diff --git a/SapiensDataAPI/Controllers/AuthController.cs b/SapiensDataAPI/Controllers/AuthController.cs index 800298b..d088eaa 100644 --- a/SapiensDataAPI/Controllers/AuthController.cs +++ b/SapiensDataAPI/Controllers/AuthController.cs @@ -24,6 +24,11 @@ if (userExists != null) // If user exists return Conflict("Username already exists."); // Return conflict response if username exists + if (model.Username.Contains("..") || model.Username.Contains('/') || model.Username.Contains('\\')) + { + return BadRequest("Invalid username. Username cannot contain '..' or '/' or '\\'."); + } + ApplicationUserModel? emailExists = await _userManager.FindByEmailAsync(model.Email); // Check if the email is already in use if (emailExists != null) // If email exists return Conflict("Email is already in use."); // Return conflict response if email exists diff --git a/SapiensDataAPI/Controllers/EncryptionTestsController.cs b/SapiensDataAPI/Controllers/EncryptionTestsController.cs deleted file mode 100644 index 5008f4b..0000000 --- a/SapiensDataAPI/Controllers/EncryptionTestsController.cs +++ /dev/null @@ -1,98 +0,0 @@ -using Microsoft.AspNetCore.Mvc; -using Microsoft.EntityFrameworkCore; -using SapiensDataAPI.Data.DbContextCs; -using SapiensDataAPI.Models; - -namespace SapiensDataAPI.Controllers -{ - [Route("api/[controller]")] - [ApiController] - public class EncryptionTestsController(SapeinsDataDbContext context) : ControllerBase - { - private readonly SapeinsDataDbContext _context = context; - - // GET: api/EncryptionTests - [HttpGet] - public async Task>> GetEncryptionTests() - { - return await _context.EncryptionTests.ToListAsync(); - } - - // GET: api/EncryptionTests/5 - [HttpGet("{id}")] - public async Task> GetEncryptionTest(int id) - { - EncryptionTest? encryptionTest = await _context.EncryptionTests.FindAsync(id); - - if (encryptionTest == null) - { - return NotFound(); - } - - return encryptionTest; - } - - // PUT: api/EncryptionTests/5 - // To protect from overposting attacks, see https://go.microsoft.com/fwlink/?linkid=2123754 - [HttpPut("{id}")] - public async Task PutEncryptionTest(int id, EncryptionTest encryptionTest) - { - if (id != encryptionTest.Id) - { - return BadRequest(); - } - - _context.Entry(encryptionTest).State = EntityState.Modified; - - try - { - await _context.SaveChangesAsync(); - } - catch (DbUpdateConcurrencyException) - { - if (!EncryptionTestExists(id)) - { - return NotFound(); - } - else - { - throw; - } - } - - return NoContent(); - } - - // POST: api/EncryptionTests - // To protect from overposting attacks, see https://go.microsoft.com/fwlink/?linkid=2123754 - [HttpPost] - public async Task> PostEncryptionTest(EncryptionTest encryptionTest) - { - _context.EncryptionTests.Add(encryptionTest); - await _context.SaveChangesAsync(); - - return CreatedAtAction("GetEncryptionTest", new { id = encryptionTest.Id }, encryptionTest); - } - - // DELETE: api/EncryptionTests/5 - [HttpDelete("{id}")] - public async Task DeleteEncryptionTest(int id) - { - EncryptionTest? encryptionTest = await _context.EncryptionTests.FindAsync(id); - if (encryptionTest == null) - { - return NotFound(); - } - - _context.EncryptionTests.Remove(encryptionTest); - await _context.SaveChangesAsync(); - - return NoContent(); - } - - private bool EncryptionTestExists(int id) - { - return _context.EncryptionTests.Any(e => e.Id == id); - } - } -} diff --git a/SapiensDataAPI/Controllers/ReceiptsController.cs b/SapiensDataAPI/Controllers/ReceiptsController.cs index f1cb79c..e2aaebd 100644 --- a/SapiensDataAPI/Controllers/ReceiptsController.cs +++ b/SapiensDataAPI/Controllers/ReceiptsController.cs @@ -48,6 +48,11 @@ public async Task ReceiveJSON([FromBody] ReceiptVailidation recei return StatusCode(500, "Google Drive path doesn't exist in .env file."); } + if (username.Contains("..") || username.Contains('/') || username.Contains('\\')) + { + return BadRequest("Invalid username. Username cannot contain '..' or '/' or '\\'."); + } + //var uploadsFolderPath = Path.Combine(Directory.GetCurrentDirectory(), "Data", "SapiensCloud", "src", "media", "UserReceiptUploads", JwtPayload.Sub); string filePath = Path.Combine(googleDrivePath, "SapiensCloud", "media", "user_data", username, "receipts", receiptVailidation.FileMetadata.ReceiptFilename); if (!await Task.Run(() => System.IO.File.Exists(filePath))) @@ -298,7 +303,7 @@ public async Task> GetReceipt(int offset = 0) List productsReceipts = await _context.ReceiptProducts .Where(rp => rp.ReceiptId == receipt.ReceiptId) .ToListAsync(); - List productsReceiptsProductsIds = productsReceipts.Select(p => p.ProductId).ToList(); + List productsReceiptsProductsIds = [.. productsReceipts.Select(p => p.ProductId)]; List products = await _context.Products .Where(p => productsReceiptsProductsIds.Contains(p.ProductId)) diff --git a/SapiensDataAPI/Data/DbContextCs/SapeinsDataDbContext.cs b/SapiensDataAPI/Data/DbContextCs/SapeinsDataDbContext.cs index cb7ab2a..b0cb032 100644 --- a/SapiensDataAPI/Data/DbContextCs/SapeinsDataDbContext.cs +++ b/SapiensDataAPI/Data/DbContextCs/SapeinsDataDbContext.cs @@ -83,8 +83,6 @@ public SapeinsDataDbContext(DbContextOptions options, Glob public virtual DbSet ReceiptProducts { get; set; } = null!; - public virtual DbSet EncryptionTests { get; set; } = null!; - protected override void OnModelCreating(ModelBuilder builder) { builder.UseEncryption(_provider); @@ -1198,15 +1196,11 @@ protected override void OnModelCreating(ModelBuilder builder) .HasConstraintName("FK__UserSessi__user___68487DD7"); }); - ValueComparer byteArrayComparer = new( - (a, b) => a != null && b != null && a.SequenceEqual(b), - a => a != null ? a.Aggregate(0, (acc, v) => HashCode.Combine(acc, v)) : 0, - a => a != null ? a.ToArray() : Array.Empty() - ); - - builder.Entity() - .Property(e => e.StreetEncrypted) - .Metadata.SetValueComparer(byteArrayComparer); + //ValueComparer byteArrayComparer = new( + // (a, b) => a != null && b != null && a.SequenceEqual(b), + // a => a != null ? a.Aggregate(0, (acc, v) => HashCode.Combine(acc, v)) : 0, + // a => a != null ? a.ToArray() : Array.Empty() + //); //OnModelCreatingPartial(builder); } diff --git a/SapiensDataAPI/Models/EncryptionTest.cs b/SapiensDataAPI/Models/EncryptionTest.cs deleted file mode 100644 index fa98edc..0000000 --- a/SapiensDataAPI/Models/EncryptionTest.cs +++ /dev/null @@ -1,15 +0,0 @@ -using SoftFluent.ComponentModel.DataAnnotations; - -namespace SapiensDataAPI.Models -{ - public class EncryptionTest - { - - public int Id { get; set; } - - public required string Street { get; set; } - - [Encrypted] - public required byte[] StreetEncrypted { get; set; } - } -}