Commit Graph

49 Commits

Author SHA1 Message Date
Manuel
be4c7e23c6 fix: Parse Pointer allows to access internal Parse Server classes and circumvent beforeFind query trigger; fixes security vulnerability [GHSA-fcv6-fg5r-jm9q](https://github.com/parse-community/parse-server/security/advisories/GHSA-fcv6-fg5r-jm9q) 2023-09-04 14:19:48 +02:00
Daniel
f3bcc9365c feat: Access the internal scope of Parse Server using the new maintenanceKey; the internal scope contains unofficial and undocumented fields (prefixed with underscore _) which are used internally by Parse Server; you may want to manipulate these fields for out-of-band changes such as data migration or correction tasks; changes within the internal scope of Parse Server may happen at any time without notice or changelog entry, it is therefore recommended to look at the source code of Parse Server to understand the effects of manipulating internal fields before using the key; it is discouraged to use the maintenanceKey for routine operations in a production environment; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) (#8212)
BREAKING CHANGE: Fields in the internal scope of Parse Server (prefixed with underscore `_`) are only returned using the new `maintenanceKey`; previously the `masterKey` allowed reading of internal fields; see [access scopes](https://github.com/parse-community/parse-server#access-scopes) for a comparison of the keys' access permissions (#8212)
2023-01-08 22:02:12 +01:00
dblythy
41a052c2c3 Fix: context for afterFind (#7078)
* Fix: context for afterFind

* Update CHANGELOG.md

Co-authored-by: Manuel <trezza.m@gmail.com>
2020-12-18 14:54:48 +01:00
Diamond Lewis
e6ac3b6932 fix(prettier): Properly handle lint-stage files (#6970)
Now handles top level files and recursive files in folders.

Set max line length to be 100
2020-10-25 15:06:58 -05:00
Antoine Cormouls
62048260c9 GraphQL: Optimize queries, fixes some null returns (on object), fix stitched GraphQLUpload (#6709)
* Optimize query, fixes some null returns, fix stitched GraphQLUpload

* Fix authData key selection

* Prefer Iso string since other GraphQL solutions use this format

* fix tests

Co-authored-by: Antonio Davi Macedo Coelho de Castro <adavimacedo@gmail.com>
2020-10-01 15:19:26 -07:00
Manuel
3bd5684f67 Add idempotency (#6748)
* added idempotency router and middleware

* added idempotency rules for routes classes, functions, jobs, installaions, users

* fixed typo

* ignore requests without header

* removed unused var

* enabled feature only for MongoDB

* changed code comment

* fixed inconsistend storage adapter specification

* Trigger notification

* Travis CI trigger

* Travis CI trigger

* Travis CI trigger

* rebuilt option definitions

* fixed incorrect import path

* added new request ID header to allowed headers

* fixed typescript typos

* add new system class to spec helper

* fixed typescript typos

* re-added postgres conn parameter

* removed postgres conn parameter

* fixed incorrect schema for index creation

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* temporarily disabling index creation to fix postgres issue

* trying to fix postgres issue

* fixed incorrect auth when writing to _Idempotency

* trying to fix postgres issue

* Travis CI trigger

* added test cases

* removed number grouping

* fixed test description

* trying to fix postgres issue

* added Github readme docs

* added change log

* refactored tests; fixed some typos

* fixed test case

* fixed default TTL value

* Travis CI Trigger

* Travis CI Trigger

* Travis CI Trigger

* added test case to increase coverage

* Trigger Travis CI

* changed configuration syntax to use regex; added test cases

* removed unused vars

* removed IdempotencyRouter

* Trigger Travis CI

* updated docs

* updated docs

* updated docs

* updated docs

* update docs

* Trigger Travis CI

* fixed coverage

* removed code comments
2020-07-15 13:10:33 -05:00
yog27ray
34614e0f78 Pass context in beforeDelete, afterDelete, beforeFind and Parse.Cloud.run. (#6666)
* add context for following hooks.
1. beforeDelete
2. afterDelete
3. beforeFind
4. Cloud Function

* revert un-necessary code change.

* fix: failing test cases.

* fix: failing test cases.

* fix: failing test cases.

* fix: failing test cases.

* fix: failing test cases.

* fix: failing test cases.

* fix: failing test cases.

* review changes

* revert changes

* revert changes

* review changes

* lint changes

* review changes
2020-07-10 22:47:27 +02:00
Old Grandpa
3c46117d9b Granular CLP pointer permissions (#6352)
* set pointer permissions per operatioon; tests

* more tests

* fixes addField permission; tests
2020-01-27 22:21:30 -08:00
Diamond Lewis
095164babd Prevent afterFind with saving objects (#6127)
Fixes: https://github.com/parse-community/parse-server/issues/6088
2019-10-15 15:50:25 -05:00
Diamond Lewis
cc6d474dcb Schema Cache Improvement 2 (#5616)
* schema hasClass improvement

* create object improvement

* destroy object

* update object

* hasClass test rewrite

* more tests

* improve signing up users
2019-05-30 11:14:05 -05:00
Florent Vilmart
46ac7e7f11 Adds fix for issue affecting update with CLP (#5269)
* Adds fix for issue affecting update with CLP

* Disable single instance
2019-01-04 14:23:27 -05:00
Georges Jamous
961abda4eb "Object not found." instead of "Insufficient auth." when using master key (#5133)
* add additional isMaster check

* adding some tests

* nits

* covering all basis
2018-10-22 19:33:43 -04:00
Florent Vilmart
7c81290252 Live query CLP (#4387)
* Auth module refactoring in order to be reusable

* Ensure cache controller is properly forwarded from helpers

* Nits

* Adds support for static validation

* Adds support for CLP in Live query (no support for roles yet)

* Adds e2e test to validate liveQuery hooks is properly called

* Adds tests over LiveQueryController to ensure data is correctly transmitted

* nits

* Fixes for flow types

* Removes usage of Parse.Promise

* Use the Auth module for authentication and caches

* Cleaner implementation of getting auth

* Adds authCache that stores auth promises

* Proper testing of the caching

* nits
2018-10-17 17:53:49 -04:00
Deokhyun Ko
462f5eb54b fix unexpected 'delete' trigger issue on LiveQuery (#5031)
* fix unexpected 'delete' trigger on LiveQuery when response is an error in cloud function beforeDelete

* tested

* Rebuild CI

* Retest due to local machine testing is passed

* Travis testing failed randomly on Cloud Code Logger. I will retry

* retry

* retry
2018-09-06 07:15:36 -04:00
Florent Vilmart
d83a0b6808 Use Prettier JS (#5017)
* Adds prettier

* Run lint before tests
2018-09-01 13:58:06 -04:00
Florent Vilmart
3bcb5a0997 Ensure User ACL's are more flexible and secure #3588 (#4860)
* Fixes an issue that would let the beforeDelete be called when user has no access to the object

* Ensure we properly lock user

- Improves find method so we can attempt to read for a write poking the right ACL instead of using masterKey
- This ensure we do not run beforeDelete/beforeFind/beforeSave in the wrong scenarios

* nits

* Caps insufficient
2018-06-28 16:31:22 -04:00
Florent Vilmart
1dd58b7527 Adds support for read-only masterKey (#4297)
* Adds support for read-only masterKey

* Adds tests to make sure all endpoints are properly protected

* Updates readme

* nits
2017-10-26 15:35:07 -04:00
Florent Vilmart
5931aa8851 Release 2.5.2 (#3985)
* Adds ability to configure cache from cli

* dont use array.includes for node 4.6

* Changelog and version bump

* Removes runtime check for version

* Build releases on 4.6
2017-07-02 20:50:13 -04:00
Antonio Davi Macedo Coelho de Castro
422723fa31 Fix beforeQuery trigger when getting objects through GET API (#3862) 2017-06-21 08:24:51 -04:00
greenkeeper[bot]
e94991b368 Update dependencies to enable Greenkeeper 🌴 (#3940)
* chore(package): update dependencies

* docs(readme): add Greenkeeper badge

* Fix indent issues with eslint 4.0

see http://eslint.org/docs/user-guide/migrating-to-4.0.0\#-the-indent-rule-is-more-strict
2017-06-20 09:15:26 -07:00
Florent Vilmart
16954c2f74 fix(#3898): session token deletion (#3937)
* fix(#3898): session token deletion

* nits
2017-06-16 12:56:28 -04:00
Florent Vilmart
f0949a1310 feat: Job Scheduling (#3927)
* Adds back _JobSchedule as volatile class

* wip

* Restores jobs endpoints for creation, update and deletion

* Adds tests

* Fixes postgres tests

* Enforce jobName exists before creating a schedule
2017-06-14 13:07:00 -04:00
Worathiti Manosroi
7d70af60ba fix: volatileClasses are masterKey only (#3916)
* volatileClass should respect the schema if defined

* masterKey only for the volatileClasses

* add some test …
2017-06-13 10:36:40 -04:00
Florent Vilmart
c2abbae92d fix(Users): Makes sure verifying emails triggers hooks and liveQuery (#3851)
* Use RestWrite when verifying emails so hooks are called (as master)

* Fixes tests for postgres

* nit

* Makes rest.update support a full where instead of objectId

* Use rest.update to guaranteed proper beforeSave and liveQuery calls
2017-05-28 20:34:49 -04:00
Tyler Brock
67260b5fe0 Factor out checking for triggers/liveQuery in rest.js (#3539) 2017-02-20 12:25:25 -08:00
Arthur Cinader
ca286b7108 Enable prefer-const lint rule (#3202) 2016-12-07 18:17:05 -05:00
Arthur Cinader
11f7712651 Add no trailing whitespace and force eol at end of file. (#3154) 2016-12-01 13:24:46 -05:00
Florent Vilmart
8c2c76dd26 Adds liniting into the workflow (#3082)
* initial linting of src

* fix indent to 2 spaces

* Removes unnecessary rules

* ignore spec folder for now

* Spec linting

* Fix spec indent

* nits

* nits

* no no-empty rule
2016-11-24 15:47:41 -05:00
Florent Vilmart
263ca5e052 Adds CloudCode handler for beforeFind (#2715)
* Adds CloudCode handler for beforeFind

- Allows cloud code to modify a query before it is run
- Works with promises for a safer environment
- Supports modifiying the current query
- Supports issuing new queries

* Adds test for cornercase empty queries from rest

* Makes sure restOptions is always definied
2016-09-17 13:52:35 -07:00
Marko Matić
3164b478ea Syncing afterSave/afterDelete trigger calls (Issue #2489) (#2499)
* Implemented syncing afterSave/afterDelete trigger calls with REST request execution flow (Issue 2489). After this change, afterSave and afterDelete triggers CAN return a promise, which needs to be resolved inside a trigger for REST request flow to continue. If trigger doesn't return a promise, request flow continues.

* Added {} to multiline if.

* Fixed bad commit.

* Fixed problem with beforeSave triggers becoming async.
2016-08-17 09:26:42 -04:00
Florent Vilmart
3b2da1d734 Cloud code logs (#2370)
* Adds logging (info/error) when running cloudCode triggers

* Adds logs for cloud-function calls

- Match parse.com original logging
2016-07-23 11:10:06 -07:00
Florent Vilmart
2498a954ce Exposes clientSDK into RestQuery, RestWrite and rest 2016-07-12 10:06:13 -04:00
Drew Gross
634d672ad1 passing another test 2016-06-15 13:11:51 -07:00
Drew
7e868b2dcc Unique indexes (#1971)
* Add unique indexing

* Add unique indexing for username/email

* WIP

* Finish unique indexes

* Notes on how to upgrade to 2.3.0 safely

* index on unique-indexes: c454180 Revert "Log objects rather than JSON stringified objects (#1922)"

* reconfigure username/email tests

* Start dealing with test shittyness

* Remove tests for files that we are removing

* most tests passing

* fix failing test

* Make specific server config for tests async

* Fix more tests

* fix more tests

* Fix another test

* fix more tests

* Fix email validation

* move some stuff around

* Destroy server to ensure all connections are gone

* Fix broken cloud code

* Save callback to variable

* no need to delete non existant cloud

* undo

* Fix all tests where connections are left open after server closes.

* Fix issues caused by missing gridstore adapter

* Update guide for 2.3.0 and fix final tests

* use strict

* don't use features that won't work in node 4

* Fix syntax error

* Fix typos

* Add duplicate finding command

* Update 2.3.0.md
2016-06-10 20:27:21 -07:00
Drew
aeb6880b85 Allow installation get (#1980) 2016-06-04 12:37:15 -04:00
Blayne Chard
8c09c3dae1 Adding Caching Adapter, allows caching of _Role and _User queries (fixes #168) (#1664)
* Adding Caching Adapter, allows caching of _Role and _User queries.
2016-05-18 12:12:30 +12:00
Drew
d33dd68cc5 Add revokeSessionOnPasswordReset option. Closes #1584 (#1597)
* Add revokeSessionOnPasswordReset option

* Fix nits
2016-04-22 18:21:50 -04:00
Blayne Chard
6e9529f81c Exposes the loggerAdapter as log to Cloud Functions and Triggers (#1565)
This allows access to logging inside cloud code and triggers via
    request.log.info
    request.log.error
2016-04-21 16:20:14 -04:00
Florent Vilmart
c050a65d49 Schema.js database agnostic (#1468)
* Schema.js database agnostic

* nits
2016-04-12 17:39:27 -04:00
Florent Vilmart
5773143973 Disables find on installation from clients
- fixes #1372
2016-04-05 13:09:40 -04:00
wangmengyan95
555e25bf33 Add LiveQuery 2016-03-18 12:32:31 -07:00
Florent Vilmart
dd7fad8e96 Allows Operations on Roles 2016-03-16 23:07:51 -04:00
wangmengyan95
8ea2b615a4 Do master query for before/afterSaveHook 2016-03-10 22:38:07 -08:00
Nikita Lutsenko
9bc636dc5c Cleanup, remove unusued methods and unify cache.js. 2016-02-26 22:48:53 -08:00
Nikita Lutsenko
5e4cecd94e Use constants instead of magic strings for trigger names. 2016-02-25 20:01:52 -08:00
Florent Vilmart
c4abd1e267 cache as ES6 2016-02-25 08:10:08 -05:00
Florent Vilmart
9ac7a52e40 Adds Hooks API
Adds Parse.Hooks.js in src/cloud-code/Parse.Hooks.js
Moves Cloud code related functions in src/cloud-code
2016-02-25 08:10:07 -05:00
Francis Lessard
42aacdf62b FIX : User Roles not added to create, update or delete calls 2016-02-11 22:16:07 -05:00
Nikita Lutsenko
b989bbcaae Move all source files into 'src' folder. 2016-02-08 19:41:07 -08:00