From db4318277befbbbc00780eaf34b9cbfbe6cb8b28 Mon Sep 17 00:00:00 2001 From: Sean Edmunds Date: Tue, 22 Apr 2025 15:14:03 -0500 Subject: [PATCH] Escape character update; README --- README.md | 3 ++ defaultDatabase.sql | 110 +++++++++++++++++++++++++++++++++++--------- package-lock.json | 43 +++++++++++++---- package.json | 1 + server.cjs | 88 ++++++++++++----------------------- 5 files changed, 156 insertions(+), 89 deletions(-) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..2148900 --- /dev/null +++ b/README.md @@ -0,0 +1,3 @@ +# Trigger Home Page API server + +A homepage replacement for your browser built on React and SQL. Please go to the [Front End repo](https://sean.bet/gitea/smedmunds/TriggerFrontend) for setup instructions. \ No newline at end of file diff --git a/defaultDatabase.sql b/defaultDatabase.sql index f2a4002..8d18816 100644 --- a/defaultDatabase.sql +++ b/defaultDatabase.sql @@ -1,9 +1,9 @@ -/*!999999\- enable the sandbox mode */ --- MariaDB dump 10.19 Distrib 10.11.8-MariaDB, for debian-linux-gnu (x86_64) +/*M!999999\- enable the sandbox mode */ +-- MariaDB dump 10.19 Distrib 10.11.11-MariaDB, for debian-linux-gnu (x86_64) -- -- Host: localhost Database: trigger_database -- ------------------------------------------------------ --- Server version 10.11.8-MariaDB-0ubuntu0.24.04.1 +-- Server version 10.11.11-MariaDB-0ubuntu0.24.04.2 /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */; /*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */; @@ -22,7 +22,7 @@ DROP TABLE IF EXISTS `apps`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `apps` ( `id` int(10) unsigned zerofill NOT NULL AUTO_INCREMENT, `name` varchar(50) NOT NULL, @@ -31,17 +31,27 @@ CREATE TABLE `apps` ( `baseUrl` varchar(50) NOT NULL, `filterName` varchar(50) NOT NULL, `index` int(11) DEFAULT 0, + `enabled` tinyint(1) DEFAULT 1, PRIMARY KEY (`id`) -) ENGINE=InnoDB AUTO_INCREMENT=70 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; +) ENGINE=InnoDB AUTO_INCREMENT=72 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Dumping data for table `apps` +-- + +LOCK TABLES `apps` WRITE; +/*!40000 ALTER TABLE `apps` DISABLE KEYS */; +/*!40000 ALTER TABLE `apps` ENABLE KEYS */; +UNLOCK TABLES; + -- -- Table structure for table `linkCategories` -- DROP TABLE IF EXISTS `linkCategories`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `linkCategories` ( `id` int(11) NOT NULL AUTO_INCREMENT, `categoryName` varchar(50) NOT NULL, @@ -51,13 +61,22 @@ CREATE TABLE `linkCategories` ( ) ENGINE=InnoDB AUTO_INCREMENT=47 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Dumping data for table `linkCategories` +-- + +LOCK TABLES `linkCategories` WRITE; +/*!40000 ALTER TABLE `linkCategories` DISABLE KEYS */; +/*!40000 ALTER TABLE `linkCategories` ENABLE KEYS */; +UNLOCK TABLES; + -- -- Table structure for table `links` -- DROP TABLE IF EXISTS `links`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `links` ( `id` int(10) unsigned zerofill NOT NULL AUTO_INCREMENT, `name` varchar(50) NOT NULL, @@ -65,31 +84,49 @@ CREATE TABLE `links` ( `index` int(11) NOT NULL DEFAULT 0, `category` varchar(100) NOT NULL DEFAULT 'Default', PRIMARY KEY (`id`) -) ENGINE=InnoDB AUTO_INCREMENT=231 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; +) ENGINE=InnoDB AUTO_INCREMENT=235 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Dumping data for table `links` +-- + +LOCK TABLES `links` WRITE; +/*!40000 ALTER TABLE `links` DISABLE KEYS */; +/*!40000 ALTER TABLE `links` ENABLE KEYS */; +UNLOCK TABLES; + -- -- Table structure for table `messages` -- DROP TABLE IF EXISTS `messages`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `messages` ( `id` int(10) unsigned zerofill NOT NULL AUTO_INCREMENT, `message` varchar(250) NOT NULL, `customGreeting` tinyint(1) DEFAULT 1, PRIMARY KEY (`id`) -) ENGINE=InnoDB AUTO_INCREMENT=39 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; +) ENGINE=InnoDB AUTO_INCREMENT=42 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Dumping data for table `messages` +-- + +LOCK TABLES `messages` WRITE; +/*!40000 ALTER TABLE `messages` DISABLE KEYS */; +/*!40000 ALTER TABLE `messages` ENABLE KEYS */; +UNLOCK TABLES; + -- -- Table structure for table `personalData` -- DROP TABLE IF EXISTS `personalData`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `personalData` ( `firstName` varchar(50) NOT NULL DEFAULT 'First', `lastName` varchar(50) NOT NULL DEFAULT 'Last', @@ -105,7 +142,7 @@ CREATE TABLE `personalData` ( LOCK TABLES `personalData` WRITE; /*!40000 ALTER TABLE `personalData` DISABLE KEYS */; INSERT INTO `personalData` VALUES -('First','Last','triggeruser@trigger.com', '1600 Pennsylvania Avenue NW, Washington, DC 20500'); +('First','Last','triggeruser@trigger.com','1600 Pennsylvania Avenue NW, Washington, DC 20500'); /*!40000 ALTER TABLE `personalData` ENABLE KEYS */; UNLOCK TABLES; @@ -115,7 +152,7 @@ UNLOCK TABLES; DROP TABLE IF EXISTS `providers`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `providers` ( `id` int(10) unsigned zerofill NOT NULL AUTO_INCREMENT, `name` varchar(50) NOT NULL, @@ -125,13 +162,22 @@ CREATE TABLE `providers` ( ) ENGINE=InnoDB AUTO_INCREMENT=28 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Dumping data for table `providers` +-- + +LOCK TABLES `providers` WRITE; +/*!40000 ALTER TABLE `providers` DISABLE KEYS */; +/*!40000 ALTER TABLE `providers` ENABLE KEYS */; +UNLOCK TABLES; + -- -- Table structure for table `searchHistory` -- DROP TABLE IF EXISTS `searchHistory`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `searchHistory` ( `id` int(11) NOT NULL AUTO_INCREMENT, `prefix` varchar(100) NOT NULL DEFAULT '/g', @@ -139,23 +185,32 @@ CREATE TABLE `searchHistory` ( `searchTerm` text DEFAULT NULL, `dateTimeStamp` datetime NOT NULL DEFAULT current_timestamp(), PRIMARY KEY (`id`) -) ENGINE=InnoDB AUTO_INCREMENT=130 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; +) ENGINE=InnoDB AUTO_INCREMENT=299 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Dumping data for table `searchHistory` +-- + +LOCK TABLES `searchHistory` WRITE; +/*!40000 ALTER TABLE `searchHistory` DISABLE KEYS */; +/*!40000 ALTER TABLE `searchHistory` ENABLE KEYS */; +UNLOCK TABLES; + -- -- Table structure for table `themePlaylists` -- DROP TABLE IF EXISTS `themePlaylists`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `themePlaylists` ( `id` int(11) NOT NULL AUTO_INCREMENT, `name` varchar(255) NOT NULL, `default` tinyint(1) NOT NULL DEFAULT 0, `themeList` text NOT NULL, PRIMARY KEY (`id`) -) ENGINE=InnoDB AUTO_INCREMENT=12 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; +) ENGINE=InnoDB AUTO_INCREMENT=13 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; -- @@ -165,9 +220,9 @@ CREATE TABLE `themePlaylists` ( LOCK TABLES `themePlaylists` WRITE; /*!40000 ALTER TABLE `themePlaylists` DISABLE KEYS */; INSERT INTO `themePlaylists` VALUES -(1,'All',1,'[]'), +(1,'All',1,'[1]'), (2,'Backgrounds',1,'[]'), -(3,'No Backgrounds',1,'[]'), +(3,'No Backgrounds',1,'[1]'), (4,'Time of Day',1,'{\"0\":\"1\",\"1\":\"1\",\"2\":\"1\",\"3\":\"1\"}'); /*!40000 ALTER TABLE `themePlaylists` ENABLE KEYS */; UNLOCK TABLES; @@ -178,7 +233,7 @@ UNLOCK TABLES; DROP TABLE IF EXISTS `themes`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `themes` ( `id` int(10) unsigned zerofill NOT NULL AUTO_INCREMENT, `name` varchar(250) NOT NULL, @@ -190,7 +245,7 @@ CREATE TABLE `themes` ( `borderColor` varchar(9) NOT NULL, `randomEnabled` tinyint(1) DEFAULT 0, PRIMARY KEY (`id`) -) ENGINE=InnoDB AUTO_INCREMENT=61 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; +) ENGINE=InnoDB AUTO_INCREMENT=65 DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; /*!40101 SET character_set_client = @saved_cs_client */; -- @@ -210,7 +265,7 @@ UNLOCK TABLES; DROP TABLE IF EXISTS `wolClients`; /*!40101 SET @saved_cs_client = @@character_set_client */; -/*!40101 SET character_set_client = utf8 */; +/*!40101 SET character_set_client = utf8mb4 */; CREATE TABLE `wolClients` ( `id` int(11) NOT NULL AUTO_INCREMENT, `hostname` varchar(100) NOT NULL, @@ -219,6 +274,15 @@ CREATE TABLE `wolClients` ( ) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci; /*!40101 SET character_set_client = @saved_cs_client */; +-- +-- Dumping data for table `wolClients` +-- + +LOCK TABLES `wolClients` WRITE; +/*!40000 ALTER TABLE `wolClients` DISABLE KEYS */; +/*!40000 ALTER TABLE `wolClients` ENABLE KEYS */; +UNLOCK TABLES; + -- -- Dumping routines for database 'trigger_database' -- @@ -232,4 +296,4 @@ CREATE TABLE `wolClients` ( /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */; /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */; --- Dump completed on 2025-03-14 12:43:39 +-- Dump completed on 2025-04-22 12:33:54 diff --git a/package-lock.json b/package-lock.json index 1ccfdfa..7ca6950 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,13 +10,15 @@ "dotenv": "^16.5.0", "express": "^5.1.0", "mariadb": "^3.4.1", + "sql-escape-string": "^1.1.0", "wol": "^1.0.7" } }, "node_modules/@types/geojson": { - "version": "7946.0.14", - "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.14.tgz", - "integrity": "sha512-WCfD5Ht3ZesJUsONdhvm84dmzWOiOzOAqOncN0++w0lBw1o8OuDNJF2McvvCef/yBqb/HYRahp1BYtODFQ8bRg==" + "version": "7946.0.16", + "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.16.tgz", + "integrity": "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==", + "license": "MIT" }, "node_modules/@types/node": { "version": "22.14.1", @@ -114,6 +116,7 @@ "version": "1.0.5", "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz", "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==", + "license": "MIT", "engines": { "node": ">= 0.6" } @@ -140,6 +143,7 @@ "version": "2.8.5", "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.5.tgz", "integrity": "sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==", + "license": "MIT", "dependencies": { "object-assign": "^4", "vary": "^1" @@ -169,6 +173,7 @@ "version": "2.1.0", "resolved": "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz", "integrity": "sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==", + "license": "Apache-2.0", "engines": { "node": ">=0.10" } @@ -177,6 +182,7 @@ "version": "2.0.0", "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==", + "license": "MIT", "engines": { "node": ">= 0.8" } @@ -210,7 +216,8 @@ "node_modules/ee-first": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", - "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==" + "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==", + "license": "MIT" }, "node_modules/encodeurl": { "version": "2.0.0", @@ -329,6 +336,7 @@ "version": "0.2.0", "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz", "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==", + "license": "MIT", "engines": { "node": ">= 0.6" } @@ -428,6 +436,7 @@ "version": "2.0.0", "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz", "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==", + "license": "MIT", "dependencies": { "depd": "2.0.0", "inherits": "2.0.4", @@ -454,12 +463,14 @@ "node_modules/inherits": { "version": "2.0.4", "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", - "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==" + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==", + "license": "ISC" }, "node_modules/ipaddr.js": { "version": "1.9.1", "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz", "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==", + "license": "MIT", "engines": { "node": ">= 0.10" } @@ -473,7 +484,8 @@ "node_modules/lru-cache": { "version": "10.4.3", "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz", - "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==" + "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==", + "license": "ISC" }, "node_modules/mariadb": { "version": "3.4.1", @@ -561,6 +573,7 @@ "version": "4.1.1", "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz", "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==", + "license": "MIT", "engines": { "node": ">=0.10.0" } @@ -581,6 +594,7 @@ "version": "2.4.1", "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz", "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==", + "license": "MIT", "dependencies": { "ee-first": "1.1.1" }, @@ -619,6 +633,7 @@ "version": "2.0.7", "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "license": "MIT", "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" @@ -705,7 +720,8 @@ "node_modules/safer-buffer": { "version": "2.1.2", "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz", - "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==" + "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", + "license": "MIT" }, "node_modules/send": { "version": "1.2.0", @@ -747,7 +763,8 @@ "node_modules/setprototypeof": { "version": "1.2.0", "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz", - "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==" + "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==", + "license": "ISC" }, "node_modules/side-channel": { "version": "1.1.0", @@ -821,10 +838,17 @@ "url": "https://github.com/sponsors/ljharb" } }, + "node_modules/sql-escape-string": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/sql-escape-string/-/sql-escape-string-1.1.0.tgz", + "integrity": "sha512-/kqO4pLZSLfV0KsBM2xkVh2S3GbjJJone37d7gYwLyP0c+REh3vnmkhQ7VwNrX76igC0OhJWpTg0ukkdef9vvA==", + "license": "MIT" + }, "node_modules/statuses": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz", "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==", + "license": "MIT", "engines": { "node": ">= 0.8" } @@ -833,6 +857,7 @@ "version": "1.0.1", "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz", "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==", + "license": "MIT", "engines": { "node": ">=0.6" } @@ -870,6 +895,7 @@ "version": "1.1.2", "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz", "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==", + "license": "MIT", "engines": { "node": ">= 0.8" } @@ -878,6 +904,7 @@ "version": "1.0.7", "resolved": "https://registry.npmjs.org/wol/-/wol-1.0.7.tgz", "integrity": "sha512-kg7ETY8g3V5+3GVhUfWCVjeXuCmfrX6xfw4cw4c88+MtoxkbFmcs9Y5yhT1wwOL8inogFUQZ8JMzH9OekaaawQ==", + "license": "MIT", "bin": { "wake": "bin/wake" } diff --git a/package.json b/package.json index 785250c..8746858 100644 --- a/package.json +++ b/package.json @@ -5,6 +5,7 @@ "dotenv": "^16.5.0", "express": "^5.1.0", "mariadb": "^3.4.1", + "sql-escape-string": "^1.1.0", "wol": "^1.0.7" } } diff --git a/server.cjs b/server.cjs index 6396b7f..6dfb2ca 100644 --- a/server.cjs +++ b/server.cjs @@ -5,6 +5,7 @@ const fs = require("node:fs"); const wol = require("wol"); const mariadb = require("mariadb"); const bodyParser = require("body-parser"); +const escapeString = require("sql-escape-string"); const pool = mariadb.createPool({ host: process.env.DB_HOST, @@ -13,33 +14,6 @@ const pool = mariadb.createPool({ connectionLimit: 5, }); -function sqlEscape(str) { - return str.replace(/[\0\x08\x09\x1a\n\r"'\\\%]/g, (char) => { - switch (char) { - case "\0": - return "\\0"; - case "\x08": - return "\\b"; - case "\x09": - return "\\t"; - case "\x1a": - return "\\z"; - case "\n": - return "\\n"; - case "\r": - return "\\r"; - case '"': - case "'": - case "\\": - case "%": - return `\\${char}`; // prepends a backslash to backslash, percent, - // and double/single quotes - default: - return char; - } - }); -} - // initializing app const app = express(); @@ -63,7 +37,7 @@ app.get("/trigger/api/personalData", async (req, res) => { app.patch("/trigger/api/personalData", async (req, res) => { const conn = await pool.getConnection(); - const query = `UPDATE trigger_database.personalData SET firstName = '${sqlEscape(req.body.firstName)}', lastName = '${sqlEscape(req.body.lastName)}', email = '${sqlEscape(req.body.email)}', physicalAddress = '${sqlEscape(req.body.physicalAddress)}';`; + const query = `UPDATE trigger_database.personalData SET firstName = ${escapeString(req.body.firstName)}, lastName = ${escapeString(req.body.lastName)}, email = ${escapeString(req.body.email)}, physicalAddress = ${escapeString(req.body.physicalAddress)};`; conn .query(query) .then((rows) => { @@ -86,7 +60,7 @@ app.get("/trigger/api/messages", async (req, res) => { app.post("/trigger/api/messages", async (req, res) => { const conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.messages (message) VALUES ('${sqlEscape(req.body.message)}');`; + const query = `INSERT INTO trigger_database.messages (message) VALUES (${escapeString(req.body.message)});`; conn .query(query) .then((rows) => { @@ -100,7 +74,7 @@ app.post("/trigger/api/messages", async (req, res) => { app.patch("/trigger/api/messages", async (req, res) => { const conn = await pool.getConnection(); - const query = `UPDATE trigger_database.messages SET message = '${sqlEscape(req.body.message)}' WHERE id = '${req.body.id}';`; + const query = `UPDATE trigger_database.messages SET message = ${escapeString(req.body.message)} WHERE id = ${req.body.id};`; conn .query(query) .then((rows) => { @@ -114,7 +88,7 @@ app.patch("/trigger/api/messages", async (req, res) => { app.delete("/trigger/api/messages", async (req, res) => { const conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.messages WHERE id = '${req.body.id}';`; + const query = `DELETE FROM trigger_database.messages WHERE id = ${req.body.id};`; conn .query(query) .then((rows) => { @@ -137,7 +111,7 @@ app.get("/trigger/api/apps", async (req, res) => { app.post("/trigger/api/apps", async (req, res) => { const conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.apps (name, url, icon, baseUrl, filterName, enabled, \`index\`) VALUES ('${sqlEscape(req.body.name)}', '${sqlEscape(req.body.url)}', '${sqlEscape(req.body.icon)}', '${sqlEscape(req.body.baseUrl)}', '${sqlEscape(req.body.filterName)}', ${req.body.enabled}, ${req.body.index});`; + const query = `INSERT INTO trigger_database.apps (name, url, icon, baseUrl, filterName, enabled, \`index\`) VALUES (${escapeString(req.body.name)}, ${escapeString(req.body.url)}, ${escapeString(req.body.icon)}, ${escapeString(req.body.baseUrl)}, ${escapeString(req.body.filterName)}, ${req.body.enabled}, ${req.body.index});`; conn .query(query) .then((rows) => { @@ -151,7 +125,7 @@ app.post("/trigger/api/apps", async (req, res) => { app.patch("/trigger/api/apps", async (req, res) => { const conn = await pool.getConnection(); - const query = `UPDATE trigger_database.apps SET name = '${sqlEscape(req.body.name)}', url = '${sqlEscape(req.body.url)}', icon = '${sqlEscape(req.body.icon)}', baseUrl = '${sqlEscape(req.body.baseUrl)}', filterName = '${sqlEscape(req.body.filterName)}', enabled = ${req.body.enabled} WHERE id = '${req.body.id}';`; + const query = `UPDATE trigger_database.apps SET name = ${escapeString(req.body.name)}, url = ${escapeString(req.body.url)}, icon = ${escapeString(req.body.icon)}, baseUrl = ${escapeString(req.body.baseUrl)}, filterName = ${escapeString(req.body.filterName)}, enabled = ${req.body.enabled} WHERE id = ${req.body.id};`; conn .query(query) .then((rows) => { @@ -165,7 +139,7 @@ app.patch("/trigger/api/apps", async (req, res) => { app.delete("/trigger/api/apps", async (req, res) => { const conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.apps WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.apps WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -198,7 +172,7 @@ app.get("/trigger/api/links", async (req, res) => { app.post("/trigger/api/links", async (req, res) => { const conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.links (name, url, category, \`index\`) VALUES ('${sqlEscape(req.body.name)}', '${sqlEscape(req.body.url)}', '${sqlEscape(req.body.category)}', ${req.body.index});`; + const query = `INSERT INTO trigger_database.links (name, url, category, \`index\`) VALUES (${escapeString(req.body.name)}, ${escapeString(req.body.url)}, ${escapeString(req.body.category)}, ${req.body.index});`; conn .query(query) .then((rows) => { @@ -212,7 +186,7 @@ app.post("/trigger/api/links", async (req, res) => { app.patch("/trigger/api/links", async (req, res) => { const conn = await pool.getConnection(); - const query = `UPDATE trigger_database.links SET name = '${sqlEscape(req.body.name)}', url = '${sqlEscape(req.body.url)}', category = '${sqlEscape(req.body.category)}' WHERE id = '${req.body.id}'`; + const query = `UPDATE trigger_database.links SET name = ${escapeString(req.body.name)}, url = ${escapeString(req.body.url)}, category = ${escapeString(req.body.category)} WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -226,19 +200,17 @@ app.patch("/trigger/api/links", async (req, res) => { app.delete("/trigger/api/links", async (req, res) => { const conn = await pool.getConnection(); - if(req.body.length > 1) { + if (req.body.length > 1) { req.body.map((link) => { conn - .query("DELETE FROM trigger_database.links where id IN (?)", [ - link.id, - ]) + .query("DELETE FROM trigger_database.links where id IN (?)", [link.id]) .then((rows) => { res.status(200); }); }); res.send({ status: "success" }); } else { - const query = `DELETE FROM trigger_database.links WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.links WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -262,7 +234,7 @@ app.get("/trigger/api/providers", async (req, res) => { app.post("/trigger/api/providers", async (req, res) => { const conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.providers (name, url, prefix) VALUES ('${sqlEscape(req.body.name)}', '${req.body.url}', '${req.body.prefix}')`; + const query = `INSERT INTO trigger_database.providers (name, url, prefix) VALUES (${escapeString(req.body.name)}, ${req.body.url}, ${req.body.prefix})`; conn .query(query) .then((rows) => { @@ -276,7 +248,7 @@ app.post("/trigger/api/providers", async (req, res) => { app.patch("/trigger/api/providers", async (req, res) => { const conn = await pool.getConnection(); - const query = `UPDATE trigger_database.providers SET name = '${sqlEscape(req.body.name)}', url = '${sqlEscape(req.body.url)}', prefix = '${sqlEscape(req.body.prefix)}' WHERE id = '${req.body.id}'`; + const query = `UPDATE trigger_database.providers SET name = ${escapeString(req.body.name)}, url = ${escapeString(req.body.url)}, prefix = ${escapeString(req.body.prefix)} WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -290,7 +262,7 @@ app.patch("/trigger/api/providers", async (req, res) => { app.delete("/trigger/api/providers", async (req, res) => { const conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.providers WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.providers WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -313,7 +285,7 @@ app.get("/trigger/api/themes", async (req, res) => { app.post("/trigger/api/themes", async (req, res) => { const conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.themes (name, backgroundImage, backgroundColor, searchColor, primaryColor, accentColor, borderColor) VALUES ('${sqlEscape(req.body.name)}','${sqlEscape(req.body.backgroundImage)}','${req.body.backgroundColor}','${req.body.searchColor}','${req.body.primaryColor}','${req.body.accentColor}','${req.body.borderColor}')`; + const query = `INSERT INTO trigger_database.themes (name, backgroundImage, backgroundColor, searchColor, primaryColor, accentColor, borderColor) VALUES (${escapeString(req.body.name)},${escapeString(req.body.backgroundImage)},${req.body.backgroundColor},${req.body.searchColor},${req.body.primaryColor},${req.body.accentColor},${req.body.borderColor})`; conn .query(query) .then((rows) => { @@ -327,7 +299,7 @@ app.post("/trigger/api/themes", async (req, res) => { app.patch("/trigger/api/themes", async (req, res) => { const conn = await pool.getConnection(); - const query = `UPDATE trigger_database.themes SET name = '${sqlEscape(req.body.name)}', backgroundImage = '${sqlEscape(req.body.backgroundImage)}', backgroundColor = '${req.body.backgroundColor}', searchColor = '${req.body.searchColor}', primaryColor = '${req.body.primaryColor}', accentColor = '${req.body.accentColor}', borderColor = '${req.body.borderColor}', randomEnabled = '${req.body.randomEnabled ? 1 : 0}' WHERE id = '${req.body.id}';`; + const query = `UPDATE trigger_database.themes SET name = ${escapeString(req.body.name)}, backgroundImage = ${escapeString(req.body.backgroundImage)}, backgroundColor = ${req.body.backgroundColor}, searchColor = ${req.body.searchColor}, primaryColor = ${req.body.primaryColor}, accentColor = ${req.body.accentColor}, borderColor = ${req.body.borderColor}, randomEnabled = ${req.body.randomEnabled ? 1 : 0} WHERE id = ${req.body.id};`; conn .query(query) .then((rows) => { @@ -341,7 +313,7 @@ app.patch("/trigger/api/themes", async (req, res) => { app.delete("/trigger/api/themes", async (req, res) => { const conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.themes WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.themes WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -370,7 +342,7 @@ app.get("/trigger/api/themePlaylists", async (req, res) => { app.post("/trigger/api/themePlaylists", async (req, res) => { const conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.themePlaylists (name, themeList) VALUES ('${sqlEscape(req.body.name)}','${sqlEscape(req.body.themeList)}');`; + const query = `INSERT INTO trigger_database.themePlaylists (name, themeList) VALUES (${escapeString(req.body.name)},${escapeString(req.body.themeList)});`; conn .query(query) .then((rows) => { @@ -384,7 +356,7 @@ app.post("/trigger/api/themePlaylists", async (req, res) => { app.patch("/trigger/api/themePlaylists", async (req, res) => { const conn = await pool.getConnection(); - const query = `UPDATE trigger_database.themePlaylists SET name = '${sqlEscape(req.body.name)}', themeList = '${req.body.themeList}' WHERE id = '${req.body.id}';`; + const query = `UPDATE trigger_database.themePlaylists SET name = ${escapeString(req.body.name)}, themeList = ${req.body.themeList} WHERE id = ${req.body.id};`; conn .query(query) .then((rows) => { @@ -398,7 +370,7 @@ app.patch("/trigger/api/themePlaylists", async (req, res) => { app.delete("/trigger/api/themePlaylists", async (req, res) => { const conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.themePlaylists WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.themePlaylists WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -421,7 +393,7 @@ app.get("/trigger/api/categories", async (req, res) => { app.post("/trigger/api/categories", async (req, res) => { const conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.linkCategories (categoryName, categoryIndex, filterName) VALUES ('${sqlEscape(req.body.categoryName)}','${req.body.categoryIndex || 0}','${sqlEscape(req.body.filterName)}')`; + const query = `INSERT INTO trigger_database.linkCategories (categoryName, categoryIndex, filterName) VALUES (${escapeString(req.body.categoryName)},${req.body.categoryIndex || 0},${escapeString(req.body.filterName)})`; conn.query(query).then((rows) => { res.status(200).send({ status: "success" }); }); @@ -430,7 +402,7 @@ app.post("/trigger/api/categories", async (req, res) => { app.patch("/trigger/api/categories", async (req, res) => { const conn = await pool.getConnection(); - const query = `UPDATE trigger_database.linkCategories SET categoryName = '${sqlEscape(req.body.categoryName)}', filterName = '${sqlEscape(req.body.filterName)}' WHERE id = '${req.body.id}';`; + const query = `UPDATE trigger_database.linkCategories SET categoryName = ${escapeString(req.body.categoryName)}, filterName = ${escapeString(req.body.filterName)} WHERE id = ${req.body.id};`; conn .query(query) .then((rows) => { @@ -444,7 +416,7 @@ app.patch("/trigger/api/categories", async (req, res) => { app.delete("/trigger/api/categories", async (req, res) => { const conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.linkCategories WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.linkCategories WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -515,7 +487,7 @@ app.get("/trigger/api/wolClients", async (req, res) => { app.post("/trigger/api/wolClients", async (req, res) => { const conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.wolClients (hostname, macAddress) VALUES ('${sqlEscape(req.body.hostname)}', '${sqlEscape(req.body.macAddress)}')`; + const query = `INSERT INTO trigger_database.wolClients (hostname, macAddress) VALUES (${escapeString(req.body.hostname)}, ${escapeString(req.body.macAddress)})`; conn .query(query) .then((rows) => { @@ -530,7 +502,7 @@ app.post("/trigger/api/wolClients", async (req, res) => { app.patch("/trigger/api/wolClients", async (req, res) => { const conn = await pool.getConnection(); - const query = `UPDATE trigger_database.wolClients SET hostname = '${sqlEscape(req.body.hostname)}', macAddress = '${sqlEscape(req.body.macAddress)}' WHERE id = '${req.body.id}'`; + const query = `UPDATE trigger_database.wolClients SET hostname = ${escapeString(req.body.hostname)}, macAddress = ${escapeString(req.body.macAddress)} WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -545,7 +517,7 @@ app.patch("/trigger/api/wolClients", async (req, res) => { app.delete("/trigger/api/wolClients", async (req, res) => { const conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.wolClients WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.wolClients WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => { @@ -575,7 +547,7 @@ app.get("/trigger/api/searchHistory", async (req, res) => { app.post("/trigger/api/searchHistory", async (req, res) => { const conn = await pool.getConnection(); - const query = `INSERT INTO trigger_database.searchHistory (prefix, provider, searchTerm) VALUES ('${sqlEscape(req.body.prefix)}', '${sqlEscape(req.body.provider)}', '${sqlEscape(req.body.searchTerm)}')`; + const query = `INSERT INTO trigger_database.searchHistory (prefix, provider, searchTerm) VALUES (${escapeString(req.body.prefix)}, ${escapeString(req.body.provider)}, ${escapeString(req.body.searchTerm)})`; conn .query(query) .then((rows) => { @@ -589,7 +561,7 @@ app.post("/trigger/api/searchHistory", async (req, res) => { app.delete("/trigger/api/searchHistory", async (req, res) => { const conn = await pool.getConnection(); - const query = `DELETE FROM trigger_database.searchHistory WHERE id = '${req.body.id}'`; + const query = `DELETE FROM trigger_database.searchHistory WHERE id = ${req.body.id}`; conn .query(query) .then((rows) => {