From 021e203c21c7cc7aa7a1c763adeceb0eba7d6181 Mon Sep 17 00:00:00 2001 From: Pranav C Date: Wed, 8 Mar 2023 22:21:06 +0530 Subject: [PATCH 1/7] refactor: block plugin apis based on env Signed-off-by: Pranav C --- packages/nocodb/src/lib/controllers/plugin.ctl.ts | 7 +++++++ packages/nocodb/src/lib/services/util.svc.ts | 1 + 2 files changed, 8 insertions(+) diff --git a/packages/nocodb/src/lib/controllers/plugin.ctl.ts b/packages/nocodb/src/lib/controllers/plugin.ctl.ts index fb3ed46341..b0a6529f6a 100644 --- a/packages/nocodb/src/lib/controllers/plugin.ctl.ts +++ b/packages/nocodb/src/lib/controllers/plugin.ctl.ts @@ -17,6 +17,7 @@ export async function pluginTest(req: Request, res: Response) { export async function pluginRead(req: Request, res: Response) { res.json(await pluginService.pluginRead({ pluginId: req.params.pluginId })); } + export async function pluginUpdate( req: Request, res: Response @@ -27,6 +28,7 @@ export async function pluginUpdate( }); res.json(plugin); } + export async function isPluginActive(req: Request, res: Response) { res.json( await pluginService.isPluginActive({ pluginTitle: req.params.pluginTitle }) @@ -34,6 +36,11 @@ export async function isPluginActive(req: Request, res: Response) { } const router = Router({ mergeParams: true }); +router.use((_req, res, next) => { + if (process.env.NC_CLOUD) { + res.status(403).send('Not allowed'); + } else next(); +}); router.get( '/api/v1/db/meta/plugins', metaApiMetrics, diff --git a/packages/nocodb/src/lib/services/util.svc.ts b/packages/nocodb/src/lib/services/util.svc.ts index 2887fcff8a..e502e96070 100644 --- a/packages/nocodb/src/lib/services/util.svc.ts +++ b/packages/nocodb/src/lib/services/util.svc.ts @@ -56,6 +56,7 @@ export async function appInfo(param: { req: { ncSiteUrl: string } }) { ee: Noco.isEE(), ncAttachmentFieldSize: NC_ATTACHMENT_FIELD_SIZE, ncMaxAttachmentsAllowed: +(process.env.NC_MAX_ATTACHMENTS_ALLOWED || 10), + isCloud: !!process.env.NC_CLOUD, }; return result; From 49272e8a9f42d4a1905a8e478c5ff31d2ec9e596 Mon Sep 17 00:00:00 2001 From: Pranav C Date: Wed, 8 Mar 2023 22:43:38 +0530 Subject: [PATCH 2/7] refactor: only allow url hook and disable app api call if env is set Signed-off-by: Pranav C --- packages/nc-gui/components/webhook/Editor.vue | 31 ++++++++++++------- .../nc-gui/composables/useGlobal/state.ts | 1 + .../nc-gui/composables/useGlobal/types.ts | 1 + packages/nc-gui/pages/account/index.vue | 5 ++- .../nc-gui/pages/account/index/[page].vue | 5 ++- packages/nocodb/src/lib/services/hook.svc.ts | 22 +++++++++++++ 6 files changed, 52 insertions(+), 13 deletions(-) diff --git a/packages/nc-gui/components/webhook/Editor.vue b/packages/nc-gui/components/webhook/Editor.vue index eb01b0d50d..0059d835bd 100644 --- a/packages/nc-gui/components/webhook/Editor.vue +++ b/packages/nc-gui/components/webhook/Editor.vue @@ -13,6 +13,7 @@ import { reactive, ref, useApi, + useGlobal, useI18n, useNuxtApp, watch, @@ -32,6 +33,8 @@ const { $e } = useNuxtApp() const { api, isLoading: loading } = useApi() +const { appInfo } = $(useGlobal()) + const meta = inject(MetaInj, ref()) const useForm = Form.useForm @@ -170,16 +173,20 @@ const eventList = [ { text: ['After', 'Delete'], value: ['after', 'delete'] }, ] -const notificationList = [ - { type: 'URL' }, - { type: 'Email' }, - { type: 'Slack' }, - { type: 'Microsoft Teams' }, - { type: 'Discord' }, - { type: 'Mattermost' }, - { type: 'Twilio' }, - { type: 'Whatsapp Twilio' }, -] +const notificationList = computed(() => { + return appInfo.isCloud + ? [{ type: 'URL' }] + : [ + { type: 'URL' }, + { type: 'Email' }, + { type: 'Slack' }, + { type: 'Microsoft Teams' }, + { type: 'Discord' }, + { type: 'Mattermost' }, + { type: 'Twilio' }, + { type: 'Whatsapp Twilio' }, + ] +}) const methodList = [ { title: 'GET' }, @@ -414,7 +421,9 @@ watch( { immediate: true }, ) -onMounted(loadPluginList) +onMounted(() => { + if (!appInfo.isCoud) loadPluginList() +})