3 @@
+import { Knex } from 'knex';
+export declare function up(knex: Knex): Promise<void>;
+export declare function down(knex: Knex): Promise<void>;

package/dist/database/migrations/20211230A-add-project-descriptor.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.down = exports.up = void 0;
+async function up(knex) {
+    await knex.schema.alterTable('directus_settings', (table) => {
+        table.string('project_descriptor', 100).nullable();
+    });
+}
+exports.up = up;
+async function down(knex) {
+    await knex.schema.alterTable('directus_settings', (table) => {
+        table.dropColumn('project_descriptor');
+    });
+}
+exports.down = down;

package/dist/database/system-data/fields/settings.yaml

@@ -14,6 +14,16 @@ fields:
       translations: Name
     width: half
 
+  - field: project_descriptor
+    interface: input
+    options:
+      iconRight: title
+      placeholder: $t:field_options.directus_settings.project_name_placeholder
+    translations:
+      language: en-US
+      translations: Name
+    width: half
+
   - field: project_url
     interface: input
     options:
@@ -22,7 +32,7 @@ fields:
     translations:
       language: en-US
       translations: Website
-    width: half
+    width: full
 
   - field: branding_divider
     interface: presentation-divider

package/dist/env.js

@@ -61,6 +61,8 @@ const defaults = {
     ASSETS_TRANSFORM_MAX_CONCURRENT: 1,
     ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION: 6000,
     ASSETS_TRANSFORM_MAX_OPERATIONS: 5,
+    IP_TRUST_PROXY: true,
+    IP_CUSTOM_HEADER: false,
     SERVE_APP: true,
 };
 // Allows us to force certain environment variable into a type, instead of relying

package/dist/middleware/authenticate.js

@@ -27,6 +27,7 @@ const database_1 = __importDefault(require("../database"));
 const env_1 = __importDefault(require("../env"));
 const exceptions_1 = require("../exceptions");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const get_ip_from_req_1 = require("../utils/get-ip-from-req");
 const is_directus_jwt_1 = __importDefault(require("../utils/is-directus-jwt"));
 /**
  * Verify the passed JWT and assign the user ID and role to `req`
@@ -37,7 +38,7 @@ const authenticate = (0, async_handler_1.default)(async (req, res, next) => {
         role: null,
         admin: false,
         app: false,
-        ip: req.ip.startsWith('::ffff:') ? req.ip.substring(7) : req.ip,
+        ip: (0, get_ip_from_req_1.getIPFromReq)(req),
         userAgent: req.get('user-agent'),
     };
     const database = (0, database_1.default)();

package/dist/middleware/rate-limiter.js

@@ -9,6 +9,7 @@ const env_1 = __importDefault(require("../env"));
 const exceptions_1 = require("../exceptions");
 const rate_limiter_1 = require("../rate-limiter");
 const async_handler_1 = __importDefault(require("../utils/async-handler"));
+const get_ip_from_req_1 = require("../utils/get-ip-from-req");
 const validate_env_1 = require("../utils/validate-env");
 let checkRateLimit = (req, res, next) => next();
 if (env_1.default.RATE_LIMITER_ENABLED === true) {
@@ -16,7 +17,7 @@ if (env_1.default.RATE_LIMITER_ENABLED === true) {
     exports.rateLimiter = (0, rate_limiter_1.createRateLimiter)();
     checkRateLimit = (0, async_handler_1.default)(async (req, res, next) => {
         try {
-            await exports.rateLimiter.consume(req.ip, 1);
+            await exports.rateLimiter.consume((0, get_ip_from_req_1.getIPFromReq)(req), 1);
         }
         catch (rateLimiterRes) {
             if (rateLimiterRes instanceof Error)

package/dist/services/graphql.d.ts

@@ -70,7 +70,7 @@ export declare class GraphQLService {
      * Effectively merges the selections with the fragments used in those selections
      */
     replaceFragmentsInSelections(selections: readonly SelectionNode[] | undefined, fragments: Record<string, FragmentDefinitionNode>): readonly SelectionNode[] | null;
-    injectSystemResolvers(schemaComposer: SchemaComposer<GraphQLParams['contextValue']>, { CreateCollectionTypes, ReadCollectionTypes, DeleteCollectionTypes, }: {
+    injectSystemResolvers(schemaComposer: SchemaComposer<GraphQLParams['contextValue']>, { CreateCollectionTypes, ReadCollectionTypes, UpdateCollectionTypes, DeleteCollectionTypes, }: {
         CreateCollectionTypes: Record<string, ObjectTypeComposer<any, any>>;
         ReadCollectionTypes: Record<string, ObjectTypeComposer<any, any>>;
         UpdateCollectionTypes: Record<string, ObjectTypeComposer<any, any>>;

package/dist/services/graphql.js

@@ -1307,7 +1307,7 @@ class GraphQLService {
         })).filter((s) => s);
         return result;
     }
-    injectSystemResolvers(schemaComposer, { CreateCollectionTypes, ReadCollectionTypes, DeleteCollectionTypes, }, schema) {
+    injectSystemResolvers(schemaComposer, { CreateCollectionTypes, ReadCollectionTypes, UpdateCollectionTypes, DeleteCollectionTypes, }, schema) {
         var _a, _b, _c, _d, _e;
         const AuthTokens = schemaComposer.createObjectTC({
             name: 'auth_tokens',
@@ -2131,6 +2131,32 @@ class GraphQLService {
                 },
             });
         }
+        if ('directus_users' in schema.update.collections) {
+            schemaComposer.Mutation.addFields({
+                update_users_me: {
+                    type: ReadCollectionTypes['directus_users'],
+                    args: {
+                        data: (0, graphql_compose_1.toInputObjectType)(UpdateCollectionTypes['directus_users']),
+                    },
+                    resolve: async (_, args, __, info) => {
+                        var _a, _b, _c;
+                        if (!((_a = this.accountability) === null || _a === void 0 ? void 0 : _a.user))
+                            return null;
+                        const service = new users_1.UsersService({
+                            schema: this.schema,
+                            accountability: this.accountability,
+                        });
+                        await service.updateOne(this.accountability.user, args.data);
+                        if ('directus_users' in ReadCollectionTypes) {
+                            const selections = this.replaceFragmentsInSelections((_c = (_b = info.fieldNodes[0]) === null || _b === void 0 ? void 0 : _b.selectionSet) === null || _c === void 0 ? void 0 : _c.selections, info.fragments);
+                            const query = this.getQuery(args, selections || [], info.variableValues);
+                            return await service.readOne(this.accountability.user, query);
+                        }
+                        return true;
+                    },
+                },
+            });
+        }
         if ('directus_activity' in schema.create.collections) {
             schemaComposer.Mutation.addFields({
                 create_comment: {

package/dist/services/server.js

@@ -52,6 +52,7 @@ class ServerService {
         const projectInfo = await this.settingsService.readSingleton({
             fields: [
                 'project_name',
+                'project_descriptor',
                 'project_logo',
                 'project_color',
                 'public_foreground',

package/dist/utils/get-ip-from-req.d.ts

@@ -0,0 +1,2 @@
+import { Request } from 'express';
+export declare function getIPFromReq(req: Request): string;

package/dist/utils/get-ip-from-req.js

@@ -0,0 +1,24 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getIPFromReq = void 0;
+const net_1 = require("net");
+const env_1 = __importDefault(require("../env"));
+const logger_1 = __importDefault(require("../logger"));
+function getIPFromReq(req) {
+    let ip = req.ip;
+    if (env_1.default.IP_CUSTOM_HEADER) {
+        const customIPHeaderValue = req.get(env_1.default.IP_CUSTOM_HEADER);
+        if (typeof customIPHeaderValue === 'string' && (0, net_1.isIP)(customIPHeaderValue) !== 0) {
+            ip = customIPHeaderValue;
+        }
+        else {
+            logger_1.default.warn(`Custom IP header didn't return valid IP address: ${JSON.stringify(customIPHeaderValue)}`);
+        }
+    }
+    // IP addresses starting with ::ffff: are IPv4 addresses in IPv6 format. We can strip the prefix to get back to IPv4
+    return ip.startsWith('::ffff:') ? ip.substring(7) : ip;
+}
+exports.getIPFromReq = getIPFromReq;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "directus",
-	"version": "9.4.1",
+	"version": "9.4.2",
 	"license": "GPL-3.0-only",
 	"homepage": "https://github.com/directus/directus#readme",
 	"description": "Directus is a real-time API and App dashboard for managing SQL database content.",
@@ -76,16 +76,16 @@
 	],
 	"dependencies": {
 		"@aws-sdk/client-ses": "^3.40.0",
-		"@directus/app": "9.4.1",
-		"@directus/drive": "9.4.1",
-		"@directus/drive-azure": "9.4.1",
-		"@directus/drive-gcs": "9.4.1",
-		"@directus/drive-s3": "9.4.1",
-		"@directus/extensions-sdk": "9.4.1",
-		"@directus/format-title": "9.4.1",
-		"@directus/schema": "9.4.1",
-		"@directus/shared": "9.4.1",
-		"@directus/specs": "9.4.1",
+		"@directus/app": "9.4.2",
+		"@directus/drive": "9.4.2",
+		"@directus/drive-azure": "9.4.2",
+		"@directus/drive-gcs": "9.4.2",
+		"@directus/drive-s3": "9.4.2",
+		"@directus/extensions-sdk": "9.4.2",
+		"@directus/format-title": "9.4.2",
+		"@directus/schema": "9.4.2",
+		"@directus/shared": "9.4.2",
+		"@directus/specs": "9.4.2",
 		"@godaddy/terminus": "^4.9.0",
 		"@rollup/plugin-alias": "^3.1.2",
 		"@rollup/plugin-virtual": "^2.0.3",
@@ -114,6 +114,7 @@
 		"fs-extra": "^10.0.0",
 		"graphql": "^15.5.0",
 		"graphql-compose": "^9.0.1",
+		"helmet": "^4.6.0",
 		"inquirer": "^8.1.1",
 		"joi": "^17.3.0",
 		"js-yaml": "^4.1.0",
@@ -169,7 +170,7 @@
 		"sqlite3": "^5.0.2",
 		"tedious": "^13.0.0"
 	},
-	"gitHead": "4991ba858bdde8bdf03aee475d77a218da6e46ab",
+	"gitHead": "1a5a9180ee6d0ad8f03076bc6e3cfdd62a0dd2f9",
 	"devDependencies": {
 		"@types/async": "3.2.10",
 		"@types/atob": "2.1.2",