Skip to content
This repository was archived by the owner on Dec 14, 2023. It is now read-only.

Commit 35c9dec

Browse files
WardormeurWardormeur
committed
Update lodash to 4.17.10 for CVE concerns
1 parent 86e73a9 commit 35c9dec

File tree

5 files changed

+33
-33
lines changed

5 files changed

+33
-33
lines changed

‎lib/profiles/user-profile-data.js

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -73,16 +73,16 @@ var youthBlackList = ['name'];
7373

7474
// var allowedOptionalFieldsYouth = ['dojos', 'linkedin', 'twitter', 'badges'];
7575
var allowedOptionalFieldsYouth = _.filter(hiddenFields, function (field) {
76-
if (_.contains(field.allowedUserTypes, 'attendee-o13')) return field.modelName;
76+
if (_.includes(field.allowedUserTypes, 'attendee-o13')) return field.modelName;
7777
});
7878

7979
// var allowedOptionalFieldsChampion = ['notes', 'projects'];
8080
var allowedOptionalFieldsChampion = _.map(hiddenFields, function (field) {
81-
if (_.contains(field.allowedUserTypes, 'champion')) return field.modelName;
81+
if (_.includes(field.allowedUserTypes, 'champion')) return field.modelName;
8282
});
8383

8484
var allowedOptionalFieldsMentor = _.map(hiddenFields, function (field) {
85-
if (_.contains(field.allowedUserTypes, 'mentor')) return field.modelName;
85+
if (_.includes(field.allowedUserTypes, 'mentor')) return field.modelName;
8686
});
8787

8888
var allowedOptionalFields = {
@@ -207,7 +207,7 @@ function cmd_user_profile_data (args, done) {
207207
if (_.isEmpty(usersDojos)) {
208208
profile.userTypes.push(profile.userType);
209209
} else {
210-
profile.userTypes = _.flatten(_.pluck(usersDojos, 'userTypes'));
210+
profile.userTypes = _.flatten(usersDojos.map(ud => ud.userTypes));
211211
profile.userTypes.push(profile.userType);
212212
}
213213
profile.userTypes = _.uniq(profile.userTypes);
@@ -219,14 +219,14 @@ function cmd_user_profile_data (args, done) {
219219
function addFlags (profile, done) {
220220
var userId = args.user ? args.user.id : null;
221221
flags.user.ownProfile = profile && profile.userId === userId;
222-
flags.user.myChild = _.contains(profile.parents, userId);
222+
flags.user.myChild = _.includes(profile.parents, userId);
223223
flags.user.isTicketingAdmin = _.find(profile.userPermissions, function (profileUserPermission) {
224224
return profileUserPermission.name === 'ticketing-admin';
225225
});
226226
if (userId) {
227227
seneca.act({role: 'cd-users', cmd: 'load', id: userId}, function (err, user) {
228228
if (err) return done(err);
229-
if (_.contains(user.roles, 'cdf-admin')) flags.requestingUser.isCDF = true;
229+
if (_.includes(user.roles, 'cdf-admin')) flags.requestingUser.isCDF = true;
230230
return done(null, profile);
231231
});
232232
} else {
@@ -279,15 +279,15 @@ function cmd_user_profile_data (args, done) {
279279

280280
// We look at viewer rights
281281
_.each(requestingUserSharedDojos, function (requestingUserDojo) {
282-
if (_.contains(requestingUserDojo.userTypes, 'champion')) flags.requestingUser.isChampionOf = true;
283-
if (_.contains(requestingUserDojo.userTypes, 'mentor')) flags.requestingUser.isMentorOf = true;
282+
if (_.includes(requestingUserDojo.userTypes, 'champion')) flags.requestingUser.isChampionOf = true;
283+
if (_.includes(requestingUserDojo.userTypes, 'mentor')) flags.requestingUser.isMentorOf = true;
284284
if (_.find(requestingUserDojo.userPermissions, {'title': 'Dojo Admin', 'name': 'dojo-admin'})) flags.requestingUser.isDojoAdminOf = true;
285285
if (_.find(requestingUserDojo.userPermissions, {'title': 'Ticketing Admin', 'name': 'ticketing-admin'})) flags.requestingUser.isTicketingAdminOf = true;
286286
});
287287

288288
// Viewed user flags
289289
_.each(profileDojos, function (profileDojo) {
290-
if (_.contains(profileDojo.userTypes, 'champion')) flags.user.isChampion = true;
290+
if (_.includes(profileDojo.userTypes, 'champion')) flags.user.isChampion = true;
291291
if (_.find(profileDojo.userPermissions, {'title': 'Dojo Admin', 'name': 'dojo-admin'})) flags.user.isDojoAdmin = true;
292292
if (_.find(profileDojo.userPermissions, {'title': 'Ticketing Admin', 'name': 'ticketing-admin'})) flags.user.isTicketingAdmin = true;
293293
});
@@ -307,23 +307,23 @@ function cmd_user_profile_data (args, done) {
307307
function filterFields (err, profile, requestingUserProfile) {
308308
var allowedFields = [];
309309

310-
if (_.contains(profile.userTypes, 'attendee-o13')) {
310+
if (_.includes(profile.userTypes, 'attendee-o13')) {
311311
allowedFields = _.union(allowedFields, allowedOptionalFields['attendee-o13']);
312312
}
313313

314-
if (_.contains(profile.userTypes, 'champion')) {
314+
if (_.includes(profile.userTypes, 'champion')) {
315315
allowedFields = _.union(allowedFields, allowedOptionalFields['champion']);
316316
}
317317

318-
if (_.contains(profile.userTypes, 'mentor')) {
318+
if (_.includes(profile.userTypes, 'mentor')) {
319319
allowedFields = _.union(allowedFields, allowedOptionalFields['mentor']);
320320
}
321321

322322
var keysToOmit = [];
323323
if (!flags.user.ownProfile && !flags.user.myChild && !flags.requestingUser.isTicketingAdmin &&
324324
!flags.requestingUser.isChampionOf && !flags.requestingUser.isDojoAdminOf && !flags.requestingUser.isCDF) {
325325
_.forOwn(profile.optionalHiddenFields, function (value, key) {
326-
if (value && _.contains(allowedFields, key)) {
326+
if (value && _.includes(allowedFields, key)) {
327327
keysToOmit.push(key);
328328
}
329329
});
@@ -380,13 +380,13 @@ function cmd_user_profile_data (args, done) {
380380
* @return {[type]} [description]
381381
*/
382382
function publicProfilesFilter (profile, done) {
383-
if (!flags.requestingUser.canBypassFilter && !_.contains(profile.userTypes, 'attendee-u13')) {
383+
if (!flags.requestingUser.canBypassFilter && !_.includes(profile.userTypes, 'attendee-u13')) {
384384
// Build the list of fields to pick
385385
_.each(profile.userTypes, function (userType) {
386386
publicFields = _.union(publicFields, fieldWhiteList[userType]);
387387
});
388388

389-
if (_.contains(profile.userTypes, 'attendee-o13')) {
389+
if (_.includes(profile.userTypes, 'attendee-o13')) {
390390
publicFields = _.remove(publicFields, function (publicField) {
391391
var idx = youthBlackList.indexOf(publicField);
392392
return !(idx > -1);
@@ -414,7 +414,7 @@ function cmd_user_profile_data (args, done) {
414414
* @return {[type]} [description]
415415
*/
416416
function under13Filter (profile, done) {
417-
if (_.contains(profile.userTypes, 'attendee-u13') && !flags.requestingUser.canBypassFilter) {
417+
if (_.includes(profile.userTypes, 'attendee-u13') && !flags.requestingUser.canBypassFilter) {
418418
profile = {};
419419
}
420420
return done(null, profile);

‎oauth2.js

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -90,13 +90,13 @@ module.exports = function (options) {
9090
seneca.act({role: 'cd-dojos', cmd: 'load_usersdojos', query: {userId: user.id}}, function (err, usersDojos) {
9191
if (err) return done(err);
9292
var championTypeFound = _.find(usersDojos, function (userDojo) {
93-
return _.contains(userDojo.userTypes, 'champion');
93+
return _.includes(userDojo.userTypes, 'champion');
9494
});
9595
var youthOver13TypeFound = _.find(usersDojos, function (userDojo) {
96-
return _.contains(userDojo.userTypes, 'attendee-o13');
96+
return _.includes(userDojo.userTypes, 'attendee-o13');
9797
});
9898
var mentorTypeFound = _.find(usersDojos, function (userDojo) {
99-
return _.contains(userDojo.userTypes, 'mentor');
99+
return _.includes(userDojo.userTypes, 'mentor');
100100
});
101101
var verifyFound = _.any(usersDojos, 'backgroundChecked');
102102
if (championTypeFound) user.isChampion = true;
@@ -178,7 +178,7 @@ module.exports = function (options) {
178178
id: user.id,
179179
name: user.name,
180180
email: user.email,
181-
isAdmin: _.contains(user.roles, 'cdf-admin'),
181+
isAdmin: _.includes(user.roles, 'cdf-admin'),
182182
isChampion: user.isChampion,
183183
isYouthOver13: user.isYouthOver13,
184184
isMentor: user.isMentor,

‎package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
"jed": "1.1.0",
4040
"js-yaml": "3.2.7",
4141
"le_node": "1.1.0",
42-
"lodash": "3.7.0",
42+
"lodash": "4.17.10",
4343
"moment": "2.10.3",
4444
"newrelic": "^2.6.0",
4545
"node-uuid": "1.4.3",

‎profiles.js

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,7 @@ module.exports = function (options) {
269269

270270
// Note : tbdeleted
271271
function saveChild (profile, parentId, done) {
272-
if (_.contains(profile.parents, parentId)) {
272+
if (_.includes(profile.parents, parentId)) {
273273
delete profile.user;
274274
seneca.make$(ENTITY_NS).save$(profile, function (err, profile) {
275275
if (err) {
@@ -417,7 +417,7 @@ module.exports = function (options) {
417417
seneca.act({role: 'cd-dojos', cmd: 'load_usersdojos', query: {userId: requestingUserId}}, function (err, usersDojos) {
418418
if (err) return done(err);
419419
var parentTypeFound = _.find(usersDojos, function (userDojo) {
420-
return _.contains(userDojo.userTypes, 'parent-guardian');
420+
return _.includes(userDojo.userTypes, 'parent-guardian');
421421
});
422422
if (parentTypeFound) return done();
423423
return done(new Error('You must have the parent/guardian user type to accept this invite'));
@@ -463,7 +463,7 @@ module.exports = function (options) {
463463
}
464464

465465
function removeInviteToken (ninjaProfile, done) {
466-
ninjaProfile.parentInvites = _.without(ninjaProfile.parentInvites, _.findWhere(ninjaProfile.parentInvites, {id: inviteTokenId}));
466+
ninjaProfile.parentInvites = _.without(ninjaProfile.parentInvites, _.find(ninjaProfile.parentInvites, {id: inviteTokenId}));
467467
seneca.act({role: plugin, cmd: 'save', profile: ninjaProfile}, done);
468468
}
469469
}
@@ -476,13 +476,13 @@ module.exports = function (options) {
476476
var hostname = process.env.HOSTNAME || '127.0.0.1:8000';
477477
var file = args.file;
478478

479-
if (!_.contains(args.fileType, 'image')) return done(null, {ok: false, why: 'Avatar upload: file must be an image.'});
479+
if (!_.includes(args.fileType, 'image')) return done(null, {ok: false, why: 'Avatar upload: file must be an image.'});
480480
if (file.length > 5242880) return done(null, {ok: false, why: 'Avatar upload: max file size of 5MB exceeded.'});
481481

482482
var buf = new Buffer(file.data, 'base64');
483483
var type = buf.toString('hex', 0, 4);
484484
var types = ['ffd8ffe0', '89504e47', '47494638'];
485-
if (!_.contains(types, type)) return done(null, {ok: false, why: 'Avatar upload: file must be an image of type png, jpeg or gif.'});
485+
if (!_.includes(types, type)) return done(null, {ok: false, why: 'Avatar upload: file must be an image of type png, jpeg or gif.'});
486486

487487
// pg conf properties
488488
options.postgresql.database = options.postgresql.name;
@@ -693,7 +693,7 @@ module.exports = function (options) {
693693
if (err) return done(err);
694694
var ninjaProfile = ninjaProfiles[0];
695695
var userId = args.user ? args.user.id : null;
696-
if (ninjaProfile && _.contains(ninjaProfile.parents, userId)) return done(new Error('User is already a parent of this Ninja'));
696+
if (ninjaProfile && _.includes(ninjaProfile.parents, userId)) return done(new Error('User is already a parent of this Ninja'));
697697
return done();
698698
});
699699
}
@@ -711,7 +711,7 @@ module.exports = function (options) {
711711
seneca.act({role: 'cd-dojos', cmd: 'load_usersdojos', query: {userId: ninjaProfile.userId}}, function (err, ninjaUsersDojos) {
712712
if (err) return done(err);
713713
var attendeeO13TypeFound = _.find(ninjaUsersDojos, function (ninjaUserDojo) {
714-
return _.contains(ninjaUserDojo.userTypes, 'attendee-o13');
714+
return _.includes(ninjaUserDojo.userTypes, 'attendee-o13');
715715
});
716716
if (attendeeO13TypeFound || ninjaProfile.userType === 'attendee-o13') return done();
717717
return done(new Error('Ninja must be an over 13 attendee'));
@@ -798,7 +798,7 @@ module.exports = function (options) {
798798
// Add ninja user id to Parent children array
799799
if (!parentProfile.children) parentProfile.children = [];
800800
parentProfile.children.push(ninjaProfile.userId);
801-
parentProfile.ninjaInvites = _.without(parentProfile.ninjaInvites, _.findWhere(parentProfile.ninjaInvites, {id: inviteData.inviteTokenId}));
801+
parentProfile.ninjaInvites = _.without(parentProfile.ninjaInvites, _.find(parentProfile.ninjaInvites, {id: inviteData.inviteTokenId}));
802802

803803
if (!ninjaProfile.parents) ninjaProfile.parents = [];
804804
ninjaProfile.parents.push(parentProfile.userId);

‎yarn.lock

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3153,10 +3153,6 @@ [email protected], lodash@^3.10.0, lodash@^3.10.1, lodash@^3.2.0, lodash@^3.3.1, lod
31533153
version "3.10.1"
31543154
resolved "https://registry.yarnpkg.com/lodash/-/lodash-3.10.1.tgz#5bf45e8e49ba4189e17d482789dfd15bd140b7b6"
31553155

3156-
[email protected]:
3157-
version "3.7.0"
3158-
resolved "https://registry.yarnpkg.com/lodash/-/lodash-3.7.0.tgz#3678bd8ab995057c07ade836ed2ef087da811d45"
3159-
31603156
[email protected]:
31613157
version "3.9.3"
31623158
resolved "https://registry.yarnpkg.com/lodash/-/lodash-3.9.3.tgz#0159e86832feffc6d61d852b12a953b99496bd32"
@@ -3177,6 +3173,10 @@ [email protected]:
31773173
version "4.15.0"
31783174
resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.15.0.tgz#3162391d8f0140aa22cf8f6b3c34d6b7f63d3aa9"
31793175

3176+
[email protected]:
3177+
version "4.17.10"
3178+
resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.10.tgz#1b7793cf7259ea38fb3661d4d38b3260af8ae4e7"
3179+
31803180
[email protected]:
31813181
version "4.2.1"
31823182
resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.2.1.tgz#171fdcfbbc30d689c544cd18c0529f56de6c1aa9"

0 commit comments

Comments
 (0)