Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
RestWrite.prototype.transformUser = function() {
var promise = Promise.resolve();
if (this.className !== '_User') {
return promise;
}
if (!this.auth.isMaster && 'emailVerified' in this.data) {
const error = `Clients aren't allowed to manually update email verification.`;
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, error);
}
// Do not cleanup session if objectId is not set
if (this.query && this.objectId()) {
// If we're updating a _User object, we need to clear out the cache for that user. Find all their
// session tokens, and remove them from the cache.
promise = new RestQuery(this.config, Auth.master(this.config), '_Session', {
user: {
__type: 'Pointer',
className: '_User',
objectId: this.objectId(),
},
})
.execute()
.then(results => {
results.results.forEach(session =>
handleVerificationEmailRequest(req) {
this._throwOnBadEmailConfig(req);
const { email } = req.body;
if (!email) {
throw new Parse.Error(
Parse.Error.EMAIL_MISSING,
'you must provide an email'
);
}
if (typeof email !== 'string') {
throw new Parse.Error(
Parse.Error.INVALID_EMAIL_ADDRESS,
'you must provide a valid email string'
);
}
return req.config.database.find('_User', { email: email }).then(results => {
if (!results.length || results.length < 1) {
throw new Parse.Error(
Parse.Error.EMAIL_NOT_FOUND,
`No user found with email ${email}`
);
}
const user = results[0];
// remove password field, messes with saving on postgres
delete user.password;
RestWrite.prototype._validateEmail = function() {
if (!this.data.email || this.data.email.__op === 'Delete') {
return Promise.resolve();
}
// Validate basic email address format
if (!this.data.email.match(/^.+@.+$/)) {
return Promise.reject(
new Parse.Error(
Parse.Error.INVALID_EMAIL_ADDRESS,
'Email address format is invalid.'
)
);
}
// Same problem for email as above for username
return this.config.database
.find(
this.className,
{ email: this.data.email, objectId: { $ne: this.objectId() } },
{ limit: 1 },
{},
this.validSchemaController
)
.then(results => {
if (results.length > 0) {
const calculateSkipAndLimit = (
skipInput,
first,
after,
last,
before,
maxLimit
) => {
let skip = undefined;
let limit = undefined;
let needToPreCount = false;
// Validates the skip input
if (skipInput || skipInput === 0) {
if (skipInput < 0) {
throw new Parse.Error(
Parse.Error.INVALID_QUERY,
'Skip should be a positive number'
);
}
skip = skipInput;
}
// Validates the after param
if (after) {
after = cursorToOffset(after);
if ((!after && after !== 0) || after < 0) {
throw new Parse.Error(
Parse.Error.INVALID_QUERY,
'After is not a valid cursor'
);
}
schema.fields[fieldName].type === 'Array'
) {
const expectedType = parseTypeToPostgresType(schema.fields[fieldName]);
if (expectedType === 'text[]') {
updatePatterns.push(`$${index}:name = $${index + 1}::text[]`);
values.push(fieldName, fieldValue);
index += 2;
} else {
updatePatterns.push(`$${index}:name = $${index + 1}::jsonb`);
values.push(fieldName, JSON.stringify(fieldValue));
index += 2;
}
} else {
debug('Not supported update', fieldName, fieldValue);
return Promise.reject(
new Parse.Error(
Parse.Error.OPERATION_FORBIDDEN,
`Postgres doesn't support update ${JSON.stringify(fieldValue)} yet`
)
);
}
}
const where = buildWhereClause({ schema, index, query });
values.push(...where.values);
const whereClause =
where.pattern.length > 0 ? `WHERE ${where.pattern}` : '';
const qs = `UPDATE $1:name SET ${updatePatterns.join()} ${whereClause} RETURNING *`;
debug('update: ', qs, values);
const promise = (transactionalSession
? transactionalSession.t
castType = undefined;
}
constraintFieldName = castType
? `CAST ((${transformDotField(fieldName)}) AS ${castType})`
: transformDotField(fieldName);
} else {
constraintFieldName = `$${index++}:name`;
values.push(fieldName);
}
values.push(postgresValue);
patterns.push(`${constraintFieldName} ${pgComparator} $${index++}`);
}
});
if (initialPatternsLength === patterns.length) {
throw new Parse.Error(
Parse.Error.OPERATION_FORBIDDEN,
`Postgres doesn't support this query type yet ${JSON.stringify(
fieldValue
)}`
);
}
}
values = values.map(transformValue);
return { pattern: patterns.join(' AND '), values, sorts };
};
tryRouteRequest(method, path, request) {
var match = this.match(method, path);
if (!match) {
throw new Parse.Error(
Parse.Error.INVALID_JSON,
'cannot route ' + method + ' ' + path
);
}
request.params = match.params;
return new Promise((resolve, reject) => {
match.handler(request).then(resolve, reject);
});
}
}
return this._config.database.find('_User', query).then(users => {
if (Array.isArray(users) && users.length > 0) {
throw new Parse.Error(
Parse.Error.OBJECT_NOT_FOUND,
'Your account is locked due to multiple failed login attempts. Please try again after ' +
this._config.accountLockout.duration +
' minute(s)'
);
}
});
}
handleGet(req) {
const body = Object.assign(req.body, ClassesRouter.JSONFromQuery(req.query));
const options = {};
for (const key of Object.keys(body)) {
if (ALLOWED_GET_QUERY_KEYS.indexOf(key) === -1) {
throw new Parse.Error(Parse.Error.INVALID_QUERY, 'Improper encode of parameter');
}
}
if (typeof body.keys == 'string') {
options.keys = body.keys;
}
if (body.include) {
options.include = String(body.include);
}
return rest.get(req.config, req.auth, this.className(req), req.params.objectId, options, req.info.clientSDK)
.then((response) => {
if (!response.results || response.results.length == 0) {
throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, 'Object not found.');
}