Merge pull request #5613 from Countly/anna/master

[populator] Nullcheck on invalid data (enviroment creation) [core] Check on invalid entries param (for cms saveEntries)

Author: Cookiezaurs

api/parts/mgmt/cms.js

@@ -157,10 +157,21 @@ function syncCMSDataToDB(params) {
 }
 
 cmsApi.saveEntries = function(params) {
+
+    var entries = [];
+    try {
+        entries = JSON.parse(params.qstring.entries);
+    }
+    catch (ex) {
+        log.e(params.qstring.entries);
+        common.returnMessage(params, 400, 'Invalid entries parameter');
+        return;
+    }
+
     transformAndStoreData(
         Object.assign({dataTransformed: true}, params),
         null,
-        JSON.parse(params.qstring.entries),
+        entries,
         function(err1) {
             if (err1) {
                 log.e('An error occured while storing entries in DB: ' + err1);

frontend/express/public/localization/dashboard/dashboard.properties

@@ -290,6 +290,8 @@ common.in-last-weeks-plural = in the last {0} weeks
 common.in-last-weeks = in the last week
 common.in-last-months-plural = in the last {0} months
 common.in-last-months = in the last month
+common.in-last-years-plural = in the last {0} years
+common.in-last-years = in the last year
 common.time-period-select.custom-range = Custom range
 common.time-period-select.presets = Presets
 common.time-period-select.last-n = In the last

plugins/populator/api/api.js

@@ -210,28 +210,36 @@ const FEATURE_NAME = 'populator';
 
     const saveEnvironment = function(ob) {
         const obParams = ob.params;
-        const users = JSON.parse(ob.params.qstring.users);
-        const setEnviromentInformationOnce = ob.params.qstring.setEnviromentInformationOnce;
-        if (!users || !users.length) {
-            common.returnMessage(obParams, 400, "Missing params: " + users);
-            return false;
-        }
-
-        const environmentId = common.crypto.createHash('sha1').update(users[0].appId + users[0].environmentName).digest('hex');
-        const insertedInformations = [];
-        const createdAt = new Date().getTime();
-        for (let i = 0; i < users.length; i++) {
-            insertedInformations.push({
-                _id: users[i].appId + "_" + users[i].templateId + "_" + environmentId + "_" + users[i].deviceId,
-                userName: users[i].userName,
-                platform: users[i].platform,
-                device: users[i].device,
-                appVersion: users[i].appVersion,
-                custom: users[i].custom,
-                createdAt: createdAt
-            });
-        }
         validateCreate(obParams, FEATURE_NAME, function(params) {
+            var users = [];
+            try {
+                users = JSON.parse(ob.params?.qstring?.users);
+            }
+            catch (e) {
+                log.e(e);
+                users = [];
+            }
+            const setEnviromentInformationOnce = ob.params?.qstring?.setEnviromentInformationOnce ;
+            if (!users || !users.length) {
+                common.returnMessage(obParams, 400, "Missing params: users");
+                return false;
+            }
+
+            const environmentId = common.crypto.createHash('sha1').update(users[0].appId + users[0].environmentName).digest('hex');
+            const insertedInformations = [];
+            const createdAt = new Date().getTime();
+            for (let i = 0; i < users.length; i++) {
+                insertedInformations.push({
+                    _id: users[i].appId + "_" + users[i].templateId + "_" + environmentId + "_" + users[i].deviceId,
+                    userName: users[i].userName,
+                    platform: users[i].platform,
+                    device: users[i].device,
+                    appVersion: users[i].appVersion,
+                    custom: users[i].custom,
+                    createdAt: createdAt
+                });
+            }
+
             if (setEnviromentInformationOnce) {
                 common.db.collection('populator_environments').insertOne({
                     _id: environmentId,

plugins/populator/tests.js

@@ -0,0 +1,45 @@
+var request = require('supertest');
+var should = require('should');
+var testUtils = require("../../test/testUtils");
+request = request(testUtils.url);
+
+var APP_KEY = "";
+var API_KEY_ADMIN = "";
+var APP_ID = "";
+var DEVICE_ID = "1234567890";
+
+describe('Testing Populator plugin', function() {
+    describe('Testing enviroment endpoint ', function() {
+        it('Set params', function(done) {
+            API_KEY_ADMIN = testUtils.get("API_KEY_ADMIN");
+            APP_ID = testUtils.get("APP_ID");
+            APP_KEY = testUtils.get("APP_KEY");
+            done();
+        });
+
+        it('Try without any params', function(done) {
+            request
+                .get('/i/populator/environment/save')
+                .expect(400)
+                .end(function(err, res) {
+                    var ob = JSON.parse(res.text);
+                    ob.result.should.eql("Missing parameter \"api_key\" or \"auth_token\"");
+                    done();
+                });
+
+        });
+
+        it('Try without "users"', function(done) {
+            request
+                .get('/i/populator/environment/save?api_key=' + API_KEY_ADMIN)
+                .expect(400)
+                .end(function(err, res) {
+                    var ob = JSON.parse(res.text);
+                    ob.result.should.eql("Missing params: users");
+                    done();
+                });
+        });
+    });
+
+
+});