From a87715f68851a2937749fdfbb25e639274ae8d2b Mon Sep 17 00:00:00 2001
From: Sebastian Gierlinger <s.gierlinger@me.com>
Date: Fri, 25 Sep 2015 21:03:33 +0200
Subject: [PATCH] Fix client.secret for new installs

closes #5872
- added random secret for new databases
- added temporary fix for existing databases
- secret is still static (`not_available`) during tests
- fixed fork mechanism to keep active environment (never change
NODE_ENV!!!)
---
 core/server/data/fixtures/index.js  |  4 ++++
 core/server/data/migration/index.js | 18 +++++++++++++++++-
 core/test/utils/fork.js             |  5 ++---
 3 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/core/server/data/fixtures/index.js b/core/server/data/fixtures/index.js
index 6e955a806f..f47715e6ac 100644
--- a/core/server/data/fixtures/index.js
+++ b/core/server/data/fixtures/index.js
@@ -92,6 +92,10 @@ populate = function populate() {
     });
 
     _.each(fixtures.clients, function (client) {
+        // no random secrets during testing
+        if (process.env.NODE_ENV.indexOf('testing') !== 0) {
+            client.secret = crypto.randomBytes(6).toString('hex');
+        }
         ops.push(Client.add(client, options));
     });
 
diff --git a/core/server/data/migration/index.js b/core/server/data/migration/index.js
index 0e08b622ef..e8813d9011 100644
--- a/core/server/data/migration/index.js
+++ b/core/server/data/migration/index.js
@@ -1,5 +1,6 @@
 var _               = require('lodash'),
     Promise         = require('bluebird'),
+    crypto          = require('crypto'),
     sequence        = require('../../utils/sequence'),
     path            = require('path'),
     fs              = require('fs'),
@@ -19,6 +20,7 @@ var _               = require('lodash'),
     logInfo,
     populateDefaultSettings,
     backupDatabase,
+    fixClientSecret,
 
     // public
     init,
@@ -52,6 +54,19 @@ backupDatabase = function backupDatabase() {
     });
 };
 
+// TODO: move to migration.to005() for next DB version
+fixClientSecret = function () {
+    return models.Clients.forge().query('where', 'secret', '=', 'not_available').fetch().then(function updateClients(results) {
+        return Promise.map(results.models, function mapper(client) {
+            if (process.env.NODE_ENV.indexOf('testing') !== 0) {
+                logInfo('Updating client secret');
+                client.secret = crypto.randomBytes(6).toString('hex');
+            }
+            return models.Client.edit(client, {context: {internal: true}, id: client.id});
+        });
+    });
+};
+
 // Check for whether data is needed to be bootstrapped or not
 init = function (tablesOnly) {
     tablesOnly = tablesOnly || false;
@@ -78,7 +93,8 @@ init = function (tablesOnly) {
         if (databaseVersion === defaultVersion) {
             // 1. The database exists and is up-to-date
             logInfo('Up to date at version ' + databaseVersion);
-            return;
+            // TODO: temporary fix for missing client.secret
+            return fixClientSecret();
         }
 
         if (databaseVersion > defaultVersion) {
diff --git a/core/test/utils/fork.js b/core/test/utils/fork.js
index c1477d3334..1c2bfac0b5 100644
--- a/core/test/utils/fork.js
+++ b/core/test/utils/fork.js
@@ -57,10 +57,10 @@ function forkGhost(newConfig, envName) {
             newConfig.server.port = port;
             newConfig.url = url.format(_.extend({}, url.parse(newConfig.url), {port: port, host: null}));
 
-            var newConfigFile = path.join(config.paths.appRoot, 'config.test' + port + '.js');
+            var newConfigFile = path.join(config.paths.appRoot, 'config.test.' + envName + '.js');
 
             return new Promise(function (resolve, reject) {
-                fs.writeFile(newConfigFile, 'module.exports = {' + envName + ': ' + JSON.stringify(newConfig) + '}', function (err) {
+                fs.writeFile(newConfigFile, 'module.exports = {"' + process.env.NODE_ENV + '": ' + JSON.stringify(newConfig) + '}', function (err) {
                     if (err) {
                         return reject(err);
                     }
@@ -81,7 +81,6 @@ function forkGhost(newConfig, envName) {
                         };
 
                     env.GHOST_CONFIG = newConfigFile;
-                    env.NODE_ENV = envName;
                     child = cp.fork(path.join(config.paths.appRoot, 'index.js'), {env: env});
                     // return the port to make it easier to do requests
                     child.port = port;