Docker/planka
Docker/planka
1
0
Fork 0
mirror of https://github.com/plankanban/planka.git synced 2025-07-24 23:59:48 +02:00
Code Issues Releases Activity

feat: Improve security of access tokens (#279)

Browse source 
Closes #275
This commit is contained in:
SimonTagne 2022-08-09 18:03:21 +02:00 • committed by GitHub
parent dab38cbc18
commit 7786533a90
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
40 changed files with 273 additions and 133 deletions
Download patch file Download diff file Expand all files Collapse all files

2
server/api/controllers/access-tokens/create.js
View file

@ -49,7 +49,7 @@ module.exports = {
}
return {
item: sails.helpers.utils.signToken(user.id),
item: sails.helpers.utils.createToken(user.id),
};
},
};

1
server/api/controllers/users/update-avatar.js
View file

@ -54,6 +54,7 @@ module.exports = {
{
avatarDirname: files[0].extra.dirname,
},
currentUser,
this.req,
);

2
server/api/controllers/users/update-email.js
View file

@ -69,7 +69,7 @@ module.exports = {
const values = _.pick(inputs, ['email']);
user = await sails.helpers.users
.updateOne(user, values, this.req)
.updateOne(user, values, currentUser, this.req)
.intercept('emailAlreadyInUse', () => Errors.EMAIL_ALREADY_IN_USE);
if (!user) {

11
server/api/controllers/users/update-password.js
View file

@ -60,12 +60,21 @@ module.exports = {
}
const values = _.pick(inputs, ['password']);
user = await sails.helpers.users.updateOne(user, values, this.req);
user = await sails.helpers.users.updateOne(user, values, currentUser, this.req);
if (!user) {
throw Errors.USER_NOT_FOUND;
}
if (user.id === currentUser.id) {
const accessToken = sails.helpers.utils.createToken(user.id, user.passwordUpdatedAt);
return {
accessToken,
item: user,
};
}
return {
item: user,
};

2
server/api/controllers/users/update-username.js
View file

@ -71,7 +71,7 @@ module.exports = {
const values = _.pick(inputs, ['username']);
user = await sails.helpers.users
.updateOne(user, values, this.req)
.updateOne(user, values, currentUser, this.req)
.intercept('usernameAlreadyInUse', () => Errors.USERNAME_ALREADY_IN_USE);
if (!user) {

2
server/api/controllers/users/update.js
View file

@ -75,7 +75,7 @@ module.exports = {
'subscribeToOwnCards',
]);
user = await sails.helpers.users.updateOne(user, values, this.req);
user = await sails.helpers.users.updateOne(user, values, currentUser, this.req);
if (!user) {
throw Errors.USER_NOT_FOUND;