paul/picpeak

Fork 0

Files

T

paul e35ac6a41c

Test Gitea Actions / test (push) Successful in 20s

Details

continuous-integration/drone/push Build is passing

Details

feat: implement critical security fixes for SQL injection and authentication vulnerabilities

Security Enhancements:
- Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries
- Add LIKE pattern escaping to prevent SQL injection in search functionality
- Implement account lockout protection (5 failed attempts = 30 min lockout)
- Add comprehensive login attempt tracking and audit trail
- Enhance JWT tokens with issuer validation, IP tracking, and password change detection
- Add logout endpoint and session management
- Prevent user enumeration with generic error messages

Database Changes:
- Add login_attempts table for authentication tracking
- Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled)

New Security Features:
- Brute force protection with configurable lockout duration
- Automatic cleanup of old login attempts
- Enhanced authentication middleware with stricter validation
- Monitoring scripts for security health checks

All fixes are backward compatible and production-ready with rollback plans included.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

2025-07-13 00:40:05 +02:00

2.6 KiB

Raw Blame History

SQL Injection Fix Rollback Plan

Overview

This document provides a rollback plan in case the SQL injection fixes cause issues in production.

Changes Made

Created: backend/src/utils/sqlSecurity.js - Central security utilities
Modified: backend/src/routes/adminDashboard.js - Replaced whereRaw with parameterized queries
Modified: backend/src/routes/adminPhotos.js - Added LIKE pattern escaping
Modified: backend/src/routes/adminEvents.js - Added LIKE pattern escaping

Quick Rollback Steps

Step 1: Revert Code Changes

If issues occur, run these commands to revert:

# Navigate to backend directory
cd backend

# Revert specific files
git checkout HEAD -- src/routes/adminDashboard.js
git checkout HEAD -- src/routes/adminPhotos.js
git checkout HEAD -- src/routes/adminEvents.js

# Remove the new security utility file
rm src/utils/sqlSecurity.js

Step 2: Restart Services

# If using Docker
docker-compose restart backend

# If using PM2
pm2 restart picpeak-backend

Verification After Rollback

Check admin dashboard loads: /admin/dashboard
Test event search functionality
Test photo search functionality
Verify analytics charts display correctly

Symptoms That May Require Rollback

Dashboard Statistics Not Loading
- Empty or NaN values in stats
- Analytics charts not rendering
Search Features Broken
- Event search returns no results
- Photo search returns errors
- Special characters in search causing issues
Date Filtering Issues
- Activity logs not showing correct date ranges
- Analytics showing incorrect time periods

Safe Testing Before Production

Test in Development First:
```
cd backend
npm run dev
```
Test Key Features:
- Admin dashboard stats: http://localhost:3001/api/admin/dashboard/stats
- Analytics: http://localhost:3001/api/admin/dashboard/analytics?days=7
- Event search: http://localhost:3001/api/admin/events?search=test
- Photo search: http://localhost:3001/api/admin/events/1/photos?search=test

Monitor Logs:

# Docker logs
docker-compose logs -f backend

# PM2 logs
pm2 logs picpeak-backend

Emergency Contacts

Keep database backups before deploying
Have monitoring alerts for 500 errors
Document any custom SQL queries in use

Post-Rollback Actions

If rollback is needed:

Document the specific issue encountered
Create test cases for the failure scenario
Fix the issue in development
Re-test thoroughly before re-deploying

2.6 KiB Raw Blame History