From 01880da5e77e72a755c420ee2bf94cd2bc3d6f25 Mon Sep 17 00:00:00 2001 From: Sean Edmunds Date: Thu, 29 Aug 2024 12:45:00 -0500 Subject: [PATCH] Matching front end changes --- package.json | 16 +++--- server.cjs | 157 ++++++++++++++++++++++++++++++--------------------- 2 files changed, 100 insertions(+), 73 deletions(-) diff --git a/package.json b/package.json index 28cc301..2743d3f 100644 --- a/package.json +++ b/package.json @@ -1,10 +1,10 @@ { - "dependencies": { - "body-parser": "^1.20.2", - "cors": "^2.8.5", - "express": "^4.19.2", - "mariadb": "^3.3.0", - "net-snmp": "^3.11.2", - "wol": "^1.0.7" - } + "dependencies": { + "body-parser": "^1.20.2", + "cors": "^2.8.5", + "express": "^4.19.2", + "mariadb": "^3.3.0", + "net-snmp": "^3.11.2", + "wol": "^1.0.7" + } } diff --git a/server.cjs b/server.cjs index 46f500a..2c78f12 100644 --- a/server.cjs +++ b/server.cjs @@ -1,15 +1,15 @@ -const express = require('express'); -const cors = require('cors'); -const fs = require('fs'); -const wol = require('wol'); -const mariadb = require('mariadb'); -const snmp = require('net-snmp'); -const bodyParser = require('body-parser'); +const express = require("express"); +const cors = require("cors"); +const fs = require("node:fs"); +const wol = require("wol"); +const mariadb = require("mariadb"); +const snmp = require("net-snmp"); +const bodyParser = require("body-parser"); const pool = mariadb.createPool({ - host: 'localhost', - user: 'triggeradmin', - password: 'trigger', + host: "localhost", + user: "triggeradmin", + password: "trigger", connectionLimit: 5, }); @@ -19,7 +19,7 @@ const options = { includeAuthentication: false, accessControlModelType: snmp.AccessControlModelType.None, address: null, - transport: 'udp4', + transport: "udp4", }; const callback = (error, notification) => { @@ -30,6 +30,33 @@ const callback = (error, notification) => { } }; +function sqlEscape(str) { + return str.replace(/[\0\x08\x09\x1a\n\r"'\\\%]/g, (char) => { + switch (char) { + case "\0": + return "\\0"; + case "\x08": + return "\\b"; + case "\x09": + return "\\t"; + case "\x1a": + return "\\z"; + case "\n": + return "\\n"; + case "\r": + return "\\r"; + case '"': + case "'": + case "\\": + case "%": + return `\\${char}`; // prepends a backslash to backslash, percent, + // and double/single quotes + default: + return char; + } + }); +} + // receiver = snmp.createReceiver(options, callback); // initializing app @@ -37,140 +64,140 @@ const app = express(); // initializing cors middleware for all routes const corsOptions = { - origin: '*', + origin: "*", credentials: true, }; app.use(cors(corsOptions)); app.use(bodyParser.json()); -app.get('/trigger/api/personalData', async (req, res) => { - let conn = await pool.getConnection(); - const query = 'SELECT * FROM trigger_database.personalData;'; +app.get("/trigger/api/personalData", async (req, res) => { + const conn = await pool.getConnection(); + const query = "SELECT * FROM trigger_database.personalData;"; conn.query(query).then((rows) => { res.status(200).send(rows); }); conn.end(); }); -app.patch('/trigger/api/personalData', async (req, res) => { +app.patch("/trigger/api/personalData", async (req, res) => { conn = await pool.getConnection(); - const query = `UPDATE trigger_database.personalData SET firstName = '${req.body.firstName}', lastName = '${req.body.lastName}', email = '${req.body.email}';`; + const query = `UPDATE trigger_database.personalData SET firstName = '${sqlEscape(req.body.firstName)}', lastName = '${sqlEscape(req.body.lastName)}', email = '${sqlEscape(req.body.email)}';`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.get('/trigger/api/messages', async (req, res) => { +app.get("/trigger/api/messages", async (req, res) => { conn = await pool.getConnection(); - const query = 'SELECT * FROM trigger_database.messages;'; + const query = "SELECT * FROM trigger_database.messages;"; conn.query(query).then((rows) => { res.status(200).send(rows); }); conn.end(); }); -app.post('/trigger/api/messages', async (req, res) => { +app.post("/trigger/api/messages", async (req, res) => { conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.messages (message) VALUES ('${req.body.message}');`; + const query = `INSERT INTO trigger_database.messages (message) VALUES ('${sqlEscape(req.body.message)}');`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.patch('/trigger/api/messages', async (req, res) => { +app.patch("/trigger/api/messages", async (req, res) => { conn = await pool.getConnection(); - const query = `UPDATE trigger_database.messages SET message = '${req.body.message}' WHERE id = '${req.body.id}';`; + const query = `UPDATE trigger_database.messages SET message = '${sqlEscape(req.body.message)}' WHERE id = '${sqlEscape(req.body.id)}';`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.delete('/trigger/api/messages', async (req, res) => { +app.delete("/trigger/api/messages", async (req, res) => { conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.messages WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.messages WHERE id = '${sqlEscape(req.body.id)}'`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.get('/trigger/api/apps', async (req, res) => { +app.get("/trigger/api/apps", async (req, res) => { conn = await pool.getConnection(); - const query = 'SELECT * FROM trigger_database.apps;'; + const query = "SELECT * FROM trigger_database.apps;"; conn.query(query).then((rows) => { res.status(200).send(rows); }); conn.end(); }); -app.post('/trigger/api/apps', async (req, res) => { +app.post("/trigger/api/apps", async (req, res) => { conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.apps (name, url, icon, baseUrl, category) VALUES ('${req.body.name}', '${req.body.url}', '${req.body.icon}', '${req.body.baseUrl}', '${req.body.category}')`; + const query = `INSERT INTO trigger_database.apps (name, url, icon, baseUrl, filterName) VALUES ('${sqlEscape(req.body.name)}', '${sqlEscape(req.body.url)}', '${sqlEscape(req.body.icon)}', '${sqlEscape(req.body.baseUrl)}', '${sqlEscape(req.body.filterName)}')`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.patch('/trigger/api/apps', async (req, res) => { +app.patch("/trigger/api/apps", async (req, res) => { conn = await pool.getConnection(); - const query = `UPDATE trigger_database.apps SET name = '${req.body.name}', url = '${req.body.url}', icon = '${req.body.icon}', baseUrl = '${req.body.baseUrl}', category = '${req.body.category}' WHERE id = '${req.body.id}'`; + const query = `UPDATE trigger_database.apps SET name = '${sqlEscape(req.body.name)}', url = '${sqlEscape(req.body.url)}', icon = '${sqlEscape(req.body.icon)}', baseUrl = '${sqlEscape(req.body.baseUrl)}', category = '${sqlEscape(req.body.filterName)}' WHERE id = '${req.body.id}'`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.delete('/trigger/api/apps', async (req, res) => { +app.delete("/trigger/api/apps", async (req, res) => { conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.apps WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.apps WHERE id = '${sqlEscape(req.body.id)}'`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.get('/trigger/api/appCategories', async (req, res) => { +app.get("/trigger/api/appCategories", async (req, res) => { conn = await pool.getConnection(); - const query = 'SELECT DISTINCT filterName FROM trigger_database.apps;'; + const query = "SELECT DISTINCT filterName FROM trigger_database.apps;"; conn.query(query).then((rows) => { res.status(200).send(rows); }); conn.end(); }); -app.get('/trigger/api/links', async (req, res) => { +app.get("/trigger/api/links", async (req, res) => { conn = await pool.getConnection(); - const query = 'SELECT * FROM trigger_database.links;'; + const query = "SELECT * FROM trigger_database.links;"; conn.query(query).then((rows) => { res.status(200).send(rows); }); conn.end(); }); -app.post('/trigger/api/links', async (req, res) => { +app.post("/trigger/api/links", async (req, res) => { conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.links (name, url, category) VALUES ('${req.body.name}', '${req.body.url}', '${req.body.category}')`; + const query = `INSERT INTO trigger_database.links (name, url, category) VALUES ('${sqlEscape(req.body.name)}', '${sqlEscape(req.body.url)}', '${sqlEscape(req.body.category)}')`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.patch('/trigger/api/links', async (req, res) => { +app.patch("/trigger/api/links", async (req, res) => { conn = await pool.getConnection(); - const query = `UPDATE trigger_database.links SET name = '${req.body.name}', url = '${req.body.url}', category = '${req.body.category}' WHERE id = '${req.body.id}'`; + const query = `UPDATE trigger_database.links SET name = '${sqlEscape(req.body.name)}', url = '${sqlEscape(req.body.url)}', category = '${sqlEscape(req.body.category)}' WHERE id = '${req.body.id}'`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.delete('/trigger/api/links', async (req, res) => { +app.delete("/trigger/api/links", async (req, res) => { conn = await pool.getConnection(); const query = `DELETE FROM trigger_database.links WHERE id = '${req.body.id}'`; conn.query(query).then((rows) => { @@ -179,34 +206,34 @@ app.delete('/trigger/api/links', async (req, res) => { conn.end(); }); -app.get('/trigger/api/providers', async (req, res) => { +app.get("/trigger/api/providers", async (req, res) => { conn = await pool.getConnection(); - const query = 'SELECT * FROM trigger_database.providers;'; + const query = "SELECT * FROM trigger_database.providers;"; conn.query(query).then((rows) => { res.status(200).send(rows); }); conn.end(); }); -app.post('/trigger/api/providers', async (req, res) => { +app.post("/trigger/api/providers", async (req, res) => { conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.providers (name, url, prefix) VALUES ('${req.body.name}', '${req.body.url}', '${req.body.prefix}')`; + const query = `INSERT INTO trigger_database.providers (name, url, prefix) VALUES ('${sqlEscape(req.body.name)}', '${req.body.url}', '${req.body.prefix}')`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.patch('/trigger/api/providers', async (req, res) => { +app.patch("/trigger/api/providers", async (req, res) => { conn = await pool.getConnection(); - const query = `UPDATE trigger_database.providers SET name = '${req.body.name}', url = '${req.body.url}', prefix = '${req.body.prefix}' WHERE id = '${req.body.id}'`; + const query = `UPDATE trigger_database.providers SET name = '${sqlEscape(req.body.name)}', url = '${sqlEscape(req.body.url)}', prefix = '${sqlEscape(req.body.prefix)}' WHERE id = '${req.body.id}'`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.delete('/trigger/api/providers', async (req, res) => { +app.delete("/trigger/api/providers", async (req, res) => { conn = await pool.getConnection(); const query = `DELETE FROM trigger_database.providers WHERE id = '${req.body.id}'`; conn.query(query).then((rows) => { @@ -215,34 +242,34 @@ app.delete('/trigger/api/providers', async (req, res) => { conn.end(); }); -app.get('/trigger/api/themes', async (req, res) => { +app.get("/trigger/api/themes", async (req, res) => { conn = await pool.getConnection(); - const query = 'SELECT * FROM trigger_database.themes;'; + const query = "SELECT * FROM trigger_database.themes;"; conn.query(query).then((rows) => { res.status(200).send(rows); }); conn.end(); }); -app.post('/trigger/api/themes', async (req, res) => { +app.post("/trigger/api/themes", async (req, res) => { conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.themes (name, backgroundImage, backgroundColor, searchColor, primary, accent, border) VALUES ('${req.body.name}','${req.body.backgroundImage}','${req.body.backgroundColor}','${req.body.searchColor}','${req.body.primary}','${req.body.accent}','${req.body.border}')`; + const query = `INSERT INTO trigger_database.themes (name, backgroundImage, backgroundColor, searchColor, primaryColor, accentColor, borderColor) VALUES ('${sqlEscape(req.body.name)}','${sqlEscape(req.body.backgroundImage)}','${req.body.backgroundColor}','${req.body.searchColor}','${req.body.primaryColor}','${req.body.accentColor}','${req.body.borderColor}')`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.patch('/trigger/api/themes', async (req, res) => { +app.patch("/trigger/api/themes", async (req, res) => { conn = await pool.getConnection(); - const query = `UPDATE trigger_database.themes SET name = '${req.body.name}', backgroundImage = '${req.body.backgroundImage}', backgroundColor = '${req.body.backgroundColor}', searchColor = '${req.body.searchColor}', primary = '${req.body.primary}', accent = '${req.body.accent}', border = '${req.body.border}' WHERE id = '${req.body.id}';`; + const query = `UPDATE trigger_database.themes SET name = '${sqlEscape(req.body.name)}', backgroundImage = '${sqlEscape(req.body.backgroundImage)}', backgroundColor = '${req.body.backgroundColor}', searchColor = '${req.body.searchColor}', primaryColor = '${req.body.primaryColor}', accentColor = '${req.body.accentColor}', borderColor = '${req.body.borderColor}' WHERE id = '${req.body.id}';`; conn.query(query).then((rows) => { res.status(200); }); conn.end(); }); -app.delete('/trigger/api/themes', async (req, res) => { +app.delete("/trigger/api/themes", async (req, res) => { conn = await pool.getConnection(); const query = `DELETE FROM trigger_database.themes WHERE id = '${req.body.id}'`; conn.query(query).then((rows) => { @@ -251,25 +278,25 @@ app.delete('/trigger/api/themes', async (req, res) => { conn.end(); }); -app.get('/trigger/api/categories', async (req, res) => { +app.get("/trigger/api/categories", async (req, res) => { conn = await pool.getConnection(); - const query = 'SELECT * from trigger_database.linkCategories;'; + const query = "SELECT * from trigger_database.linkCategories;"; conn.query(query).then((rows) => { res.status(200).send(rows); }); conn.end(); }); -app.post('/trigger/api/categories', async (req, res) => { +app.post("/trigger/api/categories", async (req, res) => { conn = await pool.getConnection(); - let query = 'SELECT * from trigger_database.linkCategories;'; + let query = "SELECT * from trigger_database.linkCategories;"; let categoryIndex; conn.query(query).then((rows) => { categoryIndex = rows.length; }); conn.end(); conn = await pool.getConnection(); - query = `INSERT INTO trigger_database.linkCategories (categoryName, categoryIndex, filterName) VALUES ('${req.body.categoryName}','${categoryIndex}','${req.body.filterName}')`; + query = `INSERT INTO trigger_database.linkCategories (categoryName, categoryIndex, filterName) VALUES ('${sqlEscape(req.body.categoryName)}','${categoryIndex || 0}','${sqlEscape(req.body.filterName)}')`; conn.query(query).then((rows) => { categoryIndex = rows.length; }); @@ -278,7 +305,7 @@ app.post('/trigger/api/categories', async (req, res) => { // TODO: Add patch method -app.delete('/trigger/api/categories', async (req, res) => { +app.delete("/trigger/api/categories", async (req, res) => { conn = await pool.getConnection(); const query = `DELETE FROM trigger_database.linkCategories WHERE id = '${req.body.id}'`; conn.query(query).then((rows) => { @@ -287,9 +314,9 @@ app.delete('/trigger/api/categories', async (req, res) => { conn.end(); }); -app.get('/trigger/api/wakeDakota', (req, res) => { - wol.wake('18:C0:4D:81:57:68', (err, res) => {}); +app.get("/trigger/api/wakeDakota", (req, res) => { + wol.wake("18:C0:4D:81:57:68", (err, res) => {}); }); // app is listening on port 5000 -app.listen(5000, 'localhost', () => {}); +app.listen(5000, "localhost", () => {});