Skip to content

Commit 6ac4e25

Browse files
timrobertsusatimrobertsusa
authored
Merge pull request #91 from pappyangel/SQLInjection
Sql injection
2 parents aca453e + c4900df commit 6ac4e25

8 files changed

+62
-26
lines changed

‎.github/workflows/BuildDeploy-API.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ jobs:
3131
uses: Azure/[email protected]
3232
with:
3333
publish-profile: ${{ secrets.COCKTAIL_API_MCAPS_F25_PUBLISH_PROFILE }}
34+
clean: true
3435
# Enter an existing Slot other than the Production slot
3536
#slot-name: # optional, default is production
3637
# Applies to Web App only: Path to package or folder. *.zip, *.war, *.jar or a folder to deploy

‎.github/workflows/BuildDeploy-Frontend.yaml

+24-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: BuildDeploy FrontEnd
22

3+
env:
4+
APP_FOLDER_PATH: frontend
5+
36
on:
47
push:
58
branches: main
@@ -15,14 +18,31 @@ jobs:
1518

1619
steps:
1720
- name: Check out source code
18-
uses: actions/checkout@v4
21+
uses: actions/checkout@v4
22+
23+
- name: Get DateTime
24+
run: echo "RUN_DT=$(TZ='America/New_York' date +'%m/%d/%Y %I:%M %p')" >> $GITHUB_ENV
25+
26+
- name: Print vars
27+
run: |
28+
echo ${{env.APP_FOLDER_PATH}}
29+
echo "The date time for this run was: ${{env.RUN_DT}}"
30+
31+
- name: update build number from GH Action
32+
uses: TomaszKandula/[email protected]
33+
with:
34+
files: '${{env.APP_FOLDER_PATH}}/appsettings.json'
35+
env:
36+
DeploymentDate: ${{env.RUN_DT}}
37+
38+
1939
- name: Setup .NET
2040
uses: actions/setup-dotnet@v4
2141
with:
2242
dotnet-version: 8.0.x
2343
- name: Restore, Build, Test, Publish
2444
run: |
25-
cd frontend
45+
cd ${{env.APP_FOLDER_PATH}}
2646
dotnet restore
2747
dotnet build --no-restore
2848
dotnet test --no-build --verbosity normal
@@ -32,7 +52,8 @@ jobs:
3252
uses: Azure/[email protected]
3353
with:
3454
#app-name: 'Cocktail-Frontend'
35-
publish-profile: ${{ secrets.COCKTAIL_FRONTEND_MCAPS_F25_PUBLISH_PROFILE }}
55+
publish-profile: ${{ secrets.COCKTAIL_FRONTEND_MCAPS_F25_PUBLISH_PROFILE }}
56+
clean: true
3657
# Enter an existing Slot other than the Production slot
3758
#slot-name: prod2
3859
# Applies to Web App only: Path to package or folder. *.zip, *.war, *.jar or a folder to deploy

‎.vscode/launch.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"type": "coreclr",
1010
"request": "launch",
1111
"preLaunchTask": "build Frontend",
12-
"program": "${workspaceFolder}/frontend/bin/Debug/net7.0/frontend.dll",
12+
"program": "${workspaceFolder}/frontend/bin/Debug/net8.0/frontend.dll",
1313
"args": [],
1414
"cwd": "${workspaceFolder}/frontend",
1515
"stopAtEntry": false,

‎README.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
# dev branch notes for SQL Injection protection 8-2024
2+
- updated Index page to display for new environment and date information
3+
- Update & Insert SQL to use parameterized values
4+
- updated config to use AppSettingsDevelopment so when in dev, dev config is auto used, when in prod, prod config auto used
5+
- Added clean: true to workflow
6+
17

28
# dev branch notes for MCAPS Deployment 7-2024
39
Added default NoImage.jpg to ddl in Database items table

‎frontend/Pages/EditCocktail.cshtml

+14-9
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,21 @@
44
ViewData["Title"] = "Edit Cocktails Page";
55

66
var srcContent ="~/images/";
7+
var userImageName = "";
78

89
@* + (Model.cocktailToEdit.ImagePath ?? "NoImage.jpg"); *@
910

1011
if (Model.cocktailToEdit.ImagePath is null)
11-
srcContent = srcContent + "NoImage.jpg";
12+
srcContent = srcContent + "NoImageSelected.png";
1213
else
1314
if (Model.cocktailToEdit.ImagePath == "")
14-
srcContent = srcContent + "NoImage.jpg";
15+
srcContent = srcContent + "NoImageSelected.png";
1516
else
17+
{
1618
srcContent = srcContent + Model.cocktailToEdit.ImagePath;
17-
18-
19-
20-
21-
19+
userImageName = Model.cocktailToEdit.ImagePath.Substring(37);
20+
}
21+
2222
}
2323

2424

@@ -34,11 +34,15 @@
3434
we need when we submit the form*@
3535
@* <input hidden asp-for="cocktailToEdit.Id" /> *@
3636
@* <input readonly asp-for="cocktailToEdit.Id" /> *@
37+
38+
39+
<input type="hidden" readonly asp-for="cocktailToEdit.ImagePath" class="form-control">
40+
3741
<div class="form-group row">
3842
<label asp-for="cocktailToEdit.Id" class="col-sm-2 col-form-label">
3943
</label>
4044
<div class="col-sm-10">
41-
<input readonly asp-for="cocktailToEdit.Id" class="form-control" placeholder="Bobo">
45+
<input readonly asp-for="cocktailToEdit.Id" class="form-control" >
4246
</div>
4347
</div>
4448

@@ -71,7 +75,8 @@
7175
@*Photo property type is IFormFile, so ASP.NET Core
7276
automatically creates a FileUpload control *@
7377
<input asp-for="ctImage" class="custom-file-input form-control">
74-
<label class="custom-file-label">Click here to change image</label>
78+
@* <label class="custom-file-label">Click here to change image</label> *@
79+
<label class="custom-file-label">@userImageName</label>
7580
</div>
7681
</div>
7782
</div>

‎frontend/Pages/Index.cshtml

+12-10
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,21 @@
55
}
66

77
<div class="text-center">
8-
<h1 class="display-4">Cocktails Application</h1>
9-
<p>Production Release</p>
10-
<p>July 2024</p>
8+
<h1 class="display-4">Cocktails Application</h1>
9+
<p>
10+
<environment include="Development">
11+
<div>Development Environment</div>
12+
</environment>
13+
14+
<environment exclude="Development">
15+
<div>Production Environment</div>
16+
</environment>
17+
</p>
18+
<p>Deployment Date: @Model.envDeploymentDate</p>
1119
<p><a href="https://cocktail-api.azurewebsites.net/cocktails">Hit the API directly!</a></p>
1220
</div>
1321

14-
<environment include="Development">
15-
<div>Environment is Development</div>
16-
</environment>
1722

18-
<environment exclude="Development">
19-
<div>Environment is NOT Development</div>
20-
</environment>
2123

2224
@* <div> Environment: @Model.envEnvironment </div>
23-
<div> API Url: @Model.envAPIProductionUrl </div> *@
25+
<div> API Url: @Model.envDeploymentDate </div> *@

‎frontend/Pages/Index.cshtml.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ public class IndexModel : PageModel
1414
private readonly ILogger<IndexModel> _logger;
1515
private readonly IConfiguration _config;
1616
public string envEnvironment { get; set; }
17-
public string envAPIProductionUrl { get; set; }
17+
public string envDeploymentDate { get; set; }
1818

1919
public IndexModel(ILogger<IndexModel> logger, IConfiguration config)
2020
{
@@ -25,7 +25,7 @@ public IndexModel(ILogger<IndexModel> logger, IConfiguration config)
2525
public void OnGet()
2626
{
2727
envEnvironment = Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT");
28-
envAPIProductionUrl = _config["APIProductionUrl"];
28+
envDeploymentDate = _config["DeploymentDate"];
2929

3030
}
3131
}

‎frontend/appsettings.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,6 @@
99
"AllowedHosts": "*",
1010
"APIProductionUrl":"https://cocktail-api.azurewebsites.net/cocktails",
1111
"FY25-APIProductionUrl": "https://cocktail-api.azurewebsites.net/cocktails",
12-
"Dev-APIUrl": "http://127.0.0.1:5000/cocktails"
12+
"Dev-APIUrl": "http://127.0.0.1:5000/cocktails",
13+
"DeploymentDate": "08/10/2024 10:24 AM"
1314
}

0 commit comments

Comments
 (0)