Fix share URL permissions. (#1745)

* Fix share URL permissions.

* Add sql param logic.

* Add permissions to edit website.

* Update permissions.

* Move parameters to param injection.

* Sanitize eventdata.

* Remove caret.

* Fix avg.

queries/analytics/event/getEventData.js

@@ -10,29 +10,44 @@ export async function getEventData(...args) {
 }
 
 async function relationalQuery(websiteId, { startDate, endDate, event_name, columns, filters }) {
-  const { rawQuery, getEventDataColumnsQuery, getEventDataFilterQuery } = prisma;
-  const params = [startDate, endDate];
+  const {
+    rawQuery,
+    getEventDataColumnsQuery,
+    getEventDataFilterQuery,
+    toUuid,
+    getSanitizedColumns,
+  } = prisma;
+  const sanitizedColumns = getSanitizedColumns(columns);
+  const params = [websiteId, startDate, endDate];
+
+  if (event_name) {
+    params.push(event_name);
+  }
+
+  const columnQuery = getEventDataColumnsQuery('event_data.event_data', sanitizedColumns, params);
+  const filterQuery =
+    Object.keys(filters).length > 0
+      ? `and ${getEventDataFilterQuery('event_data.event_data', filters, params)}`
+      : '';
 
   return rawQuery(
     `select
-      ${getEventDataColumnsQuery('event_data.event_data', columns)}
+      ${columnQuery}
     from event
       join website 
         on event.website_id = website.website_id
       join event_data
         on event.event_id = event_data.event_id
-    where website_uuid='${websiteId}'
-      and event.created_at between $1 and $2
-      ${event_name ? `and event_name = ${event_name}` : ''}
-      ${
-        Object.keys(filters).length > 0
-          ? `and ${getEventDataFilterQuery('event_data.event_data', filters)}`
-          : ''
-      }`,
+    where website_uuid = $1${toUuid()}
+      and event.created_at between $2 and $3
+      ${event_name ? `and event_name = $4` : ''}
+      ${filterQuery}`,
     params,
   ).then(results => {
-    return Object.keys(results[0]).map(a => {
-      return { x: a, y: results[0][`${a}`] };
+    const fields = Object.keys(sanitizedColumns);
+
+    return Object.keys(results[0]).map((a, i) => {
+      return { x: `${sanitizedColumns[fields[i]]}(${fields[i]})`, y: results[0][i] };
     });
   });
 }

queries/analytics/event/getEventMetrics.js

@@ -17,8 +17,8 @@ async function relationalQuery(
   unit = 'day',
   filters = {},
 ) {
-  const { rawQuery, getDateQuery, getFilterQuery } = prisma;
-  const params = [start_at, end_at];
+  const { rawQuery, getDateQuery, getFilterQuery, toUuid } = prisma;
+  const params = [websiteId, start_at, end_at];
 
   return rawQuery(
     `select
@@ -28,8 +28,8 @@ async function relationalQuery(
     from event
       join website 
         on event.website_id = website.website_id
-    where website_uuid='${websiteId}'
-      and event.created_at between $1 and $2
+    where website_uuid = $1${toUuid()}
+      and event.created_at between $2 and $3
     ${getFilterQuery('event', filters, params)}
     group by 1, 2
     order by 2`,

queries/analytics/pageview/getPageviewMetrics.js

@@ -10,8 +10,8 @@ export async function getPageviewMetrics(...args) {
 }
 
 async function relationalQuery(websiteId, { startDate, endDate, column, table, filters = {} }) {
-  const { rawQuery, parseFilters } = prisma;
-  const params = [startDate, endDate];
+  const { rawQuery, parseFilters, toUuid } = prisma;
+  const params = [websiteId, startDate, endDate];
   const { pageviewQuery, sessionQuery, eventQuery, joinSession } = parseFilters(
     table,
     column,
@@ -24,8 +24,8 @@ async function relationalQuery(websiteId, { startDate, endDate, column, table, f
     from ${table}
       ${` join website on ${table}.website_id = website.website_id`}
       ${joinSession}
-    where website.website_uuid='${websiteId}'
-      and ${table}.created_at between $1 and $2
+    where website.website_uuid = $1${toUuid()}
+      and ${table}.created_at between $2 and $3
       ${pageviewQuery}
       ${joinSession && sessionQuery}
       ${eventQuery}

queries/analytics/pageview/getPageviewParams.js

@@ -9,8 +9,8 @@ export async function getPageviewParams(...args) {
 }
 
 async function relationalQuery(websiteId, start_at, end_at, column, table, filters = {}) {
-  const { parseFilters, rawQuery } = prisma;
-  const params = [start_at, end_at];
+  const { parseFilters, rawQuery, toUuid } = prisma;
+  const params = [websiteId, start_at, end_at];
   const { pageviewQuery, sessionQuery, eventQuery, joinSession } = parseFilters(
     table,
     column,
@@ -24,8 +24,8 @@ async function relationalQuery(websiteId, start_at, end_at, column, table, filte
     from ${table}
       ${` join website on ${table}.website_id = website.website_id`}
       ${joinSession}
-    where website.website_uuid='${websiteId}'
-      and ${table}.created_at between $1 and $2
+    where website.website_uuid = $1${toUuid()}
+      and ${table}.created_at between $2 and $3
       and ${table}.url like '%?%'
       ${pageviewQuery}
       ${joinSession && sessionQuery}

queries/analytics/pageview/getPageviewStats.js

@@ -21,8 +21,8 @@ async function relationalQuery(
     sessionKey = 'session_id',
   },
 ) {
-  const { getDateQuery, parseFilters, rawQuery } = prisma;
-  const params = [start_at, end_at];
+  const { getDateQuery, parseFilters, rawQuery, toUuid } = prisma;
+  const params = [websiteId, start_at, end_at];
   const { pageviewQuery, sessionQuery, joinSession } = parseFilters(
     'pageview',
     null,
@@ -37,8 +37,8 @@ async function relationalQuery(
         join website
             on pageview.website_id = website.website_id
         ${joinSession}
-      where website.website_uuid='${websiteId}'
-        and pageview.created_at between $1 and $2
+      where website.website_uuid = $1${toUuid()}
+        and pageview.created_at between $2 and $3
         ${pageviewQuery}
         ${sessionQuery}
       group by 1`,

queries/analytics/session/getSessionMetrics.js

@@ -10,8 +10,8 @@ export async function getSessionMetrics(...args) {
 }
 
 async function relationalQuery(websiteId, { startDate, endDate, field, filters = {} }) {
-  const { parseFilters, rawQuery } = prisma;
-  const params = [startDate, endDate];
+  const { parseFilters, rawQuery, toUuid } = prisma;
+  const params = [websiteId, startDate, endDate];
   const { pageviewQuery, sessionQuery, joinSession } = parseFilters(null, filters, params);
 
   return rawQuery(
@@ -23,8 +23,8 @@ async function relationalQuery(websiteId, { startDate, endDate, field, filters =
         join website 
           on pageview.website_id = website.website_id
         ${joinSession}
-      where website.website_uuid='${websiteId}'
-      and pageview.created_at between $1 and $2
+      where website.website_uuid = $1${toUuid()}
+      and pageview.created_at between $2 and $3
       ${pageviewQuery}
       ${sessionQuery}
     )

queries/analytics/stats/getActiveVisitors.js

@@ -11,16 +11,17 @@ export async function getActiveVisitors(...args) {
 }
 
 async function relationalQuery(websiteId) {
+  const { rawQuery, toUuid } = prisma;
   const date = subMinutes(new Date(), 5);
-  const params = [date];
+  const params = [websiteId, date];
 
-  return prisma.rawQuery(
+  return rawQuery(
     `select count(distinct session_id) x
     from pageview
       join website 
         on pageview.website_id = website.website_id
-    where website.website_uuid = '${websiteId}'
-    and pageview.created_at >= $1`,
+    where website.website_uuid = $1${toUuid()}
+    and pageview.created_at >= $2`,
     params,
   );
 }

queries/analytics/stats/getWebsiteStats.js

@@ -10,8 +10,8 @@ export async function getWebsiteStats(...args) {
 }
 
 async function relationalQuery(websiteId, { start_at, end_at, filters = {} }) {
-  const { getDateQuery, getTimestampInterval, parseFilters, rawQuery } = prisma;
-  const params = [start_at, end_at];
+  const { getDateQuery, getTimestampInterval, parseFilters, rawQuery, toUuid } = prisma;
+  const params = [websiteId, start_at, end_at];
   const { pageviewQuery, sessionQuery, joinSession } = parseFilters(
     'pageview',
     null,
@@ -33,8 +33,8 @@ async function relationalQuery(websiteId, { start_at, end_at, filters = {} }) {
           join website 
             on pageview.website_id = website.website_id
           ${joinSession}
-        where website.website_uuid='${websiteId}'
-          and pageview.created_at between $1 and $2
+        where website.website_uuid = $1${toUuid()}
+          and pageview.created_at between $2 and $3
           ${pageviewQuery}
           ${sessionQuery}
         group by 1, 2