From 1aefd3d9a138f349af7fb0d5808644b07b753844 Mon Sep 17 00:00:00 2001 From: patrickwebsdev Date: Sat, 9 Nov 2024 01:33:50 -0300 Subject: [PATCH 1/5] security fix: policy post limit per minute --- .../migrations/20241109043158_limit_post_per_minute.sql | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 supabase/migrations/20241109043158_limit_post_per_minute.sql diff --git a/supabase/migrations/20241109043158_limit_post_per_minute.sql b/supabase/migrations/20241109043158_limit_post_per_minute.sql new file mode 100644 index 00000000..a0066b19 --- /dev/null +++ b/supabase/migrations/20241109043158_limit_post_per_minute.sql @@ -0,0 +1,8 @@ +create policy "limit_post_per_minute" +on "public"."help_requests" +as restrictive +for insert +to authenticated +with check ((NOT (EXISTS ( SELECT 1 + FROM help_requests help_requests_1 + WHERE ((help_requests_1.user_id = auth.uid()) AND (help_requests_1.created_at > (now() - '00:01:00'::interval))))))); \ No newline at end of file From d56e10680b941613616b127d227e9bb438eb61ba Mon Sep 17 00:00:00 2001 From: patrickwebsdev Date: Sat, 9 Nov 2024 03:09:54 -0300 Subject: [PATCH 2/5] security: now only authenticated users can post --- src/app/auth/page.tsx | 15 +++++++ src/app/ofrecer-ayuda/page.tsx | 19 +++++++- .../_components/Form/FormContainer.tsx | 3 +- .../_components/Form/FormRenderer.tsx | 40 +++++++++-------- src/app/solicitar-ayuda/page.tsx | 22 ++++++++-- src/app/solicitudes/editar/[id]/page.tsx | 8 ---- src/components/OfferHelp.js | 43 +++++++++++-------- src/components/layout/Sidebar.tsx | 6 ++- src/lib/supabase/middleware.ts | 13 ++++++ ...4846_limit_post_to_authenticated_users.sql | 41 ++++++++++++++++++ 10 files changed, 160 insertions(+), 50 deletions(-) create mode 100644 supabase/migrations/20241109054846_limit_post_to_authenticated_users.sql diff --git a/src/app/auth/page.tsx b/src/app/auth/page.tsx index 887b4689..0796c335 100644 --- a/src/app/auth/page.tsx +++ b/src/app/auth/page.tsx @@ -3,6 +3,7 @@ import { Suspense, useEffect } from 'react'; import Login from '../../components/auth/Login'; import { useRouter, useSearchParams } from 'next/navigation'; import { authService } from '@/lib/service'; +import { AlertTriangle } from 'lucide-react'; export default function AUthPage() { return ( @@ -28,6 +29,20 @@ function Auth() { return (
+
+
+ +
+

+ POR MOTIVOS DE SEGURIDAD HEMOS DESHABILITADO LAS PUBLICACIONES ANONIMAS +

+

Ahora debes registrarte para crear una publicacion.

+

+ Por dificultades tecnicas, por favor escríbenos a info@ajudadana.es +

+
+
+
router.push(redirect)} redirectUrl={redirect} />
); diff --git a/src/app/ofrecer-ayuda/page.tsx b/src/app/ofrecer-ayuda/page.tsx index 63783a6b..c2f4a3a6 100644 --- a/src/app/ofrecer-ayuda/page.tsx +++ b/src/app/ofrecer-ayuda/page.tsx @@ -1,5 +1,22 @@ +'use client'; import OfferHelp from '@/components/OfferHelp'; +import { supabase } from '@/lib/supabase/client'; +import { useEffect, useState } from 'react'; export default function OfrecerAyuda() { - return ; + const [session, setSession] = useState(null); + + useEffect(() => { + supabase.auth.getSession().then(({ data: { session } }: any) => { + setSession(session); + }); + }, []); + + return session ? ( + + ) : ( +
+
+
+ ); } diff --git a/src/app/solicitar-ayuda/_components/Form/FormContainer.tsx b/src/app/solicitar-ayuda/_components/Form/FormContainer.tsx index 43971f3c..a70fc9a3 100644 --- a/src/app/solicitar-ayuda/_components/Form/FormContainer.tsx +++ b/src/app/solicitar-ayuda/_components/Form/FormContainer.tsx @@ -28,9 +28,8 @@ const mapHelpToEnum = (helpTypeMap: FormData['tiposDeAyuda']): Enums['help_type_ [] as Enums['help_type_enum'][], ); -export function FormContainer() { +export function FormContainer({ session }: any) { const router = useRouter(); - const session = useSession(); const userId = session.user?.id; diff --git a/src/app/solicitar-ayuda/_components/Form/FormRenderer.tsx b/src/app/solicitar-ayuda/_components/Form/FormRenderer.tsx index b0968a8e..7136122a 100644 --- a/src/app/solicitar-ayuda/_components/Form/FormRenderer.tsx +++ b/src/app/solicitar-ayuda/_components/Form/FormRenderer.tsx @@ -72,23 +72,29 @@ export function FormRenderer({ -
- - -

- {isUserLoggedIn - ? 'Se utilizará para que puedas eliminar o editar la información de tu solicitud' - : 'Se utilizará para que puedas actualizar tu solicitud y marcarla como completada. Para realizar cambios, deberás registrarte con el mismo email'} -

-
+ {/* + MANTENIDO EN CASO DE RE UTILIZAR EN EL FUTURO + ACTUALMENTE NO APARECERA DE NINGUNA FORMA + */} + {!isUserLoggedIn && ( +
+ + +

+ {isUserLoggedIn + ? 'Se utilizará para que puedas eliminar o editar la información de tu solicitud' + : 'Se utilizará para que puedas actualizar tu solicitud y marcarla como completada. Para realizar cambios, deberás registrarte con el mismo email'} +

+
+ )}
-
+ {session ? ( + + ) : ( +
+
+
+ )} ); } diff --git a/src/app/solicitudes/editar/[id]/page.tsx b/src/app/solicitudes/editar/[id]/page.tsx index d5d4fc0e..5600012e 100644 --- a/src/app/solicitudes/editar/[id]/page.tsx +++ b/src/app/solicitudes/editar/[id]/page.tsx @@ -1,15 +1,7 @@ import RequestHelp from '@/components/RequestHelp'; -import Unauthorized from '@/components/Unauthorized'; import { helpRequestService } from '@/lib/service'; -import { createClient } from '@/lib/supabase/server'; - export default async function EditarSolicitud({ params }: { params: Promise<{ id: string }> }) { const { id } = await params; - const supabase = await createClient(); - const { data: session } = await supabase.auth.getUser(); - if (session.user === null) { - return ; - } const request = await helpRequestService.getOne(Number(id)); return ( diff --git a/src/components/OfferHelp.js b/src/components/OfferHelp.js index 524b4495..750143df 100644 --- a/src/components/OfferHelp.js +++ b/src/components/OfferHelp.js @@ -23,16 +23,19 @@ export default function OfferHelp({ id = 0, redirect = '/casos-activos/ofertas', submitType = 'create', + sessionProp, }) { const { towns } = useTowns(); - const session = useSession(); + const session = sessionProp || useSession(); const router = useRouter(); const userId = session.user?.id; + const isLoggedIn = Boolean(session?.user); + const [formData, setFormData] = useState({ - nombre: data.name || session?.user?.user_metadata?.full_name || '', + nombre: data.name || session?.user?.user_metadata?.full_name || session?.user?.user_metadata?.nombre || '', telefono: data.contact_info || session?.user?.user_metadata?.telefono || '', email: data.additional_info?.email || session?.user?.user_metadata?.email || '', ubicacion: data.location || '', @@ -201,7 +204,7 @@ export default function OfferHelp({ {/* Formulario */} -
+
{/* Datos personales */}
@@ -218,21 +221,25 @@ export default function OfferHelp({
- - {submitType === 'create' && ( -
- - setFormData({ ...formData, email: e.target.value })} - className="w-full p-2 border rounded focus:ring-2 focus:ring-green-500 focus:border-green-500" - /> -
- )} + {/* + MANTENIDO EN CASO DE RE UTILIZAR EN EL FUTURO + ACTUALMENTE NO APARECERA DE NINGUNA FORMA + */} + {submitType === 'create' || + (isLoggedIn && ( +
+ + setFormData({ ...formData, email: e.target.value })} + className="w-full p-2 border rounded focus:ring-2 focus:ring-green-500 focus:border-green-500" + /> +
+ ))} {submitType === 'edit' && (