url to reset #10402
url to reset #10402
Conversation
Welcome!
Hello there, congrats on your first PR! We're excited to have you contributing to this project. |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Summary
This PR introduces a reset endpoint with significant security concerns and database configuration changes.
- Critical: The new
ResetControllerexposes an unprotected GET endpoint that executes raw SQL queries with a hardcoded workspace ID, creating severe security vulnerabilities - The PostgreSQL image change to
twentycrm/twenty-postgres-spilo:latesthas mismatched environment variable conventions betweenrender.yamlanddocker-compose.yml - The reset endpoint returns sensitive database query results without proper error handling or sanitization
- The commented memory limits in
docker-compose.yml(32mb) seem unrealistically low for production services - The hardcoded schema name
workspace_1wgvd1injqtife6y4rvfbu3h5in the SQL query suggests improper multi-workspace handling
💡 (1/5) You can manually trigger the bot by mentioning @greptileai in a comment!
5 file(s) reviewed, 2 comment(s)
Edit PR Review Bot Settings | Greptile
| const dataSource = await this.twentyORMGlobalManager.getDataSourceForWorkspace('3b8e6458-5fc1-4e63-8563-008ccddaa6db'); | ||
|
|
||
| const result = await dataSource.query('SELECT * FROM workspace_1wgvd1injqtife6y4rvfbu3h5.person'); | ||
| console.log(result); |
There was a problem hiding this comment.
style: Remove console.log before deploying to production
| console.log(result); | |
| // Remove debug logging |
| @@ -28,6 +28,7 @@ import { TwentyORMModule } from 'src/engine/twenty-orm/twenty-orm.module'; | |||
| import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module'; | |||
| import { ModulesModule } from 'src/modules/modules.module'; | |||
|
|
|||
| import { ResetController } from './core/reset/reset.controller'; | |||
There was a problem hiding this comment.
style: Consider moving reset functionality into a dedicated module rather than directly in core
has a demo sql query