Fix regex check in background + admin check for managers (#626)

mboudet · web-flow · commit 559634f22631 · 2026-03-30T11:39:10.000+02:00
* Changes

* Also increase api key size

* Update auth.js

* Regex + fix project deletion

* Fix admin check for managers

* typos

* fix

* debug?

* remove number in names for test

* fixes
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -15,6 +15,7 @@
 * Modified add_readme template
 * Fix typo in cron due to remove_tp_reservation changes
 * Allow spaces, - and ' in user first/last names
+* Fix project deletion process
 
 ## 1.4.32 (2025-04-22)
 
diff --git a/manager2/src/app/admin/project/project.component.ts b/manager2/src/app/admin/project/project.component.ts
@@ -6,6 +6,8 @@ import { Group, GroupsService } from 'src/app/admin/groups/groups.service';
 import { User, UserService } from 'src/app/user/user.service';
 import { Table } from 'primeng/table';
 
+import { forkJoin } from 'rxjs';
+
 @Component({
     selector: 'app-project',
     templateUrl: './project.component.html',
@@ -156,7 +158,7 @@ export class ProjectComponent implements OnInit {
     remove_user() {
         this.admin_user_msg = '';
         this.admin_user_err_msg = '';
-        this.userService.removeFromProject(this.remove_user_admin, this.project.id).subscribe(
+        this.userService.removeFromProject(this.remove_user_admin, this.project.id, false).subscribe(
             (resp) => {
                 this.admin_user_msg = resp['message'];
                 this.show_project_users(this.project.id);
@@ -177,16 +179,23 @@ export class ProjectComponent implements OnInit {
 
     delete_project() {
         this.admin_user_err_msg = '';
-        for (var i = 0; i < this.users.length; i++) {
-            this.userService.removeFromProject(this.users[i].uid, this.project.id).subscribe(
-                (resp) => {},
-                (err) => (this.prj_err_msg = err.error.message)
-            );
-        }
-        this.projectsService.delete(this.project.id).subscribe(
-            (resp) => this.router.navigate(['/admin/project'], { queryParams: { deleted: 'ok' } }),
-            (err) => (this.admin_user_err_msg = err.error.message)
+        this.prj_err_msg = '';
+
+        const deleteRequests = this.users.map(user => 
+            this.userService.removeFromProject(user.uid, this.project.id, true)
         );
+
+        forkJoin(deleteRequests).subscribe({
+            next: () => {
+                this.projectsService.delete(this.project.id).subscribe(
+                    () => this.router.navigate(['/admin/project'], { queryParams: { deleted: 'ok' } }),
+                    (err) => (this.admin_user_err_msg = err.error.message)
+                );
+            },
+            error: (err) => {
+                this.prj_err_msg = err.error?.message || 'Error removing users from project';
+            }
+        }); 
     }
 
     update_project() {
diff --git a/manager2/src/app/project/project.component.ts b/manager2/src/app/project/project.component.ts
@@ -39,7 +39,7 @@ export class ProjectComponent implements OnInit {
     manager_visible: boolean;
     overview_visible: boolean;
     members_visible: boolean;
-    
+
     request_err_msg: string;
     request_msg: string;
     owner_request_err_msg: string;
@@ -151,7 +151,7 @@ export class ProjectComponent implements OnInit {
                     for (let i = 0; i < resp.length; i++) {
                         this.users[i].temp = { ...this.users[i].temp, is_manager: this.selectedProject.managers.includes(this.users[i].uid) }
                         if (
-                            resp[i].group.indexOf(this.selectedProject.group) >= 0 || 
+                            resp[i].group.indexOf(this.selectedProject.group) >= 0 ||
                             resp[i].secondarygroups.indexOf(this.selectedProject.group) >= 0
                         ) {
                             this.users[i].temp = { ...this.users[i].temp, access: true };
@@ -216,7 +216,7 @@ export class ProjectComponent implements OnInit {
         }
         if (request_type === 'remove' && this.session_user.uid === user_id) {
             // Self removal
-            this.userService.removeFromProject(user_id, project.id).subscribe(
+            this.userService.removeFromProject(user_id, project.id, false).subscribe(
                 (resp) => {
                     this.manager_request_msg = resp['message'];
                     this.project_list();
diff --git a/manager2/src/app/user/projects/projects.component.ts b/manager2/src/app/user/projects/projects.component.ts
@@ -51,7 +51,7 @@ export class ProjectsComponent implements OnInit {
     }
 
     remove_from_project(project_id) {
-        this.userService.removeFromProject(this.user.uid, project_id).subscribe(
+        this.userService.removeFromProject(this.user.uid, project_id, false).subscribe(
             (resp) => {
                 this.remove_from_project_msg = resp['message'];
                 let tmpproject = [];
diff --git a/manager2/src/app/user/user.component.ts b/manager2/src/app/user/user.component.ts
@@ -860,7 +860,7 @@ export class UserComponent implements OnInit {
     }
 
     remove_from_project(project_id) {
-        this.userService.removeFromProject(this.user.uid, project_id).subscribe(
+        this.userService.removeFromProject(this.user.uid, project_id, false).subscribe(
             (resp) => {
                 this.remove_from_project_msg = resp['message'];
                 var tmp_project: any[] = [];
diff --git a/manager2/src/app/user/user.service.ts b/manager2/src/app/user/user.service.ts
@@ -410,15 +410,15 @@ export class UserService {
         }));
     }
 
-    removeFromProject(userId: string, projectId: string) {
+    removeFromProject(userId: string, projectId: string, force: boolean) {
         //let user = this.authService.profile;
         let httpOptions = {
             //headers: new HttpHeaders({
             //  'x-api-key': user.apikey
             //}),
         };
         return this.http.delete(
-            environment.apiUrl + '/user/' + userId + '/project/' + projectId,
+            environment.apiUrl + '/user/' + userId + '/project/' + projectId + '?force=' + force,
             httpOptions)
     }
 
diff --git a/routes/auth.js b/routes/auth.js
@@ -417,7 +417,7 @@ router.post('/auth/:id', async function (req, res) {
         req.connection.socket.remoteAddress;
     if ((user.is_admin && GENERAL_CONFIG.admin_ip.indexOf(ip) >= 0) || process.env.gomngr_auth == 'fake') {
         // Skip auth
-        usertoken = jwt.sign({ isLogged: true, u2f: user._id }, CONFIG.general.secret, { expiresIn: '2 days' });
+        usertoken = jwt.sign({ isLogged: true, u2f: user._id, user: user._id }, CONFIG.general.secret, { expiresIn: '2 days' });
         return res.send({ token: usertoken, user: user, message: '', double_auth: need_double_auth });
     } else {
         try {
diff --git a/routes/projects.js b/routes/projects.js
@@ -250,6 +250,12 @@ router.delete('/project/:id', async function (req, res) {
         return res.status(401).send({ message: 'Not authorized' });
     }
 
+    let users_in_project = await dbsrv.mongo_users().find({ projects: req.params.id }).toArray();
+
+    if (users_in_project.length > 0){
+        return res.status(403).send({ message: 'Project is not empty. Cannot remove' });
+    }
+
     try {
         await prjsrv.remove_project(req.params.id, user.uid);
     } catch (e) {
@@ -325,16 +331,26 @@ router.post('/project/:id/request/user', async function (req, res) {
     if (!sansrv.sanitizeAll([req.params.id])) {
         return res.status(403).send({ message: 'Invalid parameters' });
     }
-    let user = await dbsrv.mongo_users().findOne({ _id: req.locals.logInfo.id });
-    if (!user) {
+
+    let session_user = null;
+    let isadmin = false;
+    try {
+        session_user = await dbsrv.mongo_users().findOne({ _id: req.locals.logInfo.id });
+        isadmin = await rolsrv.is_admin(session_user);
+    } catch (e) {
+        logger.error(e);
+        return res.status(404).send({ message: 'User session not found' });
+    }
+
+    if (!session_user) {
         return res.status(404).send({ message: 'User not found' });
     }
     let project = await dbsrv.mongo_projects().findOne({ id: req.params.id });
     if (!project) {
         return res.status(404).send({ message: 'Project ' + req.params.id + ' not found' });
     }
-    if ((!project.managers || !project.managers.includes(user.uid)) && user.uid !== project.owner && !user.is_admin) {
-        return res.status(401).send({ message: 'User ' + user.uid + ' is not project manager for project ' + project.id });
+    if ((!project.managers || !project.managers.includes(session_user.uid)) && session_user.uid !== project.owner && !isadmin) {
+        return res.status(401).send({ message: 'User ' + session_user.uid + ' is not project manager for project ' + project.id });
     }
     if (req.body.user == project.owner) {
         return res.status(403).send({ message: 'User ' + req.body.user + ' is the owner of project ' + project.id });
@@ -349,9 +365,9 @@ router.post('/project/:id/request/user', async function (req, res) {
 
     try {
         if (req.body.request === 'add') {
-            await usrsrv.add_user_to_project(project.id, req.body.user, user.uid);
+            await usrsrv.add_user_to_project(project.id, req.body.user, session_user.uid);
         } else if (req.body.request === 'remove') {
-            await usrsrv.remove_user_from_project(project.id, req.body.user, user.uid, user.is_admin, false);
+            await usrsrv.remove_user_from_project(project.id, req.body.user, session_user.uid, isadmin, false);
         }
     } catch (e) {
         logger.error(e);
@@ -369,19 +385,30 @@ router.post('/project/:id/add/manager/:uid', async function(req, res) {
     if (!req.locals.logInfo.is_logged) {
         return res.status(401).send({ message: 'Not authorized' });
     }
-    if (!sansrv.sanitizeAll([req.params.id])) {
+    if (!sansrv.sanitizeAll([req.params.id]) || !sansrv.sanitizeAll([req.params.uid])) {
         return res.status(403).send({ message: 'Invalid parameters' });
     }
-    let user = await dbsrv.mongo_users().findOne({ _id: req.locals.logInfo.id });
-    if (!user) {
+
+    let session_user = null;
+    let isadmin = false;
+    try {
+        session_user = await dbsrv.mongo_users().findOne({ _id: req.locals.logInfo.id });
+        isadmin = await rolsrv.is_admin(session_user);
+    } catch (e) {
+        logger.error(e);
+        return res.status(404).send({ message: 'User session not found' });
+    }
+
+    if (!session_user) {
         return res.status(404).send({ message: 'User not found' });
     }
+
     let project = await dbsrv.mongo_projects().findOne({ 'id': req.params.id });
     if (!project) {
         return res.status(404).send({ message: 'Project ' + req.params.id + ' not found' });
     }
-    if (user.uid != project.owner && !user.is_admin) {
-        return res.status(401).send({ message: 'Non-admin user ' + user.uid + ' is not the owner of project ' + project.id });
+    if (session_user.uid != project.owner && !isadmin) {
+        return res.status(401).send({ message: 'Non-admin user ' + session_user.uid + ' is not the owner of project ' + project.id });
     }
     const new_manager = await dbsrv.mongo_users().findOne({ 'uid': req.params.uid });
     if (!new_manager) {
@@ -416,19 +443,30 @@ router.post('/project/:id/remove/manager/:uid', async function(req, res) {
     if (!req.locals.logInfo.is_logged) {
         return res.status(401).send({ message: 'Not authorized' });
     }
-    if (!sansrv.sanitizeAll([req.params.id])) {
+    if (!sansrv.sanitizeAll([req.params.id]) || !sansrv.sanitizeAll([req.params.uid])) {
         return res.status(403).send({ message: 'Invalid parameters' });
     }
-    let user = await dbsrv.mongo_users().findOne({ _id: req.locals.logInfo.id });
-    if (!user) {
+
+    let session_user = null;
+    let isadmin = false;
+    try {
+        session_user = await dbsrv.mongo_users().findOne({ _id: req.locals.logInfo.id });
+        isadmin = await rolsrv.is_admin(session_user);
+    } catch (e) {
+        logger.error(e);
+        return res.status(404).send({ message: 'User session not found' });
+    }
+
+    if (!session_user) {
         return res.status(404).send({ message: 'User not found' });
     }
+
     let project = await dbsrv.mongo_projects().findOne({ 'id': req.params.id });
     if (!project) {
         return res.status(404).send({ message: 'Project ' + req.params.id + ' not found' });
     }
-    if (user.uid != project.owner && !user.is_admin) {
-        return res.status(401).send({ message: 'Non-admin user ' + user.uid + ' is not the owner of project ' + project.id });
+    if (session_user.uid != project.owner && !isadmin) {
+        return res.status(401).send({ message: 'Non-admin user ' + session_user.uid + ' is not the owner of project ' + project.id });
     }
     const ex_manager = await dbsrv.mongo_users().findOne({ 'uid': req.params.uid });
     if (!ex_manager) {
diff --git a/routes/users.js b/routes/users.js
@@ -693,9 +693,19 @@ router.post('/user/:id', async function (req, res) {
     if (req.body.firstname == '' || req.body.firstname === null || req.body.firstname === undefined) {
         return res.send({ status: 1, message: 'Missing field: firstname' });
     }
+
+    if (!req.body.firstname.match(/^[a-zA-Zà-ü -']+$/)) {
+        return res.send({ status: 1, message: 'Firstname contains unauthorized characters' });
+    }
+
     if (req.body.lastname == '' || req.body.lastname === null || req.body.lastname === undefined) {
         return res.send({ status: 1, message: 'Missing field: lastname' });
     }
+
+    if (!req.body.lastname.match(/^[a-zA-Zà-ü -']+$/)) {
+        return res.send({ status: 1, message: 'Lastname contains unauthorized characters' });
+    }
+
     if (req.body.team == '' || req.body.team === null || req.body.team === undefined) {
         return res.send({ status: 1, message: 'Missing field: team' });
     }
@@ -1633,7 +1643,7 @@ router.delete('/user/:id/project/:project', async function (req, res) {
     }
     let oldproject = req.params.project;
     let uid = req.params.id;
-    let force = req.query.force ? true : false;
+
 
     let session_user = null;
     let isadmin = false;
@@ -1647,6 +1657,9 @@ router.delete('/user/:id/project/:project', async function (req, res) {
         return res.status(404).send({ message: 'User session not found' });
     }
 
+    // Force is restricted to admins
+    let force = req.query.force && isadmin;
+
     if (!session_user) {
         return res.status(404).send({ message: 'User session not found' });
     }
diff --git a/test/my.js b/test/my.js
@@ -133,8 +133,8 @@ describe('My', () => {
             chai.request('http://localhost:3000')
                 .post('/user/' + test_user_id2)
                 .send({
-                    'firstname': 'ftest2',
-                    'lastname': 'ltest2',
+                    'firstname': 'ftestt',
+                    'lastname': 'ltestt',
                     'email': test_user_id2 + '@my.org',
                     'address': 'test address',
                     'lab': 'test',
@@ -583,7 +583,7 @@ describe('My', () => {
                 create: true
 
             };
-            
+
             chai.request('http://localhost:3000')
                 .post('/database/create/' + test_db_id)
                 .set('X-Api-Key', token_id)
@@ -594,7 +594,7 @@ describe('My', () => {
                         .get('/database')
                         .set('X-Api-Key', token_id)
                         .end((err, res) => {
-  
+
                             expect(res).to.have.status(200);
                             let found = false;
                             for(let i=0; i<res.body.length; i++){
@@ -743,7 +743,7 @@ describe('My', () => {
                 single_user: true,
                 create: true
             };
-            
+
             chai.request('http://localhost:3000')
                 .post('/database/create/' + db.name)
                 .set('X-Api-Key', user_token_id)
@@ -754,7 +754,7 @@ describe('My', () => {
                 });
         });
 
-       
+
         it('User delete database', (done) => {
             chai.request('http://localhost:3000')
                 .delete('/database/' + test_db_id)

Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,7 @@ export class ProjectsComponent implements OnInit {`
`51`	`51`	`}`
`52`	`52`
`53`	`53`	`remove_from_project(project_id) {`
`54`		`- this.userService.removeFromProject(this.user.uid, project_id).subscribe(`
	`54`	`+ this.userService.removeFromProject(this.user.uid, project_id, false).subscribe(`
`55`	`55`	`(resp) => {`
`56`	`56`	`this.remove_from_project_msg = resp['message'];`
`57`	`57`	`let tmpproject = [];`
Original file line number	Diff line number	Diff line change
`@@ -860,7 +860,7 @@ export class UserComponent implements OnInit {`
`860`	`860`	`}`
`861`	`861`
`862`	`862`	`remove_from_project(project_id) {`
`863`		`- this.userService.removeFromProject(this.user.uid, project_id).subscribe(`
	`863`	`+ this.userService.removeFromProject(this.user.uid, project_id, false).subscribe(`
`864`	`864`	`(resp) => {`
`865`	`865`	`this.remove_from_project_msg = resp['message'];`
`866`	`866`	`var tmp_project: any[] = [];`