Skip to content

Commit 8448178

Browse files
folathecoderfolathecoder
committed
Fixed security issues in services
1 parent 05af765 commit 8448178

17 files changed

+753
-740
lines changed

‎Controllers/AuthController.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ public AuthController(UserService userService, AuthService authService)
2020
_userService = userService;
2121
_authService = authService;
2222
}
23-
23+
2424

2525
[HttpPost("register")]
2626
[ProducesResponseType(typeof(SignInResponseDto), 201)]
@@ -40,8 +40,8 @@ public async Task<IActionResult> Register(SignInRegisterDto regDto)
4040
token = _authService.GenerateToken(user),
4141
};
4242
return Ok(res);
43-
}
44-
43+
}
44+
4545
var newUser = new User
4646
{
4747
userName = regDto.userName,

‎Controllers/CategoryController.cs‎

Lines changed: 51 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -13,73 +13,73 @@ namespace MARKETPLACEAPI.Controllers;
1313
[Route("api/categories/[controller]")]
1414
public class CategoryController : ControllerBase
1515
{
16-
private readonly CategoryService _categoryService;
16+
private readonly CategoryService _categoryService;
1717

18-
public CategoryController(CategoryService categoryService) =>
19-
_categoryService = categoryService;
18+
public CategoryController(CategoryService categoryService) =>
19+
_categoryService = categoryService;
2020

21-
[HttpGet]
22-
public async Task<List<Category>> Get() =>
23-
await _categoryService.GetAsync();
21+
[HttpGet]
22+
public async Task<List<Category>> Get() =>
23+
await _categoryService.GetAsync();
2424

25-
[HttpGet("{id:length(24)}")]
26-
public async Task<ActionResult<Category>> Get(string id, [FromHeader] string userId)
27-
{
28-
var category = await _categoryService.GetAsync(id);
29-
30-
if (category is null)
31-
{
32-
return NotFound();
33-
}
25+
[HttpGet("{id:length(24)}")]
26+
public async Task<ActionResult<Category>> Get(string id, [FromHeader] string userId)
27+
{
28+
var category = await _categoryService.GetAsync(id);
3429

35-
return category;
30+
if (category is null)
31+
{
32+
return NotFound();
3633
}
3734

38-
[HttpPost]
35+
return category;
36+
}
3937

40-
public async Task<IActionResult> Post(CategoryCreateDto newCategory)
41-
{
42-
var category = new Category
43-
{
44-
categoryName = newCategory.categoryName,
45-
categoryDescription = newCategory.categoryDescription,
46-
};
47-
await _categoryService.CreateAsync(category);
48-
49-
return CreatedAtAction(nameof(Get), new { id = category.categoryId }, category);
50-
}
38+
[HttpPost]
5139

52-
[HttpPatch("{id:length(24)}")]
53-
public async Task<IActionResult> Update(string id, CategoryUpdateDto updatedCategory)
40+
public async Task<IActionResult> Post(CategoryCreateDto newCategory)
41+
{
42+
var category = new Category
5443
{
55-
var category = await _categoryService.GetAsync(id);
56-
57-
if (category is null)
58-
{
59-
return NotFound();
60-
}
44+
categoryName = newCategory.categoryName,
45+
categoryDescription = newCategory.categoryDescription,
46+
};
47+
await _categoryService.CreateAsync(category);
6148

62-
category.categoryName = updatedCategory.categoryName;
63-
category.categoryDescription = updatedCategory.categoryDescription;
64-
category.updatedAt = DateTime.UtcNow;
49+
return CreatedAtAction(nameof(Get), new { id = category.categoryId }, category);
50+
}
6551

66-
await _categoryService.UpdateAsync(id, category);
52+
[HttpPatch("{id:length(24)}")]
53+
public async Task<IActionResult> Update(string id, CategoryUpdateDto updatedCategory)
54+
{
55+
var category = await _categoryService.GetAsync(id);
6756

68-
return NoContent();
57+
if (category is null)
58+
{
59+
return NotFound();
6960
}
7061

71-
[HttpDelete("{id:length(24)}")]
72-
public async Task<IActionResult> Delete(string id)
73-
{
74-
var category = await _categoryService.GetAsync(id);
62+
category.categoryName = updatedCategory.categoryName;
63+
category.categoryDescription = updatedCategory.categoryDescription;
64+
category.updatedAt = DateTime.UtcNow;
65+
66+
await _categoryService.UpdateAsync(id, category);
7567

76-
if (category is null)
77-
{
78-
return NotFound();
79-
}
68+
return NoContent();
69+
}
8070

81-
await _categoryService.RemoveAsync(id);
71+
[HttpDelete("{id:length(24)}")]
72+
public async Task<IActionResult> Delete(string id)
73+
{
74+
var category = await _categoryService.GetAsync(id);
8275

83-
return NoContent();
76+
if (category is null)
77+
{
78+
return NotFound();
8479
}
80+
81+
await _categoryService.RemoveAsync(id);
82+
83+
return NoContent();
84+
}
8585
}

‎Controllers/NftController.cs‎

Lines changed: 73 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -13,40 +13,41 @@ namespace MARKETPLACEAPI.Controllers;
1313
[Route("api/user/[controller]")]
1414
public class NftController : ControllerBase
1515
{
16-
private readonly NftService _nftService;
17-
private readonly CategoryService _categoryService;
18-
19-
public NftController(NftService nftService, CategoryService categoryService) {
20-
_nftService = nftService;
21-
_categoryService = categoryService;
16+
private readonly NftService _nftService;
17+
private readonly CategoryService _categoryService;
18+
19+
public NftController(NftService nftService, CategoryService categoryService)
20+
{
21+
_nftService = nftService;
22+
_categoryService = categoryService;
23+
}
24+
25+
[HttpGet]
26+
public async Task<List<Nft>> Get() =>
27+
await _nftService.GetAsync();
28+
29+
[HttpGet("{id:length(24)}")]
30+
public async Task<ActionResult<NftDto>> Get(string id)
31+
{
32+
var nft = await _nftService.GetAsync(id);
33+
if (nft is null)
34+
{
35+
return NotFound();
2236
}
2337

24-
[HttpGet]
25-
public async Task<List<Nft>> Get() =>
26-
await _nftService.GetAsync();
27-
28-
[HttpGet("{id:length(24)}")]
29-
public async Task<ActionResult<NftDto>> Get(string id)
38+
var nftDto = new NftDto
3039
{
31-
var nft = await _nftService.GetAsync(id);
32-
if (nft is null)
33-
{
34-
return NotFound();
35-
}
36-
37-
var nftDto = new NftDto
38-
{
39-
nft = nft,
40-
category = await _categoryService.GetAsync(nft.categoryId),
41-
};
42-
43-
return nftDto;
44-
}
40+
nft = nft,
41+
category = await _categoryService.GetAsync(nft.categoryId),
42+
};
43+
44+
return nftDto;
45+
}
4546

46-
[HttpPost]
47-
public async Task<IActionResult> Post(NftCreateDto newNft)
48-
{
49-
var userId = HttpContext.Request.Headers["userId"].ToString();
47+
[HttpPost]
48+
public async Task<IActionResult> Post(NftCreateDto newNft)
49+
{
50+
var userId = HttpContext.Request.Headers["userId"].ToString();
5051

5152
var nft = new Nft
5253
{
@@ -57,63 +58,63 @@ public async Task<IActionResult> Post(NftCreateDto newNft)
5758
creatorId = userId,
5859
categoryId = newNft.categoryId
5960
};
60-
61+
6162
await _nftService.CreateAsync(nft);
6263

63-
return CreatedAtAction(nameof(Get), new { id = nft.nftId }, nft);
64-
}
64+
return CreatedAtAction(nameof(Get), new { id = nft.nftId }, nft);
65+
}
66+
67+
[HttpPatch("{id:length(24)}")]
68+
public async Task<IActionResult> Update(string id, NftUpdateDto updatedNft)
69+
{
70+
var nft = await _nftService.GetAsync(id);
6571

66-
[HttpPatch("{id:length(24)}")]
67-
public async Task<IActionResult> Update(string id, NftUpdateDto updatedNft)
72+
if (nft is null)
6873
{
69-
var nft = await _nftService.GetAsync(id);
74+
return NotFound();
75+
}
7076

71-
if (nft is null)
72-
{
73-
return NotFound();
74-
}
77+
nft.nftName = updatedNft.nftName ?? nft.nftName;
78+
nft.nftDescription = updatedNft.nftDescription ?? nft.nftDescription;
79+
nft.price = updatedNft.price ?? nft.price;
80+
nft.updatedAt = DateTime.UtcNow;
7581

76-
nft.nftName = updatedNft.nftName ?? nft.nftName;
77-
nft.nftDescription = updatedNft.nftDescription ?? nft.nftDescription;
78-
nft.price = updatedNft.price ?? nft.price;
79-
nft.updatedAt = DateTime.UtcNow;
8082

83+
await _nftService.UpdateAsync(id, nft);
8184

82-
await _nftService.UpdateAsync(id, nft);
85+
return NoContent();
86+
}
8387

84-
return NoContent();
85-
}
88+
[HttpDelete("{id:length(24)}")]
89+
public async Task<IActionResult> Delete(string id)
90+
{
91+
var nft = await _nftService.GetAsync(id);
8692

87-
[HttpDelete("{id:length(24)}")]
88-
public async Task<IActionResult> Delete(string id)
93+
if (nft is null)
8994
{
90-
var nft = await _nftService.GetAsync(id);
91-
92-
if (nft is null)
93-
{
94-
return NotFound();
95-
}
95+
return NotFound();
96+
}
9697

97-
await _nftService.RemoveAsync(id);
98+
await _nftService.RemoveAsync(id);
9899

99-
return NoContent();
100-
}
100+
return NoContent();
101+
}
101102

102-
[HttpGet("creator")]
103-
public async Task<List<Nft>> GetNftsByCreatorId([FromQuery] string creatorId) =>
104-
await _nftService.GetNftsByCreatorId(creatorId);
103+
[HttpGet("creator")]
104+
public async Task<List<Nft>> GetNftsByCreatorId([FromQuery] string creatorId) =>
105+
await _nftService.GetNftsByCreatorId(creatorId);
105106

106-
[HttpGet("owner")]
107-
public async Task<List<Nft>> GetNftsByOwnerId([FromQuery] string ownerId) =>
108-
await _nftService.GetNftsByOwnerId(ownerId);
107+
[HttpGet("owner")]
108+
public async Task<List<Nft>> GetNftsByOwnerId([FromQuery] string ownerId) =>
109+
await _nftService.GetNftsByOwnerId(ownerId);
109110

110-
[HttpGet("with-price-filter")]
111-
public async Task<List<Nft>> GetNftWithPriceFilter(
112-
[FromQuery] double? priceMax, [FromQuery] double?
113-
priceMin, [FromQuery] bool? ascending = true) =>
114-
await _nftService.GetNftWithPriceFilter(priceMax, priceMin, ascending);
111+
[HttpGet("with-price-filter")]
112+
public async Task<List<Nft>> GetNftWithPriceFilter(
113+
[FromQuery] double? priceMax, [FromQuery] double?
114+
priceMin, [FromQuery] bool? ascending = true) =>
115+
await _nftService.GetNftWithPriceFilter(priceMax, priceMin, ascending);
115116

116-
[HttpGet("search")]
117-
public async Task<List<Nft>> SearchByNftName([FromQuery] string nftName, [FromQuery] bool ascending = true) =>
118-
await _nftService.SearchByNftName(nftName, ascending);
117+
[HttpGet("search")]
118+
public async Task<List<Nft>> SearchByNftName([FromQuery] string nftName, [FromQuery] bool ascending = true) =>
119+
await _nftService.SearchByNftName(nftName, ascending);
119120
}

0 commit comments

Comments
 (0)