Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions apps/web/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
"geist": "^1.5.1",
"lucide-react": "^0.546.0",
"marked-react": "^3.0.2",
"motion": "^12.23.26",
"next": "^16.0.10",
"next-themes": "^0.4.6",
"prism-react-renderer": "^2.4.1",
Expand Down
137 changes: 58 additions & 79 deletions apps/web/src/app/api/data/settings/route.ts
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,8 @@ export const POST = async (request: NextRequest) => {
if (
body.action === "site_title_description" &&
body.title &&
body.description
body.description &&
body.server_owner
) {
try {
await db
Expand All @@ -61,16 +62,15 @@ export const POST = async (request: NextRequest) => {
.update(main_schema.kvData)
.set({ value: body.description })
.where(dorm.eq(main_schema.kvData.key, "description"));
return Response.json(
{
success: true,
status: 200,
msg: "",
},
{
status: 200,
},
);
await db
.update(main_schema.kvData)
.set({ value: body.server_owner })
.where(dorm.eq(main_schema.kvData.key, "copyrightOwner"));
return Response.json({
success: true,
status: 200,
msg: "",
});
} catch (e: any) {
statusCode = 500;
throw new Error(e.message || "ERR_GENERIC");
Expand Down Expand Up @@ -103,22 +103,24 @@ export const POST = async (request: NextRequest) => {
.from(main_schema.kvData)
.where(dorm.eq(main_schema.kvData.key, "searchStatus"))
)[0].value;
return Response.json(
{
success: true,
status: 200,
msg: "",
data: {
homePage,
registration,
robotsTxt,
search,
},
},
{
status: 200,
const displayVersion = (
await db
.select()
.from(main_schema.kvData)
.where(dorm.eq(main_schema.kvData.key, "exposeVersion"))
)[0].value;
Comment on lines +106 to +111
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

rg -n "exposeVersion" --type ts

Repository: hpware/log

Length of output: 164


🏁 Script executed:

fd -e "seed" -e "migration" -e "init" --type f | head -20

Repository: hpware/log

Length of output: 36


🏁 Script executed:

sed -n '80,115p' apps/web/src/app/api/data/settings/route.ts | cat -n

Repository: hpware/log

Length of output: 1514


Potential runtime error if exposeVersion key doesn't exist.

The code accesses [0].value without verifying the query returned results. If the exposeVersion key is missing from kvData, this will throw a TypeError. While other queries in this block (lines 82-105) follow the same pattern, applying it to newly added code continues an unsafe practice.

Add null safety:

   const displayVersion = (
     await db
       .select()
       .from(main_schema.kvData)
       .where(dorm.eq(main_schema.kvData.key, "exposeVersion"))
-  )[0].value;
+  )[0]?.value ?? false;
🤖 Prompt for AI Agents
In apps/web/src/app/api/data/settings/route.ts around lines 106 to 111, the code
assumes the query returns an entry and uses [0].value directly which will throw
if the "exposeVersion" key is missing; change the code to capture the query
result into a variable, check whether a row was returned before accessing
.value, and then either use a sensible default (e.g., null or an explicit
default string) or return/throw a clear error/log message; ensure you handle
this the same way other kvData lookups in the file handle missing keys for
consistency.

return Response.json({
success: true,
status: 200,
msg: "",
data: {
homePage,
registration,
robotsTxt,
search,
displayVersion,
},
);
});
} catch (e: any) {
statusCode = 500;
throw new Error(e.message || "ERR_GENERIC");
Expand All @@ -134,12 +136,14 @@ export const POST = async (request: NextRequest) => {
registration: boolean;
robotsTxt: boolean;
search: boolean;
displayVersion: boolean;
};
if (
typeof data.homePage !== "boolean" ||
typeof data.registration !== "boolean" ||
typeof data.robotsTxt !== "boolean" ||
typeof data.search !== "boolean"
typeof data.search !== "boolean" ||
typeof data.displayVersion !== "boolean"
) {
throw new Error("ERR_INVALID_BODY_TYPE");
}
Expand All @@ -159,23 +163,20 @@ export const POST = async (request: NextRequest) => {
.update(main_schema.kvData)
.set({ value: body.data.search })
.where(dorm.eq(main_schema.kvData.key, "searchStatus"));

return Response.json(
{
success: true,
status: 200,
msg: "",
},
{
status: 200,
},
);
await db
.update(main_schema.kvData)
.set({ value: body.data.displayVersion })
.where(dorm.eq(main_schema.kvData.key, "exposeVersion"));
return Response.json({
success: true,
status: 200,
msg: "",
});
} catch (e: any) {
statusCode = 500;
throw new Error(e.message || "ERR_GENERIC");
}
}
if (body.action === "site_robots_txt_json") {
} else if (body.action === "site_robots_txt_json") {
try {
if (!body.data || typeof body.data !== "object") {
throw new Error("ERR_INVALID_BODY_DATA_OBJ");
Expand All @@ -186,16 +187,11 @@ export const POST = async (request: NextRequest) => {
.set({ value: body.data })
.where(dorm.eq(main_schema.kvData.key, "robotsTxtList"));

return Response.json(
{
success: true,
status: 200,
msg: "",
},
{
status: 200,
},
);
return Response.json({
success: true,
status: 200,
msg: "",
});
} catch (e: any) {
statusCode = 500;
throw new Error(e.message || "ERR_GENERIC");
Expand All @@ -208,17 +204,12 @@ export const POST = async (request: NextRequest) => {
.from(main_schema.kvData)
.where(dorm.eq(main_schema.kvData.key, "robotsTxtList"));

return Response.json(
{
success: true,
status: 200,
msg: "",
data: currentList[0].value,
},
{
status: 200,
},
);
return Response.json({
success: true,
status: 200,
msg: "",
data: currentList[0].value,
});
} catch (e: any) {
statusCode = 500;
throw new Error(e.message || "ERR_GENERIC");
Expand Down Expand Up @@ -270,12 +261,7 @@ export const POST = async (request: NextRequest) => {
statusCode = 500;
throw new Error("ERR_REMOVE_FAILED");
}
return Response.json(
{ success: true, msg: "Deleted User" },
{
status: 200,
},
);
return Response.json({ success: true, msg: "Deleted User" });
} catch (e: any) {
console.log(e);
statusCode = 403;
Expand Down Expand Up @@ -305,12 +291,7 @@ export const POST = async (request: NextRequest) => {
.update(main_schema.userPosts)
.set({ status: "draft" }) // making every post a "draft" instaed of making it unlisted
.where(dorm.eq(main_schema.userPosts.byUser, body.user));
return Response.json(
{ success: true, msg: "Banned User" },
{
status: 200,
},
);
return Response.json({ success: true, msg: "Banned User" });
} catch (e: any) {
console.log(e);
statusCode = 500;
Expand All @@ -331,12 +312,10 @@ export const POST = async (request: NextRequest) => {
if (!data.success) {
throw new Error("Failed to revoke the user's sessions");
}
return Response.json(
{ success: true, msg: "Revoked the user's sessions" },
{
status: 200,
},
);
return Response.json({
success: true,
msg: "Revoked the user's sessions",
});
} catch (e: any) {
console.log(e);
statusCode = 500;
Expand Down
6 changes: 3 additions & 3 deletions apps/web/src/app/api/data/system_info/route.ts
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,10 @@ export const GET = async (request: NextRequest) => {
return Response.json({
copyright_owner: getCopyrightOwner[0].value,
feature_status: {
homePage: getHomePageStatus[0].value !== "false",
search: getSearchPageStatus[0].value !== "false",
homePage: getHomePageStatus[0].value,
search: getSearchPageStatus[0].value,
},
optionalExposeVersion: exposeVersion[0].value !== "false",
optionalExposeVersion: exposeVersion[0].value,
version: exposeVersion[0].value !== "false" ? projectData.version : null,
});
};
Loading