Files
picpeak/backend/scripts/run-migrations.js
T
paul e35ac6a41c
Test Gitea Actions / test (push) Successful in 20s
continuous-integration/drone/push Build is passing
feat: implement critical security fixes for SQL injection and authentication vulnerabilities
Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-13 00:40:05 +02:00

40 lines
959 B
JavaScript

#!/usr/bin/env node
/**
* Run database migrations using existing db connection
*/
const { db } = require('../src/database/db');
async function runMigrations() {
console.log('Running database migrations...\n');
try {
// Run all pending migrations
const result = await db.migrate.latest({
directory: './migrations'
});
if (result[1].length === 0) {
console.log('✓ Database is already up to date');
} else {
console.log(`✓ Ran ${result[1].length} migrations:`);
result[1].forEach(migration => {
console.log(` - ${migration}`);
});
}
// Show current migration status
const list = await db.migrate.list();
console.log(`\nCurrent status: ${list[0].length} completed migrations`);
await db.destroy();
process.exit(0);
} catch (error) {
console.error('Migration error:', error);
await db.destroy();
process.exit(1);
}
}
runMigrations();