Skip to content

Commit cf304d5

Browse files
pdiazpdiaz
authored
Merge branch 'master' into master
2 parents d06201d + f01059f commit cf304d5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+869
-1905
lines changed

‎.github/ISSUE_TEMPLATE/---1-report-an-issue.md

+15-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@ assignees: ''
88
---
99

1010
### New Issue Checklist
11-
<!-- Please check the following boxes [ ] -> [x] before submitting your issue. Click the "Preview" tab for better readability. Thanks for reporting issues back to Parse Server! -->
11+
<!--
12+
Please check the following boxes [x] before submitting your issue.
13+
Click the "Preview" tab for better readability.
14+
Thanks for contributing to Parse Server!
15+
-->
1216

1317
- [ ] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md).
1418
- [ ] I am not just asking a [question](https://github.com/parse-community/.github/blob/master/SUPPORT.md).
@@ -27,6 +31,16 @@ assignees: ''
2731
### Expected Outcome
2832
<!-- What outcome, for example query result, did you expect? -->
2933

34+
### Failing Test Case / Pull Request
35+
<!--
36+
Check one of the following boxes [x] if you added a PR and add the link.
37+
See the contribution guide for how add a test cases:
38+
https://github.com/parse-community/parse-server/blob/master/CONTRIBUTING.md
39+
-->
40+
41+
- [ ] 🤩 I submitted a PR with a fix and a test case.
42+
- [ ] 🧐 I submitted a PR with a failing test case.
43+
3044
### Environment
3145
<!-- Be specific with versions, don't use "latest" or semver ranges like "~x.y.z" or "^x.y.z". -->
3246

‎.github/ISSUE_TEMPLATE/---2-feature-request.md

+22-8
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,28 @@ assignees: ''
77

88
---
99

10-
**Is your feature request related to a problem? Please describe.**
11-
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
10+
### New Feature / Enhancement Checklist
11+
<!--
12+
Please check the following boxes [x] before submitting your issue.
13+
Click the "Preview" tab for better readability.
14+
Thanks for contributing to Parse Server!
15+
-->
1216

13-
**Describe the solution you'd like**
14-
A clear and concise description of what you want to happen.
17+
- [ ] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md).
18+
- [ ] I am not just asking a [question](https://github.com/parse-community/.github/blob/master/SUPPORT.md).
19+
- [ ] I have searched through [existing issues](https://github.com/parse-community/parse-server/issues?q=is%3Aissue).
1520

16-
**Describe alternatives you've considered**
17-
A clear and concise description of any alternative solutions or features you've considered.
21+
### Current Limitation
22+
<!-- Which current limitation is the feature or enhancement addressing? -->
1823

19-
**Additional context**
20-
Add any other context or screenshots about the feature request here.
24+
### Feature / Enhancement Description
25+
<!-- What is the concept of the functionality and how should it be implemented? -->
26+
27+
### Example Use Case
28+
<!-- What is an example use case in steps (1. / 2. / 3. / etc.) that describes the functionality? -->
29+
30+
### Alternatives / Workarounds
31+
<!-- Which alternatives or workarounds exist currently? -->
32+
33+
### 3rd Party References
34+
<!-- Have you seen a similar functionality provided somewhere else? -->

‎.github/PULL_REQUEST_TEMPLATE/pull_request_template.md

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
### New Pull Request Checklist
2+
<!--
3+
Please check the following boxes [x] before submitting your issue.
4+
Click the "Preview" tab for better readability.
5+
Thanks for contributing to Parse Server!
6+
-->
7+
8+
- [ ] I am not disclosing a [vulnerability](https://github.com/parse-community/parse-server/blob/master/SECURITY.md).
9+
- [ ] I am creating this PR in reference to an [issue](https://github.com/parse-community/parse-server/issues?q=is%3Aissue).
10+
11+
### Issue Description
12+
<!-- Add a brief description of the issue this PR solves. -->
13+
14+
Related issue: FILL_THIS_OUT
15+
16+
### Approach
17+
<!-- Add a description of the approach in this PR. -->
18+
19+
### TODOs before merging
20+
<!--
21+
Add TODOs that need to be completed before merging this PR.
22+
Delete suggested TODOs that do not apply to this PR.
23+
-->
24+
25+
- [ ] Add test cases
26+
- [ ] Add entry to changelog
27+
- [ ] Add changes to documentation (guides, repository pages, in-code descriptions)
28+
- [ ] Add [security check](https://github.com/parse-community/parse-server/blob/master/CONTRIBUTING.md#security-checks)
29+
- [ ] Add new Parse Error codes to Parse JS SDK <!-- no hard-coded error codes in Parse Server -->
30+
- [ ] ...

‎.github/workflows/release.yml

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: release
2+
on:
3+
release:
4+
types: [published]
5+
jobs:
6+
publish-npm:
7+
runs-on: ubuntu-18.04
8+
steps:
9+
- uses: actions/checkout@v2
10+
- uses: actions/setup-node@v1
11+
with:
12+
node-version: '10.14'
13+
registry-url: https://registry.npmjs.org/
14+
- name: Cache Node.js modules
15+
uses: actions/cache@v2
16+
with:
17+
path: ~/.npm
18+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
19+
restore-keys: |
20+
${{ runner.os }}-node-
21+
- run: npm ci
22+
- run: npm publish
23+
env:
24+
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
25+
publish-docs:
26+
runs-on: ubuntu-18.04
27+
timeout-minutes: 30
28+
steps:
29+
- uses: actions/checkout@v2
30+
- name: Use Node.js
31+
uses: actions/setup-node@v1
32+
with:
33+
node-version: '10.14'
34+
- name: Cache Node.js modules
35+
uses: actions/cache@v2
36+
with:
37+
path: ~/.npm
38+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
39+
restore-keys: |
40+
${{ runner.os }}-node-
41+
- name: Get Tag
42+
uses: actions/github-script@v3
43+
id: tag
44+
with:
45+
github-token: ${{secrets.GITHUB_TOKEN}}
46+
result-encoding: string
47+
script: |
48+
const ref = process.env.GITHUB_REF
49+
if(!ref.startsWith('refs/tags/'))
50+
return ''
51+
return ref.replace(/^refs\/tags\//, '')
52+
- name: Generate Docs
53+
run: |
54+
echo $SOURCE_TAG
55+
npm ci
56+
./release_docs.sh
57+
env:
58+
SOURCE_TAG: ${{ steps.tag.outputs.result }}
59+
- name: Deploy
60+
uses: peaceiris/[email protected]
61+
with:
62+
github_token: ${{ secrets.GITHUB_TOKEN }}
63+
publish_dir: ./docs

‎CHANGELOG.md

+23-1
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,31 @@
11
## Parse Server Changelog
22

33
### master
4-
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.4.0...master)
4+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.5.0...master)
55
- IMPROVE: Optimize queries on classes with pointer permissions. [#7061](https://github.com/parse-community/parse-server/pull/7061). Thanks to [Pedro Diaz](https://github.com/pdiaz)
66

7+
### 4.5.0
8+
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.4.0...4.5.0)
9+
10+
__BREAKING CHANGES:__
11+
- FIX: Consistent casing for afterLiveQueryEvent. The afterLiveQueryEvent was introduced in 4.4.0 with inconsistent casing for the event names, which was fixed in 4.5.0. [#7023](https://github.com/parse-community/parse-server/pull/7023). Thanks to [dblythy](https://github.com/dblythy).
12+
___
13+
- FIX: Properly handle serverURL and publicServerUrl in Batch requests. [#7049](https://github.com/parse-community/parse-server/pull/7049). Thanks to [Zach Goldberg](https://github.com/ZachGoldberg).
14+
- IMPROVE: Prevent invalid column names (className and length). [#7053](https://github.com/parse-community/parse-server/pull/7053). Thanks to [Diamond Lewis](https://github.com/dplewis).
15+
- IMPROVE: GraphQL: Remove viewer from logout mutation. [#7029](https://github.com/parse-community/parse-server/pull/7029). Thanks to [Antoine Cormouls](https://github.com/Moumouls).
16+
- IMPROVE: GraphQL: Optimize on Relation. [#7044](https://github.com/parse-community/parse-server/pull/7044). Thanks to [Antoine Cormouls](https://github.com/Moumouls).
17+
- NEW: Include sessionToken in onLiveQueryEvent. [#7043](https://github.com/parse-community/parse-server/pull/7043). Thanks to [dblythy](https://github.com/dblythy).
18+
- FIX: Definitions for accountLockout and passwordPolicy. [#7040](https://github.com/parse-community/parse-server/pull/7040). Thanks to [dblythy](https://github.com/dblythy).
19+
- FIX: Fix typo in server definitions for emailVerifyTokenReuseIfValid. [#7037](https://github.com/parse-community/parse-server/pull/7037). Thanks to [dblythy](https://github.com/dblythy).
20+
- SECURITY FIX: LDAP auth stores password in plain text. See [GHSA-4w46-w44m-3jq3](https://github.com/parse-community/parse-server/security/advisories/GHSA-4w46-w44m-3jq3) for more details about the vulnerability and [da905a3](https://github.com/parse-community/parse-server/commit/da905a357d062ab4fea727a21eac231acc2ed92a) for the fix. Thanks to [Fabian Strachanski](https://github.com/fastrde).
21+
- NEW: Reuse tokens if they haven't expired. [#7017](https://github.com/parse-community/parse-server/pull/7017). Thanks to [dblythy](https://github.com/dblythy).
22+
- NEW: Add LDAPS-support to LDAP-Authcontroller. [#7014](https://github.com/parse-community/parse-server/pull/7014). Thanks to [Fabian Strachanski](https://github.com/fastrde).
23+
- FIX: (beforeSave/afterSave): Return value instead of Parse.Op for nested fields. [#7005](https://github.com/parse-community/parse-server/pull/7005). Thanks to [Diamond Lewis](https://github.com/dplewis).
24+
- FIX: (beforeSave): Skip Sanitizing Database results. [#7003](https://github.com/parse-community/parse-server/pull/7003). Thanks to [Diamond Lewis](https://github.com/dplewis).
25+
- FIX: Fix includeAll for querying a Pointer and Pointer array. [#7002](https://github.com/parse-community/parse-server/pull/7002). Thanks to [Corey Baker](https://github.com/cbaker6).
26+
- FIX: Add encryptionKey to src/options/index.js. [#6999](https://github.com/parse-community/parse-server/pull/6999). Thanks to [dblythy](https://github.com/dblythy).
27+
- IMPROVE: Update PostgresStorageAdapter.js. [#6989](https://github.com/parse-community/parse-server/pull/6989). Thanks to [Vitaly Tomilov](https://github.com/vitaly-t).
28+
729
### 4.4.0
830
[Full Changelog](https://github.com/parse-community/parse-server/compare/4.3.0...4.4.0)
931
- IMPROVE: Update PostgresStorageAdapter.js. [#6981](https://github.com/parse-community/parse-server/pull/6981). Thanks to [Vitaly Tomilov](https://github.com/vitaly-t)

‎CONTRIBUTING.md

+12-1
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,18 @@ If you want to make changes to [Parse Server Configuration][config] add the desi
100100

101101
To view docs run `npm run docs` and check the `/out` directory.
102102

103-
### Code of Conduct
103+
## Feature Considerations
104+
### Security Checks
105+
106+
The Parse Server security checks feature warns developers about weak security settings in their Parse Server deployment.
107+
108+
A security check needs to be added for every new feature or enhancement that allows the developer to configure it in a way that weakens security mechanisms or exposes functionality which creates a weak spot for malicious attacks. If you are not sure whether your feature or enhancements requires a security check, feel free to ask.
109+
110+
For example, allowing public read and write to a class may be useful to simplify development but should be disallowed in a production environment.
111+
112+
Security checks are added in [SecurityChecks.js](https://github.com/parse-community/parse-server/blob/master/src/SecurityChecks.js).
113+
114+
## Code of Conduct
104115

105116
This project adheres to the [Contributor Covenant Code of Conduct](https://github.com/parse-community/parse-server/blob/master/CODE_OF_CONDUCT.md). By participating, you are expected to honor this code.
106117

‎package-lock.json

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "parse-server",
3-
"version": "4.4.0",
3+
"version": "4.5.0",
44
"description": "An express module providing a Parse-compatible API server",
55
"main": "lib/index.js",
66
"repository": {
@@ -105,7 +105,7 @@
105105
"posttest": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.0.4} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=mmapv1} mongodb-runner stop",
106106
"coverage": "cross-env MONGODB_VERSION=${MONGODB_VERSION:=4.0.4} MONGODB_TOPOLOGY=${MONGODB_TOPOLOGY:=standalone} MONGODB_STORAGE_ENGINE=${MONGODB_STORAGE_ENGINE:=mmapv1} TESTING=1 nyc jasmine",
107107
"start": "node ./bin/parse-server",
108-
"prettier": "prettier --write {src,spec}/{**/*,*}.js",
108+
"prettier": "prettier --write '{src,spec}/{**/*,*}.js'",
109109
"prepare": "npm run build",
110110
"postinstall": "node -p 'require(\"./postinstall.js\")()'"
111111
},

‎release_docs.sh

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
#!/bin/sh -e
22
set -x
3-
if [ "${TRAVIS_REPO_SLUG}" = "" ];
3+
if [ "${GITHUB_ACTIONS}" = "" ];
44
then
5-
echo "Cannot release docs without TRAVIS_REPO_SLUG set"
5+
echo "Cannot release docs without GITHUB_ACTIONS set"
66
exit 0;
77
fi
8-
REPO="https://github.com/${TRAVIS_REPO_SLUG}"
8+
REPO="https://github.com/parse-community/parse-server"
99

1010
rm -rf docs
1111
git clone -b gh-pages --single-branch $REPO ./docs
@@ -15,9 +15,9 @@ cd ..
1515

1616
DEST="master"
1717

18-
if [ "${TRAVIS_TAG}" != "" ];
18+
if [ "${SOURCE_TAG}" != "" ];
1919
then
20-
DEST="${TRAVIS_TAG}"
20+
DEST="${SOURCE_TAG}"
2121
# change the default page to the latest
2222
echo "<meta http-equiv='refresh' content='0; url=/parse-server/api/${DEST}'>" > "docs/api/index.html"
2323
fi

‎spec/LdapAuth.spec.js

+10-9
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ it('Should delete the password from authData after validation', done => {
216216
const options = {
217217
suffix: 'o=example',
218218
url: `ldap://localhost:${port}`,
219-
dn: 'uid={{id}}, o=example'
219+
dn: 'uid={{id}}, o=example',
220220
};
221221

222222
const authData = { id: 'testuser', password: 'secret' };
@@ -237,22 +237,23 @@ it('Should not save the password in the user record after authentication', done
237237
const options = {
238238
suffix: 'o=example',
239239
url: `ldap://localhost:${port}`,
240-
dn: 'uid={{id}}, o=example'
240+
dn: 'uid={{id}}, o=example',
241241
};
242242
reconfigureServer({ auth: { ldap: options } }).then(() => {
243243
const authData = { authData: { id: 'testuser', password: 'secret' } };
244-
Parse.User.logInWith('ldap', authData).then((returnedUser) => {
245-
const query = new Parse.Query("User");
244+
Parse.User.logInWith('ldap', authData).then(returnedUser => {
245+
const query = new Parse.Query('User');
246246
query
247-
.equalTo('objectId', returnedUser.id).first({ useMasterKey: true })
248-
.then((user) => {
249-
expect(user.get('authData')).toEqual({ ldap:{ id: 'testuser' }});
247+
.equalTo('objectId', returnedUser.id)
248+
.first({ useMasterKey: true })
249+
.then(user => {
250+
expect(user.get('authData')).toEqual({ ldap: { id: 'testuser' } });
250251
expect(user.get('authData').ldap.password).toBeUndefined();
251252
done();
252253
})
253254
.catch(done.fail)
254-
.finally(() => server.close())
255-
})
255+
.finally(() => server.close());
256+
});
256257
});
257258
});
258259
});

0 commit comments

Comments
 (0)