Commit Graph

29 Commits

Author SHA1 Message Date
Manuel
4c1befabf2 fix: server crashes when receiving file download request with invalid byte range; this fixes a security vulnerability that allows an attacker to impact the availability of the server instance; the fix improves parsing of the range parameter to properly handle invalid range requests ([GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)) [skip release] (#8237) 2022-10-15 00:54:08 +02:00
Manuel
1a04a347cf fix: invalid file request not properly handled [skip release] (#8061) 2022-06-18 02:15:08 +02:00
Ali Oğuzhan Yıldız
4d167026ae fix: empty file tags cause upload error for some providers (#7300)
* fix: empty file tags cause upload error for some providers

DigitalOcean and Linode object storage solutions do not accept `tags` option while uploading a file. Previously, tags option was set to default empty object. Now, we do not include it if it is empty.

* chore: add tests for saving a file with/without tags

* chore: update file tags handling to make tests pass

* chore: refactor file tag tests

* chore: update file tag tests

* chore: update changelog

* chore: update changelog entry

* chore: remove duplicated changelog entry
2021-04-02 17:29:46 +02:00
Diamond Lewis
9563793303 Allow single server instance in test suite (#7262)
* initial pass

* reconfigureServer when needed

* finish postgres tests

* mongo tests

* more tests

* clean up

* re-add skipped test

* Fix transaction tests

* handle batch

* AuthenticationAdapter fix

* More reconfiguration

* clean up

* properly terminate cli servers

* handle Parse.Push

* Flaky PushController

* ensure reconfigureServer when changed

* fix postgres tests

* remove console.log

* LiveQuery spec remove duplicates and listeners
2021-03-13 09:05:22 -06:00
Manuel
e08618e377 Fix fileupload defaults not applied (#7086)
* added fileUpload definition default value

* added undefined and null as invalid

* removed explicit default value reference

* improved test grouping in describes
2021-01-11 21:26:56 +01:00
dblythy
97c3046f3f FileUpload options for Server Config (#7071)
* New: fileUpload options to restrict file uploads

* review changes

* update review

* Update helper.js

* added complete fileUpload values for tests

* fixed config validation

* allow file upload only for authenicated user by default

* fixed inconsistent error messages

* consolidated and extended tests

* minor compacting

* removed irregular whitespace

* added changelog entry

* always allow file upload with master key

* fix lint

* removed fit

Co-authored-by: Manuel Trezza <trezza.m@gmail.com>
2020-12-17 10:16:37 +01:00
Diamond Lewis
e6ac3b6932 fix(prettier): Properly handle lint-stage files (#6970)
Now handles top level files and recursive files in folders.

Set max line length to be 100
2020-10-25 15:06:58 -05:00
stevestencil
a9dba442b1 Add file triggers and file meta data (#6344)
* added hint to aggregate

* added support for hint in query

* added else clause to aggregate

* fixed tests

* updated tests

* Add tests and clean up

* added beforeSaveFile and afterSaveFile triggers

* Add support for explain

* added some validation

* added support for metadata and tags

* tests?

* trying tests

* added tests

* fixed failing tests

* added some docs for fileObject

* updated hooks to use Parse.File

* added test for already saved file being returned in hook

* added beforeDeleteFile and afterDeleteFile hooks

* removed contentLength because it's already in the header

* added fileSize param to FileTriggerRequest

* added support for client side metadata and tags

* removed fit test

* removed unused import

* added loging to file triggers

* updated error message

* updated error message

* fixed tests

* fixed typos

* Update package.json

* fixed failing test

* fixed error message

* fixed failing tests (hopefully)

* TESTS!!!

* Update FilesAdapter.js

fixed comment

* added test for changing file name

* updated comments

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-04-02 16:00:15 -05:00
Florent Vilmart
045d941aef Remove request and request-promise from dev dependencies (#5077)
* removes from emailverificationtoken spec

* updates winston

* Updates ValidationAndPasswordsReset

* Use local request in schemas

* Removes request in rest.spec

* Removes request from PushRouter0

* removes request from public API

* removes request from index.spec

* Removes request form parse.push spec

* removes request from ParseInstallation spec

* Removes from ParseHooks

* removes request from ParseGlobalConfig.spec

* Removes request from ParseAPI.spec.js

* removes request from LogsRouter

* removes in features

* Filters undefined headers instead of crashing

* Removes request from ParseUser spec

* Removes usage of request in ParseFile.spec.js

* Removes request from AuthAdapters.js

* removes request-promise from ParseGeoPoint.spec

* Removes request-promise from ParseQuery spec

* remove request-promise from UserPII

* removes request-promise from EnableExpressErrorHandler

* Updates RevocableSessionUpgrade spec

* Update RestQuery

* Removes read preferenceOptionM

* ensure we forward auth from URL

* use request in CloudCode.spec.js

* Removes request-promise from JobSchedule.spec

* Removes rp from VerifyUserPassword.spec.js

* Removes rp from PasswordPolicy spec

* Removes rp from ParsePolygon spec

* Removes rp from fullTextSearch spec

* Removes rp from PArseQuery.Aggregate

* Ensure we properly forward errors

* Removes request and request-promise
2018-09-24 17:07:51 -04:00
Florent Vilmart
a42101531a Silences warnings from mongodb client (#5025)
* Silences warnings from mongodb client

* Update count, delete and finds to recommended implementations

* With new parser, readPref will be null by default

* Update flaky specs wih async/await style

* Adds gridstore adapter spec

* Use GridFSBucketStorage adapter
2018-09-04 16:15:09 -04:00
Florent Vilmart
d83a0b6808 Use Prettier JS (#5017)
* Adds prettier

* Run lint before tests
2018-09-01 13:58:06 -04:00
Florent Vilmart
ff25ae254d Update parse SDK to 2.0.0 (#4925)
* WIP: Integrate JS SDK v2

- Removes backbone style callbacks
- Use Promise instead of Parse.Promise

* Fixes ParseObject and ParseRelation

* Updates Parse.Query with promises

* Alls tests should pass

* Ensure a fresh user is used for each test

* Use REST implementation to avoid side effects for username/email duplicates

* Uses js sdk v2
2018-08-05 13:58:07 -04:00
Florent Vilmart
960431b92d Even faster tests (#4868)
* Various improvements in test name / de-duplications

* Reverts to class by class deletion, introduced fast mode that just delete data for mongo

- Speeds up are incredible Executed 1695 of 1713 specs INCOMPLETE (18 PENDING) in 4 mins 19 secs.

* Adds documentation about the deleteEverything
2018-07-03 11:13:08 -04:00
Florent Vilmart
b754d51e8e chore(package): update jasmine to version 3.0.0 (#4553)
* chore(package): update jasmine to version 3.0.0

Closes #4547

* Fixes failing tests for jasmine 3.0

Starting 3.0, done(something) will fail

* Update tests so they dont leverage var, but let and const

With jasmine 3.0, the randomization engine was making the test fails because of the scope of `var`

* Remove randomizer

* Use same adapter for PG tests, drop table to ensure the tests dont side effect
2018-02-17 09:55:30 -05:00
Florent Vilmart
139b9e1cb3 Finding areas that are untested and need love (#4131)
* Makes InstallationRouter like others

* Adds testing for Range file requests

- Fixes issue with small requests (0-2)

* Revert "Makes InstallationRouter like others"

This reverts commit e2d2a16ebf2757db6138c7b5b33c97c56c69ead6.

* Better handling of errors in FilesRouter

* Fix incorrectness in range requests

* Better/simpler logic

* Only on mongo at it requires Gridstore

* Open file streaming to all adapters supporting it

* Improves coverage of parsers

* Ensures depreciation warning is effective

* Removes unused function

* de-duplicate logic

* Removes necessity of overriding req.params.className on subclasses routers

* Use babel-preset-env to ensure min-version compatible code

* removes dead code

* Leverage indexes in order to infer which field is duplicated upon signup

- A note mentioned that it would be possible to leverage using the indexes on username/email to infer which is duplicated

* Small nit

* Better template to match column name

* Restores original implementation for safety

* nits
2017-09-05 17:51:11 -04:00
Arthur Cinader
ca286b7108 Enable prefer-const lint rule (#3202) 2016-12-07 18:17:05 -05:00
Florent Vilmart
8c2c76dd26 Adds liniting into the workflow (#3082)
* initial linting of src

* fix indent to 2 spaces

* Removes unnecessary rules

* ignore spec folder for now

* Spec linting

* Fix spec indent

* nits

* nits

* no no-empty rule
2016-11-24 15:47:41 -05:00
Florent Vilmart
4dcefd6386 Repro for issue #1944 (#2736) 2016-09-24 13:47:44 -04:00
Florent Vilmart
9ecb9a3595 Postgres: Operations, Hooks, OAuth login, Files support (#2528)
* Adds files related tests through fs-adapter with PG

* Schema deletions implementations

* Adds Hooks spec

* Fix test

* Adds support for containsAll (numbers and strings)

* Better support for deleteFields and deleteClass

* Recursive JSON update for authData

* Adds node_modules to travis cache

* Disable temporarily to make tests pass

* Adds _perishable_token support for _User class

* ignore when a table creation fails at init (table exists)

* Adds support for AddUnique and Remove

* PG 9.4 compatible functions

* Re-enable tests

* nit

* Better handling of schema creation race
2016-08-18 18:05:26 -04:00
Florent Vilmart
c0249283ac Advancements with postgres (#2510)
* Start DB runner from tests

* Connect GridstoreAdapter only when needed

* removes unused package

* better test errors reporting

* Adds support for __op.Delete

* Better test error reporting

* Makes sure all tests can run without crashing

* Use xdescribe to skip test suite

* Removes unused dependencies

* Let volatiles classes be created with PG on start

* Do not fail if class dont exist

* adds index.spec.js to the pg suite

* Use a new config each test to prevent side effects

* Enable EmailVerificationToken specs with pg

* Makes sure failure output is not cut

* Reduces number of ignored tests in ParseObject.spec

* Inspect reconfiguration errors

* Mark GlobalConfig is incompatible with PG

- Problem is with nested updates (param.prop = value)

* PG: Nested JSON queries and updates

- Adds support for nested json and . operator queries
- Adds debug support for PG adapter
- Adds loglevel support in helper

* Enable working specs in ParseUser

* Sets default logLevel in tests to undefined

* Adds File type support, retores purchaseValidation specs

* Adds support for updating jsonb objects

- Restores PushController tests

* Proper implementation of deleteByQuery and ORs

- Adds ParseInstallation spec to the test suite

* xit only failing tests

* Nit on ParseAPI spec

* add sorting operator

* properly bound order keys

* reverts describe_only_db behavior

* Enables passing tests

* Adds basic support for relations, upsertOneObject aliased to createObject

* progress on queries options

* Fix ACL update related problems

* Creates relation tables on class creation

* Adds Relation tests

* remove flaky tests

* use promises instead of CB

* disable flaky test

* nits

* Fixes on schema spec

- Next thing is to implemenet geopoint and files correctly

* fix failues

* Basic GeoPoint support

* Adds support for $nearSphere/$maxDistance geopoint queries

* enable passing tests

* drop tables afterEach for PG, clean up relation tables too

* Better initialization/dropTables
2016-08-15 16:48:39 -04:00
Drew
ae36200d1f Disable tests that don't work in Postgres, and don't start a mongo for postgres tests (#2481)
* Disable tests that don't work in Postgres, and don't start a mongo for postgres tests

* Remove unnecessary chages

* remove more unnecessary chagnes
2016-08-07 22:21:01 -04:00
Drew
ab06055369 Postgres exclude failing tests (#2081)
* reload the right data

More passing postgres tests

Handle schema updates, and $in for non array columns

remove authdata from user and implement ensureUniqueness

Make some tests work, detect existing classes

Throw proper error for unique index violation

fix findOneAndUpdate

Support more types

support more type

Support boolean, fix _rperm/_wperm, add TODO

Support string types and also simplify tests

Move operator flattening into Parse Server and out of mongo adapters

Move authdata transform for create into Parse Server

Move authdata transforms completely in to Parse Server

Fix test setup

inline addSchema

Inject default schema to response from DB adapter

* Mark tests that don't work in Postgres

* Exclude one more test

* Exclude some more failing tests

* Exclude more tests
2016-06-17 12:59:16 -04:00
Patrick Pelletier
65518cdd64 Support file objects in the legacy bucket: files.parse.com 2016-06-07 15:59:45 -07:00
Blayne Chard
3997b1aa5a Fixing #1900 JS SDK file upload (#1935)
* Fixing #1900 JS SDK file upload

JS SDK file upload uses req.body._ContentType to specify the upload content type

* Fixing import statements

* Dont clear the cache just delete the new entry that the test added.

* adding E2E test for _ContentType support
2016-05-30 21:42:45 -04:00
Nikita Lutsenko
a96cb6b31d Remove 'url' as a required field on Files when they are stored on object. 2016-02-25 19:31:55 -08:00
Nikita Lutsenko
966d10ca43 Allow uploading files without content-type. 2016-02-22 14:07:58 -08:00
Nikita Lutsenko
f53cb60d57 Add enforceMasterKeyAccess middleware. 2016-02-11 23:26:44 -08:00
Wes Thomas
a75376523c file DELETE support 2016-02-11 21:21:42 -05:00
Fosco Marotto
7f5d744ce2 Initial release, parse-server, 2.0.0 2016-01-28 10:58:12 -08:00