diff --git a/routes/middlewares/SecurityChecker.js b/routes/middlewares/SecurityChecker.js index 8810423..93fad31 100755 --- a/routes/middlewares/SecurityChecker.js +++ b/routes/middlewares/SecurityChecker.js @@ -9,6 +9,7 @@ */ 'use strict'; const crypto = require('crypto'); +const _ = require('lodash'); const logger = require('../../utils/logger'); const Project = require('../../models').Project; const dbHelper = require('../../utils/db-helper'); @@ -17,17 +18,24 @@ module.exports = (provider) => async (req, res, next) => { let isValid = false; const params = req.body; if (provider === 'github') { - const projectDetail = await dbHelper.scanOne(Project, { + const projectDetails = await dbHelper.scan(Project, { repoUrl: params.repository.html_url }); - - const hash = crypto.createHmac('sha1', projectDetail.secretWebhookKey).update(req.rawBody).digest('hex'); - isValid = `sha1=${hash}` === req.header('X-Hub-Signature'); + _.forEach(projectDetails, (projectDetail) => { + const hash = crypto.createHmac('sha1', projectDetail.secretWebhookKey).update(req.rawBody).digest('hex'); + if (`sha1=${hash}` === req.header('X-Hub-Signature')) { + isValid = true; + } + }); } else if (provider === 'gitlab') { - const projectDetail = await dbHelper.scanOne(Project, { + const projectDetails = await dbHelper.scan(Project, { repoUrl: params.project.web_url }); - isValid = projectDetail.secretWebhookKey === req.header('X-Gitlab-Token'); + _.forEach(projectDetails, (projectDetail) => { // eslint-disable-line lodash/prefer-filter + if (projectDetail.secretWebhookKey === req.header('X-Gitlab-Token')) { + isValid = true; + } + }); } else { // unknown provider return next(); diff --git a/utils/db-helper.js b/utils/db-helper.js index 217440f..db8c0f7 100644 --- a/utils/db-helper.js +++ b/utils/db-helper.js @@ -17,7 +17,7 @@ */ async function scan(model, scanParams) { return await new Promise((resolve, reject) => { - model.scan(scanParams).exec((err, result) => { + model.scan(scanParams).consistent().all().exec((err, result) => { if (err) { reject(err); } @@ -34,7 +34,7 @@ async function scan(model, scanParams) { */ async function scanOne(model, scanParams) { return await new Promise((resolve, reject) => { - model.scan(scanParams).exec((err, result) => { + model.scan(scanParams).consistent().all().exec((err, result) => { if (err) { reject(err); }