Skip to content

Commit 25dfce3

Browse files
dblythydblythy
committed
review changes
1 parent df8be61 commit 25dfce3

File tree

7 files changed

+118
-60
lines changed

7 files changed

+118
-60
lines changed

‎spec/ParseFile.spec.js

Lines changed: 60 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -860,7 +860,8 @@ describe('Parse.File testing', () => {
860860
});
861861
});
862862
});
863-
describe('file upload restrictions', () => {
863+
864+
describe('disable file upload', () => {
864865
it('can reject file upload with unspecified', async () => {
865866
await reconfigureServer({
866867
fileUpload: {},
@@ -871,15 +872,16 @@ describe('Parse.File testing', () => {
871872
fail('should not have been able to save file.');
872873
} catch (e) {
873874
expect(e.code).toBe(130);
874-
expect(e.message).toBe('Public file upload is not enabled.');
875+
expect(e.message).toBe('File upload by public is not enabled.');
875876
}
876877
});
877-
it('disable file upload', async () => {
878+
879+
it('disable all file upload', async () => {
878880
await reconfigureServer({
879881
fileUpload: {
880-
enabledForPublic: false,
881-
enabledForAnonymousUser: false,
882-
enabledForAuthenticatedUser: false,
882+
enableForPublic: false,
883+
enableForAnonymousUser: false,
884+
enableForAuthenticatedUser: false,
883885
},
884886
});
885887
try {
@@ -888,13 +890,14 @@ describe('Parse.File testing', () => {
888890
fail('should not have been able to save file.');
889891
} catch (e) {
890892
expect(e.code).toBe(130);
891-
expect(e.message).toBe('Public file upload is not enabled.');
893+
expect(e.message).toBe('File upload by public is not enabled.');
892894
}
893895
});
894-
it('disable for public', async () => {
896+
897+
it('disable public file upload', async () => {
895898
await reconfigureServer({
896899
fileUpload: {
897-
enabledForPublic: false,
900+
enableForPublic: false,
898901
},
899902
});
900903
try {
@@ -903,14 +906,15 @@ describe('Parse.File testing', () => {
903906
fail('should not have been able to save file.');
904907
} catch (e) {
905908
expect(e.code).toBe(130);
906-
expect(e.message).toBe('Public file upload is not enabled.');
909+
expect(e.message).toBe('File upload by public is not enabled.');
907910
}
908911
});
909912

910-
it('disable for public allow user', async () => {
913+
it('disable file upload for public but allow for user', async () => {
911914
await reconfigureServer({
912915
fileUpload: {
913-
enabledForPublic: false,
916+
enableForPublic: false,
917+
enableForAuthenticatedUser: true,
914918
},
915919
});
916920
try {
@@ -922,10 +926,10 @@ describe('Parse.File testing', () => {
922926
}
923927
});
924928

925-
it('disable for anonymous', async () => {
929+
it('disable file upload for anonymous', async () => {
926930
await reconfigureServer({
927931
fileUpload: {
928-
enabledForAnonymousUser: false,
932+
enableForAnonymousUser: false,
929933
},
930934
});
931935
try {
@@ -935,15 +939,15 @@ describe('Parse.File testing', () => {
935939
fail('should not have been able to save file.');
936940
} catch (e) {
937941
expect(e.code).toBe(130);
938-
expect(e.message).toBe('Anonymous file upload is not enabled.');
942+
expect(e.message).toBe('File upload by anonymous user is not allowed.');
939943
}
940944
});
941945

942-
it('enable for anonymous', async () => {
946+
it('enable file upload for anonymous', async () => {
943947
await reconfigureServer({
944948
fileUpload: {
945-
enabledForPublic: false,
946-
enabledForAnonymousUser: true,
949+
enableForPublic: false,
950+
enableForAnonymousUser: true,
947951
},
948952
});
949953
try {
@@ -955,12 +959,12 @@ describe('Parse.File testing', () => {
955959
}
956960
});
957961

958-
it('enable for anonymous but not authenticated', async () => {
962+
it('enable file upload for anonymous but not authenticated users', async () => {
959963
await reconfigureServer({
960964
fileUpload: {
961-
enabledForPublic: false,
962-
enabledForAnonymousUser: true,
963-
enabledForAuthenticatedUser: false,
965+
enableForPublic: false,
966+
enableForAnonymousUser: true,
967+
enableForAuthenticatedUser: false,
964968
},
965969
});
966970
try {
@@ -977,8 +981,41 @@ describe('Parse.File testing', () => {
977981
fail('should have not allowed file to save.');
978982
} catch (e) {
979983
expect(e.code).toBe(130);
980-
expect(e.message).toBe('Authenticated file upload is not enabled.');
984+
expect(e.message).toBe('File upload by authenticated users is not enabled.');
981985
}
982986
});
983987
});
988+
989+
it('setup with invalid configuration', async () => {
990+
try {
991+
await reconfigureServer({
992+
fileUpload: {
993+
enableForPublic: [],
994+
},
995+
});
996+
fail('should not allow invalid configuration');
997+
} catch (e) {
998+
expect(e).toBe('enableForPublic must be a boolean value');
999+
}
1000+
try {
1001+
await reconfigureServer({
1002+
fileUpload: {
1003+
enableForAnonymousUser: [],
1004+
},
1005+
});
1006+
fail('should not allow invalid configuration');
1007+
} catch (e) {
1008+
expect(e).toBe('enableForAnonymousUser must be a boolean value');
1009+
}
1010+
try {
1011+
await reconfigureServer({
1012+
fileUpload: {
1013+
enableForAuthenticatedUser: [],
1014+
},
1015+
});
1016+
fail('should not allow invalid configuration');
1017+
} catch (e) {
1018+
expect(e).toBe('enableForAuthenticatedUser must be a boolean value');
1019+
}
1020+
});
9841021
});

‎spec/helper.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ const defaultConfiguration = {
8989
silent,
9090
logLevel,
9191
fileUpload: {
92-
enabledForPublic: true,
92+
enableForPublic: true,
9393
},
9494
push: {
9595
android: {

‎src/Config.js

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ export class Config {
7171
allowHeaders,
7272
idempotencyOptions,
7373
emailVerifyTokenReuseIfValid,
74+
fileUpload,
7475
}) {
7576
if (masterKey === readOnlyMasterKey) {
7677
throw new Error('masterKey and readOnlyMasterKey should be different');
@@ -91,6 +92,8 @@ export class Config {
9192

9293
this.validatePasswordPolicy(passwordPolicy);
9394

95+
this.validateFileUploadOptions(fileUpload);
96+
9497
if (typeof revokeSessionOnPasswordReset !== 'boolean') {
9598
throw 'revokeSessionOnPasswordReset must be a boolean value';
9699
}
@@ -244,7 +247,25 @@ export class Config {
244247
throw 'You cannot use emailVerifyTokenReuseIfValid without emailVerifyTokenValidityDuration';
245248
}
246249
}
250+
static validateFileUploadOptions(fileUpload) {
251+
if (
252+
fileUpload.enableForAnonymousUser &&
253+
typeof fileUpload.enableForAnonymousUser !== 'boolean'
254+
) {
255+
throw 'enableForAnonymousUser must be a boolean value';
256+
}
257+
258+
if (fileUpload.enableForPublic && typeof fileUpload.enableForPublic !== 'boolean') {
259+
throw 'enableForPublic must be a boolean value';
260+
}
247261

262+
if (
263+
fileUpload.enableForAuthenticatedUser &&
264+
typeof fileUpload.enableForAuthenticatedUser !== 'boolean'
265+
) {
266+
throw 'enableForAuthenticatedUser must be a boolean value';
267+
}
268+
}
248269
static validateMasterKeyIps(masterKeyIps) {
249270
for (const ip of masterKeyIps) {
250271
if (!net.isIP(ip)) {

‎src/Options/Definitions.js

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -606,22 +606,21 @@ module.exports.PasswordPolicyOptions = {
606606
},
607607
};
608608
module.exports.FileUploadOptions = {
609-
enabledForAnonymousUser: {
610-
env: 'PARSE_SERVER_FILE_UPLOAD_ENABLED_FOR_ANONYMOUS_USER',
611-
help: 'File upload is enabled for Anonymous Users.',
609+
enableForAnonymousUser: {
610+
env: 'PARSE_SERVER_FILE_UPLOAD_ENABLE_FOR_ANONYMOUS_USER',
611+
help: 'Is true if file upload should be allowed for anonymous users.',
612612
action: parsers.booleanParser,
613613
default: false,
614614
},
615-
enabledForAuthenticatedUser: {
616-
env: 'PARSE_SERVER_FILE_UPLOAD_ENABLED_FOR_AUTHENTICATED_USER',
617-
help: 'File upload is enabled for authenticated users.',
615+
enableForAuthenticatedUser: {
616+
env: 'PARSE_SERVER_FILE_UPLOAD_ENABLE_FOR_AUTHENTICATED_USER',
617+
help: 'Is true if file upload should be allowed for authenticated users.',
618618
action: parsers.booleanParser,
619-
default: true,
619+
default: false,
620620
},
621-
enabledForPublic: {
622-
env: 'PARSE_SERVER_FILE_UPLOAD_ENABLED_FOR_PUBLIC',
623-
help:
624-
'File upload is enabled for anyone with access to the Parse Server file upload endpoint, regardless of user authentication.',
621+
enableForPublic: {
622+
env: 'PARSE_SERVER_FILE_UPLOAD_ENABLE_FOR_PUBLIC',
623+
help: 'Is true if file upload should be allowed for anyone, regardless of user authentication.',
625624
action: parsers.booleanParser,
626625
default: false,
627626
},

‎src/Options/docs.js

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@
141141

142142
/**
143143
* @interface FileUploadOptions
144-
* @property {Boolean} enabledForAnonymousUser File upload is enabled for Anonymous Users.
145-
* @property {Boolean} enabledForAuthenticatedUser File upload is enabled for authenticated users.
146-
* @property {Boolean} enabledForPublic File upload is enabled for anyone with access to the Parse Server file upload endpoint, regardless of user authentication.
144+
* @property {Boolean} enableForAnonymousUser Is true if file upload should be allowed for anonymous users.
145+
* @property {Boolean} enableForAuthenticatedUser Is true if file upload should be allowed for authenticated users.
146+
* @property {Boolean} enableForPublic Is true if file upload should be allowed for anyone, regardless of user authentication.
147147
*/

‎src/Options/index.js

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -320,13 +320,13 @@ export interface PasswordPolicyOptions {
320320
}
321321

322322
export interface FileUploadOptions {
323-
/* File upload is enabled for Anonymous Users.
323+
/* Is true if file upload should be allowed for anonymous users.
324324
:DEFAULT: false */
325-
enabledForAnonymousUser: ?boolean;
326-
/* File upload is enabled for anyone with access to the Parse Server file upload endpoint, regardless of user authentication.
325+
enableForAnonymousUser: ?boolean;
326+
/* Is true if file upload should be allowed for authenticated users.
327327
:DEFAULT: false */
328-
enabledForPublic: ?boolean;
329-
/* File upload is enabled for authenticated users.
330-
:DEFAULT: true */
331-
enabledForAuthenticatedUser: ?boolean;
328+
enableForAuthenticatedUser: ?boolean;
329+
/* Is true if file upload should be allowed for anyone, regardless of user authentication.
330+
:DEFAULT: false */
331+
enableForPublic: ?boolean;
332332
}

‎src/Routers/FilesRouter.js

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -94,27 +94,28 @@ export class FilesRouter {
9494

9595
async createHandler(req, res, next) {
9696
const config = req.config;
97-
if (
98-
!req.config.fileUpload.enabledForAnonymousUser &&
99-
req.auth.user &&
100-
Parse.AnonymousUtils.isLinked(req.auth.user)
101-
) {
102-
next(new Parse.Error(Parse.Error.FILE_SAVE_ERROR, 'Anonymous file upload is not enabled.'));
97+
const user = req.auth.user;
98+
const isLinked = user && Parse.AnonymousUtils.isLinked(user);
99+
if (!config.fileUpload.enableForAnonymousUser && isLinked) {
100+
next(
101+
new Parse.Error(
102+
Parse.Error.FILE_SAVE_ERROR,
103+
'File upload by anonymous user is not allowed.'
104+
)
105+
);
103106
return;
104107
}
105-
if (
106-
!req.config.fileUpload.enabledForAuthenticatedUser &&
107-
req.config.fileUpload.enabledForAuthenticatedUser != null &&
108-
req.auth.user &&
109-
!Parse.AnonymousUtils.isLinked(req.auth.user)
110-
) {
108+
if (!config.fileUpload.enableForAuthenticatedUser && !isLinked && user) {
111109
next(
112-
new Parse.Error(Parse.Error.FILE_SAVE_ERROR, 'Authenticated file upload is not enabled.')
110+
new Parse.Error(
111+
Parse.Error.FILE_SAVE_ERROR,
112+
'File upload by authenticated users is not enabled.'
113+
)
113114
);
114115
return;
115116
}
116-
if (!req.config.fileUpload.enabledForPublic && !req.auth.user) {
117-
next(new Parse.Error(Parse.Error.FILE_SAVE_ERROR, 'Public file upload is not enabled.'));
117+
if (!config.fileUpload.enableForPublic && !user) {
118+
next(new Parse.Error(Parse.Error.FILE_SAVE_ERROR, 'File upload by public is not enabled.'));
118119
return;
119120
}
120121
const filesController = config.filesController;

0 commit comments

Comments
 (0)