Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enhance Profile Endpoint Robustness and Security in profile.js #327

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Enhance Profile Endpoint Robustness and Security in profile.js #327

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
124 changes: 69 additions & 55 deletions backend/profile.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,67 +1,81 @@
const {decodeAccessToken}=require('../login-system/token')
const db = require('../config/mysql_connection')
const mysql=require('mysql')
const { decodeAccessToken } = require('../login-system/token');
const db = require('../config/mysql_connection');

const display=async(req,res)=>{
const decodedtoken = decodeAccessToken(req.headers.authorization);
if (!decodedtoken || !decodedtoken.user) {
console.error('Invalid or missing user information in the token');
return res.status(401).send('Unauthorized');
}
const userid=decodedtoken.user;
await db.getConnection(async(err,connection)=>{
if(err) throw err;
const sqlquery="SELECT user.*,info.* FROM user_table as user inner join info_table as info where id=?"
const query=mysql.format(sqlquery,[userid])
await connection.query(query,(err,result)=>{
if(err) throw err;
const username=result[0].username
const name=result[0].name;
const email=result[0].email;
const col_name=result[0].col_name;
const state=result[0].state;
const year=result[0].year;
const course=result[0].course;
res.status(200).json({username,name,email,col_name,state,year,course});
connection.release();
})
})
}
const display = async (req, res) => {
let connection;
try {
const decodedtoken = decodeAccessToken(req.headers.authorization);
if (!decodedtoken || !decodedtoken.user) {
console.error('Invalid or missing user information in the token');
return res.status(401).send('Unauthorized');
}

const updateProfile = async (req, res) => {
const decodedtoken = decodeAccessToken(req.headers.authorization);
if (!decodedtoken || !decodedtoken.user) {
console.error('Invalid or missing user information in the token');
return res.status(401).send('Unauthorized');
}
const userid=decodedtoken.user;
const userid = decodedtoken.user;
connection = await db.getConnection();

const { name,email,col_name, state, year, course } = req.body;
const sqlquery = `
SELECT user.*, info.*
FROM user_table AS user
LEFT JOIN info_table AS info
ON user.id = info.id
WHERE user.id = ?
`;

const [results] = await connection.promise().query(sqlquery, [userid]);

if (!userid) {
return res.status(400).json({ error: 'User ID is required.' });
}
if (!results || results.length === 0) {
return res.status(404).json({ error: 'User not found' });
}

// Query to update the 'info_table'
const infoQuery = `
UPDATE info_table
SET name = ?,email = ?,col_name = ?, state = ?, year = ?, course = ?
WHERE id = ?
`;
const infoValues = [name,email,col_name, state, year, course, userid];
const { username, name, email, col_name, state, year, course } = results[0];
res.status(200).json({ username, name, email, col_name, state, year, course });
} catch (error) {
console.error('Error in display function:', error);
res.status(500).json({ error: 'Server error' });
} finally {
if (connection) connection.release();
}
};

db.query(infoQuery, infoValues, (err, infoResult) => {
if (err) {
console.error('Error updating info table:', err);
return res.status(500).json({ error: 'Database error in info table update.' });
const updateProfile = async (req, res) => {
try {
const decodedtoken = decodeAccessToken(req.headers.authorization);
if (!decodedtoken || !decodedtoken.user) {
console.error('Invalid or missing user information in the token');
return res.status(401).send('Unauthorized');
}

if (infoResult.affectedRows === 0) {
const userid = decodedtoken.user;
const { name, email, col_name, state, year, course } = req.body;

const infoQuery = `
UPDATE info_table
SET name = ?, email = ?, col_name = ?, state = ?, year = ?, course = ?
WHERE id = ?
`;
const infoValues = [name, email, col_name, state, year, course, userid];

// Wrapping the db query in a promise to enable async/await
const result = await new Promise((resolve, reject) => {
db.query(infoQuery, infoValues, (err, infoResult) => {
if (err) {
console.error('Error updating info table:', err);
reject(new Error('Database error in info table update.'));
} else {
resolve(infoResult);
}
});
});

if (result.affectedRows === 0) {
return res.status(404).json({ error: 'User not found in info table.' });
}

res.status(200).json({ message: 'User info updated successfully!' });
});
};
} catch (error) {
console.error('Error in updateProfile function:', error);
res.status(500).json({ error: 'Server error' });
}
};

module.exports={display,updateProfile}
module.exports = { display, updateProfile };