Skip to content

Commit 8a1d1e0

Browse files
MoumoulsMoumouls
committed
Merge branch 'upstream/master' into moumouls/auth-adapter-spec
2 parents 96274f4 + 05f5aa0 commit 8a1d1e0

25 files changed

+1279
-623
lines changed

‎.github/ISSUE_TEMPLATE/---1-report-an-issue.md

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@ assignees: ''
88
---
99

1010
### New Issue Checklist
11-
<!-- Please check the following boxes [ ] -> [x] before submitting your issue. Click the "Preview" tab for better readability. Thanks for reporting issues back to Parse Server! -->
11+
<!--
12+
Please check the following boxes [x] before submitting your issue.
13+
Click the "Preview" tab for better readability.
14+
Thanks for contributing to Parse Server!
15+
-->
1216

1317
- [ ] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md).
1418
- [ ] I am not just asking a [question](https://github.com/parse-community/.github/blob/master/SUPPORT.md).
@@ -27,6 +31,16 @@ assignees: ''
2731
### Expected Outcome
2832
<!-- What outcome, for example query result, did you expect? -->
2933

34+
### Failing Test Case / Pull Request
35+
<!--
36+
Check one of the following boxes [x] if you added a PR and add the link.
37+
See the contribution guide for how add a test cases:
38+
https://github.com/parse-community/parse-server/blob/master/CONTRIBUTING.md
39+
-->
40+
41+
- [ ] 🤩 I submitted a PR with a fix and a test case.
42+
- [ ] 🧐 I submitted a PR with a failing test case.
43+
3044
### Environment
3145
<!-- Be specific with versions, don't use "latest" or semver ranges like "~x.y.z" or "^x.y.z". -->
3246

‎.github/ISSUE_TEMPLATE/---2-feature-request.md

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,28 @@ assignees: ''
77

88
---
99

10-
**Is your feature request related to a problem? Please describe.**
11-
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
10+
### New Feature / Enhancement Checklist
11+
<!--
12+
Please check the following boxes [x] before submitting your issue.
13+
Click the "Preview" tab for better readability.
14+
Thanks for contributing to Parse Server!
15+
-->
1216

13-
**Describe the solution you'd like**
14-
A clear and concise description of what you want to happen.
17+
- [ ] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md).
18+
- [ ] I am not just asking a [question](https://github.com/parse-community/.github/blob/master/SUPPORT.md).
19+
- [ ] I have searched through [existing issues](https://github.com/parse-community/parse-server/issues?q=is%3Aissue).
1520

16-
**Describe alternatives you've considered**
17-
A clear and concise description of any alternative solutions or features you've considered.
21+
### Current Limitation
22+
<!-- Which current limitation is the feature or enhancement addressing? -->
1823

19-
**Additional context**
20-
Add any other context or screenshots about the feature request here.
24+
### Feature / Enhancement Description
25+
<!-- What is the concept of the functionality and how should it be implemented? -->
26+
27+
### Example Use Case
28+
<!-- What is an example use case in steps (1. / 2. / 3. / etc.) that describes the functionality? -->
29+
30+
### Alternatives / Workarounds
31+
<!-- Which alternatives or workarounds exist currently? -->
32+
33+
### 3rd Party References
34+
<!-- Have you seen a similar functionality provided somewhere else? -->

‎.github/pull_request_template.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
### New Pull Request Checklist
2+
<!--
3+
Please check the following boxes [x] before submitting your issue.
4+
Click the "Preview" tab for better readability.
5+
Thanks for contributing to Parse Server!
6+
-->
7+
8+
- [ ] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md).
9+
- [ ] I am creating this PR in reference to an [issue](https://github.com/parse-community/parse-server/issues?q=is%3Aissue).
10+
11+
### Issue Description
12+
<!-- Add a brief description of the issue this PR solves. -->
13+
14+
Related issue: FILL_THIS_OUT
15+
16+
### Approach
17+
<!-- Add a description of the approach in this PR. -->
18+
19+
### TODOs before merging
20+
<!--
21+
Add TODOs that need to be completed before merging this PR.
22+
Delete suggested TODOs that do not apply to this PR.
23+
-->
24+
25+
- [ ] Add test cases
26+
- [ ] Add entry to changelog
27+
- [ ] Add changes to documentation (guides, repository pages, in-code descriptions)
28+
- [ ] Add [security check](https://github.com/parse-community/parse-server/blob/master/CONTRIBUTING.md#security-checks)
29+
- [ ] Add new Parse Error codes to Parse JS SDK <!-- no hard-coded error codes in Parse Server -->
30+
- [ ] ...

‎.github/workflows/release.yml

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: release
2+
on:
3+
release:
4+
types: [published]
5+
jobs:
6+
publish-npm:
7+
runs-on: ubuntu-18.04
8+
steps:
9+
- uses: actions/checkout@v2
10+
- uses: actions/setup-node@v1
11+
with:
12+
node-version: '10.14'
13+
registry-url: https://registry.npmjs.org/
14+
- name: Cache Node.js modules
15+
uses: actions/cache@v2
16+
with:
17+
path: ~/.npm
18+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
19+
restore-keys: |
20+
${{ runner.os }}-node-
21+
- run: npm ci
22+
- run: npm publish
23+
env:
24+
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
25+
publish-docs:
26+
runs-on: ubuntu-18.04
27+
timeout-minutes: 30
28+
steps:
29+
- uses: actions/checkout@v2
30+
- name: Use Node.js
31+
uses: actions/setup-node@v1
32+
with:
33+
node-version: '10.14'
34+
- name: Cache Node.js modules
35+
uses: actions/cache@v2
36+
with:
37+
path: ~/.npm
38+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
39+
restore-keys: |
40+
${{ runner.os }}-node-
41+
- name: Get Tag
42+
uses: actions/github-script@v3
43+
id: tag
44+
with:
45+
github-token: ${{secrets.GITHUB_TOKEN}}
46+
result-encoding: string
47+
script: |
48+
const ref = process.env.GITHUB_REF
49+
if(!ref.startsWith('refs/tags/'))
50+
return ''
51+
return ref.replace(/^refs\/tags\//, '')
52+
- name: Generate Docs
53+
run: |
54+
echo $SOURCE_TAG
55+
npm ci
56+
./release_docs.sh
57+
env:
58+
SOURCE_TAG: ${{ steps.tag.outputs.result }}
59+
- name: Deploy
60+
uses: peaceiris/[email protected]
61+
with:
62+
github_token: ${{ secrets.GITHUB_TOKEN }}
63+
publish_dir: ./docs

‎CHANGELOG.md

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,35 @@
11
## Parse Server Changelog
22

33
### master
4-
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.4.0...master)
4+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.5.0...master)
5+
6+
__BREAKING CHANGES:__
7+
- NEW: Added file upload restriction. File upload is now only allowed for authenticated users by default for improved security. To allow file upload also for Anonymous Users or Public, set the `fileUpload` parameter in the [Parse Server Options](https://parseplatform.org/parse-server/api/master/ParseServerOptions.html). [#7071](https://github.com/parse-community/parse-server/pull/7071). Thanks to [dblythy](https://github.com/dblythy).
8+
___
9+
- IMPROVE: Optimize queries on classes with pointer permissions. [#7061](https://github.com/parse-community/parse-server/pull/7061). Thanks to [Pedro Diaz](https://github.com/pdiaz)
10+
- FIX: request.context for afterFind triggers. [#7078](https://github.com/parse-community/parse-server/pull/7078). Thanks to [dblythy](https://github.com/dblythy)
11+
12+
### 4.5.0
13+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.4.0...4.5.0)
14+
15+
__BREAKING CHANGES:__
16+
- FIX: Consistent casing for afterLiveQueryEvent. The afterLiveQueryEvent was introduced in 4.4.0 with inconsistent casing for the event names, which was fixed in 4.5.0. [#7023](https://github.com/parse-community/parse-server/pull/7023). Thanks to [dblythy](https://github.com/dblythy).
17+
___
18+
- FIX: Properly handle serverURL and publicServerUrl in Batch requests. [#7049](https://github.com/parse-community/parse-server/pull/7049). Thanks to [Zach Goldberg](https://github.com/ZachGoldberg).
19+
- IMPROVE: Prevent invalid column names (className and length). [#7053](https://github.com/parse-community/parse-server/pull/7053). Thanks to [Diamond Lewis](https://github.com/dplewis).
20+
- IMPROVE: GraphQL: Remove viewer from logout mutation. [#7029](https://github.com/parse-community/parse-server/pull/7029). Thanks to [Antoine Cormouls](https://github.com/Moumouls).
21+
- IMPROVE: GraphQL: Optimize on Relation. [#7044](https://github.com/parse-community/parse-server/pull/7044). Thanks to [Antoine Cormouls](https://github.com/Moumouls).
22+
- NEW: Include sessionToken in onLiveQueryEvent. [#7043](https://github.com/parse-community/parse-server/pull/7043). Thanks to [dblythy](https://github.com/dblythy).
23+
- FIX: Definitions for accountLockout and passwordPolicy. [#7040](https://github.com/parse-community/parse-server/pull/7040). Thanks to [dblythy](https://github.com/dblythy).
24+
- FIX: Fix typo in server definitions for emailVerifyTokenReuseIfValid. [#7037](https://github.com/parse-community/parse-server/pull/7037). Thanks to [dblythy](https://github.com/dblythy).
25+
- SECURITY FIX: LDAP auth stores password in plain text. See [GHSA-4w46-w44m-3jq3](https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3) for more details about the vulnerability and [da905a3](https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a) for the fix. Thanks to [Fabian Strachanski](https://github.com/fastrde).
26+
- NEW: Reuse tokens if they haven't expired. [#7017](https://github.com/parse-community/parse-server/pull/7017). Thanks to [dblythy](https://github.com/dblythy).
27+
- NEW: Add LDAPS-support to LDAP-Authcontroller. [#7014](https://github.com/parse-community/parse-server/pull/7014). Thanks to [Fabian Strachanski](https://github.com/fastrde).
28+
- FIX: (beforeSave/afterSave): Return value instead of Parse.Op for nested fields. [#7005](https://github.com/parse-community/parse-server/pull/7005). Thanks to [Diamond Lewis](https://github.com/dplewis).
29+
- FIX: (beforeSave): Skip Sanitizing Database results. [#7003](https://github.com/parse-community/parse-server/pull/7003). Thanks to [Diamond Lewis](https://github.com/dplewis).
30+
- FIX: Fix includeAll for querying a Pointer and Pointer array. [#7002](https://github.com/parse-community/parse-server/pull/7002). Thanks to [Corey Baker](https://github.com/cbaker6).
31+
- FIX: Add encryptionKey to src/options/index.js. [#6999](https://github.com/parse-community/parse-server/pull/6999). Thanks to [dblythy](https://github.com/dblythy).
32+
- IMPROVE: Update PostgresStorageAdapter.js. [#6989](https://github.com/parse-community/parse-server/pull/6989). Thanks to [Vitaly Tomilov](https://github.com/vitaly-t).
533

634
### 4.4.0
735
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.3.0...4.4.0)

‎CONTRIBUTING.md

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,18 @@ If you want to make changes to [Parse Server Configuration][config] add the desi
101101

102102
To view docs run `npm run docs` and check the `/out` directory.
103103

104-
### Code of Conduct
104+
## Feature Considerations
105+
### Security Checks
106+
107+
The Parse Server security checks feature warns developers about weak security settings in their Parse Server deployment.
108+
109+
A security check needs to be added for every new feature or enhancement that allows the developer to configure it in a way that weakens security mechanisms or exposes functionality which creates a weak spot for malicious attacks. If you are not sure whether your feature or enhancements requires a security check, feel free to ask.
110+
111+
For example, allowing public read and write to a class may be useful to simplify development but should be disallowed in a production environment.
112+
113+
Security checks are added in [SecurityChecks.js](https://github.com/parse-community/parse-server/blob/master/src/SecurityChecks.js).
114+
115+
## Code of Conduct
105116

106117
This project adheres to the [Contributor Covenant Code of Conduct](https://github.com/parse-community/parse-server/blob/master/CODE_OF_CONDUCT.md). By participating, you are expected to honor this code.
107118

‎package-lock.json

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "parse-server",
3-
"version": "4.4.0",
3+
"version": "4.5.0",
44
"description": "An express module providing a Parse-compatible API server",
55
"main": "lib/index.js",
66
"repository": {

‎release_docs.sh

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
#!/bin/sh -e
22
set -x
3-
if [ "${TRAVIS_REPO_SLUG}" = "" ];
3+
if [ "${GITHUB_ACTIONS}" = "" ];
44
then
5-
echo "Cannot release docs without TRAVIS_REPO_SLUG set"
5+
echo "Cannot release docs without GITHUB_ACTIONS set"
66
exit 0;
77
fi
8-
REPO="https://github.com/${TRAVIS_REPO_SLUG}"
8+
REPO="https://github.com/parse-community/parse-server"
99

1010
rm -rf docs
1111
git clone -b gh-pages --single-branch $REPO ./docs
@@ -15,9 +15,9 @@ cd ..
1515

1616
DEST="master"
1717

18-
if [ "${TRAVIS_TAG}" != "" ];
18+
if [ "${SOURCE_TAG}" != "" ];
1919
then
20-
DEST="${TRAVIS_TAG}"
20+
DEST="${SOURCE_TAG}"
2121
# change the default page to the latest
2222
echo "<meta http-equiv='refresh' content='0; url=/parse-server/api/${DEST}'>" > "docs/api/index.html"
2323
fi

‎resources/buildConfigDefinitions.js

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,8 @@ function getENVPrefix(iface) {
4747
'LiveQueryOptions' : 'PARSE_SERVER_LIVEQUERY_',
4848
'IdempotencyOptions' : 'PARSE_SERVER_EXPERIMENTAL_IDEMPOTENCY_',
4949
'AccountLockoutOptions' : 'PARSE_SERVER_ACCOUNT_LOCKOUT_',
50-
'PasswordPolicyOptions' : 'PARSE_SERVER_PASSWORD_POLICY_'
50+
'PasswordPolicyOptions' : 'PARSE_SERVER_PASSWORD_POLICY_',
51+
'FileUploadOptions' : 'PARSE_SERVER_FILE_UPLOAD_'
5152
}
5253
if (options[iface.id.name]) {
5354
return options[iface.id.name]
@@ -163,14 +164,8 @@ function parseDefaultValue(elt, value, t) {
163164
if (type == 'NumberOrBoolean') {
164165
literalValue = t.numericLiteral(parsers.numberOrBoolParser('')(value));
165166
}
166-
if (type == 'CustomPagesOptions') {
167-
const object = parsers.objectParser(value);
168-
const props = Object.keys(object).map((key) => {
169-
return t.objectProperty(key, object[value]);
170-
});
171-
literalValue = t.objectExpression(props);
172-
}
173-
if (type == 'IdempotencyOptions') {
167+
const literalTypes = ['IdempotencyOptions','FileUploadOptions','CustomPagesOptions'];
168+
if (literalTypes.includes(type)) {
174169
const object = parsers.objectParser(value);
175170
const props = Object.keys(object).map((key) => {
176171
return t.objectProperty(key, object[value]);

‎spec/CloudCode.spec.js

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3157,4 +3157,14 @@ describe('afterLogin hook', () => {
31573157

31583158
await Parse.Cloud.run('contextTest', {}, { context: { a: 'a' } });
31593159
});
3160+
3161+
it('afterFind should have access to context', async () => {
3162+
Parse.Cloud.afterFind('TestObject', req => {
3163+
expect(req.context.a).toEqual('a');
3164+
});
3165+
const obj = new TestObject();
3166+
await obj.save();
3167+
const query = new Parse.Query(TestObject);
3168+
await query.find({ context: { a: 'a' } });
3169+
});
31603170
});

0 commit comments

Comments
 (0)