Skip to content

Commit de2cde7

Browse files
tryshanktryshank
authored
Merge pull request #7355 from Countly/fix/crashes-add-edit-delete-comment-args
fix: crashes add-edit-delete comment args
2 parents c045360 + fd01b91 commit de2cde7

File tree

1 file changed

+80
-24
lines changed

1 file changed

+80
-24
lines changed

‎plugins/crashes/api/api.js‎

Lines changed: 80 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1299,13 +1299,30 @@ plugins.setConfigs("crashes", {
12991299
plugins.register("/i/crashes", function(ob) {
13001300
var obParams = ob.params;
13011301
var paths = ob.paths;
1302-
if (obParams.qstring.args) {
1303-
try {
1302+
1303+
if (!obParams.qstring.args) {
1304+
common.returnMessage(obParams, 400, 'Error: args not found');
1305+
return true;
1306+
}
1307+
1308+
try {
1309+
if (typeof obParams.qstring.args === "string") {
13041310
obParams.qstring.args = JSON.parse(obParams.qstring.args);
13051311
}
1306-
catch (SyntaxError) {
1307-
console.log('Parse ' + obParams.apiPath + ' JSON failed');
1308-
}
1312+
}
1313+
catch (SyntaxError) {
1314+
console.log('Parse %s JSON failed %s', obParams.apiPath, obParams.req && obParams.req.url, obParams.req && obParams.req.body);
1315+
common.returnMessage(obParams, 400, 'Error: could not parse args');
1316+
return true;
1317+
}
1318+
1319+
if (obParams.qstring.app_id && obParams.qstring.args.app_id && obParams.qstring.app_id !== obParams.qstring.args.app_id) {
1320+
common.returnMessage(obParams, 400, 'Error: app_id mismatch');
1321+
return true;
1322+
}
1323+
1324+
if (!obParams.qstring.app_id && obParams.qstring.args.app_id) {
1325+
obParams.qstring.app_id = obParams.qstring.args.app_id;
13091326
}
13101327

13111328
switch (paths[3]) {
@@ -1496,58 +1513,84 @@ plugins.setConfigs("crashes", {
14961513
break;
14971514
case 'add_comment':
14981515
validateCreate(obParams, FEATURE_NAME, function() {
1516+
var args = obParams.qstring.args || {};
1517+
var appId = obParams.qstring.app_id;
1518+
1519+
if (!appId || !args.crash_id) {
1520+
common.returnMessage(obParams, 400, 'Missing params');
1521+
return true;
1522+
}
1523+
1524+
if (args.app_id && args.app_id !== appId) {
1525+
common.returnMessage(obParams, 403, 'Error: app_id mismatch');
1526+
return true;
1527+
}
1528+
14991529
var comment = {};
1500-
if (obParams.qstring.args.time) {
1501-
comment.time = obParams.qstring.args.time;
1530+
if (args.time) {
1531+
comment.time = args.time;
15021532
}
15031533
else {
15041534
comment.time = new Date().getTime();
15051535
}
15061536

1507-
if (obParams.qstring.args.text) {
1508-
comment.text = obParams.qstring.args.text;
1537+
if (args.text) {
1538+
comment.text = args.text;
15091539
}
15101540
else {
15111541
comment.text = "";
15121542
}
15131543

15141544
comment.author = obParams.member.full_name;
15151545
comment.author_id = obParams.member._id + "";
1516-
comment._id = common.crypto.createHash('sha1').update(obParams.qstring.args.app_id + obParams.qstring.args.crash_id + JSON.stringify(comment) + "").digest('hex');
1517-
common.db.collection('app_crashgroups' + obParams.qstring.args.app_id).update({'_id': obParams.qstring.args.crash_id }, {"$push": {'comments': comment}}, function() {
1518-
plugins.dispatch("/systemlogs", {params: obParams, action: "crash_added_comment", data: {app_id: obParams.qstring.args.app_id, crash_id: obParams.qstring.args.crash_id, comment: comment}});
1546+
comment._id = common.crypto.createHash('sha1').update(appId + args.crash_id + JSON.stringify(comment) + "").digest('hex');
1547+
common.db.collection('app_crashgroups' + appId).update({'_id': args.crash_id }, {"$push": {'comments': comment}}, function() {
1548+
plugins.dispatch("/systemlogs", {params: obParams, action: "crash_added_comment", data: {app_id: appId, crash_id: args.crash_id, comment: comment}});
15191549
common.returnMessage(obParams, 200, 'Success');
15201550
return true;
15211551
});
15221552
});
15231553
break;
15241554
case 'edit_comment':
15251555
validateUpdate(obParams, FEATURE_NAME, function() {
1526-
common.db.collection('app_crashgroups' + obParams.qstring.args.app_id).findOne({'_id': obParams.qstring.args.crash_id }, function(err, crash) {
1556+
var args = obParams.qstring.args || {};
1557+
var appId = obParams.qstring.app_id;
1558+
1559+
if (!appId || !args.crash_id || !args.comment_id) {
1560+
common.returnMessage(obParams, 400, 'Missing params');
1561+
return true;
1562+
}
1563+
1564+
if (args.app_id && args.app_id !== appId) {
1565+
common.returnMessage(obParams, 403, 'Error: app_id mismatch');
1566+
return true;
1567+
}
1568+
1569+
common.db.collection('app_crashgroups' + appId).findOne({'_id': args.crash_id }, function(err, crash) {
15271570
var comment;
15281571
if (crash && crash.comments) {
15291572
for (var i = 0; i < crash.comments.length; i++) {
1530-
if (crash.comments[i]._id === obParams.qstring.args.comment_id) {
1573+
if (crash.comments[i]._id === args.comment_id) {
15311574
comment = crash.comments[i];
15321575
break;
15331576
}
15341577
}
15351578
}
15361579
if (comment && (comment.author_id === obParams.member._id + "" || obParams.member.global_admin)) {
15371580
var commentBefore = JSON.parse(JSON.stringify(comment));
1538-
if (obParams.qstring.args.time) {
1539-
comment.edit_time = obParams.qstring.args.time;
1581+
if (args.time) {
1582+
comment.edit_time = args.time;
15401583
}
15411584
else {
15421585
comment.edit_time = new Date().getTime();
15431586
}
15441587

1545-
if (obParams.qstring.args.text) {
1546-
comment.text = obParams.qstring.args.text;
1588+
if (args.text) {
1589+
comment.text = args.text;
15471590
}
15481591

1549-
common.db.collection('app_crashgroups' + obParams.qstring.args.app_id).update({'_id': obParams.qstring.args.crash_id, "comments._id": obParams.qstring.args.comment_id}, {$set: {"comments.$": comment}}, function() {
1550-
plugins.dispatch("/systemlogs", {params: obParams, action: "crash_edited_comment", data: {app_id: obParams.qstring.args.app_id, crash_id: obParams.qstring.args.crash_id, _id: obParams.qstring.args.comment_id, before: commentBefore, update: comment}});
1592+
common.db.collection('app_crashgroups' + appId).update({'_id': args.crash_id, "comments._id": args.comment_id}, {$set: {"comments.$": comment}}, function() {
1593+
plugins.dispatch("/systemlogs", {params: obParams, action: "crash_edited_comment", data: {app_id: appId, crash_id: args.crash_id, _id: args.comment_id, before: commentBefore, update: comment}});
15511594
common.returnMessage(obParams, 200, 'Success');
15521595
return true;
15531596
});
@@ -1561,20 +1604,33 @@ plugins.setConfigs("crashes", {
15611604
break;
15621605
case 'delete_comment':
15631606
validateDelete(obParams, FEATURE_NAME, function() {
1564-
common.db.collection('app_crashgroups' + obParams.qstring.args.app_id).findOne({'_id': obParams.qstring.args.crash_id }, function(err, crash) {
1607+
var args = obParams.qstring.args || {};
1608+
var appId = obParams.qstring.app_id;
1609+
1610+
if (!appId || !args.crash_id || !args.comment_id) {
1611+
common.returnMessage(obParams, 400, 'Missing params');
1612+
return true;
1613+
}
1614+
1615+
if (args.app_id && args.app_id !== appId) {
1616+
common.returnMessage(obParams, 403, 'Error: app_id mismatch');
1617+
return true;
1618+
}
1619+
1620+
common.db.collection('app_crashgroups' + appId).findOne({'_id': args.crash_id }, function(err, crash) {
15651621
var comment;
15661622

15671623
if (crash && crash.comments) {
15681624
for (var i = 0; i < crash.comments.length; i++) {
1569-
if (crash.comments[i]._id === obParams.qstring.args.comment_id) {
1625+
if (crash.comments[i]._id === args.comment_id) {
15701626
comment = crash.comments[i];
15711627
break;
15721628
}
15731629
}
15741630
}
15751631
if (comment && (comment.author_id === obParams.member._id + "" || obParams.member.global_admin)) {
1576-
common.db.collection('app_crashgroups' + obParams.qstring.args.app_id).update({'_id': obParams.qstring.args.crash_id }, { $pull: { comments: { _id: obParams.qstring.args.comment_id } } }, function() {
1577-
plugins.dispatch("/systemlogs", {params: obParams, action: "crash_deleted_comment", data: {app_id: obParams.qstring.args.app_id, crash_id: obParams.qstring.args.crash_id, comment: comment}});
1632+
common.db.collection('app_crashgroups' + appId).update({'_id': args.crash_id }, { $pull: { comments: { _id: args.comment_id } } }, function() {
1633+
plugins.dispatch("/systemlogs", {params: obParams, action: "crash_deleted_comment", data: {app_id: appId, crash_id: args.crash_id, comment: comment}});
15781634
common.returnMessage(obParams, 200, 'Success');
15791635
return true;
15801636
});

0 commit comments

Comments
 (0)