Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (!req.body.apiKey) {
res.locals.csrf = req.csrfToken();
} else {
res.locals.csrf = false;
}
if (!process.env.NODE_ENV) {
res.locals.debug = true;
} else {
res.locals.debug = false;
}
res.locals.analytics = nconf.get('analytics');
res.locals.appId = nconf.get('appId');
res.locals.analyticsHost = nconf.get('analyticsHost');
next();
});
app.use(i18n.handle);
app.enable('trust proxy');
app.locals.pretty = true;
app.use(function (req, res, next) {
// prevent framing by other sites
res.set('X-Frame-Options', 'SAMEORIGIN');
next();
});
app.use(app.router);
app.use(function (req, res, next) {
res.status(404);
res.render('404', { url: req.url, layout: false });
return;
});
app.use(function (req, res, next) {
res.status(403);
res.render('403', { url: req.url, layout: false });
// see: http://stackoverflow.com/questions/7067966/how-to-allow-cors-in-express-nodejs
app.use(function(req, res, next) {
res.header('Access-Control-Allow-Origin', '*');
res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
res.header('Cache-Control', 'private, max-age=0');
res.header('Expires', new Date().toUTCString());
if ('OPTIONS' === req.method) {
res.send(200);
} else {
next();
}
});
// i18next routing
app.use(i18n.handle);
// Static resources
for (var route in settings.webroot) {
if ( ! settings.webroot.hasOwnProperty(route)) {
continue;
}
var staticAssets = settings.webroot[route];
app.use(route, express.static(staticAssets));
}
// "app.router" positions our routes
// above the middleware defined below,
// this means that Express will attempt
// to match & call routes _before_ continuing
// on, at which point we assume it's a 404 because
// no route has handled the request.
maxAge: 365 * 24 * 60 * 60 * 1000 // one year
}, // 1 minute
secret: settings.sessionSecret
}));
*/
app.use(express.compress());
if (settings.route) {
app.use(settings.route, express.static(settings.asset));
} else {
app.use(express.static(settings.asset));
}
/**
* i18n routing
*/
app.use(i18n.handle);
/**
* app.router positions our routes above the middleware defined below,
* this means that Express will attempt to match & call routes _before_
* continuing on, at which point we assume it's a 404 because no route
* has handled the request.
*/
app.use(app.router);
/**
* Error handling
*/
app.use(middleware.err_log());
app.use(middleware.err_client({
error: 'XHR error'
}));
secret:sessionSecret}));
app.use(express.bodyParser());
var csrf = express.csrf();
app.use(function(req,res,next){
if (isClustered && (!req.cookies.stickyid || (req.headers.stickyid && req.cookies.stickyid !== req.headers.stickyid)) && req.headers.stickyid) {
res.cookie('stickyid', req.headers.stickyid, { /*maxAge: null,*/ httpOnly: true });
}
// Skip CSRF Check for LTI Initial Route, and forces https
if ((req.protocol === 'http') && (req.url === LTI_PATH) && isOpenShift()) {
Object.defineProperty(req, 'protocol', { value: 'https', writable: false });
req.headers.host = process.env.LTI_DOMAIN || req.headers.host;
logger.debug(req.protocol+'://'+req.headers.host+(req.port?':'+req.port:'')+'/'+req.url);
}
return skipPath(req.url)?next():csrf(req,res,next);
});
app.use(i18n.handle);
app.use(express.methodOverride());
app.use(function(req, res, next) {
if (req.csrfToken) {
res.locals.token = req.csrfToken();
}
next();
});
express.logger.token('sessionid', function(req){
return req.cookies.jsessionid;
});
express.logger.token('ip', function(request) {
var retval = '';
if (request.headers && request.headers['x-forwarded-for']) {
// Proxied request
retval = request.headers['x-forwarded-for'];
} else if (request.socket && request.socket.remoteAddress) {
app.configure(function() {
app.use(express.bodyParser());
app.use(i18n.handle); // have i18n befor app.router
app.use(app.router);
// app.set('view engine', 'jade');
// app.set('views', __dirname);
app.use('/app', express.static('client/app'));
app.use('/assets', express.static('client/assets'));
app.use('/app/templates', express.static('client/assets/templates'));
// for release
app.use('/release', express.static('client/dist/release/assets'));
app.use('/', express.static('client/dist/release/assets'));
});
module.exports = function(app) {
i18n.init(i18nOptions, function(err) {
if (err)
console.warn('error initializing i18n module');
else
console.log('i18n module initialized');
});
app.use(i18n.handle);
i18n.registerAppHelper(app);
};
});
utils.extendEjs(ejs);
var app = express();
app.engine('.html', ejs.__express);
app.set('views', __dirname + '/views');
app.set('view engine', 'html');
i18n.init();
app.locals.config = require('./config');
app.locals.utils = utils;
app.use(i18n.handle);
app.use(favicon(__dirname + '/public/assets/images/favicon.ico'));
app.use(utils.sundry);
app.use(utils.rightsControl);
app.use(express.static(path.join(__dirname, 'public')));
app.use(bodyParser());
app.use(config.managerPath, require('./controllers/api'));
app.use(config.managerPath, require('./controllers/simulator'));
app.use(require('./controllers/handler'));
app.listen(config.port, function(){
console.log('Server started at '+config.port + ' ...');
});
register(app) {
i18next.init();
return app.use(i18next.handle);
},
app.configure(function(){
app.use(express.bodyParser());
app.use(i18n.handle);
app.set('views', __dirname + '/views');
app.set('view engine', 'jade');
app.use(app.router);
app.use(require('stylus').middleware(
{ src : __dirname + '/public' ,
compile: compile
} ));
app.use(express.static(path.join(__dirname, 'public')));
});
.then(passValue(fn))
.catch(passError(fn));
});
app.set('view engine', 'html');
app.use(express.favicon());
app.use(express.static(path.join(__dirname, htdocs), {
index: 'default.htm'
}));
app.use(express.logger('dev'));
app.use(express.cookieParser());
app.use(express.json());
app.use(express.urlencoded());
app.use(methodOverride());
app.use(i18next.handle);
//register moment handler & server-side rendering
app.use(function(req, res, next) {
res.locals({
rendered: true,
pushState: true,
'moment': {
'obj': moment,
'lang': req.lng.toLowerCase()
}
});
next();
});
app.use(app.router);