You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ignite.apache.org by GitBox <gi...@apache.org> on 2019/01/14 11:53:47 UTC
[ignite] Diff for: [GitHub] akuznetsov-gridgain closed pull request #5802:
WC-882 WIP
diff --git a/modules/web-console/backend/app/configure.js b/modules/web-console/backend/app/configure.js
index a0e5190c8b2d..ac71b7486483 100644
--- a/modules/web-console/backend/app/configure.js
+++ b/modules/web-console/backend/app/configure.js
@@ -25,6 +25,7 @@ const session = require('express-session');
const connectMongo = require('connect-mongo');
const passport = require('passport');
const passportSocketIo = require('passport.socketio');
+const mongoSanitize = require('express-mongo-sanitize');
// Fire me up!
@@ -50,6 +51,9 @@ module.exports.factory = function(settings, mongo, apis) {
app.use(bodyParser.json({limit: '50mb'}));
app.use(bodyParser.urlencoded({limit: '50mb', extended: true}));
+
+ app.use(mongoSanitize({replaceWith: '_'}));
+
app.use(session({
secret: settings.sessionSecret,
resave: false,
diff --git a/modules/web-console/backend/package.json b/modules/web-console/backend/package.json
index 4399ae79f654..9d1918e83eb9 100644
--- a/modules/web-console/backend/package.json
+++ b/modules/web-console/backend/package.json
@@ -52,6 +52,7 @@
"connect-mongo": "1.3.2",
"cookie-parser": "1.4.3",
"express": "4.15.3",
+ "express-mongo-sanitize": "1.3.2",
"express-session": "1.15.4",
"fire-up": "1.0.0",
"glob": "7.1.2",
diff --git a/modules/web-console/backend/routes/profile.js b/modules/web-console/backend/routes/profile.js
index 0ce2656b1f7f..79fb3de42d22 100644
--- a/modules/web-console/backend/routes/profile.js
+++ b/modules/web-console/backend/routes/profile.js
@@ -43,7 +43,7 @@ module.exports.factory = function(mongo, usersService) {
if (req.body.password && _.isEmpty(req.body.password))
return res.status(500).send('Wrong value for new password!');
- usersService.save(req.body)
+ usersService.save(req.user._id, req.body)
.then((user) => {
const becomeUsed = req.session.viewedUser && req.user.admin;
diff --git a/modules/web-console/backend/services/users.js b/modules/web-console/backend/services/users.js
index ed844db61e14..b41c56abd7c9 100644
--- a/modules/web-console/backend/services/users.js
+++ b/modules/web-console/backend/services/users.js
@@ -102,16 +102,17 @@ module.exports.factory = (errors, settings, mongo, spacesService, mailsService,
/**
* Save user.
*
- * @param {Object} changed - The user
+ * @param userId User ID.
+ * @param {Object} changed Changed user.
* @returns {Promise.<mongo.ObjectId>} that resolves account id of merge operation.
*/
- static save(changed) {
+ static save(userId, changed) {
delete changed.admin;
delete changed.activated;
delete changed.activationSentAt;
delete changed.activationToken;
- return mongo.Account.findById(changed._id).exec()
+ return mongo.Account.findById(userId).exec()
.then((user) => {
if (!changed.password)
return Promise.resolve(user);
With regards,
Apache Git Services