lzstealth/pulse-signage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Activity

Release v2.5.6

Browse Source
This commit is contained in:
lzstealth
2026-08-05 19:38:16 +01:00
parent a8ef35b287
commit 9f831f04bc
161 changed files with 8487 additions and 1295 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/web/routes/admin/account.js
+5 -3
View File
@@ -8,6 +8,7 @@ module.exports = function registerAccountRoutes(app, deps) {
const getAuditUserId = deps.getAuditUserId;
const verifyPassword = deps.verifyPassword;
const hashPassword = deps.hashPassword;
const validatePasswordStrength = deps.validatePasswordStrength;
const createUserSession = deps.createUserSession;
const setSessionCookie = deps.setSessionCookie;
@@ -52,8 +53,9 @@ module.exports = function registerAccountRoutes(app, deps) {
if (!verifyPassword(currentPassword, user)) {
return res.status(400).send('Current password is incorrect.');
}
if (!newPassword || newPassword.length < 8) {
return res.status(400).send('New password must be at least 8 characters.');
const passwordStrengthMessage = validatePasswordStrength(newPassword);
if (passwordStrengthMessage) {
return res.status(400).send(passwordStrengthMessage);
}
if (newPassword !== confirmPassword) {
return res.status(400).send('New passwords do not match.');
@@ -68,7 +70,7 @@ module.exports = function registerAccountRoutes(app, deps) {
const token = await createUserSession(pool, user.id);
setSessionCookie(res, token);
res.redirect('/dashboard?message=' + encodeURIComponent('Password updated.'));
res.redirect('/account?message=' + encodeURIComponent('Password updated.'));
} catch (error) {
next(error);
}
src/web/routes/admin/content.js
+84 -7
View File
@@ -29,6 +29,8 @@ module.exports = function registerContentRoutes(app, deps) {
const requirePermission = deps.requirePermission;
const hasAnyPermission = deps.hasAnyPermission;
const { buildPagination } = require('#src/web/lib/pagination');
const { buildDuplicateSlideName, buildDuplicateSlide } = require('#src/web/routes/signage/slides/duplicate');
const { buildDuplicateCanvasSizeName, buildDuplicateCanvasSize } = require('#src/web/routes/signage/canvas-sizes/duplicate');
const LIST_PAGE_SIZE = 25;
const IMAGE_UPLOAD_MAX_BYTES = 100 * 1024 * 1024;
@@ -163,6 +165,11 @@ module.exports = function registerContentRoutes(app, deps) {
return Number(rows[0] && rows[0].slide_count) || 0;
}
async function fetchCanvasSizeUsageCount(canvasSizeId) {
const [rows] = await pool.query('SELECT COUNT(*) AS ref_count FROM c_templates WHERE canvas_size_id = ?', [canvasSizeId]);
return Number(rows[0] && rows[0].ref_count) || 0;
}
async function fetchTemplateRegionUsage(template) {
const [slides] = await pool.query('SELECT content_json FROM c_slides WHERE template_id = ?', [template.id]);
const usage = new Set();
@@ -188,6 +195,7 @@ module.exports = function registerContentRoutes(app, deps) {
return Array.from(usage);
}
const { buildDuplicateTemplateName, buildDuplicateTemplate } = require('../signage/templates/duplicate');
async function fetchSlidesByTemplateId(templateId) {
const [slides] = await pool.query('SELECT id, thumbnail_path FROM c_slides WHERE template_id = ? ORDER BY id ASC', [templateId]);
@@ -201,6 +209,27 @@ module.exports = function registerContentRoutes(app, deps) {
.filter((regionKey) => regionKey && !nextKeys.has(regionKey));
}
app.get('/templates/:id/duplicate', requirePermission('templates.read'), requirePermission('templates.create'), async function (req, res, next) {
try {
const template = await common.fetchTemplateById(pool, Number(req.params.id));
if (!template) {
return res.status(404).send('Template not found');
}
const canvasSizes = await common.fetchCanvasSizesData(pool);
let duplicateName = buildDuplicateTemplateName(template.name);
let duplicateIndex = 2;
while (await common.fetchDuplicateName(pool, 'c_templates', duplicateName)) {
duplicateName = buildDuplicateTemplateName(template.name) + ' (' + duplicateIndex + ')';
duplicateIndex += 1;
}
res.send(pages.renderTemplateAddPage(buildDuplicateTemplate(template, duplicateName), req.query.message ? String(req.query.message) : 'Review the copied values and save when ready.', canvasSizes.canvasSizes, req.currentUser));
} catch (error) {
next(error);
}
});
async function getTemplateRegionDeleteBlockMessage(template, nextRegions) {
const removedRegionKeys = getRemovedTemplateRegionKeys(template && template.regions ? template.regions : [], nextRegions);
if (!removedRegionKeys.length) {
@@ -306,6 +335,27 @@ module.exports = function registerContentRoutes(app, deps) {
}
});
app.get('/slides/:id/duplicate', requirePermission('slides.read'), requirePermission('slides.create'), async function (req, res, next) {
try {
const slide = await common.fetchSlideById(pool, Number(req.params.id));
if (!slide) {
return res.status(404).send('Slide not found');
}
const data = await fetchSlideFormData();
let duplicateName = buildDuplicateSlideName(slide.title);
let duplicateIndex = 2;
while (await common.fetchDuplicateName(pool, 'c_slides', duplicateName, null, 'title')) {
duplicateName = buildDuplicateSlideName(slide.title) + ' (' + duplicateIndex + ')';
duplicateIndex += 1;
}
res.send(pages.renderSlideAddPage(buildDuplicateSlide(slide, duplicateName), data, req.query.message ? String(req.query.message) : 'Review the copied values and save when ready.', req.currentUser));
} catch (error) {
next(error);
}
});
app.get('/slides/:id/edit', requirePermission('slides.update'), async function (req, res, next) {
try {
const slide = await common.fetchSlideById(pool, Number(req.params.id));
@@ -342,12 +392,16 @@ module.exports = function registerContentRoutes(app, deps) {
try {
const uploadPaths = Array.isArray(req.body && req.body.uploadPaths)
? req.body.uploadPaths
: Array.isArray(req.body && req.body.paths)
? req.body.paths
: req.body && req.body.uploadPaths
? [req.body.uploadPaths]
: [];
if (!uploadPaths.length) {
return res.status(400).json({ error: 'No upload paths were provided.' });
}
await removeUnusedUploadFiles(pool, deps.uploadDir, uploadPaths);
res.json({ ok: true });
res.sendStatus(204);
} catch (error) {
next(error);
}
@@ -639,6 +693,26 @@ module.exports = function registerContentRoutes(app, deps) {
res.send(pages.renderCanvasSizeAddPage(null, req.query.message ? String(req.query.message) : '', req.currentUser));
});
app.get('/canvas-sizes/:id/duplicate', requirePermission('canvas-sizes.read'), requirePermission('canvas-sizes.create'), async function (req, res, next) {
try {
const canvasSize = await common.fetchCanvasSizeById(pool, Number(req.params.id));
if (!canvasSize) {
return res.status(404).send('Canvas size not found');
}
let duplicateName = buildDuplicateCanvasSizeName(canvasSize.name);
let duplicateIndex = 2;
while (await common.fetchDuplicateName(pool, 'c_canvas_sizes', duplicateName)) {
duplicateName = buildDuplicateCanvasSizeName(canvasSize.name) + ' (' + duplicateIndex + ')';
duplicateIndex += 1;
}
res.send(pages.renderCanvasSizeAddPage(buildDuplicateCanvasSize(canvasSize, duplicateName), req.query.message ? String(req.query.message) : 'Review the copied values and save when ready.', req.currentUser));
} catch (error) {
next(error);
}
});
app.post('/canvas-sizes', requirePermission('canvas-sizes.create'), async function (req, res, next) {
try {
const payload = common.buildCanvasSizePayload(req, null);
@@ -646,7 +720,7 @@ module.exports = function registerContentRoutes(app, deps) {
return res.redirect('/canvas-sizes/new?message=' + encodeURIComponent('A canvas size with that name already exists.'));
}
if (await canvasSizeExists(payload.width, payload.height)) {
return res.redirect('/canvas-sizes/new?message=' + encodeURIComponent('That canvas size already exists.'));
return res.status(400).send('That canvas size already exists.');
}
const actorId = getAuditUserId(req);
const [result] = await pool.query('INSERT INTO c_canvas_sizes (name, width, height, created_by, modified_by) VALUES (?, ?, ?, ?, ?)', [payload.name, payload.width, payload.height, actorId, actorId]);
@@ -666,8 +740,7 @@ module.exports = function registerContentRoutes(app, deps) {
if (!canvasSize) {
return res.status(404).send('Canvas size not found');
}
const [rows] = await pool.query('SELECT COUNT(*) AS ref_count FROM c_templates WHERE canvas_size_id = ?', [canvasSize.id]);
canvasSize.inUse = Number(rows[0] && rows[0].ref_count) > 0;
canvasSize.inUse = (await fetchCanvasSizeUsageCount(canvasSize.id)) > 0;
res.send(pages.renderCanvasSizeEditPage(canvasSize, null, req.query.message ? String(req.query.message) : '', req.currentUser));
} catch (error) {
next(error);
@@ -680,12 +753,16 @@ module.exports = function registerContentRoutes(app, deps) {
if (!canvasSize) {
return res.status(404).send('Canvas size not found');
}
canvasSize.inUse = (await fetchCanvasSizeUsageCount(canvasSize.id)) > 0;
const payload = common.buildCanvasSizePayload(req, canvasSize);
if (canvasSize.inUse && (payload.width !== Number(canvasSize.width) || payload.height !== Number(canvasSize.height))) {
return res.status(400).send('This canvas size is still used by one or more templates, so its dimensions cannot be changed.');
}
if (await common.fetchDuplicateName(pool, 'c_canvas_sizes', payload.name, canvasSize.id)) {
return res.redirect('/canvas-sizes/' + canvasSize.id + '/edit?message=' + encodeURIComponent('A canvas size with that name already exists.'));
}
if (await canvasSizeExists(payload.width, payload.height, canvasSize.id)) {
return res.redirect('/canvas-sizes/' + canvasSize.id + '/edit?message=' + encodeURIComponent('That canvas size already exists.'));
return res.status(400).send('That canvas size already exists.');
}
await pool.query('UPDATE c_canvas_sizes SET name = ?, width = ?, height = ?, modified_by = ? WHERE id = ?', [payload.name, payload.width, payload.height, getAuditUserId(req), canvasSize.id]);
redirectAfterSave(req, res, '/canvas-sizes', {
src/web/routes/admin/manage.js
+24 -4
View File
@@ -14,6 +14,18 @@ module.exports = function registerManageRoutes(app, deps) {
const PLAYER_PUBLIC_BASE_URL = deps.playerPublicBaseUrl;
const requirePermission = deps.requirePermission;
const SCREEN_NAME_MAX_LENGTH = 255;
const SCREEN_SLUG_MAX_LENGTH = 255;
function readLimitedText(value, maxLength) {
const text = String(value || '').trim();
const limit = Number(maxLength);
if (!Number.isFinite(limit) || limit < 1 || text.length <= limit) {
return text;
}
return text.slice(0, limit);
}
async function fetchAllScreenSlugs() {
const [rows] = await pool.query('SELECT slug FROM d_screens ORDER BY slug ASC');
return (rows || [])
@@ -85,14 +97,18 @@ module.exports = function registerManageRoutes(app, deps) {
app.post('/screens', requirePermission('screens.create'), async function (req, res, next) {
try {
const name = String(req.body.name || '').trim();
const name = typeof common.validateMaxLength === 'function'
? common.validateMaxLength(req.body.name || '', SCREEN_NAME_MAX_LENGTH, 'Screen name')
: readLimitedText(req.body.name || '', 255);
if (!name) {
return res.status(400).send('Screen name is required.');
}
if (await common.fetchDuplicateName(pool, 'd_screens', name)) {
return res.status(400).send('A screen with that name already exists.');
}
const slugInput = String(req.body.slug || '').trim();
const slugInput = typeof common.validateMaxLength === 'function'
? common.validateMaxLength(req.body.slug || '', SCREEN_SLUG_MAX_LENGTH, 'Screen URL')
: readLimitedText(req.body.slug || '', 255);
const playlistId = req.body.playlist_id ? Number(req.body.playlist_id) : null;
const slug = await common.uniqueScreenSlug(pool, common.slugify(slugInput || name));
const actorId = getAuditUserId(req);
@@ -109,7 +125,9 @@ module.exports = function registerManageRoutes(app, deps) {
app.post('/screens/:id', requirePermission('screens.update'), async function (req, res, next) {
try {
const name = String(req.body.name || '').trim();
const name = typeof common.validateMaxLength === 'function'
? common.validateMaxLength(req.body.name || '', SCREEN_NAME_MAX_LENGTH, 'Screen name')
: readLimitedText(req.body.name || '', 255);
if (!name) {
return res.status(400).send('Screen name is required.');
}
@@ -120,7 +138,9 @@ module.exports = function registerManageRoutes(app, deps) {
if (await common.fetchDuplicateName(pool, 'd_screens', name, screen.id)) {
return res.status(400).send('A screen with that name already exists.');
}
const slugInput = String(req.body.slug || '').trim();
const slugInput = typeof common.validateMaxLength === 'function'
? common.validateMaxLength(req.body.slug || '', SCREEN_SLUG_MAX_LENGTH, 'Screen URL')
: readLimitedText(req.body.slug || '', 255);
const playlistId = req.body.playlist_id ? Number(req.body.playlist_id) : null;
const previousPlaylistId = screen.playlist_id;
const slug = await common.uniqueScreenSlug(pool, common.slugify(slugInput || name), screen.id);
src/web/routes/admin/rbac.js
+47 -12
View File
@@ -11,12 +11,17 @@
const normalizePermissionKeys = deps.normalizePermissionKeys;
const { buildPagination } = require('../../lib/pagination');
const requirePermission = deps.requirePermission;
const { buildDuplicateRoleName, buildDuplicateRole } = require('../settings/rbac/duplicate');
const ROLE_NAME_MAX_LENGTH = 255;
const ROLE_DESCRIPTION_MAX_LENGTH = 255;
const ROLE_KEY_MAX_LENGTH = 100;
const LIST_PAGE_SIZE = 25;
function slugifyRoleKey(name) {
const value = String(name || '').trim().toLowerCase();
const slug = value.replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
const slug = value.replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, ROLE_KEY_MAX_LENGTH);
return slug || 'role';
}
@@ -65,10 +70,12 @@
return (Array.isArray(permissionRows) ? permissionRows : []).map(function (permission) {
const definition = permissionDefinitions.get(String(permission.permission_key || '').trim()) || null;
return Object.assign({}, permission, {
resourceKey: definition ? definition.sectionKey : String(permission.section_name || '').trim().toLowerCase().replace(/[^a-z0-9]+/g, '-'),
resourceName: definition ? definition.name : permission.section_name,
resourceKey: definition ? definition.resourceKey : String(permission.section_name || '').trim().toLowerCase().replace(/[^a-z0-9]+/g, '-'),
resourceName: definition ? definition.resourceName : permission.section_name,
categoryName: definition ? definition.sectionName : permission.section_name,
sectionOrder: definition ? definition.sectionOrder : 999,
resourceOrder: definition ? Number(definition.resourceOrder) || 999 : 999,
permissionOrder: definition ? Number(definition.permissionOrder) || 999 : 999,
actionKey: definition ? definition.actionKey : 'read',
actionLabel: definition ? definition.actionName : getActionLabel(permission.actionKey),
isSelected: selectedKeys.has(String(permission.permission_key || '').trim())
@@ -107,9 +114,8 @@
groups.forEach(function (group) {
group.permissions.sort(function (left, right) {
const actionOrder = { create: 1, read: 2, update: 3, edit: 3, delete: 4, allow: 5 };
const leftOrder = actionOrder[String(left.actionKey || '').trim()] || 99;
const rightOrder = actionOrder[String(right.actionKey || '').trim()] || 99;
const leftOrder = Number(left.permissionOrder) || 999;
const rightOrder = Number(right.permissionOrder) || 999;
if (leftOrder !== rightOrder) {
return leftOrder - rightOrder;
}
@@ -136,8 +142,8 @@
});
return {
formValues: {
name: String(formValues && formValues.name || '').trim(),
description: String(formValues && formValues.description || '').trim()
name: common.validateMaxLength(formValues && formValues.name || '', ROLE_NAME_MAX_LENGTH, 'Role name'),
description: common.validateMaxLength(formValues && formValues.description || '', ROLE_DESCRIPTION_MAX_LENGTH, 'Role description')
},
permissionGroups: buildPermissionGroups(mapPermissionsForView(permissionRows, selectedPermissionKeys)),
users: mapUsersForView(data.users, selectedUserIds),
@@ -197,10 +203,39 @@
});
});
app.get('/rbac/:id/duplicate', requirePermission('rbac.read'), requirePermission('rbac.create'), async function (req, res, next) {
try {
const roleId = Number(req.params.id);
if (!Number.isInteger(roleId) || roleId <= 0) {
return res.status(400).send('Invalid role.');
}
const role = await rbacData.fetchRoleById(pool, roleId);
if (!role) {
return res.status(404).send('Role not found.');
}
const page = Math.max(1, Math.floor(Number(req.query.page) || 1));
const search = common.getSearchQuery(req);
const sort = common.getSortQuery(req);
const direction = common.getSortDirectionQuery(req);
const currentUserId = req.currentUser ? Number(req.currentUser.id) : null;
const permissionKeys = await rbacData.fetchRolePermissionKeys(pool, roleId);
const viewModel = await buildRoleCreateViewModel({
name: buildDuplicateRoleName(role.name),
description: buildDuplicateRole(role).description
}, permissionKeys, [], page, search, sort, direction, currentUserId);
res.send(pages.renderRbacAddPage('Review the copied values and save when ready.', req.currentUser, viewModel.formValues, viewModel.permissionGroups, viewModel.users, viewModel.pagination, 'primary'));
} catch (error) {
next(error);
}
});
app.post('/rbac', requirePermission('rbac.create'), async function (req, res, next) {
try {
const name = String(req.body.name || '').trim();
const description = String(req.body.description || '').trim();
const name = common.validateMaxLength(req.body.name || '', ROLE_NAME_MAX_LENGTH, 'Role name');
const description = common.validateMaxLength(req.body.description || '', ROLE_DESCRIPTION_MAX_LENGTH, 'Role description');
const selectedUserIds = Object.prototype.hasOwnProperty.call(req.body || {}, 'users_present')
? readArrayField(req.body, ['user_ids[]', 'user_ids'])
: [];
@@ -311,8 +346,8 @@
return res.status(404).send('Role not found.');
}
const name = String(req.body.name || '').trim();
const description = String(req.body.description || '').trim();
const name = common.validateMaxLength(req.body.name || '', ROLE_NAME_MAX_LENGTH, 'Role name');
const description = common.validateMaxLength(req.body.description || '', ROLE_DESCRIPTION_MAX_LENGTH, 'Role description');
const shouldSyncPermissions = Object.prototype.hasOwnProperty.call(req.body || {}, 'permissions_present');
const shouldSyncUsers = Object.prototype.hasOwnProperty.call(req.body || {}, 'users_present');
const selectedPermissionKeys = shouldSyncPermissions
src/web/routes/admin/users.js
+63 -16
View File
@@ -7,10 +7,15 @@
const formatDashboardDate = deps.formatDashboardDate;
const getAuditUserId = deps.getAuditUserId;
const hashPassword = deps.hashPassword;
const validatePasswordStrength = deps.validatePasswordStrength;
const readArrayField = deps.readArrayField;
const rbacData = deps.rbacData;
const { buildPagination } = require('../../lib/pagination');
const requirePermission = deps.requirePermission;
const { buildDuplicateUserName, buildDuplicateUser } = require('../settings/users/duplicate');
const USER_NAME_MAX_LENGTH = 255;
const USER_USERNAME_MAX_LENGTH = 255;
const LIST_PAGE_SIZE = 25;
@@ -43,10 +48,6 @@
return Number.isInteger(roleId) && roleId > 0;
})));
if (!normalizedRoleIds.length) {
return { ok: false, message: 'Select at least one role.' };
}
if (normalizedRoleIds.some(function (roleId) {
return !validRoleIds.has(roleId);
})) {
@@ -88,6 +89,38 @@
});
});
app.get('/users/:id/duplicate', requirePermission('users.read'), requirePermission('users.create'), async function (req, res, next) {
try {
const userId = Number(req.params.id);
if (!Number.isInteger(userId) || userId <= 0) {
return res.status(400).send('Invalid user.');
}
const user = await rbacData.fetchUserWithRoles(pool, userId);
if (!user) {
return res.status(404).send('User not found.');
}
if (Number(req.currentUser.id) === userId) {
return res.redirect('/users?message=' + encodeURIComponent('Use Add user to create another login for yourself.'));
}
const roles = await fetchRoleOptions();
const duplicateUser = buildDuplicateUser(user, buildDuplicateUserName(user.name));
res.send(pages.renderUsersAddPage(
'Review the copied values and save when ready.',
req.currentUser,
mapRolesForForm(roles, user.roleIds),
{
name: duplicateUser.name
},
'primary'
));
} catch (error) {
next(error);
}
});
app.get('/users/:id/edit', requirePermission('users.update'), async function (req, res, next) {
try {
const userId = Number(req.params.id);
@@ -122,10 +155,11 @@
app.post('/users', requirePermission('users.create'), async function (req, res, next) {
const connection = await pool.getConnection();
try {
const name = String(req.body.name || '').trim();
const username = String(req.body.username || user.username || '').trim();
const name = common.validateMaxLength(req.body.name || '', USER_NAME_MAX_LENGTH, 'Name');
const username = common.validateMaxLength(req.body.username || '', USER_USERNAME_MAX_LENGTH, 'Username');
const password = String(req.body.password || '');
const confirmPassword = String(req.body.confirm_password || '');
const saveAction = String(req.body.save_action || req.body.action || '').trim().toLowerCase();
const selectedRoleIds = readArrayField(req.body, ['role_ids[]', 'role_ids']);
const roleCheck = await validateRoleIds(selectedRoleIds);
const formValues = {
@@ -144,8 +178,9 @@
if (!username) {
return renderValidationError('Username is required.');
}
if (!password || password.length < 8) {
return renderValidationError('Password must be at least 8 characters.');
const passwordStrengthMessage = validatePasswordStrength(password);
if (passwordStrengthMessage) {
return renderValidationError(passwordStrengthMessage);
}
if (password !== confirmPassword) {
return renderValidationError('Passwords do not match.');
@@ -171,6 +206,9 @@
);
await rbacData.syncUserRoles(connection, result.insertId, roleCheck.roleIds);
await connection.commit();
if (saveAction === 'new') {
return res.redirect('/users/new?message=' + encodeURIComponent('User created.'));
}
res.redirect('/users/' + result.insertId + '/edit?message=' + encodeURIComponent('User created.'));
} catch (error) {
try {
@@ -216,11 +254,12 @@
const connection = await pool.getConnection();
try {
const userId = Number(req.params.id);
const name = String(req.body.name || '').trim();
const name = common.validateMaxLength(req.body.name || '', USER_NAME_MAX_LENGTH, 'Name');
const selectedRoleIds = readArrayField(req.body, ['role_ids[]', 'role_ids']);
const password = String(req.body.password || '');
const confirmPassword = String(req.body.confirm_password || '');
const shouldUpdatePassword = Boolean(password || confirmPassword);
const saveAction = String(req.body.save_action || req.body.action || '').trim().toLowerCase();
if (!Number.isInteger(userId) || userId <= 0) {
return res.status(400).send('Invalid user.');
@@ -234,7 +273,7 @@
return res.status(404).send('User not found.');
}
const username = String(req.body.username || user.username || '').trim();
const username = common.validateMaxLength(req.body.username || user.username || '', USER_USERNAME_MAX_LENGTH, 'Username');
const [countRows] = await pool.query('SELECT COUNT(*) AS user_count FROM a_users');
const canDelete = !countRows.length || Number(countRows[0].user_count) > 1;
@@ -256,8 +295,11 @@
if (!username) {
return renderValidationError('Username is required.');
}
if (shouldUpdatePassword && (!password || password.length < 8)) {
return renderValidationError('Password must be at least 8 characters.');
if (shouldUpdatePassword) {
const passwordStrengthMessage = validatePasswordStrength(password);
if (passwordStrengthMessage) {
return renderValidationError(passwordStrengthMessage);
}
}
if (shouldUpdatePassword && password !== confirmPassword) {
return renderValidationError('Passwords do not match.');
@@ -290,6 +332,9 @@
await connection.query('DELETE FROM a_sessions WHERE user_id = ?', [userId]);
}
await connection.commit();
if (saveAction === 'new') {
return res.redirect('/users/new?message=' + encodeURIComponent('User updated.'));
}
res.redirect('/users?message=' + encodeURIComponent('User updated.'));
} catch (error) {
try {
@@ -308,6 +353,7 @@
const userId = Number(req.params.id);
const password = String(req.body.password || '');
const confirmPassword = String(req.body.confirm_password || '');
const editUrl = '/users/' + userId + '/edit';
if (!Number.isInteger(userId) || userId <= 0) {
return res.status(400).send('Invalid user.');
@@ -315,11 +361,12 @@
if (Number(req.currentUser.id) === userId) {
return res.redirect('/account?message=' + encodeURIComponent('Use My Account to change your own password.'));
}
if (!password || password.length < 8) {
return res.redirect('/users?message=' + encodeURIComponent('Password must be at least 8 characters.'));
const passwordStrengthMessage = validatePasswordStrength(password);
if (passwordStrengthMessage) {
return res.redirect(editUrl + '?message=' + encodeURIComponent(passwordStrengthMessage));
}
if (password !== confirmPassword) {
return res.redirect('/users?message=' + encodeURIComponent('Passwords do not match.'));
return res.redirect(editUrl + '?message=' + encodeURIComponent('Passwords do not match.'));
}
const [rows] = await pool.query('SELECT id FROM a_users WHERE id = ? LIMIT 1', [userId]);
@@ -333,7 +380,7 @@
[passwordRecord.hash, passwordRecord.salt, passwordRecord.iterations, getAuditUserId(req), userId]
);
await pool.query('DELETE FROM a_sessions WHERE user_id = ?', [userId]);
res.redirect('/users?message=' + encodeURIComponent('Password updated.'));
res.redirect(editUrl + '?message=' + encodeURIComponent('Password updated.'));
} catch (error) {
next(error);
}