paul
e35ac6a41c
Security Enhancements: - Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries - Add LIKE pattern escaping to prevent SQL injection in search functionality - Implement account lockout protection (5 failed attempts = 30 min lockout) - Add comprehensive login attempt tracking and audit trail - Enhance JWT tokens with issuer validation, IP tracking, and password change detection - Add logout endpoint and session management - Prevent user enumeration with generic error messages Database Changes: - Add login_attempts table for authentication tracking - Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled) New Security Features: - Brute force protection with configurable lockout duration - Automatic cleanup of old login attempts - Enhanced authentication middleware with stricter validation - Monitoring scripts for security health checks All fixes are backward compatible and production-ready with rollback plans included. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
1.8 KiB
1.8 KiB
SQL Injection Fix Summary
Quick Overview
Fixed SQL injection vulnerabilities in the admin panel endpoints by:
- Replacing dangerous
whereRawqueries with parameterized queries - Escaping special characters in LIKE patterns
- Validating sort columns and orders
Test Results
✅ All 31 security tests passed ✅ Verification script confirms fixes working ✅ No breaking changes to API functionality
Changed Files
backend/
├── src/
│ ├── utils/
│ │ └── sqlSecurity.js (NEW - 117 lines)
│ └── routes/
│ ├── adminDashboard.js (6 changes)
│ ├── adminEvents.js (2 changes)
│ └── adminPhotos.js (2 changes)
└── scripts/
├── test-sql-security.js (NEW)
└── verify-sql-fixes.js (NEW)
Before & After Examples
Date Range Queries
// ❌ BEFORE (Vulnerable)
.whereRaw(`timestamp >= datetime("now", "-${days} days")`)
// ✅ AFTER (Safe)
const startDate = new Date();
startDate.setDate(startDate.getDate() - sanitizeDays(days));
.where('timestamp', '>=', startDate.toISOString())
LIKE Queries
// ❌ BEFORE (Vulnerable)
.where('event_name', 'like', `%${search}%`)
// ✅ AFTER (Safe)
const escapedSearch = escapeLikePattern(search);
.where('event_name', 'like', `%${escapedSearch}%`)
Deployment Checklist
- Run
node scripts/test-sql-security.js(should show 31/31 passed) - Test in development environment
- Review rollback plan (
SQL_INJECTION_FIX_ROLLBACK.md) - Deploy to production
- Monitor logs for errors
- Test search functionality with special characters
Risk Assessment
- Risk Level: Low (with proper testing)
- Breaking Changes: None
- Performance Impact: Minimal
- Rollback Time: < 2 minutes