feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/routes/adminDashboard.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const { db } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
+const { sanitizeDays, addDateRangeCondition } = require('../utils/sqlSecurity');
 const router = express.Router();
 
 // Get dashboard statistics
@@ -14,11 +15,15 @@ router.get('/stats', adminAuth, async (req, res) => {
       .first();
 
     // Get events expiring within 7 days
+    const sevenDaysFromNow = new Date();
+    sevenDaysFromNow.setDate(sevenDaysFromNow.getDate() + 7);
+    const now = new Date();
+    
     const expiringEvents = await db('events')
       .where('is_active', true)
       .where('is_archived', false)
-      .whereRaw('expires_at <= datetime("now", "+7 days")')
-      .whereRaw('expires_at > datetime("now")')
+      .where('expires_at', '<=', sevenDaysFromNow.toISOString())
+      .where('expires_at', '>', now.toISOString())
       .count('id as count')
       .first();
 
@@ -33,16 +38,19 @@ router.get('/stats', adminAuth, async (req, res) => {
       .first();
 
     // Get total views (last 30 days)
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+    
     const totalViews = await db('access_logs')
       .where('action', 'view')
-      .whereRaw('timestamp >= datetime("now", "-30 days")')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
       .count('id as count')
       .first();
 
     // Get total downloads (last 30 days)
     const totalDownloads = await db('access_logs')
       .where('action', 'download')
-      .whereRaw('timestamp >= datetime("now", "-30 days")')
+      .where('timestamp', '>=', thirtyDaysAgo.toISOString())
       .count('id as count')
       .first();
 
@@ -53,17 +61,20 @@ router.get('/stats', adminAuth, async (req, res) => {
       .first();
 
     // Calculate trends (compare with previous 30 days)
+    const sixtyDaysAgo = new Date();
+    sixtyDaysAgo.setDate(sixtyDaysAgo.getDate() - 60);
+    
     const previousViews = await db('access_logs')
       .where('action', 'view')
-      .whereRaw('timestamp >= datetime("now", "-60 days")')
-      .whereRaw('timestamp < datetime("now", "-30 days")')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
       .count('id as count')
       .first();
 
     const previousDownloads = await db('access_logs')
       .where('action', 'download')
-      .whereRaw('timestamp >= datetime("now", "-60 days")')
-      .whereRaw('timestamp < datetime("now", "-30 days")')
+      .where('timestamp', '>=', sixtyDaysAgo.toISOString())
+      .where('timestamp', '<', thirtyDaysAgo.toISOString())
       .count('id as count')
       .first();
 
@@ -140,9 +151,12 @@ router.get('/health', adminAuth, async (req, res) => {
       .where('status', 'pending')
       .count('* as count');
     
+    const twentyFourHoursAgo = new Date();
+    twentyFourHoursAgo.setHours(twentyFourHoursAgo.getHours() - 24);
+    
     const [failedEmails] = await db('email_queue')
       .where('status', 'failed')
-      .whereRaw('created_at >= datetime("now", "-24 hours")')
+      .where('created_at', '>=', twentyFourHoursAgo.toISOString())
       .count('* as count');
 
     const emailStatus = failedEmails.count > 10 ? 'warning' : 'healthy';
@@ -194,7 +208,7 @@ router.get('/health', adminAuth, async (req, res) => {
 // Get analytics data for charts
 router.get('/analytics', adminAuth, async (req, res) => {
   try {
-    const days = parseInt(req.query.days) || 7;
+    const days = sanitizeDays(req.query.days || 7);
     
     // Generate date range
     const dates = [];
@@ -207,24 +221,29 @@ router.get('/analytics', adminAuth, async (req, res) => {
       });
     }
 
+    // Calculate the start date for queries
+    const startDate = new Date();
+    startDate.setDate(startDate.getDate() - days);
+    const startDateStr = startDate.toISOString();
+
     // Get views per day
     const viewsData = await db('access_logs')
       .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
       .where('action', 'view')
-      .whereRaw(`timestamp >= datetime("now", "-${days} days")`)
+      .where('timestamp', '>=', startDateStr)
       .groupByRaw('DATE(timestamp)');
 
     // Get downloads per day
     const downloadsData = await db('access_logs')
       .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(*) as count'))
       .where('action', 'download')
-      .whereRaw(`timestamp >= datetime("now", "-${days} days")`)
+      .where('timestamp', '>=', startDateStr)
       .groupByRaw('DATE(timestamp)');
 
     // Get unique visitors per day
     const visitorsData = await db('access_logs')
       .select(db.raw('DATE(timestamp) as date'), db.raw('COUNT(DISTINCT ip_address) as count'))
-      .whereRaw(`timestamp >= datetime("now", "-${days} days")`)
+      .where('timestamp', '>=', startDateStr)
       .groupByRaw('DATE(timestamp)');
 
     // Merge data into dates array
@@ -249,7 +268,7 @@ router.get('/analytics', adminAuth, async (req, res) => {
       .select(db.raw('COUNT(*) as views'))
       .join('events', 'access_logs.event_id', 'events.id')
       .where('access_logs.action', 'view')
-      .whereRaw(`access_logs.timestamp >= datetime("now", "-${days} days")`)
+      .where('access_logs.timestamp', '>=', startDateStr)
       .groupBy('events.id')
       .orderBy('views', 'desc')
       .limit(5);
@@ -266,7 +285,7 @@ router.get('/analytics', adminAuth, async (req, res) => {
         `),
         db.raw('COUNT(*) as count')
       )
-      .whereRaw(`timestamp >= datetime("now", "-${days} days")`)
+      .where('timestamp', '>=', startDateStr)
       .groupBy('device_type');
 
     const totalDevices = deviceData.reduce((sum, d) => sum + d.count, 0);

backend/src/routes/adminEvents.js

@@ -8,6 +8,7 @@ const crypto = require('crypto');
 const fs = require('fs').promises;
 const path = require('path');
 const { archiveEvent } = require('../services/archiveService');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
 const { formatDate } = require('../utils/dateFormatter');
 
 // Create new event
@@ -152,10 +153,11 @@ router.get('/', adminAuth, async (req, res) => {
     
     // Apply search filter
     if (search) {
+      const escapedSearch = escapeLikePattern(search);
       query = query.where((builder) => {
-        builder.where('event_name', 'like', `%${search}%`)
-          .orWhere('admin_email', 'like', `%${search}%`)
-          .orWhere('slug', 'like', `%${search}%`);
+        builder.where('event_name', 'like', `%${escapedSearch}%`)
+          .orWhere('admin_email', 'like', `%${escapedSearch}%`)
+          .orWhere('slug', 'like', `%${escapedSearch}%`);
       });
     }
 

backend/src/routes/adminPhotos.js

@@ -6,6 +6,7 @@ const { db, logActivity } = require('../database/db');
 const { adminAuth } = require('../middleware/auth');
 const { generateThumbnail } = require('../services/imageProcessor');
 const { generatePhotoFilename } = require('../utils/filenameSanitizer');
+const { escapeLikePattern } = require('../utils/sqlSecurity');
 const router = express.Router();
 
 // Get storage path from environment or default
@@ -473,7 +474,8 @@ router.get('/:eventId/photos', adminAuth, async (req, res) => {
     
     // Search by filename
     if (search) {
-      query = query.where('photos.filename', 'like', `%${search}%`);
+      const escapedSearch = escapeLikePattern(search);
+      query = query.where('photos.filename', 'like', `%${escapedSearch}%`);
     }
     
     // Sorting

backend/src/routes/auth-enhanced.js

@@ -0,0 +1,265 @@
+const express = require('express');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+const { body, validationResult } = require('express-validator');
+const { db } = require('../database/db');
+const { verifyRecaptcha } = require('../services/recaptcha');
+const { 
+  trackFailedAttempt,
+  trackSuccessfulLogin,
+  checkAccountLockout,
+  checkSuspiciousActivity,
+  getGenericAuthError
+} = require('../utils/authSecurity');
+const { endSession } = require('../middleware/sessionTimeout');
+const logger = require('../utils/logger');
+const router = express.Router();
+
+// Admin login with enhanced security
+router.post('/admin/login', [
+  body('username').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { username, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check account lockout first
+    const lockoutStatus = await checkAccountLockout(username);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Login attempt on locked account', { username, ipAddress });
+      return res.status(423).json({ 
+        error: 'Account temporarily locked due to too many failed attempts',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    // Check for suspicious activity
+    const isSuspicious = await checkSuspiciousActivity(username, ipAddress);
+    if (isSuspicious) {
+      // Still allow login but log it
+      logger.warn('Suspicious login pattern detected', { username, ipAddress });
+    }
+    
+    const admin = await db('admin_users')
+      .where({ username })
+      .orWhere({ email: username })
+      .first();
+    
+    // Use generic error to prevent user enumeration
+    if (!admin || !await bcrypt.compare(password, admin.password_hash)) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    if (!admin.is_active) {
+      await trackFailedAttempt(username, ipAddress, userAgent);
+      return res.status(401).json({ error: getGenericAuthError() });
+    }
+    
+    // Successful login
+    await trackSuccessfulLogin(username, ipAddress, userAgent);
+    
+    // Update last login and login metadata
+    await db('admin_users').where('id', admin.id).update({ 
+      last_login: new Date(),
+      last_login_ip: ipAddress
+    });
+    
+    // Generate token with additional claims
+    const token = jwt.sign({ 
+      id: admin.id,
+      username: admin.username,
+      type: 'admin',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      user: {
+        id: admin.id,
+        username: admin.username,
+        email: admin.email,
+        mustChangePassword: admin.must_change_password || false
+      }
+    });
+  } catch (error) {
+    logger.error('Login error:', error);
+    res.status(500).json({ error: 'Login failed' });
+  }
+});
+
+// Logout endpoint
+router.post('/logout', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (token) {
+      // End the session
+      endSession(token);
+      
+      // Log the logout
+      try {
+        const decoded = jwt.verify(token, process.env.JWT_SECRET);
+        logger.info('User logged out', { 
+          userId: decoded.id,
+          username: decoded.username,
+          type: decoded.type
+        });
+      } catch (err) {
+        // Token might be invalid, but still process logout
+      }
+    }
+    
+    res.json({ message: 'Logged out successfully' });
+  } catch (error) {
+    logger.error('Logout error:', error);
+    res.status(500).json({ error: 'Logout failed' });
+  }
+});
+
+// Gallery password verification with enhanced security
+router.post('/gallery/verify', [
+  body('slug').notEmpty().trim(),
+  body('password').notEmpty()
+], async (req, res) => {
+  try {
+    const errors = validationResult(req);
+    if (!errors.isEmpty()) {
+      return res.status(400).json({ errors: errors.array() });
+    }
+    
+    const { slug, password, recaptchaToken } = req.body;
+    const ipAddress = req.ip || req.connection.remoteAddress;
+    const userAgent = req.headers['user-agent'] || '';
+    
+    // Check gallery-specific lockout
+    const lockoutStatus = await checkAccountLockout(`gallery:${slug}`);
+    if (lockoutStatus.isLocked) {
+      logger.warn('Gallery access attempt on locked gallery', { slug, ipAddress });
+      return res.status(423).json({ 
+        error: 'Too many failed attempts. Please try again later.',
+        retryAfter: lockoutStatus.remainingTime
+      });
+    }
+    
+    // Verify reCAPTCHA
+    const recaptchaValid = await verifyRecaptcha(recaptchaToken);
+    if (!recaptchaValid) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(400).json({ error: 'reCAPTCHA verification failed' });
+    }
+    
+    const event = await db('events').where({ slug, is_active: true, is_archived: false }).first();
+    if (!event) {
+      // Don't reveal if gallery exists
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await trackFailedAttempt(`gallery:${slug}`, ipAddress, userAgent);
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: ipAddress,
+        user_agent: userAgent,
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid gallery or password' });
+    }
+    
+    // Successful access
+    await trackSuccessfulLogin(`gallery:${slug}`, ipAddress, userAgent);
+    
+    // Log successful access
+    await db('access_logs').insert({
+      event_id: event.id,
+      ip_address: ipAddress,
+      user_agent: userAgent,
+      action: 'login_success'
+    });
+    
+    // Generate session token with additional security info
+    const token = jwt.sign({ 
+      eventId: event.id, 
+      eventSlug: event.slug,
+      type: 'gallery',
+      ip: ipAddress,
+      loginTime: Date.now()
+    }, process.env.JWT_SECRET, { 
+      expiresIn: '24h',
+      issuer: 'picpeak-auth'
+    });
+    
+    res.json({
+      token,
+      event: {
+        id: event.id,
+        event_name: event.event_name,
+        event_type: event.event_type,
+        event_date: event.event_date,
+        welcome_message: event.welcome_message,
+        color_theme: event.color_theme,
+        expires_at: event.expires_at,
+        allow_user_uploads: event.allow_user_uploads,
+        upload_category_id: event.upload_category_id
+      }
+    });
+  } catch (error) {
+    logger.error('Gallery verification error:', error);
+    res.status(500).json({ error: 'Verification failed' });
+  }
+});
+
+// Get current session info
+router.get('/session', async (req, res) => {
+  try {
+    const token = req.headers.authorization?.split(' ')[1];
+    
+    if (!token) {
+      return res.status(401).json({ error: 'No token provided' });
+    }
+    
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET);
+      
+      // Calculate remaining time
+      const now = Date.now() / 1000;
+      const remainingTime = Math.max(0, decoded.exp - now);
+      
+      res.json({
+        valid: true,
+        type: decoded.type,
+        expiresIn: Math.floor(remainingTime),
+        user: decoded.username || decoded.eventSlug
+      });
+    } catch (err) {
+      res.json({
+        valid: false,
+        error: 'Invalid or expired token'
+      });
+    }
+  } catch (error) {
+    res.status(500).json({ error: 'Session check failed' });
+  }
+});
+
+module.exports = router;