Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DiIpreet | Test | White label Task #14302

Open
wants to merge 1 commit into
base: giddh-2.0
Choose a base branch
from
Open

DiIpreet | Test | White label Task #14302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 94 additions & 2 deletions apps/web-giddh/src/app/app.module.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import { APP_BASE_HREF } from '@angular/common';
import { HTTP_INTERCEPTORS, HttpClientModule } from '@angular/common/http';
import { ErrorHandler, NgModule } from '@angular/core';
import { APP_INITIALIZER, ErrorHandler, NgModule } from '@angular/core';
import { FormsModule, ReactiveFormsModule } from '@angular/forms';
import { BrowserModule } from '@angular/platform-browser';
import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
Expand Down Expand Up @@ -73,6 +73,93 @@ if (giddhRegion === "UK") {
localStorage.setItem("Country-Region", "GL");
}

// Temporary config object
const tempConfig = {
"status": "success",
"body": {
"googleClientId": "641015054140-uj0d996itggsesgn4okg09jtn8mp0omu.apps.googleusercontent.com",
"googleClientSecret": "8htr7iQVXfZp_n87c99-jm7a",
"otpWidgetId": "33686b716134333831313239",
"otpWidgetToken": "205968TmXguUAwoD633af103P1",
Comment on lines +80 to +83
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Critical security issue: Hard-coded sensitive credentials

The tempConfig object contains hard-coded sensitive information such as googleClientId, googleClientSecret, otpWidgetId, and otpWidgetToken. Including API keys and secrets directly in the codebase is a significant security risk, as it can lead to unauthorized access if the source code is exposed.

I strongly recommend removing these hard-coded credentials from the code. Instead, store them securely using environment variables or a secrets management service, and retrieve them at runtime.

🧰 Tools
🪛 Gitleaks (8.21.2)

81-81: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

83-83: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

"giddhWhiteLabel": {
"companyName": "Giddh",
"domainName": "test.giddh.com",
"apiDomainName": "apitest.giddh.com",
"adminDomainName": "vtest.giddh.com",
"archiveStatus": "UNARCHIVED",
"portalDomainName": "master.d2n1i21e52r793.amplifyapp.com",
"supportedDomains": [
"localhost",
"stage.giddh.com",
"vtest.giddh.com",
"test.giddh.com"
]
}
}
};

// Set temporary cookie
function setTempCookie() {
const cookieValue = encodeURIComponent(JSON.stringify(tempConfig));
document.cookie = `giddh_config=${cookieValue}; path=/`;
}

// Simple function to get cookie config
function getCookieConfig() {
// Set temporary cookie if it doesn't exist
if (!document.cookie.includes('giddh_config=')) {
setTempCookie();
}

try {
const cookie = document.cookie
.split('; ')
.find(row => row.startsWith('giddh_config='));
return cookie ? JSON.parse(decodeURIComponent(cookie.split('=')[1])) : null;
} catch (e) {
console.error('Error parsing cookie:', e);
return null;
}
}

// Function to update environment variables
function initializeEnvironment(): () => void {
return () => {
const config = getCookieConfig()?.body;
console.log('config',config);
if (config) {
// Update all environment variables at once
const envUpdates = {
'AppUrl': `https://${config.giddhWhiteLabel.domainName}/`,
'ApiUrl': `https://${config.giddhWhiteLabel.apiDomainName}/`,
'GOOGLE_CLIENT_ID': config.googleClientId,
'GOOGLE_CLIENT_SECRET': config.googleClientSecret,
'OTP_WIDGET_ID': config.otpWidgetId,
'OTP_TOKEN_AUTH': config.otpWidgetToken,
'PORTAL_URL': `https://${config.giddhWhiteLabel.portalDomainName}/`
};

// Update both window and process.env variables
Object.entries(envUpdates).forEach(([key, value]) => {
(window as any)[key] = value;
(window as any)[`process.env.${key}`] = value;
});
}
};
}

// Function to create service config
function createServiceConfig() {
const config = getCookieConfig()?.body;
return {
apiUrl: config?.giddhWhiteLabel?.apiDomainName
? `https://${config.giddhWhiteLabel.apiDomainName}/`
: Configuration.ApiUrl,
appUrl: config?.giddhWhiteLabel?.domainName
? `https://${config.giddhWhiteLabel.domainName}/`
: Configuration.AppUrl
};
}
/**
* `AppModule` is the main entry point into Angular2's bootstraping process
*/
Expand Down Expand Up @@ -124,9 +211,14 @@ if (giddhRegion === "UK") {
environment.ENV_PROVIDERS,
APP_PROVIDERS,
WindowRef,
{
provide: APP_INITIALIZER,
useFactory: initializeEnvironment,
multi: true
},
{
provide: ServiceConfig,
useValue: { apiUrl: localStorage.getItem('Country-Region') === 'GB' ? Configuration.UkApiUrl : Configuration.ApiUrl, appUrl: Configuration.AppUrl, _ }
useFactory: createServiceConfig
},
{
provide: HTTP_INTERCEPTORS,
Expand Down
4 changes: 3 additions & 1 deletion apps/web-giddh/src/app/home/home.component.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,10 @@ export class HomeComponent implements OnInit, OnDestroy {
}

public ngOnInit() {
console.log(ApiUrl, GOOGLE_CLIENT_ID);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Avoid logging sensitive information to the console

The console.log(ApiUrl, GOOGLE_CLIENT_ID); statement logs potentially sensitive information. Logging API endpoints and client IDs can expose configuration details in production environments.

Consider removing this console log or ensuring it's only used in a development environment.

Apply this diff:

- console.log(ApiUrl, GOOGLE_CLIENT_ID);


this.companyUniqueName = this.generalService.companyUniqueName;

this.needsToRedirectToLedger$.pipe(take(1)).subscribe(result => {
if (result) {
this.accountService.getFlattenAccounts('', '').pipe(takeUntil(this.destroyed$)).subscribe(data => {
Expand Down
24 changes: 12 additions & 12 deletions apps/web-giddh/webpack.partial.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@ module.exports = {
'isElectron': JSON.stringify(false),
'errlyticsNeeded': JSON.stringify(false),
'errlyticsKey': JSON.stringify(''),
'AppUrl': JSON.stringify('http://localhost:3000/'),
'ApiUrl': JSON.stringify('https://apitest.giddh.com/'),
'AppUrl': 'window.APP_URL || ' + JSON.stringify('http://localhost:3000/'),
'ApiUrl': 'window.API_URL || ' + JSON.stringify('https://apitest.giddh.com/'),
'UkApiUrl': JSON.stringify('https://gbapi.giddh.com/'),
'PORTAL_URL': JSON.stringify('https://master.d2n1i21e52r793.amplifyapp.com/'),
'APP_FOLDER': JSON.stringify(''),
Expand All @@ -21,26 +21,26 @@ module.exports = {
'TEST_ENV': JSON.stringify(false),
'LOCAL_ENV': JSON.stringify(true),
'enableVoucherAdjustmentMultiCurrency': JSON.stringify(true),
'GOOGLE_CLIENT_ID': JSON.stringify(process.env.GOOGLE_CLIENT_ID_TEST),
'GOOGLE_CLIENT_SECRET': JSON.stringify(process.env.GOOGLE_CLIENT_SECRET_TEST),
'GOOGLE_CLIENT_ID': 'window.GOOGLE_CLIENT_ID || ' + JSON.stringify(process.env.GOOGLE_CLIENT_ID_TEST),
'GOOGLE_CLIENT_SECRET': 'window.GOOGLE_CLIENT_SECRET || ' + JSON.stringify(process.env.GOOGLE_CLIENT_SECRET_TEST),
'OTP_WIDGET_ID': 'window.OTP_WIDGET_ID || ' + JSON.stringify(process.env.OTP_WIDGET_ID),
'OTP_TOKEN_AUTH': 'window.OTP_TOKEN_AUTH || ' + JSON.stringify(process.env.OTP_TOKEN_AUTH),
'RAZORPAY_KEY': JSON.stringify(process.env.RAZORPAY_KEY_TEST),
'FROALA_EDITOR_KEY': JSON.stringify(process.env.FROALA_EDITOR_KEY),
'OTP_WIDGET_ID': JSON.stringify(process.env.OTP_WIDGET_ID),
'OTP_TOKEN_AUTH': JSON.stringify(process.env.OTP_TOKEN_AUTH),
'process.env.enableVoucherAdjustmentMultiCurrency': JSON.stringify(true),
'process.env.GOOGLE_CLIENT_ID': JSON.stringify(process.env.GOOGLE_CLIENT_ID_TEST),
'process.env.GOOGLE_CLIENT_SECRET': JSON.stringify(process.env.GOOGLE_CLIENT_SECRET_TEST),
'process.env.GOOGLE_CLIENT_ID': 'window["process.env.GOOGLE_CLIENT_ID"] || ' + JSON.stringify(process.env.GOOGLE_CLIENT_ID_TEST),
'process.env.GOOGLE_CLIENT_SECRET': 'window["process.env.GOOGLE_CLIENT_SECRET"] || ' + JSON.stringify(process.env.GOOGLE_CLIENT_SECRET_TEST),
'process.env.OTP_WIDGET_ID': 'window["process.env.OTP_WIDGET_ID"] || ' + JSON.stringify(process.env.OTP_WIDGET_ID),
'process.env.OTP_TOKEN_AUTH': 'window["process.env.OTP_TOKEN_AUTH"] || ' + JSON.stringify(process.env.OTP_TOKEN_AUTH),
'process.env.RAZORPAY_KEY': JSON.stringify(process.env.RAZORPAY_KEY_TEST),
'process.env.FROALA_EDITOR_KEY': JSON.stringify(process.env.FROALA_EDITOR_KEY),
'process.env.OTP_WIDGET_ID': JSON.stringify(process.env.OTP_WIDGET_ID),
'process.env.OTP_TOKEN_AUTH': JSON.stringify(process.env.OTP_TOKEN_AUTH),
'process.env.ENV': JSON.stringify('development'),
'process.env.NODE_ENV': JSON.stringify('development'),
'process.env.isElectron': JSON.stringify(false),
'process.env.errlyticsNeeded': JSON.stringify(false),
'process.env.errlyticsKey': JSON.stringify(''),
'process.env.AppUrl': JSON.stringify('http://localhost:3000/'),
'process.env.ApiUrl': JSON.stringify('https://apitest.giddh.com/'),
'process.env.AppUrl': 'window["process.env.AppUrl"] || ' + JSON.stringify('http://localhost:3000/'),
'process.env.ApiUrl': 'window["process.env.ApiUrl"] || ' + JSON.stringify('https://apitest.giddh.com/'),
'process.env.UkApiUrl': JSON.stringify('https://gbapi.giddh.com/'),
'process.PORTAL_URL': JSON.stringify('https://master.d2n1i21e52r793.amplifyapp.com/'),
'process.env.APP_FOLDER': JSON.stringify('')
Expand Down
46 changes: 46 additions & 0 deletions tools/web/postbuild.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,25 @@ for (var i = 0; i < process.argv.length; i++) {
}

const versionFilePath = path.join(__dirname, rootDirectiory, 'version.json');
const indexFilePath = path.join(__dirname, rootDirectiory, 'index.html');
const newIndexFilePath = path.join(__dirname, rootDirectiory, 'index.php');

// Add PHP script to be inserted at the beginning
const phpScript = `<?php
$apiUrl = "https://apitest.giddh.com/white-label";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $apiUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
if ($response === false) {
echo "Error: " . curl_error($ch);
} else {
$data = json_decode($response, true);
}
print_r($data);
curl_close($ch);
?>
`;

let mainHash = '';
let mainBundleFile = '';
Expand All @@ -45,6 +64,7 @@ readDir(path.join(__dirname, rootDirectiory))
}

console.log(`Writing version and hash to ${versionFilePath}`);
console.log(`Index ${indexFilePath}`);

// write current version and hash into the version.json file
const src = `{"version": "${appVersion}", "hash": "${mainHash}"}`;
Expand All @@ -64,6 +84,32 @@ readDir(path.join(__dirname, rootDirectiory))
const replacedFile = mainFileData.replace('{{POST_BUILD_ENTERS_HASH_HERE}}', mainHash);
return writeFile(mainFilepath, replacedFile);
});
}).then(() => {
// Read index.html and convert to PHP
console.log('Converting index.html to index.php...');
return readFile(indexFilePath, 'utf8')
.then(indexContent => {
// Combine PHP script with existing HTML content
const newContent = phpScript + indexContent;

// Write the new index.php file
return writeFile(newIndexFilePath, newContent)
.then(() => {
console.log('Successfully created index.php');
// Delete the original index.html
return new Promise((resolve, reject) => {
fs.unlink(indexFilePath, (err) => {
if (err) {
console.log('Error deleting index.html:', err);
reject(err);
} else {
console.log('Successfully deleted index.html');
resolve();
}
});
});
});
});
}).catch(err => {
console.log('Error with post build:', err);
});