Skip to content

Fix for unhandled undefined config #4334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Nov 11, 2017
Merged

Fix for unhandled undefined config #4334

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a877c85
Fix for unhandled undefined config
bryandel Nov 9, 2017
94eb920
Throwing a 403 exception instead of returning a 404 for an invalid ap…
bryandel Nov 11, 2017
6db01b7
Fix indent issues
bryandel Nov 11, 2017
e62b88a
Fix invalid colon to semicolon
bryandel Nov 11, 2017
d245d0f
Fix space and indent issues
bryandel Nov 11, 2017
b64beae
Merge branch 'master' into master
bryandel Nov 11, 2017
9ce201c
Tests for the fix for unhandled undefined config
bryandel Nov 11, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions spec/PublicAPI.spec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,3 +63,47 @@ describe("public API without publicServerURL", () => {
});
});
});


describe("public API supplied with invalid application id", () => {
beforeEach(done => {
reconfigureServer({appName: "unused"})
.then(done, fail);
});

it("should get 403 on verify_email", (done) => {
request('http://localhost:8378/1/apps/invalid/verify_email', (err, httpResponse) => {
expect(httpResponse.statusCode).toBe(403);
done();
});
});

it("should get 403 choose_password", (done) => {
request('http://localhost:8378/1/apps/choose_password?id=invalid', (err, httpResponse) => {
expect(httpResponse.statusCode).toBe(403);
done();
});
});

it("should get 403 on get of request_password_reset", (done) => {
request('http://localhost:8378/1/apps/invalid/request_password_reset', (err, httpResponse) => {
expect(httpResponse.statusCode).toBe(403);
done();
});
});


it("should get 403 on post of request_password_reset", (done) => {
request.post('http://localhost:8378/1/apps/invalid/request_password_reset', (err, httpResponse) => {
expect(httpResponse.statusCode).toBe(403);
done();
});
});

it("should get 403 on resendVerificationEmail", (done) => {
request('http://localhost:8378/1/apps/invalid/resend_verification_email', (err, httpResponse) => {
expect(httpResponse.statusCode).toBe(403);
done();
});
});
});
30 changes: 29 additions & 1 deletion src/Routers/PublicAPIRouter.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,10 @@ export class PublicAPIRouter extends PromiseRouter {
const appId = req.params.appId;
const config = Config.get(appId);

if(!config){
this.invalidRequest();
}

if (!config.publicServerURL) {
return this.missingPublicServerURL();
}
Expand All @@ -40,6 +44,10 @@ export class PublicAPIRouter extends PromiseRouter {
const appId = req.params.appId;
const config = Config.get(appId);

if(!config){
this.invalidRequest();
}

if (!config.publicServerURL) {
return this.missingPublicServerURL();
}
Expand All @@ -66,6 +74,11 @@ export class PublicAPIRouter extends PromiseRouter {
changePassword(req) {
return new Promise((resolve, reject) => {
const config = Config.get(req.query.id);

if(!config){
this.invalidRequest();
}

if (!config.publicServerURL) {
return resolve({
status: 404,
Expand All @@ -89,6 +102,10 @@ export class PublicAPIRouter extends PromiseRouter {

const config = req.config;

if(!config){
this.invalidRequest();
}

if (!config.publicServerURL) {
return this.missingPublicServerURL();
}
Expand All @@ -114,6 +131,10 @@ export class PublicAPIRouter extends PromiseRouter {

const config = req.config;

if(!config){
this.invalidRequest();
}

if (!config.publicServerURL) {
return this.missingPublicServerURL();
}
Expand All @@ -135,7 +156,7 @@ export class PublicAPIRouter extends PromiseRouter {
location: `${config.passwordResetSuccessURL}?${params}`
});
}, (err) => {
const params = qs.stringify({username: username, token: token, id: config.applicationId, error:err, app:config.appName})
const params = qs.stringify({username: username, token: token, id: config.applicationId, error:err, app:config.appName});
return Promise.resolve({
status: 302,
location: `${config.choosePasswordURL}?${params}`
Expand Down Expand Up @@ -171,6 +192,13 @@ export class PublicAPIRouter extends PromiseRouter {
});
}

invalidRequest() {
const error = new Error();
error.status = 403;
error.message = "unauthorized";
throw error;
}

setConfig(req) {
req.config = Config.get(req.params.appId);
return Promise.resolve();
Expand Down