paul
e35ac6a41c
Security Enhancements: - Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries - Add LIKE pattern escaping to prevent SQL injection in search functionality - Implement account lockout protection (5 failed attempts = 30 min lockout) - Add comprehensive login attempt tracking and audit trail - Enhance JWT tokens with issuer validation, IP tracking, and password change detection - Add logout endpoint and session management - Prevent user enumeration with generic error messages Database Changes: - Add login_attempts table for authentication tracking - Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled) New Security Features: - Brute force protection with configurable lockout duration - Automatic cleanup of old login attempts - Enhanced authentication middleware with stricter validation - Monitoring scripts for security health checks All fixes are backward compatible and production-ready with rollback plans included. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
96 lines
3.0 KiB
JavaScript
96 lines
3.0 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
/**
|
|
* Check Docker deployment status for security fixes
|
|
*/
|
|
|
|
console.log('=== Docker Deployment Status Check ===\n');
|
|
|
|
// Color codes
|
|
const GREEN = '\x1b[32m';
|
|
const RED = '\x1b[31m';
|
|
const YELLOW = '\x1b[33m';
|
|
const RESET = '\x1b[0m';
|
|
|
|
let allGood = true;
|
|
|
|
// Check SQL Security
|
|
console.log('1. SQL Injection Fixes:');
|
|
try {
|
|
const { sanitizeDays, escapeLikePattern } = require('../src/utils/sqlSecurity');
|
|
console.log(`${GREEN}✓${RESET} sqlSecurity.js exists`);
|
|
console.log(`${GREEN}✓${RESET} Security functions available`);
|
|
} catch (e) {
|
|
console.log(`${RED}✗${RESET} sqlSecurity.js missing`);
|
|
allGood = false;
|
|
}
|
|
|
|
// Check Auth Security
|
|
console.log('\n2. Authentication Security:');
|
|
try {
|
|
const authSec = require('../src/utils/authSecurity');
|
|
console.log(`${GREEN}✓${RESET} authSecurity.js exists`);
|
|
|
|
const authEnhanced = require('../src/middleware/auth-enhanced');
|
|
console.log(`${GREEN}✓${RESET} auth-enhanced middleware exists`);
|
|
|
|
const authRoutes = require('../src/routes/auth-enhanced');
|
|
console.log(`${GREEN}✓${RESET} auth-enhanced routes exist`);
|
|
} catch (e) {
|
|
console.log(`${YELLOW}!${RESET} Auth security files exist but not active`);
|
|
}
|
|
|
|
// Check Database
|
|
console.log('\n3. Database Status:');
|
|
const { db } = require('../src/database/db');
|
|
|
|
async function checkDatabase() {
|
|
try {
|
|
// Check login_attempts table
|
|
await db('login_attempts').count();
|
|
console.log(`${GREEN}✓${RESET} login_attempts table exists`);
|
|
} catch (e) {
|
|
console.log(`${YELLOW}!${RESET} login_attempts table not created (run migrations)`);
|
|
}
|
|
|
|
try {
|
|
// Check admin_users columns
|
|
await db('admin_users').select('password_changed_at').limit(1);
|
|
console.log(`${GREEN}✓${RESET} Auth security columns exist`);
|
|
} catch (e) {
|
|
console.log(`${YELLOW}!${RESET} Auth security columns missing (run migrations)`);
|
|
}
|
|
|
|
// Close database connection
|
|
await db.destroy();
|
|
}
|
|
|
|
// Check server configuration
|
|
console.log('\n4. Server Configuration:');
|
|
const fs = require('fs');
|
|
const serverContent = fs.readFileSync('./server.js', 'utf8');
|
|
|
|
if (serverContent.includes("require('./src/routes/auth-enhanced')")) {
|
|
console.log(`${GREEN}✓${RESET} Using enhanced auth routes`);
|
|
} else if (serverContent.includes("require('./src/routes/auth')")) {
|
|
console.log(`${YELLOW}!${RESET} Using original auth routes (enhanced not active)`);
|
|
}
|
|
|
|
if (serverContent.includes('initializeCleanupJob')) {
|
|
console.log(`${GREEN}✓${RESET} Auth cleanup job initialized`);
|
|
} else {
|
|
console.log(`${YELLOW}!${RESET} Auth cleanup job not initialized`);
|
|
}
|
|
|
|
// Run async checks
|
|
checkDatabase().then(() => {
|
|
console.log('\n=== Summary ===');
|
|
if (allGood) {
|
|
console.log(`${GREEN}All security fixes are deployed!${RESET}`);
|
|
} else {
|
|
console.log(`${YELLOW}Some security features need activation:${RESET}`);
|
|
console.log('1. Run migrations: npx knex migrate:latest');
|
|
console.log('2. Update server.js to use auth-enhanced routes');
|
|
console.log('3. Restart the container');
|
|
}
|
|
}); |