watson/umami
1
0
Fork 0
mirror of https://github.com/umami-software/umami.git synced 2026-02-21 21:15:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

API security updates.

Browse source
This commit is contained in:
Mike Cao 2020-09-11 13:49:43 -07:00
parent 01432266ef
commit 8e3286179a
7 changed files with 115 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

55
pages/api/website/[id]/rankings.js
View file

@ -1,6 +1,7 @@
import { getRankings } from 'lib/queries';
import { ok, badRequest } from 'lib/response';
import { DOMAIN_REGEX } from '../../../../lib/constants';
import { ok, badRequest, methodNotAllowed } from 'lib/response';
import { DOMAIN_REGEX } from 'lib/constants';
import { useAuth } from 'lib/middleware';
const sessionColumns = ['browser', 'os', 'device', 'country'];
const pageviewColumns = ['url', 'referrer'];
@ -25,29 +26,35 @@ function getColumn(type) {
}
export default async (req, res) => {
const { id, type, start_at, end_at, domain } = req.query;
const websiteId = +id;
const startDate = new Date(+start_at);
const endDate = new Date(+end_at);
await useAuth(req, res);
if (
type !== 'event' &&
!sessionColumns.includes(type) &&
!pageviewColumns.includes(type) &&
domain &&
DOMAIN_REGEX.test(domain)
) {
return badRequest(res);
if (req.method === 'GET') {
const { id, type, start_at, end_at, domain } = req.query;
const websiteId = +id;
const startDate = new Date(+start_at);
const endDate = new Date(+end_at);
if (
type !== 'event' &&
!sessionColumns.includes(type) &&
!pageviewColumns.includes(type) &&
domain &&
DOMAIN_REGEX.test(domain)
) {
return badRequest(res);
}
const rankings = await getRankings(
websiteId,
startDate,
endDate,
getColumn(type),
getTable(type),
domain,
);
return ok(res, rankings);
}
const rankings = await getRankings(
websiteId,
startDate,
endDate,
getColumn(type),
getTable(type),
domain,
);
return ok(res, rankings);
return methodNotAllowed(res);
};