Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
app.get("/", function(req, res) {
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync("B4c0/\/", salt);
if (bcrypt.compare_sync("B4c0/\/", hash))
res.send("hello from express");
else
res.send("");
});
client.query("SELECT * FROM `primarywall`.`user` WHERE `UserID` = ?", [user], function (err, results, fields)
{
var success=err == null && results.length==1;
if (success)
{
var user = JSON.parse(results[0].JSON);
correctauth = bcrypt.compare_sync(pass, user.password);
}
else if(err)
{
//mysql problem
console.error("MYSQL_ERROR: " + JSON.stringify(err));
}
callback(success, correctauth);
});
}
adminUserModel.findOne({'username': username}, function(err, adminUserData) {
if (err) {
console.log('Unable to get admin user because: ' + err);
onReady('Unable to get admin user', null);
} else {
if (adminUserData) {
if (bcrypt.compare_sync(password, adminUserData.passwordHash)) {
adminUser.fields = adminUserData;
onReady(null, adminUser);
} else {
onReady(null, null);
}
} else {
onReady(null, null);
}
}
});
};
getUser(req.body.email, function (user) {
if (user && bcrypt.compare_sync(req.body.password, user.encrypted_password)) {
var pt = helpers.persistence_token();
user.persistence_token = pt;
user.last_login_at = user.current_login_at;
user.last_login_ip = user.current_login_ip;
user.current_login_at = +(new Date());
user.current_login_ip = req.connection.remoteAddress;
saveUser(user, function () {
req.session.pt = pt;
res.redirect("/");
}, failed_authentication);
} else {
failed_authentication();
}
redis.hgetall(req.body.email, function (err, user) {
if (!err && user.email == req.body.email) {
if (bcrypt.compare_sync(req.body.password, user.encrypted_password)) {
var pt = helpers.persistence_token();
var now = +new Date();
var ipAddr = req.connection.remoteAddress;
redis.hmset(req.body.email, "persistence_token", pt, "current_login_at", ""+now, "last_login_at", user.current_login_at, "last_login_ip", user.current_login_ip, "current_login_ip", ipAddr, function (err) {
req.session.pt = req.body.email+":"+pt;
res.redirect("/");
});
} else {
res.render(__dirname+"/views/authenticate", {layout: __dirname+"/views/layout", failed: true, email: req.body.email})
}
} else {
res.render(__dirname+"/views/authenticate", {layout: __dirname+"/views/layout", failed: true, email: req.body.email})
}
})
} else {
postgresql.query("select * from users where LOWER("+options["email_key"]+") = $1 and disabled_at is null and deleted_at is null", [req.body.email.toLowerCase()], function (err, result) {
if (result.rows.length == 1) {
var user = result.rows[0];
if (bcrypt.compare_sync(req.body.password, user.crypted_password)) {
var pt = helpers.persistence_token();
var now = new Date();
var ipAddr = req.connection.remoteAddress;
postgresql.query("update users set persistence_token = $1, current_login_at = $2, last_login_at = $3, last_login_ip = $4, current_login_ip = $5, login_count = $6 where id = $7;", [pt, now, user.current_login_at, user.current_login_ip, ipAddr, (user.login_count || 0) + 1, user.id ], function (err, update_res) {
if (!err) {
req.session.pt = pt;
if (req.session.previous_url) {
var purl = req.session.previous_url;
delete req.session.previous_url;
res.redirect(purl);
} else {
res.redirect("/");
}
} else {
failed();
}