From b17dabbb266e439133ba9ba6727842686a6ec1b2 Mon Sep 17 00:00:00 2001 From: yau-wd Date: Mon, 27 Apr 2026 16:20:23 +0800 Subject: [PATCH] Fix FLOWISE-319 Sanitize User (#6269) * fix(account): flowise-319 sanitize user * Update packages/server/src/enterprise/services/account.service.ts Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- .../controllers/account.controller.ts | 10 ---------- .../src/enterprise/middleware/passport/index.ts | 6 +++--- .../src/enterprise/routes/account.route.ts | 2 -- .../src/enterprise/services/account.service.ts | 17 +++++++++-------- 4 files changed, 12 insertions(+), 23 deletions(-) diff --git a/packages/server/src/enterprise/controllers/account.controller.ts b/packages/server/src/enterprise/controllers/account.controller.ts index 0acaf4843..3a3bc13ab 100644 --- a/packages/server/src/enterprise/controllers/account.controller.ts +++ b/packages/server/src/enterprise/controllers/account.controller.ts @@ -31,16 +31,6 @@ export class AccountController { } } - public async login(req: Request, res: Response, next: NextFunction) { - try { - const accountService = new AccountService() - const data = await accountService.login(req.body) - return res.status(StatusCodes.CREATED).json(data) - } catch (error) { - next(error) - } - } - public async verify(req: Request, res: Response, next: NextFunction) { try { const accountService = new AccountService() diff --git a/packages/server/src/enterprise/middleware/passport/index.ts b/packages/server/src/enterprise/middleware/passport/index.ts index 2fe913580..88c700a4f 100644 --- a/packages/server/src/enterprise/middleware/passport/index.ts +++ b/packages/server/src/enterprise/middleware/passport/index.ts @@ -6,6 +6,7 @@ import { StatusCodes } from 'http-status-codes' import jwt, { JwtPayload, sign } from 'jsonwebtoken' import passport from 'passport' import { VerifiedCallback } from 'passport-jwt' +import { v4 as uuidv4 } from 'uuid' import { InternalFlowiseError } from '../../../errors/internalFlowiseError' import { IdentityManager } from '../../../IdentityManager' import { Platform } from '../../../Interface' @@ -29,7 +30,6 @@ import { import { decryptToken, encryptToken, generateSafeCopy } from '../../utils/tempTokenUtils' import { getAuthStrategy } from './AuthStrategy' import { initializeDBClientAndStore, initializeRedisClientAndStore } from './SessionPersistance' -import { v4 as uuidv4 } from 'uuid' const localStrategy = require('passport-local').Strategy @@ -173,8 +173,8 @@ export const initializeJwtCookieMiddleware = async (app: express.Application, id const loggedInUser: LoggedInUser = { id: workspaceUser.userId, - email: response.user.email, - name: response.user?.name, + email: response.user.email!, + name: response.user.name ?? response.user.email!, roleId: workspaceUser.roleId, activeOrganizationId: organization.id, activeOrganizationSubscriptionId: subscriptionId, diff --git a/packages/server/src/enterprise/routes/account.route.ts b/packages/server/src/enterprise/routes/account.route.ts index cf4733f92..41b8f3ce0 100644 --- a/packages/server/src/enterprise/routes/account.route.ts +++ b/packages/server/src/enterprise/routes/account.route.ts @@ -16,8 +16,6 @@ router.post( accountController.invite ) -router.post('/login', accountController.login) - router.post('/logout', accountController.logout) router.post('/verify', accountController.verify) diff --git a/packages/server/src/enterprise/services/account.service.ts b/packages/server/src/enterprise/services/account.service.ts index 33f3c2fb8..39e7591b8 100644 --- a/packages/server/src/enterprise/services/account.service.ts +++ b/packages/server/src/enterprise/services/account.service.ts @@ -1,7 +1,7 @@ import bcrypt from 'bcryptjs' import { removeFolderFromStorage } from 'flowise-components' -import jwt, { JwtPayload } from 'jsonwebtoken' import { StatusCodes } from 'http-status-codes' +import jwt, { JwtPayload } from 'jsonwebtoken' import moment from 'moment' import { DataSource, In, QueryRunner } from 'typeorm' import { ApiKey } from '../../database/entities/ApiKey' @@ -30,6 +30,7 @@ import { GeneralErrorMessage } from '../../utils/constants' import { getRunningExpressApp } from '../../utils/getRunningExpressApp' import logger from '../../utils/logger' import { checkUsageLimit } from '../../utils/quotaUsage' +import { sanitizeUser } from '../../utils/sanitize.util' import { emitEvent, TelemetryEventCategory, TelemetryEventResult } from '../../utils/telemetry' import { WorkspaceShared } from '../database/entities/EnterpriseEntities' import { OrganizationUser, OrganizationUserStatus } from '../database/entities/organization-user.entity' @@ -41,8 +42,8 @@ import { Workspace, WorkspaceName } from '../database/entities/workspace.entity' import { LoggedInUser, LoginActivityCode } from '../Interface.Enterprise' import { destroyAllSessionsForUser } from '../middleware/passport/SessionPersistance' import { getJWTAuthTokenSecret } from '../utils/authSecrets' -import { compareHash, getHash, getPasswordSaltRounds, hashNeedsUpgrade } from '../utils/encryption.util' import { EMAIL_CHANGE_JWT_TYP, isEmailChangeJwtShape, signEmailChangeJwt, verifyEmailChangeJwt } from '../utils/emailChangeJwt.util' +import { compareHash, getHash, getPasswordSaltRounds, hashNeedsUpgrade } from '../utils/encryption.util' import { isSmtpConfigured, sendEmailChangeConfirmationEmail, @@ -58,7 +59,6 @@ import auditService from './audit' import { OrganizationUserErrorMessage, OrganizationUserService } from './organization-user.service' import { OrganizationErrorMessage, OrganizationService } from './organization.service' import { RoleErrorMessage, RoleService } from './role.service' -import { sanitizeUser } from '../../utils/sanitize.util' import { UserErrorMessage, UserService } from './user.service' import { WorkspaceUserErrorMessage, WorkspaceUserService } from './workspace-user.service' import { WorkspaceErrorMessage, WorkspaceService } from './workspace.service' @@ -409,9 +409,7 @@ export class AccountService { data.workspaceUser = await this.workspaceUserService.saveWorkspaceUser(data.workspaceUser, queryRunner) data.role = await this.roleService.saveRole(data.role, queryRunner) await queryRunner.commitTransaction() - delete data.user.credential - delete data.user.tempToken - delete data.user.tokenExpiry + data.user = sanitizeUser(data.user) return data } @@ -522,6 +520,7 @@ export class AccountService { data.role = await this.roleService.saveRole(data.role, queryRunner) await queryRunner.commitTransaction() + data.user = sanitizeUser(data.user) return data } catch (error) { if (queryRunner && queryRunner.isTransactionActive) await queryRunner.rollbackTransaction() @@ -586,7 +585,9 @@ export class AccountService { if (platform === Platform.ENTERPRISE) { await auditService.recordLoginActivity(user.email, LoginActivityCode.LOGIN_SUCCESS, 'Login Success') } - return { user, workspaceDetails: wsUserOrUsers } + + const sanitizedUser = sanitizeUser(user) + return { user: sanitizedUser, workspaceDetails: wsUserOrUsers } } finally { await queryRunner.release() } @@ -614,7 +615,7 @@ export class AccountService { } finally { await queryRunner.release() } - + data.user = sanitizeUser(data.user) return data }