diff --git a/CHANGELOG.md b/CHANGELOG.md index 4f0aa65d2..2ebe372e3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog Fab-manager +## v4.7.2 2021 March 1st +- Updated yq to v4 +- Fix a bug: unable to upgrade using the easy upgrade command +- Fix a security issue: possible SQL injection when dropping the database +- Fix a security issue: restrict allowed keys when creating/updating credits +- [TODO DEPLOY] `bundle exec rails fablab:openlab:bulk_export` if you have enabled OpenLab (projects sharing) + ## v4.7.1 2021 February 24 - Fix a security issue: updated axios to 0.21.1 to fix [CVE-2020-28168](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28168) diff --git a/app/controllers/api/credits_controller.rb b/app/controllers/api/credits_controller.rb index cbc762c9a..0c19cb148 100644 --- a/app/controllers/api/credits_controller.rb +++ b/app/controllers/api/credits_controller.rb @@ -47,6 +47,6 @@ class API::CreditsController < API::ApiController end def credit_params - params.require(:credit).permit! + params.require(:credit).permit(:creditable_id, :creditable_type, :plan_id, :hours) end end diff --git a/config/initializers/postgresql_database_tasks.rb b/config/initializers/postgresql_database_tasks.rb index 8883701bb..4616148e7 100644 --- a/config/initializers/postgresql_database_tasks.rb +++ b/config/initializers/postgresql_database_tasks.rb @@ -1,11 +1,21 @@ +# frozen_string_literal: true + module ActiveRecord module Tasks + # The following magic allows to drop a PG database even if a connection exists + # @see https://stackoverflow.com/a/38710021 class PostgreSQLDatabaseTasks + include ActiveRecord::Sanitization::ClassMethods + def drop establish_master_connection - connection.select_all "select pg_terminate_backend(pg_stat_activity.pid) from pg_stat_activity where datname='#{configuration['database']}' AND state='idle';" + q = sanitize_sql_array [ + "select pg_terminate_backend(pg_stat_activity.pid) from pg_stat_activity where datname= ? AND state='idle';", + configuration['database'] + ] + connection.select_all q connection.drop_database configuration['database'] end end end -end \ No newline at end of file +end diff --git a/package.json b/package.json index 5482f59fd..0da893056 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "fab-manager", - "version": "4.7.1", + "version": "4.7.2", "description": "Fab-manager is the FabLab management solution. It provides a comprehensive, web-based, open-source tool to simplify your administrative tasks and your marker's projects.", "keywords": [ "fablab", diff --git a/scripts/mount-payment-schedules.sh b/scripts/mount-payment-schedules.sh index 5a9e15dda..7ad7a92e2 100644 --- a/scripts/mount-payment-schedules.sh +++ b/scripts/mount-payment-schedules.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash yq() { - docker run --rm -i -v "${PWD}:/workdir" mikefarah/yq yq "$@" + docker run --rm -i -v "${PWD}:/workdir" mikefarah/yq:4 "$@" } config() @@ -13,20 +13,14 @@ config() echo "current user is not allowed to use docker, exiting..." exit 1 fi - if ! command -v awk || ! [[ $(awk -W version) =~ ^GNU ]] - then - echo "Please install GNU Awk before running this script." - echo "gawk was not found, exiting..." - exit 1 - fi - SERVICE="$(yq r docker-compose.yml --printMode p 'services.*(.==sleede/fab-manager*)' | awk 'BEGIN { FS = "." } ; {print $2}')" + SERVICE="$(yq eval '.services.*.image | select(. == "sleede/fab-manager*") | path | .[-2]' docker-compose.yml)" } add_mount() { # shellcheck disable=SC2016 # we don't want to expand ${PWD} - yq w -i docker-compose.yml "services.$SERVICE.volumes[+]" '${PWD}/payment_schedules:/usr/src/app/payment_schedules' + yq -i eval ".services.$SERVICE.volumes += [\"\${PWD}/payment_schedules:/usr/src/app/payment_schedules\"]" docker-compose.yml } proceed() diff --git a/scripts/mount-webpack.sh b/scripts/mount-webpack.sh index 00b6d50d2..5dc9a2b7e 100644 --- a/scripts/mount-webpack.sh +++ b/scripts/mount-webpack.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash yq() { - docker run --rm -i -v "${PWD}:/workdir" mikefarah/yq yq "$@" + docker run --rm -i -v "${PWD}:/workdir" mikefarah/yq:4 "$@" } config() @@ -13,27 +13,13 @@ config() echo "current user is not allowed to use docker, exiting..." exit 1 fi - if ! command -v awk || ! [[ $(awk -W version) =~ ^GNU ]] - then - echo "Please install GNU Awk before running this script." - echo "gawk was not found, exiting..." - exit 1 - fi - SERVICE="$(yq r docker-compose.yml --printMode p 'services.*(.==sleede/fab-manager*)' | awk 'BEGIN { FS = "." } ; {print $2}')" + SERVICE="$(yq eval '.services.*.image | select(. == "sleede/fab-manager*") | path | .[-2]' docker-compose.yml)" } change_mount() { - local volumes=$(yq r docker-compose.yml --length "services.$SERVICE.volumes") - local maxVol=$(($volumes - 1)) - for i in $(seq 0 $maxVol); do - yq r docker-compose.yml "services.$SERVICE.volumes.[$i]" | grep assets - if [[ $? = 0 ]]; then - yq w -i docker-compose.yml "services.$SERVICE.volumes.[$i]" "\${PWD}/public/packs:/usr/src/app/public/packs" - echo "Volume #$i was replaced for $SERVICE: /assets changed to /packs" - exit 0 - fi - done + yq -i eval ".services.$SERVICE.volumes.[] | select(. == \"*assets\") |= \"\${PWD}/public/packs:/usr/src/app/public/packs\"" docker-compose.yml + echo "Service volume was replaced for $SERVICE: /assets changed to /packs" } proceed() diff --git a/scripts/redis-upgrade.sh b/scripts/redis-upgrade.sh index d7bf02021..c55d3a45a 100755 --- a/scripts/redis-upgrade.sh +++ b/scripts/redis-upgrade.sh @@ -60,7 +60,7 @@ test_docker_compose() } yq() { - docker run --rm -i -v "${FM_PATH}:/workdir" mikefarah/yq yq "$@" + docker run --rm -i -v "${FM_PATH}:/workdir" mikefarah/yq:4 "$@" } @@ -71,7 +71,7 @@ docker_down() proceed_upgrade() { - yq w -i docker-compose.yml services.redis.image redis:6-alpine + yq -i eval '.services.redis.image = "redis:6-alpine"' docker-compose.yml } diff --git a/setup/setup.sh b/setup/setup.sh index 594f3e21c..756f511dc 100755 --- a/setup/setup.sh +++ b/setup/setup.sh @@ -147,7 +147,7 @@ prepare_files() } yq() { - docker run --rm -i -v "${FABMANAGER_PATH}:/workdir" mikefarah/yq yq "$@" + docker run --rm -i -v "${FABMANAGER_PATH}:/workdir" mikefarah/yq:4 "$@" } prepare_nginx() @@ -160,16 +160,16 @@ prepare_nginx() else # if nginx is not installed, remove its associated block from docker-compose.yml echo "Removing nginx..." - yq d -i docker-compose.yml services.nginx + yq -i eval 'del(.services.nginx)' docker-compose.yml read -rp "Do you want to map the Fab-manager's service to an external network? (Y/n) " confirm