Merge pull request #7466 from Countly/codex/upload-validation-guards

Fix CMS clear write validation

Author: ar2rsawseen

api/utils/requestProcessor.js

@@ -3319,7 +3319,7 @@ const processRequest = (params) => {
                     validateUserForWrite(params, countlyApi.mgmt.cms.saveEntries);
                     break;
                 case 'clear':
-                    validateUserForWrite(countlyApi.mgmt.cms.clearCache, params);
+                    validateUserForWrite(params, countlyApi.mgmt.cms.clearCache);
                     break;
                 default:
                     if (!plugins.dispatch(apiPath, {

plugins/crashes/api/api.js

@@ -647,7 +647,7 @@ const FEATURE_NAME = 'crashes';
                 try {
                     [crash] = await getCrashesTable({
                         query: { _id: id },
-                        fields: { error: 1 },
+                        fields: { binary_crash_dump: 1 },
                         limit: 1,
                     });
                 }

test/2.api/08b.cms.js

@@ -0,0 +1,58 @@
+var request = require('supertest');
+var should = require('should');
+var testUtils = require("../testUtils");
+request = request(testUtils.url);
+
+describe('CMS API', function() {
+    it('should save, read and clear CMS cache entries', async() => {
+        const API_KEY_ADMIN = testUtils.get("API_KEY_ADMIN");
+        const APP_ID = testUtils.get("APP_ID");
+        const namespace = 'server-guides';
+        const entryId = `${namespace}_docs_${Date.now()}`;
+
+        let sp = new URLSearchParams();
+        sp.append('api_key', API_KEY_ADMIN);
+        sp.append('app_id', APP_ID);
+        sp.append('_id', namespace);
+        sp.append('entries', JSON.stringify([
+            {_id: entryId, title: 'Validator Guide', body: 'Welcome'}
+        ]));
+
+        const saveResponse = await request.get(`/i/cms/save_entries?${sp.toString()}`);
+        should(saveResponse.status).equal(200);
+        saveResponse.body.should.have.property('result', 'Entries saved');
+
+        sp = new URLSearchParams();
+        sp.append('api_key', API_KEY_ADMIN);
+        sp.append('app_id', APP_ID);
+        sp.append('_id', namespace);
+        sp.append('query', JSON.stringify({title: 'Validator Guide'}));
+
+        const readResponse = await request.get(`/o/cms/entries?${sp.toString()}`);
+        should(readResponse.status).equal(200);
+        readResponse.body.should.have.property('data');
+        should(readResponse.body.data).be.Array();
+        should.exist(readResponse.body.data.find((entry) => entry._id === entryId));
+
+        sp = new URLSearchParams();
+        sp.append('api_key', API_KEY_ADMIN);
+        sp.append('app_id', APP_ID);
+        sp.append('_id', namespace);
+
+        const clearResponse = await request.get(`/i/cms/clear?${sp.toString()}`);
+        should(clearResponse.status).equal(200);
+        clearResponse.body.should.have.property('result', 'CMS cache cleared');
+
+        sp = new URLSearchParams();
+        sp.append('api_key', API_KEY_ADMIN);
+        sp.append('app_id', APP_ID);
+        sp.append('_id', namespace);
+        sp.append('query', JSON.stringify({_id: entryId}));
+
+        const postClearResponse = await request.get(`/o/cms/entries?${sp.toString()}`);
+        should(postClearResponse.status).equal(200);
+        postClearResponse.body.should.have.property('data');
+        should(postClearResponse.body.data).be.Array();
+        should.not.exist(postClearResponse.body.data.find((entry) => entry._id === entryId));
+    });
+});