verdnatura-mirror
/
loopback
mirror of https://github.com/strongloop/loopback.git
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
2,361 Commits 62 Branches 176 Tags 11 MiB
Commit Graph

2361 Commits

Author SHA1 Message Date
Miroslav Bajtoš 0a2a45512c
Fix "POST /reset-password" for multi-user setup 
Fix the code extracting current user id from the access token provided
in the HTTP request, to allow only access tokens created by the target
user models to execute the action.

This fixes the following security vulnerability:

* A UserA with id 1 (for example), requires a resetToken1

* A UserB with the same id requires a resetToken2.

* Using resetToken2, use the UserAs/reset-password endpoint and change
  the password of UserA and/or vice-versa.
 2017-10-19 13:29:08 +02:00
Miroslav Bajtoš 4ebc517a78
test: extract helpers for logging HTTP errors 
Extract two helpers into a shared file:

 - logAllServerErrors(app)
 - logServerErrorsOtherThan(statusCode, app)
 2017-10-19 13:08:54 +02:00
Miroslav Bajtoš 083fb5d668 Merge pull request #3659 from strongloop/remove/lehni 
CODEOWNERS: move @lehni to Alumni section
 2017-10-19 10:44:20 +02:00
Miroslav Bajtoš c3450df4db
CODEOWNERS: move @lehni to Alumni section 2017-10-19 10:42:54 +02:00
Miroslav Bajtoš f30159cd23
3.15.0 
* update strong-globalize to 3.1.0 (shimks)
 * Fix handling of user verification options (Miroslav Bajtoš)
 * Handle missing getUpdateOnlyProperties fn (Jürg Lehni)
 * test: fix too strict test assertion (Miroslav Bajtoš)
 * Fix typo (Siegfried Ehret)
 2017-10-13 15:33:56 +02:00
Miroslav Bajtoš 64d60fb6f7 Merge pull request #3650 from strongloop/update-strong-globalize 
update strong-globalize to 3.1.0
 2017-10-13 15:27:02 +02:00
shimks 2f02fbac89 update strong-globalize to 3.1.0 2017-10-12 15:08:04 -04:00
Miroslav Bajtoš fb8f3d9df3 Merge pull request #3647 from lehni/model/fix-updateonly-props-check 
Handle missing getUpdateOnlyProperties fn on Model
 2017-10-09 17:00:55 +02:00
Miroslav Bajtoš 9176ee2e11 Merge pull request #3609 from sebastianfelipe/fix/user-verify-duplicated-token 
Fix handling of user verification options
 2017-10-09 14:00:22 +02:00
Miroslav Bajtoš d0a4941668
Fix handling of user verification options 
- Fix `User.prototype.verify` to not modify properties of the supplied
   `verifyOptions` argument. This is needed to allow callers to supply
   the same options object to multiple calls of `verify`.

 - Fix `User.getVerifyOptions` to always return a new copy of the
   options object. This is needed to allow callers to modify the
   returned options object without affecting the result returned
   by subsequent calls of `getVerifyOptions`.
 2017-10-09 13:42:22 +02:00
Jürg Lehni 826ee2aca8 Handle missing getUpdateOnlyProperties fn 
If the current scope does not define a getUpdateOnlyProperties
function, the updateOnlyProps value will now be set to false.
 2017-10-09 09:19:47 +02:00
Miroslav Bajtoš 8488da2e26 Merge pull request #3637 from strongloop/fix/build 
test: fix too strict test assertion
 2017-10-05 13:14:52 +02:00
Miroslav Bajtoš 33989d776c
test: fix too strict test assertion 
Rework the test verifying properties of `loopback` to ignore
new express properties added after the test was written.
 2017-10-04 10:31:50 +02:00
Miroslav Bajtoš 1dd0ab31e0 Merge pull request #3636 from SiegfriedEhret/patch-1 
Fix typo in jsdoc
 2017-10-04 10:11:04 +02:00
Siegfried Ehret db8130ac6d Fix typo 
Update a jsdoc thing to match the argument name.
 2017-10-04 09:26:17 +02:00
Raymond Feng c9913927e5 3.14.0 
* Allow declarative nestRemoting for relations (Raymond Feng)
 2017-09-28 11:07:15 -07:00
Raymond Feng c453ad52c2 Merge pull request #3628 from strongloop/declarative-nest-remoting 
Allow declarative nestRemoting for relations
 2017-09-28 11:06:32 -07:00
Raymond Feng c0a0f09f3a Allow declarative nestRemoting for relations 
Now relation.options.nestRemoting can be set to true so that
nestRemoting will be set up automatically without explicitly
calling MyModel.nestRemoting
 2017-09-27 09:22:06 -07:00
Miroslav Bajtoš fcfaf7ef53
3.13.0 
* Fix OWNER role to handle multiple relations (pierreclr)
 * Fix acl.resolvePermission for wildcard req (Farid Neshat)
 * CODEOWNERS: add zbarbuto (Miroslav Bajtoš)
 2017-09-27 17:45:28 +02:00
Miroslav Bajtoš 658d228789 Merge pull request #3140 from pierreclr/feature/allow-mutiple-owners-resolving 
Fix OWNER role to handle multiple relations
 2017-09-27 17:43:48 +02:00
pierreclr e17132d061
Fix OWNER role to handle multiple relations 
Fix the code resolving OWNER role to correctly handle the situation
where the target model has multiple "belongsTo" relations to the User
model.

Introduce a new model setting "ownerRelations" that enables the new
behavior. When "ownerRelations" is set to true, then all "belongsTo"
relations are considered as granting ownership. Alternatively,
"ownerRelations" can be set to an array of the relations which
are granting ownership.

For example, a document can "belongTo" an author and a reviewer,
but only the author is an owner, the reviewer is not. In this case,
"ownerRelations" should be set to "['author']".
 2017-09-27 17:11:36 +02:00
Miroslav Bajtoš ef7175a4d5 Merge pull request #3293 from alFReD-NSH/bugfix/acl-checkpermission 
Fix acl.resolvePermission not working with wildcard request
 2017-09-27 16:51:27 +02:00
Miroslav Bajtoš 2128ecde46 Merge pull request #3625 from strongloop/welcome-zbarbuto 
CODEOWNERS: add zbarbuto
 2017-09-27 11:10:40 +02:00
Farid Neshat d2d8fabb16 Fix acl.resolvePermission for wildcard req 
When acl.resolvePermission was called with a request containing a
wildcard, it would return the matching acl with lowest score instead of
higher.

Fixes #2153
 2017-09-27 02:48:34 +02:00
Miroslav Bajtoš 4c4430ea95
3.12.0 
* Fix relation race condition in model glob (Zak Barbuto)
 * CODEOWNERS: add lehni (Miroslav Bajtoš)
 2017-09-25 15:58:47 +02:00
Miroslav Bajtoš 883667ce8e
CODEOWNERS: add zbarbuto 2017-09-25 09:49:00 +02:00
Miroslav Bajtoš 0f40ca8f8e Merge pull request #3565 from zbarbuto/fix/shared-glob 
Fix relation race condition in model glob
 2017-09-01 09:44:13 +02:00
Zak Barbuto d405432b2d Fix relation race condition in model glob 
Globs working depended on the order that models were imported.
Remote sharing is now re-calculated whenever a new model is remoted.
 2017-09-01 09:18:39 +09:30
Miroslav Bajtoš 30f3161c65 Merge pull request #3595 from strongloop/welcome-lehni 
CODEOWNERS: add lehni as a collaborator
 2017-08-31 11:15:07 +02:00
Miroslav Bajtoš 63721fd253
CODEOWNERS: add lehni 2017-08-30 10:46:06 +02:00
rashmihunt 6ba35c297b 3.11.1 
* Handle missing getUpdateOnlyProperties fn (Kevin Delisle)
 2017-08-23 09:17:57 -07:00
Kevin Delisle 8bff145c65 Merge pull request #3579 from strongloop/persisted-model/fix-updateonly-props-check 
Handle missing getUpdateOnlyProperties fn
 2017-08-23 10:48:19 -04:00
Kevin Delisle 16ede97033 Handle missing getUpdateOnlyProperties fn 
If the current scope does not define a getUpdateOnlyProperties
function, the updateOnlyProps value will now be set to false.
 2017-08-23 10:21:11 -04:00
rashmihunt 29e89f50e5 3.11.0 
* Support createOnlyInstance in model (#3548) (Rashmi Hunt)
 * Add stalebot configuration (Kevin Delisle)
 * Catch errors on invalidate update (loay)
 * Update Issue and PR Templates (#3568) (Sakib Hasan)
 2017-08-22 17:17:24 -07:00
Rashmi Hunt 3651c09782 Support createOnlyInstance in model (#3548) 
* setting up createOnlyInstance

* add comment

* fix eslint issue

* new tests

* Address code review comments
 2017-08-22 17:10:55 -07:00
Kevin Delisle 661f7741cd Add stalebot configuration 2017-08-22 15:12:54 -04:00
Loay 4a8e3f1327 Merge pull request #3570 from strongloop/catch-err 
Catch errors on invalidate update
 2017-08-17 11:24:57 -04:00
loay bf4b5de648 Catch errors on invalidate update 2017-08-17 10:46:09 -04:00
Sakib Hasan b3602bdd18 Update Issue and PR Templates (#3568) 
* update issue template

* update pr template
 2017-08-16 11:54:30 -04:00
Miroslav Bajtoš b1adba1c4a
3.10.1 
* fix(validatePassword): reword error message (Samuel Reed)
 * Do not add isStatic properties to method settings (Jürg Lehni)
 2017-08-16 16:20:33 +02:00
Miroslav Bajtoš 2ebe38b4d5 Merge pull request #3540 from lehni/fix/isStatic-method-settings 
Do not add isStatic properties to method settings
 2017-08-16 15:55:11 +02:00
Miroslav Bajtoš bc8778908e Merge pull request #3556 from STRML/fix/validatePassword 
fix(validatePassword): Reword password too long error.
 2017-08-16 15:53:58 +02:00
Samuel Reed 44dd048036
fix(validatePassword): reword error message 
Reword the error message returned when the password is too long
 - remove the plaintext password value, it looks very bad
 - include information about the maximum allowed length instead

Also add additional context to the error.
 2017-08-16 14:57:57 +02:00
Jürg Lehni a736f782af Do not add isStatic properties to method settings 
Closes #3529
 2017-08-15 18:09:16 +02:00
Miroslav Bajtoš 5db00c6ab2
3.10.0 
* Allow glob-style patterns for remote options (Zak Barbuto)
 * Fix case of values per doc issue (crandmck)
 * Update translated strings Q3 2017 (Allen Boone)
 * Revert "Validate on updateAll" (Sakib Hasan)
 * Add tests of HTTP normalization on app level (Jürg Lehni)
 * travis: drop Node.js 7.x, add 8.x (Miroslav Bajtoš)
 * Validate on updateAll (ssh24)
 * Update juggler version (loay)
 * update messages.json (Diana Lau)
 * small fix for the title (Michael Alaev)
 * Changed http to https (Michael Alaev)
 * Update Travis registry (loay)
 * Add unit test for empty password (loay)
 * Add CODEOWNER file (Diana Lau)
 2017-08-14 17:45:31 +02:00
Miroslav Bajtoš 06a2b6d86b Merge pull request #3504 from zbarbuto/feature/share-method-glob 
Allow glob-style patterns for remote options
 2017-08-14 17:25:43 +02:00
Zak Barbuto 724a7d1928 Allow glob-style patterns for remote options 2017-08-14 12:23:26 +09:30
Rand McKinney df87c17c08 Merge pull request #3559 from strongloop/acl-apidoc-fix 
Fix case of values per doc issue
 2017-08-11 11:27:00 -07:00
crandmck 9f8321ad61 Fix case of values per doc issue 2017-08-11 11:10:51 -07:00
Miroslav Bajtoš 132ce4c4ae Merge pull request #3555 from kallenboone/master 
Update translated strings Q3 2017
 2017-08-11 13:59:01 +02:00