- Fixed SQL injection ""issue""
And various code cleaning things for spell route
This commit is contained in:
Alexis
157
routes/spells.js
157
routes/spells.js
@@ -6,23 +6,64 @@ let router = express.Router()
|
||||
const connection = require('../database/connection')
|
||||
const db = connection.db
|
||||
|
||||
const getSpells = (params) => {
|
||||
// Builds the associated infos for a given spell object
|
||||
const buildSpell = async (spell) => {
|
||||
|
||||
// Fetches the spell's schools
|
||||
let fetchSpellSchoolData = new Promise((resolve, reject) => {
|
||||
let query =
|
||||
"SELECT school.id, school.name " +
|
||||
"FROM spells_schools AS sc " +
|
||||
"INNER JOIN school AS school ON sc.id_school = school.id " +
|
||||
"WHERE sc.id_spell = " + spell.id
|
||||
|
||||
db.query(query, (err, result) => {
|
||||
if (err) return reject
|
||||
resolve(result)
|
||||
})
|
||||
})
|
||||
|
||||
// Fetches the spell's variables
|
||||
let fetchSpellVariablesData = new Promise((resolve, reject) => {
|
||||
let query =
|
||||
"SELECT variable.id, variable.description " +
|
||||
"FROM spells_variables AS sv " +
|
||||
"INNER JOIN variable AS variable ON sv.id_variable = variable.id " +
|
||||
"WHERE sv.id_spell = " + spell.id
|
||||
|
||||
db.query(query, (err, result) => {
|
||||
if (err) console.log(err)
|
||||
resolve(result)
|
||||
})
|
||||
})
|
||||
|
||||
// Fetches the spell's ingredients
|
||||
let fetchSpellIngredientsData = new Promise((resolve, reject) => {
|
||||
let query =
|
||||
"SELECT ingredient.id, ingredient.name " +
|
||||
"FROM spells_ingredients AS si " +
|
||||
"INNER JOIN ingredient AS ingredient ON si.id_ingredient = ingredient.id " +
|
||||
"WHERE si.id_spell = " + spell.id
|
||||
|
||||
db.query(query, (err, result) => {
|
||||
if (err) console.log(err)
|
||||
resolve(result)
|
||||
})
|
||||
})
|
||||
|
||||
// Builds the spell and returns it
|
||||
spell.schools = await fetchSpellSchoolData
|
||||
spell.variables = await fetchSpellVariablesData
|
||||
spell.ingredients = await fetchSpellIngredientsData
|
||||
return spell
|
||||
}
|
||||
|
||||
const getSpells = () => {
|
||||
let fetchSpellsData = new Promise((resolve, reject) => {
|
||||
|
||||
let query =
|
||||
"SELECT DISTINCT * " +
|
||||
"FROM spell " +
|
||||
"WHERE 1 = 1 "
|
||||
|
||||
// Checks if the params object has items
|
||||
if (!(Object.keys(params).length === 0 && params.constructor === Object)) {
|
||||
if (params.id) {
|
||||
query += "AND id = " + params.id + " "
|
||||
}
|
||||
if (params.name) {
|
||||
query += "AND name = " + params.name + " "
|
||||
}
|
||||
}
|
||||
"FROM spell "
|
||||
|
||||
db.query(query, async (err, result) => {
|
||||
if (err) { return reject }
|
||||
@@ -30,68 +71,35 @@ const getSpells = (params) => {
|
||||
|
||||
// Loops over the results to fetch the associated tables
|
||||
for (let i = 0; i < result.length; i++) {
|
||||
|
||||
let currentSpell_ID = result[i].id
|
||||
|
||||
// Fetches the spell's schools
|
||||
let fetchSpellSchoolData = new Promise((resolve, reject) => {
|
||||
let query =
|
||||
"SELECT school.name " +
|
||||
"FROM spells_schools AS sc " +
|
||||
"INNER JOIN school AS school ON sc.id_school = school.id " +
|
||||
"WHERE sc.id_spell = " + currentSpell_ID
|
||||
|
||||
db.query(query, (err, result) => {
|
||||
if (err) return reject
|
||||
resolve(result)
|
||||
})
|
||||
})
|
||||
|
||||
// Fetches the spell's variables
|
||||
let fetchSpellVariablesData = new Promise((resolve, reject) => {
|
||||
let query =
|
||||
"SELECT variable.description " +
|
||||
"FROM spells_variables AS sv " +
|
||||
"INNER JOIN variable AS variable ON sv.id_variable = variable.id " +
|
||||
"WHERE sv.id_spell = " + currentSpell_ID
|
||||
|
||||
db.query(query, (err, result) => {
|
||||
if (err) console.log(err)
|
||||
resolve(result)
|
||||
})
|
||||
})
|
||||
|
||||
// Fetches the spell's ingredients
|
||||
let fetchSpellIngredientsData = new Promise((resolve, reject) => {
|
||||
let query =
|
||||
"SELECT ingredient.name " +
|
||||
"FROM spells_ingredients AS si " +
|
||||
"INNER JOIN ingredient AS ingredient ON si.id_ingredient = ingredient.id " +
|
||||
"WHERE si.id_spell = " + currentSpell_ID
|
||||
|
||||
db.query(query, (err, result) => {
|
||||
if (err) console.log(err)
|
||||
resolve(result)
|
||||
})
|
||||
})
|
||||
|
||||
result[i].schools = await fetchSpellSchoolData
|
||||
result[i].variables = await fetchSpellVariablesData
|
||||
result[i].ingredients = await fetchSpellIngredientsData
|
||||
|
||||
result[i] = await buildSpell(result[i])
|
||||
}
|
||||
resolve(result)
|
||||
})
|
||||
})
|
||||
|
||||
return fetchSpellsData
|
||||
}
|
||||
|
||||
router
|
||||
.get('/', async (req, res, next) => {
|
||||
const getSpell = (id) => {
|
||||
let fetchSpellData = new Promise((resolve, reject) => {
|
||||
|
||||
let query =
|
||||
"SELECT FROM spell where id = " + id
|
||||
|
||||
db.query(query, async (err, result) => {
|
||||
if (err) { return reject }
|
||||
resolve(result);
|
||||
})
|
||||
})
|
||||
return fetchSpellData
|
||||
}
|
||||
|
||||
// ROUTES
|
||||
// ALL SPELLS METHODS
|
||||
// Router
|
||||
router.get('/', async (req, res, next) => {
|
||||
getSpells(req.query)
|
||||
.then(v => {
|
||||
res.setHeader('Content-Type', 'application/json')
|
||||
res.setHeader('Content-Type', 'application/json;charset=utf-8')
|
||||
res.end(JSON.stringify(v))
|
||||
})
|
||||
.catch(err => {
|
||||
@@ -100,5 +108,22 @@ router
|
||||
})
|
||||
})
|
||||
|
||||
// ONE SPELL METHODS
|
||||
// Regex for param validation
|
||||
const regex = RegExp(/^[1-9]\d*$/);
|
||||
|
||||
// Param validation
|
||||
router.param('id', (req, res, next, id) => {
|
||||
if (regex.test(id)) {
|
||||
next()
|
||||
} else {
|
||||
res.status(403).send('The id parameter should be an integer.')
|
||||
}
|
||||
})
|
||||
|
||||
// Router
|
||||
router.get('/:id/', async (req, res, next) => {
|
||||
console.log("id")
|
||||
})
|
||||
|
||||
module.exports = router
|
||||
Reference in New Issue
Block a user