From db4494c463a8bc9756576ba096a22249abb980e9 Mon Sep 17 00:00:00 2001 From: prafull-opensignlabs Date: Thu, 9 Nov 2023 17:08:57 +0530 Subject: [PATCH] security improvment --- apps/OpenSign/src/components/LoginFacebook.js | 12 +-- apps/OpenSign/src/components/LoginGoogle.js | 8 +- apps/OpenSign/src/routes/Login.js | 77 ++++++++----------- apps/OpenSign/src/routes/Pgsignup.js | 12 +-- apps/OpenSign/src/routes/Signup.js | 5 +- apps/OpenSignServer/cloud/main.js | 2 + .../cloud/parsefunction/getContractUser.js | 12 +++ apps/OpenSignServer/package-lock.json | 7 ++ .../default-data/legadraGCva.w_dashboard.json | 2 +- 9 files changed, 68 insertions(+), 69 deletions(-) create mode 100644 apps/OpenSignServer/cloud/parsefunction/getContractUser.js diff --git a/apps/OpenSign/src/components/LoginFacebook.js b/apps/OpenSign/src/components/LoginFacebook.js index e6b77eed3..d158a96aa 100644 --- a/apps/OpenSign/src/components/LoginFacebook.js +++ b/apps/OpenSign/src/components/LoginFacebook.js @@ -27,14 +27,14 @@ const LoginFacebook = ({ setThirdpartyLoader(true); const details = { Email: response.email, - Name: response.name, + Name: response.name }; setUserDetails({ ...userDetails, ...details }); const fDetails = { Id: response.userID, AccessToken: response.accessToken, Name: response.name, - Email: response.email, + Email: response.email }; setFBDetails({ ...fBDetails, ...fDetails }); const res = await checkExtUser(fDetails); @@ -42,9 +42,11 @@ const LoginFacebook = ({ }; const checkExtUser = async (details) => { - const extUser = new Parse.Query("contracts_Users"); - extUser.equalTo("Email", details.Email); - const extRes = await extUser.first(); + // const extUser = new Parse.Query("contracts_Users"); + // extUser.equalTo("Email", details.Email); + // const extRes = await extUser.first(); + const params = { email: details.Email }; + const extRes = await Parse.Cloud.run("getContractUser", params); // console.log("extRes ", extRes); if (extRes) { const params = { ...details, Phone: extRes.get("Phone") }; diff --git a/apps/OpenSign/src/components/LoginGoogle.js b/apps/OpenSign/src/components/LoginGoogle.js index 5fbf3309c..2a19f7c8f 100644 --- a/apps/OpenSign/src/components/LoginGoogle.js +++ b/apps/OpenSign/src/components/LoginGoogle.js @@ -66,9 +66,11 @@ const GoogleSignInBtn = ({ } }; const checkExtUser = async (details) => { - const extUser = new Parse.Query("contracts_Users"); - extUser.equalTo("Email", details.Gmail); - const extRes = await extUser.first(); + // const extUser = new Parse.Query("contracts_Users"); + // extUser.equalTo("Email", details.Gmail); + // const extRes = await extUser.first(); + const params = { email: details.Gmail }; + const extRes = await Parse.Cloud.run("getContractUser", params); // console.log("extRes ", extRes); if (extRes) { const params = { ...details, Phone: extRes.get("Phone") }; diff --git a/apps/OpenSign/src/routes/Login.js b/apps/OpenSign/src/routes/Login.js index 9ca1a2eb0..509dc0efd 100644 --- a/apps/OpenSign/src/routes/Login.js +++ b/apps/OpenSign/src/routes/Login.js @@ -129,7 +129,7 @@ function Login(props) { ); if (rolesfiltered.length > 0) { _currentRole = rolesfiltered[0]; - } + } } else { const rolesfiltered = userRoles.filter( (x) => !valuesToExclude.includes(x) @@ -334,23 +334,6 @@ function Login(props) { sessionToken: user.getSessionToken() }; handleSubmitbtn(payload); - // setState({ - // ...state, - // loading: false, - // toastColor: "#d9534f", - // toastDescription: - // "You dont have access to this application." - // }); - - // const x = document.getElementById("snackbar"); - // x.className = "show"; - // setTimeout(function () { - // x.className = x.className.replace( - // "show", - // "" - // ); - // }, 2000); - // localStorage.setItem("accesstoken", null); console.error( "Error while fetching Follow", error @@ -472,7 +455,7 @@ function Login(props) { ); if (rolesfiltered.length > 0) { _currentRole = rolesfiltered[0]; - } + } } else { const rolesfiltered = userRoles.filter( (x) => !valuesToExclude.includes(x) @@ -596,6 +579,30 @@ function Login(props) { setThirdpartyLoader(false); setState({ ...state, loading: false }); if (process.env.REACT_APP_ENABLE_SUBSCRIPTION) { + if (billingDate) { + if (billingDate > new Date()) { + localStorage.removeItem("userDetails"); + navigate( + `/${element.pageType}/${element.pageId}` + ); + } else { + navigate(`/subscription`); + } + } else { + navigate(`/subscription`); + } + } + } + } else { + localStorage.setItem("PageLanding", element.pageId); + localStorage.setItem( + "defaultmenuid", + element.menuId + ); + localStorage.setItem("pageType", element.pageType); + setState({ ...state, loading: false }); + setThirdpartyLoader(false); + if (process.env.REACT_APP_ENABLE_SUBSCRIPTION) { if (billingDate) { if (billingDate > new Date()) { localStorage.removeItem("userDetails"); @@ -610,31 +617,7 @@ function Login(props) { } } } - } else { - localStorage.setItem("PageLanding", element.pageId); - localStorage.setItem( - "defaultmenuid", - element.menuId - ); - localStorage.setItem("pageType", element.pageType); - setState({ ...state, loading: false }); - setThirdpartyLoader(false); - if (process.env.REACT_APP_ENABLE_SUBSCRIPTION) { - if (billingDate) { - if (billingDate > new Date()) { - localStorage.removeItem("userDetails"); - navigate( - `/${element.pageType}/${element.pageId}` - ); - } else { - navigate(`/subscription`); - } - } else { - navigate(`/subscription`); - } - } - } - }, + }, (error) => { const payload = { sessionToken: sessionToken @@ -655,7 +638,6 @@ function Login(props) { } else { setThirdpartyLoader(false); setState({ ...state, loading: false }); - } }) .catch((err) => { @@ -717,9 +699,10 @@ function Login(props) { await axios .post(url, JSON.stringify(body), { headers: headers1 }) - .then((roles) => { + .then((axiosres) => { + const roles = axiosres.data.result; if (roles) { - userRoles = roles.data.result; + userRoles = roles; let _currentRole = ""; if (userRoles.length > 1) { if ( diff --git a/apps/OpenSign/src/routes/Pgsignup.js b/apps/OpenSign/src/routes/Pgsignup.js index bda1934a4..ab215844c 100644 --- a/apps/OpenSign/src/routes/Pgsignup.js +++ b/apps/OpenSign/src/routes/Pgsignup.js @@ -67,9 +67,8 @@ const PgSignUp = (props) => { const userSettings = JSON.parse(localStorage.getItem("userSettings")); const extClass = userSettings[0].extended_class; // console.log("extClass ", extClass); - const checkUser = new Parse.Query(extClass); - checkUser.equalTo("Email", userDetails.email); - const res = await checkUser.first(); + const params = { email: userDetails.email }; + const res = await Parse.Cloud.run("getContractUser", params); // console.log("res", res); if (res) { const checkUser = new Parse.Query(extClass); @@ -279,13 +278,6 @@ const PgSignUp = (props) => { "" ); localStorage.setItem("_user_role", _role); - - if (element.enableCart) { - localStorage.setItem("EnableCart", element.enableCart); - props.setEnableCart(element.enableCart); - } else { - localStorage.removeItem("EnableCart"); - } // Get TenentID from Extendend Class localStorage.setItem( "extended_class", diff --git a/apps/OpenSign/src/routes/Signup.js b/apps/OpenSign/src/routes/Signup.js index 1f52261b6..31c26f566 100644 --- a/apps/OpenSign/src/routes/Signup.js +++ b/apps/OpenSign/src/routes/Signup.js @@ -101,9 +101,8 @@ const Signup = (props) => { }) .catch(async (err) => { if (err.code === 202) { - const userQuery = new Parse.Query("contracts_Users"); - userQuery.equalTo("Email", email); - const res = await userQuery.first(); + const params = { email: email }; + const res = await Parse.Cloud.run("getContractUser", params); // console.log("Res ", res); if (res) { alert("User already exists with this username!"); diff --git a/apps/OpenSignServer/cloud/main.js b/apps/OpenSignServer/cloud/main.js index 45cc0efae..ed4396a9f 100644 --- a/apps/OpenSignServer/cloud/main.js +++ b/apps/OpenSignServer/cloud/main.js @@ -13,6 +13,7 @@ import sendMailOTPv1 from './parsefunction/SendMailOTPv1.js'; import SendMailv1 from './parsefunction/SendMailv1.js'; import AuthLoginAsMail from './parsefunction/AuthLoginAsMail.js'; import getUserId from './parsefunction/getUserId.js'; +import getContractUser from './parsefunction/getContractUser.js'; Parse.Cloud.define('AddUserToRole', addUserToGroups); Parse.Cloud.define('UserGroups', getUserGroups); @@ -29,3 +30,4 @@ Parse.Cloud.define('SendOTPMailV1', sendMailOTPv1); Parse.Cloud.define('sendmail', SendMailv1); Parse.Cloud.define('AuthLoginAsMail', AuthLoginAsMail); Parse.Cloud.define('getUserId', getUserId); +Parse.Cloud.define('getContractUser', getContractUser); diff --git a/apps/OpenSignServer/cloud/parsefunction/getContractUser.js b/apps/OpenSignServer/cloud/parsefunction/getContractUser.js new file mode 100644 index 000000000..96f403be4 --- /dev/null +++ b/apps/OpenSignServer/cloud/parsefunction/getContractUser.js @@ -0,0 +1,12 @@ +async function getContractUser(request) { + try { + const userQuery = new Parse.Query('contracts_Users'); + userQuery.equalTo('Email', request.params.email); + const res = await userQuery.first({ useMasterKey: true }); + return res; + } catch (err) { + console.log('Err ', err); + return err; + } +} +export default getContractUser; diff --git a/apps/OpenSignServer/package-lock.json b/apps/OpenSignServer/package-lock.json index 6b692e824..aadbb80b1 100644 --- a/apps/OpenSignServer/package-lock.json +++ b/apps/OpenSignServer/package-lock.json @@ -28,6 +28,7 @@ "parse": "4.1.0", "parse-server": "6.3.1", "parse-server-api-mail-adapter": "^3.0.0", + "parse-server-fs-adapter": "1.0.1", "parse-server-s3-adapter": "^1.2.0", "pdf-lib": "^1.16.0", "pdfkit": "^0.13.0", @@ -7403,6 +7404,12 @@ "node": ">=12" } }, + "node_modules/parse-server-fs-adapter": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/parse-server-fs-adapter/-/parse-server-fs-adapter-1.0.1.tgz", + "integrity": "sha512-5IRKAT2QkzHrYrBESY4E8jsV1sl+XVBTKGyUvBPgBR2QzsTTqiyU/lFZD8PAJavA+TH1BLyLTUMZbhZhswNVbQ==", + "deprecated": "use @parse/fs-files-adapter" + }, "node_modules/parse-server-s3-adapter": { "version": "1.2.0", "resolved": "https://registry.npmjs.org/parse-server-s3-adapter/-/parse-server-s3-adapter-1.2.0.tgz", diff --git a/apps/mongo/default-data/legadraGCva.w_dashboard.json b/apps/mongo/default-data/legadraGCva.w_dashboard.json index 3ca1737a5..3f2c2794f 100644 --- a/apps/mongo/default-data/legadraGCva.w_dashboard.json +++ b/apps/mongo/default-data/legadraGCva.w_dashboard.json @@ -40,7 +40,7 @@ "id": "c1935cc0-28d4-3d73-b72a-8c1e3d18a17f", "queryType": "", "class": "contracts_Document", - "query": "where={\"CreatedBy\":{\"__type\":\"Pointer\",\"className\":\"_User\",\"objectId\":\"#UserId.objectId#\"},\"IsCompleted\":{\"$ne\":true},\"IsDeclined\":{\"$ne\":true},\"Type\":{\"$ne\":\"Folder\"},\"Placeholders\":{\"$ne\":null},\"ExpiryDate\":{\"#*gt\":{\"__type\":\"#Date#\",\"iso\":\"#today#\"}}}&count=1", + "query": "where={\"IsDeclined\":{\"$ne\":true},\"IsCompleted\":{\"$ne\":true},\"Type\":{\"$ne\":\"Folder\"},\"Placeholders\":{\"$ne\":null},\"ExpiryDate\":{\"#*gt\":{\"__type\":\"#Date#\",\"iso\":\"#today#\"}}}&include=Signers,AuditTrail.UserPtr", "key": "count", "Redirect_type": "Report", "Redirect_id": "1MwEuxLEkF",