paul
e35ac6a41c
Security Enhancements: - Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries - Add LIKE pattern escaping to prevent SQL injection in search functionality - Implement account lockout protection (5 failed attempts = 30 min lockout) - Add comprehensive login attempt tracking and audit trail - Enhance JWT tokens with issuer validation, IP tracking, and password change detection - Add logout endpoint and session management - Prevent user enumeration with generic error messages Database Changes: - Add login_attempts table for authentication tracking - Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled) New Security Features: - Brute force protection with configurable lockout duration - Automatic cleanup of old login attempts - Enhanced authentication middleware with stricter validation - Monitoring scripts for security health checks All fixes are backward compatible and production-ready with rollback plans included. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
94 lines
2.6 KiB
Markdown
94 lines
2.6 KiB
Markdown
# SQL Injection Fix Rollback Plan
|
|
|
|
## Overview
|
|
This document provides a rollback plan in case the SQL injection fixes cause issues in production.
|
|
|
|
## Changes Made
|
|
1. **Created**: `backend/src/utils/sqlSecurity.js` - Central security utilities
|
|
2. **Modified**: `backend/src/routes/adminDashboard.js` - Replaced whereRaw with parameterized queries
|
|
3. **Modified**: `backend/src/routes/adminPhotos.js` - Added LIKE pattern escaping
|
|
4. **Modified**: `backend/src/routes/adminEvents.js` - Added LIKE pattern escaping
|
|
|
|
## Quick Rollback Steps
|
|
|
|
### Step 1: Revert Code Changes
|
|
If issues occur, run these commands to revert:
|
|
|
|
```bash
|
|
# Navigate to backend directory
|
|
cd backend
|
|
|
|
# Revert specific files
|
|
git checkout HEAD -- src/routes/adminDashboard.js
|
|
git checkout HEAD -- src/routes/adminPhotos.js
|
|
git checkout HEAD -- src/routes/adminEvents.js
|
|
|
|
# Remove the new security utility file
|
|
rm src/utils/sqlSecurity.js
|
|
```
|
|
|
|
### Step 2: Restart Services
|
|
```bash
|
|
# If using Docker
|
|
docker-compose restart backend
|
|
|
|
# If using PM2
|
|
pm2 restart picpeak-backend
|
|
```
|
|
|
|
## Verification After Rollback
|
|
|
|
1. Check admin dashboard loads: `/admin/dashboard`
|
|
2. Test event search functionality
|
|
3. Test photo search functionality
|
|
4. Verify analytics charts display correctly
|
|
|
|
## Symptoms That May Require Rollback
|
|
|
|
1. **Dashboard Statistics Not Loading**
|
|
- Empty or NaN values in stats
|
|
- Analytics charts not rendering
|
|
|
|
2. **Search Features Broken**
|
|
- Event search returns no results
|
|
- Photo search returns errors
|
|
- Special characters in search causing issues
|
|
|
|
3. **Date Filtering Issues**
|
|
- Activity logs not showing correct date ranges
|
|
- Analytics showing incorrect time periods
|
|
|
|
## Safe Testing Before Production
|
|
|
|
1. **Test in Development First**:
|
|
```bash
|
|
cd backend
|
|
npm run dev
|
|
```
|
|
|
|
2. **Test Key Features**:
|
|
- Admin dashboard stats: `http://localhost:3001/api/admin/dashboard/stats`
|
|
- Analytics: `http://localhost:3001/api/admin/dashboard/analytics?days=7`
|
|
- Event search: `http://localhost:3001/api/admin/events?search=test`
|
|
- Photo search: `http://localhost:3001/api/admin/events/1/photos?search=test`
|
|
|
|
3. **Monitor Logs**:
|
|
```bash
|
|
# Docker logs
|
|
docker-compose logs -f backend
|
|
|
|
# PM2 logs
|
|
pm2 logs picpeak-backend
|
|
```
|
|
|
|
## Emergency Contacts
|
|
- Keep database backups before deploying
|
|
- Have monitoring alerts for 500 errors
|
|
- Document any custom SQL queries in use
|
|
|
|
## Post-Rollback Actions
|
|
If rollback is needed:
|
|
1. Document the specific issue encountered
|
|
2. Create test cases for the failure scenario
|
|
3. Fix the issue in development
|
|
4. Re-test thoroughly before re-deploying |