Skip to content

Commit ed63979

Browse files
NoNameProvidedNoNameProvided
authored
Merge pull request #251 from pleerock/fix/fileupload-auth
fix(Drivers): check auhorization before accepting files
2 parents 726b913 + 4a23396 commit ed63979

File tree

3 files changed

+75
-69
lines changed

3 files changed

+75
-69
lines changed

‎CHANGELOG.md

Lines changed: 44 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,61 @@
11
# Changelog and release notes
22

3-
**0.7.2**
4-
- FIXED: Using `@Authorization` decorator with Koa caused 404 responses (ref #240)
3+
### 0.7.2
54

6-
**0.7.1**
5+
- FIXED: Using `@Authorization` decorator with Koa caused 404 responses (ref [#240](https://github.com/pleerock/routing-controllers/pull/240))
6+
- FIXED: Allow throwing custom errors in `authorizationChecker` (ref [#233](https://github.com/pleerock/routing-controllers/pull/233), ref [#247](https://github.com/pleerock/routing-controllers/pull/247))
7+
- FIXED: check auth permissions before accepting files for upload (ref [#251](https://github.com/pleerock/routing-controllers/pull/240))
78

8-
**0.7.0** *[BREAKING CHANGES]*
9+
### 0.7.1
910

10-
* some routing-controllers options has been changed and renamed
11-
* returned validation error value signature has changed
12-
* controllers and middlewares now can be specified in routing-controllers options
13-
* `MiddlewareInterface` was removed and instead `ExpressMiddlewareInterface` or `KoaMiddlewareInterface` should be used
14-
* `ExpressErrorMiddlewareInterface` was renamed into `ErrorMiddlewareInterface`
15-
* per-controller and per-action middlewares used in `@UseBefore` and `@UseAfter` now should not be marked with `@Middleware` decorator
16-
* `@MiddlewareGlobalBefore()` and `@MiddlewareGlobalAfter()` were removed and instead new signatures should be used: `@Middleware({ type: "before" })`
11+
### 0.7.0 [BREAKING CHANGES]
12+
13+
- some routing-controllers options has been changed and renamed
14+
- returned validation error value signature has changed
15+
- controllers and middlewares now can be specified in routing-controllers options
16+
- `MiddlewareInterface` was removed and instead `ExpressMiddlewareInterface` or `KoaMiddlewareInterface` should be used
17+
- `ExpressErrorMiddlewareInterface` was renamed into `ErrorMiddlewareInterface`
18+
- per-controller and per-action middlewares used in `@UseBefore` and `@UseAfter` now should not be marked with `@Middleware` decorator
19+
- `@MiddlewareGlobalBefore()` and `@MiddlewareGlobalAfter()` were removed and instead new signatures should be used: `@Middleware({ type: "before" })`
1720
and `@Middleware({ type: "after" })`
18-
* named some decorator parameter names
19-
* added few new decorators to get all parameters like `@QueryParams`, `@Params`, `@HeaderParams` etc.
20-
* added `@Authorized` and `@CurrentUser` decorators
21-
* added new `@Ctx` decorator to use context with koa
22-
* `@NullResultCode` has been renamed to `@OnNull`, now supports error classes
23-
* `@UndefinedResultCode` has been renamed to `@OnUndefined`, now supports error classes
24-
* `@EmptyResultCode` has been removed. Use `@OnUndefined` decorator instead and return concrete types in your controllers.
25-
* added ability to create custom decorators
26-
* enabled validation by default
27-
* multiple bug fixes
28-
* codebase refactoring
29-
* removed `JsonResponse` and `TextResponse` decorators
30-
31-
**0.6.10**
21+
- named some decorator parameter names
22+
- added few new decorators to get all parameters like `@QueryParams`, `@Params`, `@HeaderParams` etc.
23+
- added `@Authorized` and `@CurrentUser` decorators
24+
- added new `@Ctx` decorator to use context with koa
25+
- `@NullResultCode` has been renamed to `@OnNull`, now supports error classes
26+
- `@UndefinedResultCode` has been renamed to `@OnUndefined`, now supports error classes
27+
- `@EmptyResultCode` has been removed. Use `@OnUndefined` decorator instead and return concrete types in your controllers.
28+
- added ability to create custom decorators
29+
- enabled validation by default
30+
- multiple bug fixes
31+
- codebase refactoring
32+
- removed `JsonResponse` and `TextResponse` decorators
33+
34+
### 0.6.10
3235

3336
* added integration with `class-transform-validator` for deserialization and auto validation request parameters
3437

35-
**0.6.2**
38+
### 0.6.2
3639

3740
* made interceptors to support promises
3841

39-
**0.6.1**
42+
### 0.6.1
4043

41-
* added interceptors support
44+
- added interceptors support
4245

43-
**0.6.0** *[BREAKING CHANGES]*
46+
### 0.6.0 [BREAKING CHANGES]
4447

45-
* middleware and error handlers support
46-
* everything packed into "routing-controllers" main export
47-
* removed parseJson from @Body decorator
48-
* removed ActionOptions
49-
* removed responseType from action options and added @JsonResponse and @TextResponse decorators
50-
* added few more new decorators
51-
* fixed multiple issues with param decorators
52-
* fixed multiple bugs
53-
* refactored core
48+
- middleware and error handlers support
49+
- everything packed into "routing-controllers" main export
50+
- removed parseJson from @Body decorator
51+
- removed ActionOptions
52+
- removed responseType from action options and added @JsonResponse and @TextResponse decorators
53+
- added few more new decorators
54+
- fixed multiple issues with param decorators
55+
- fixed multiple bugs
56+
- refactored core
5457

55-
**0.5.0**
58+
### 0.5.0
5659

57-
* renamed package from `controllers.ts` to `routing-controllers`
58-
* added integration with `constructor-utils` for serialization and deserialization
60+
- renamed package from `controllers.ts` to `routing-controllers`
61+
- added integration with `constructor-utils` for serialization and deserialization

‎src/driver/express/ExpressDriver.ts

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -87,33 +87,21 @@ export class ExpressDriver extends BaseDriver implements Driver {
8787

8888
// middlewares required for this action
8989
const defaultMiddlewares: any[] = [];
90+
9091
if (actionMetadata.isBodyUsed) {
9192
if (actionMetadata.isJsonTyped) {
9293
defaultMiddlewares.push(this.loadBodyParser().json(actionMetadata.bodyExtraOptions));
9394
} else {
9495
defaultMiddlewares.push(this.loadBodyParser().text(actionMetadata.bodyExtraOptions));
9596
}
9697
}
97-
if (actionMetadata.isFileUsed || actionMetadata.isFilesUsed) {
98-
const multer = this.loadMulter();
99-
actionMetadata.params
100-
.filter(param => param.type === "file")
101-
.forEach(param => {
102-
defaultMiddlewares.push(multer(param.extraOptions).single(param.name));
103-
});
104-
actionMetadata.params
105-
.filter(param => param.type === "files")
106-
.forEach(param => {
107-
defaultMiddlewares.push(multer(param.extraOptions).array(param.name));
108-
});
109-
}
11098

11199
if (actionMetadata.isAuthorizedUsed) {
112100
defaultMiddlewares.push((request: any, response: any, next: Function) => {
113101
if (!this.authorizationChecker)
114102
throw new AuthorizationCheckerNotDefinedError();
115103

116-
const action: Action = {request, response, next};
104+
const action: Action = { request, response, next };
117105
const checkResult = this.authorizationChecker(action, actionMetadata.authorizedRoles);
118106

119107
const handleError = (result: any) => {
@@ -135,6 +123,20 @@ export class ExpressDriver extends BaseDriver implements Driver {
135123
});
136124
}
137125

126+
if (actionMetadata.isFileUsed || actionMetadata.isFilesUsed) {
127+
const multer = this.loadMulter();
128+
actionMetadata.params
129+
.filter(param => param.type === "file")
130+
.forEach(param => {
131+
defaultMiddlewares.push(multer(param.extraOptions).single(param.name));
132+
});
133+
actionMetadata.params
134+
.filter(param => param.type === "files")
135+
.forEach(param => {
136+
defaultMiddlewares.push(multer(param.extraOptions).array(param.name));
137+
});
138+
}
139+
138140
// user used middlewares
139141
const uses = [...actionMetadata.controllerMetadata.uses, ...actionMetadata.uses];
140142
const beforeMiddlewares = this.prepareMiddlewares(uses.filter(use => !use.afterAction));

‎src/driver/koa/KoaDriver.ts

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -69,26 +69,13 @@ export class KoaDriver extends BaseDriver implements Driver {
6969

7070
// middlewares required for this action
7171
const defaultMiddlewares: any[] = [];
72-
if (actionMetadata.isFileUsed || actionMetadata.isFilesUsed) {
73-
const multer = this.loadMulter();
74-
actionMetadata.params
75-
.filter(param => param.type === "file")
76-
.forEach(param => {
77-
defaultMiddlewares.push(multer(param.extraOptions).single(param.name));
78-
});
79-
actionMetadata.params
80-
.filter(param => param.type === "files")
81-
.forEach(param => {
82-
defaultMiddlewares.push(multer(param.extraOptions).array(param.name));
83-
});
84-
}
8572

8673
if (actionMetadata.isAuthorizedUsed) {
8774
defaultMiddlewares.push((context: any, next: Function) => {
8875
if (!this.authorizationChecker)
8976
throw new AuthorizationCheckerNotDefinedError();
9077

91-
const action: Action = {request: context.request, response: context.response, context, next};
78+
const action: Action = { request: context.request, response: context.response, context, next };
9279
const checkResult = actionMetadata.authorizedRoles instanceof Function ?
9380
getFromContainer<RoleChecker>(actionMetadata.authorizedRoles).check(action) :
9481
this.authorizationChecker(action, actionMetadata.authorizedRoles);
@@ -112,6 +99,20 @@ export class KoaDriver extends BaseDriver implements Driver {
11299
});
113100
}
114101

102+
if (actionMetadata.isFileUsed || actionMetadata.isFilesUsed) {
103+
const multer = this.loadMulter();
104+
actionMetadata.params
105+
.filter(param => param.type === "file")
106+
.forEach(param => {
107+
defaultMiddlewares.push(multer(param.extraOptions).single(param.name));
108+
});
109+
actionMetadata.params
110+
.filter(param => param.type === "files")
111+
.forEach(param => {
112+
defaultMiddlewares.push(multer(param.extraOptions).array(param.name));
113+
});
114+
}
115+
115116
// user used middlewares
116117
const uses = actionMetadata.controllerMetadata.uses.concat(actionMetadata.uses);
117118
const beforeMiddlewares = this.prepareMiddlewares(uses.filter(use => !use.afterAction));

0 commit comments

Comments
 (0)