watson/umami
1
0
Fork 0
mirror of https://github.com/umami-software/umami.git synced 2026-02-10 15:47:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

v1.39.2 (#1599)

Browse source 
* Fixed issue with realtime page rendering.

* fix auth, add pg extension (#1596)

* Fixed change password issue. API refactoring. Closes #1592.

* Fixed account lookup.

* Fixed issue with accessing user dashboards. Closes #1590

* fix sort on dashboard (#1600)

Co-authored-by: Brian Cao <brian@umami.is>
This commit is contained in:
Mike Cao 2022-10-25 16:50:12 -07:00 • committed by GitHub
parent 94dc915272
commit aceb904398
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
38 changed files with 145 additions and 169 deletions
Download patch file Download diff file Expand all files Collapse all files

14
pages/api/accounts/[id]/password.js
View file

@ -1,4 +1,4 @@
import { getAccountById, updateAccount } from 'queries';
import { getAccount, updateAccount } from 'queries';
import { useAuth } from 'lib/middleware';
import {
badRequest,
@ -8,21 +8,21 @@ import {
checkPassword,
hashPassword,
} from 'next-basics';
import { allowQuery } from 'lib/auth';
import { TYPE_ACCOUNT } from 'lib/constants';
export default async (req, res) => {
await useAuth(req, res);
const { userId: currentUserId, isAdmin: currentUserIsAdmin } = req.auth;
const { current_password, new_password } = req.body;
const { id } = req.query;
const userId = +id;
const { id: accountUuid } = req.query;
if (!currentUserIsAdmin && userId !== currentUserId) {
if (!(await allowQuery(req, TYPE_ACCOUNT))) {
return unauthorized(res);
}
if (req.method === 'POST') {
const account = await getAccountById(userId);
const account = await getAccount({ accountUuid });
if (!checkPassword(current_password, account.password)) {
return badRequest(res, 'Current password is incorrect');
@ -30,7 +30,7 @@ export default async (req, res) => {
const password = hashPassword(new_password);
const updated = await updateAccount(userId, { password });
const updated = await updateAccount({ password }, { accountUuid });
return ok(res, updated);
}

6
pages/api/accounts/index.js
View file

@ -1,7 +1,7 @@
import { ok, unauthorized, methodNotAllowed, badRequest, hashPassword } from 'next-basics';
import { useAuth } from 'lib/middleware';
import { uuid } from 'lib/crypto';
import { createAccount, getAccountByUsername, getAccounts } from 'queries';
import { createAccount, getAccount, getAccounts } from 'queries';
export default async (req, res) => {
await useAuth(req, res);
@ -21,9 +21,9 @@ export default async (req, res) => {
if (req.method === 'POST') {
const { username, password, account_uuid } = req.body;
const accountByUsername = await getAccountByUsername(username);
const account = await getAccount({ username });
if (accountByUsername) {
if (account) {
return badRequest(res, 'Account already exists');
}

4
pages/api/auth/login.js
View file

@ -1,5 +1,5 @@
import { ok, unauthorized, badRequest, checkPassword, createSecureToken } from 'next-basics';
import { getAccountByUsername } from 'queries/admin/account/getAccountByUsername';
import { getAccount } from 'queries';
import { secret } from 'lib/crypto';
export default async (req, res) => {
@ -9,7 +9,7 @@ export default async (req, res) => {
return badRequest(res);
}
const account = await getAccountByUsername(username);
const account = await getAccount({ username });
if (account && checkPassword(password, account.password)) {
const { id, username, isAdmin, accountUuid } = account;

2
pages/api/realtime/init.js
View file

@ -10,7 +10,7 @@ export default async (req, res) => {
if (req.method === 'GET') {
const { userId } = req.auth;
const websites = await getUserWebsites(userId);
const websites = await getUserWebsites({ userId });
const ids = websites.map(({ websiteUuid }) => websiteUuid);
const token = createToken({ websites: ids }, secret());
const data = await getRealtimeData(ids, subMinutes(new Date(), 30));

4
pages/api/share/[id].js
View file

@ -1,4 +1,4 @@
import { getWebsiteByShareId } from 'queries';
import { getWebsite } from 'queries';
import { ok, notFound, methodNotAllowed, createToken } from 'next-basics';
import { secret } from 'lib/crypto';
@ -6,7 +6,7 @@ export default async (req, res) => {
const { id } = req.query;
if (req.method === 'GET') {
const website = await getWebsiteByShareId(id);
const website = await getWebsite({ shareId: id });
if (website) {
const { websiteUuid } = website;

3
pages/api/websites/[id]/active.js
View file

@ -2,13 +2,14 @@ import { methodNotAllowed, ok, unauthorized } from 'next-basics';
import { allowQuery } from 'lib/auth';
import { useAuth, useCors } from 'lib/middleware';
import { getActiveVisitors } from 'queries';
import { TYPE_WEBSITE } from 'lib/constants';
export default async (req, res) => {
await useCors(req, res);
await useAuth(req, res);
if (req.method === 'GET') {
if (!(await allowQuery(req))) {
if (!(await allowQuery(req, TYPE_WEBSITE))) {
return unauthorized(res);
}

3
pages/api/websites/[id]/eventdata.js
View file

@ -3,13 +3,14 @@ import { getEventData } from 'queries';
import { ok, badRequest, methodNotAllowed, unauthorized } from 'next-basics';
import { allowQuery } from 'lib/auth';
import { useAuth, useCors } from 'lib/middleware';
import { TYPE_WEBSITE } from 'lib/constants';
export default async (req, res) => {
await useCors(req, res);
await useAuth(req, res);
if (req.method === 'POST') {
if (!(await allowQuery(req))) {
if (!(await allowQuery(req, TYPE_WEBSITE))) {
return unauthorized(res);
}

3
pages/api/websites/[id]/events.js
View file

@ -3,6 +3,7 @@ import { getEventMetrics } from 'queries';
import { ok, badRequest, methodNotAllowed, unauthorized } from 'next-basics';
import { allowQuery } from 'lib/auth';
import { useAuth, useCors } from 'lib/middleware';
import { TYPE_WEBSITE } from 'lib/constants';
const unitTypes = ['year', 'month', 'hour', 'day'];
@ -11,7 +12,7 @@ export default async (req, res) => {
await useAuth(req, res);
if (req.method === 'GET') {
if (!(await allowQuery(req))) {
if (!(await allowQuery(req, TYPE_WEBSITE))) {
return unauthorized(res);
}

15
pages/api/websites/[id]/index.js
View file

@ -2,19 +2,20 @@ import { allowQuery } from 'lib/auth';
import { useAuth, useCors } from 'lib/middleware';
import { getRandomChars, methodNotAllowed, ok, serverError, unauthorized } from 'next-basics';
import { deleteWebsite, getAccount, getWebsite, updateWebsite } from 'queries';
import { TYPE_WEBSITE } from 'lib/constants';
export default async (req, res) => {
await useCors(req, res);
await useAuth(req, res);
const { id: websiteId } = req.query;
const { id: websiteUuid } = req.query;
if (!(await allowQuery(req))) {
if (!(await allowQuery(req, TYPE_WEBSITE))) {
return unauthorized(res);
}
if (req.method === 'GET') {
const website = await getWebsite({ websiteUuid: websiteId });
const website = await getWebsite({ websiteUuid });
return ok(res, website);
}
@ -32,7 +33,7 @@ export default async (req, res) => {
}
}
const website = await getWebsite({ websiteUuid: websiteId });
const website = await getWebsite({ websiteUuid });
const newShareId = enableShareUrl ? website.shareId || getRandomChars(8) : null;
@ -44,7 +45,7 @@ export default async (req, res) => {
shareId: shareId ? shareId : newShareId,
userId: account ? account.id : +owner || undefined,
},
{ websiteUuid: websiteId },
{ websiteUuid },
);
} catch (e) {
if (e.message.includes('Unique constraint') && e.message.includes('share_id')) {
@ -56,11 +57,11 @@ export default async (req, res) => {
}
if (req.method === 'DELETE') {
if (!(await allowQuery(req, true))) {
if (!(await allowQuery(req, TYPE_WEBSITE))) {
return unauthorized(res);
}
await deleteWebsite(websiteId);
await deleteWebsite(websiteUuid);
return ok(res);
}

8
pages/api/websites/[id]/metrics.js
View file

@ -1,8 +1,8 @@
import { allowQuery } from 'lib/auth';
import { FILTER_IGNORED } from 'lib/constants';
import { FILTER_IGNORED, TYPE_WEBSITE } from 'lib/constants';
import { useAuth, useCors } from 'lib/middleware';
import { badRequest, methodNotAllowed, ok, unauthorized } from 'next-basics';
import { getPageviewMetrics, getSessionMetrics, getWebsiteByUuid } from 'queries';
import { getPageviewMetrics, getSessionMetrics, getWebsite } from 'queries';
const sessionColumns = ['browser', 'os', 'device', 'screen', 'country', 'language'];
const pageviewColumns = ['url', 'referrer', 'query'];
@ -38,7 +38,7 @@ export default async (req, res) => {
await useAuth(req, res);
if (req.method === 'GET') {
if (!(await allowQuery(req))) {
if (!(await allowQuery(req, TYPE_WEBSITE))) {
return unauthorized(res);
}
@ -94,7 +94,7 @@ export default async (req, res) => {
let domain;
if (type === 'referrer') {
const website = await getWebsiteByUuid(websiteId);
const website = await getWebsite({ websiteUuid: websiteId });
if (!website) {
return badRequest(res);

3
pages/api/websites/[id]/pageviews.js
View file

@ -3,6 +3,7 @@ import { getPageviewStats } from 'queries';
import { ok, badRequest, methodNotAllowed, unauthorized } from 'next-basics';
import { allowQuery } from 'lib/auth';
import { useAuth, useCors } from 'lib/middleware';
import { TYPE_WEBSITE } from 'lib/constants';
const unitTypes = ['year', 'month', 'hour', 'day'];
@ -11,7 +12,7 @@ export default async (req, res) => {
await useAuth(req, res);
if (req.method === 'GET') {
if (!(await allowQuery(req))) {
if (!(await allowQuery(req, TYPE_WEBSITE))) {
return unauthorized(res);
}

3
pages/api/websites/[id]/reset.js
View file

@ -2,6 +2,7 @@ import { resetWebsite } from 'queries';
import { methodNotAllowed, ok, unauthorized } from 'next-basics';
import { allowQuery } from 'lib/auth';
import { useAuth, useCors } from 'lib/middleware';
import { TYPE_WEBSITE } from 'lib/constants';
export default async (req, res) => {
await useCors(req, res);
@ -10,7 +11,7 @@ export default async (req, res) => {
const { id: websiteId } = req.query;
if (req.method === 'POST') {
if (!(await allowQuery(req))) {
if (!(await allowQuery(req, TYPE_WEBSITE))) {
return unauthorized(res);
}

3
pages/api/websites/[id]/stats.js
View file

@ -2,13 +2,14 @@ import { getWebsiteStats } from 'queries';
import { methodNotAllowed, ok, unauthorized } from 'next-basics';
import { allowQuery } from 'lib/auth';
import { useAuth, useCors } from 'lib/middleware';
import { TYPE_WEBSITE } from 'lib/constants';
export default async (req, res) => {
await useCors(req, res);
await useAuth(req, res);
if (req.method === 'GET') {
if (!(await allowQuery(req))) {
if (!(await allowQuery(req, TYPE_WEBSITE))) {
return unauthorized(res);
}

9
pages/api/websites/index.js
View file

@ -6,15 +6,16 @@ import { uuid } from 'lib/crypto';
export default async (req, res) => {
await useAuth(req, res);
const { userId: currentUserId, isAdmin, accountUuid } = req.auth;
const { user_id, include_all } = req.query;
const { userId: currentUserId, isAdmin } = req.auth;
const accountUuid = user_id || req.auth.accountUuid;
let account;
if (accountUuid) {
account = await getAccount({ accountUuid: accountUuid });
account = await getAccount({ accountUuid });
}
const userId = account ? account.id : +user_id;
const userId = account ? account.id : user_id;
if (req.method === 'GET') {
if (userId && userId !== currentUserId && !isAdmin) {
@ -24,7 +25,7 @@ export default async (req, res) => {
const websites =
isAdmin && include_all
? await getAllWebsites()
: await getUserWebsites(userId || currentUserId);
: await getUserWebsites({ userId: account.id });
return ok(res, websites);
}