issue #23894: validate inputs

diff --git a/enyo-client/application/source/en/strings.js b/enyo-client/application/source/en/strings.js
index 496d892..28e9885 100644 (file)
--- a/enyo-client/application/source/en/strings.js
+++ b/enyo-client/application/source/en/strings.js
@@ -990,6 +990,8 @@
     "_customerOrProspect": "Would you like to create a new Customer or a new Prospect?",
     "_deleteLine?": "Are you sure you want to delete this line?",
     "_exitPageWarning": "You are about to leave the xTuple application.",
+    "_installExtensionWarning": "Extensions are very powerful and potentially have full access to your " +
+      "data. You should only install an extension from a source you trust.",
     "_insufficientPrivileges": "You have insufficient privileges to perform this action.",
     "_manualFreight": "Manually editing the freight will disable automatic freight recalculations.",
     "_mustSave": "You must save your changes before proceeding.",

diff --git a/enyo-client/application/source/views/workspace.js b/enyo-client/application/source/views/workspace.js
index dd2762a..86bc045 100644 (file)
--- a/enyo-client/application/source/views/workspace.js
+++ b/enyo-client/application/source/views/workspace.js
@@ -472,9 +472,17 @@ strict: false*/
           );
         };
 
+      if (!this.$.extensionName.getValue()) {
+        this.doNotify({
+          type: XM.Model.WARNING,
+          message: "_attributeIsRequired".loc().replace("{attr}", "_extensionName".loc())
+        });
+        return;
+      }
+
       this.doNotify({
         type: XM.Model.QUESTION,
-        message: "_confirmAction".loc(),
+        message: "_installExtensionWarning".loc() + "_confirmAction".loc(),
         callback: callback
       });
     }

diff --git a/node-datasource/routes/install_extension.js b/node-datasource/routes/install_extension.js
index 7ce2e56..4ee4bb4 100644 (file)
--- a/node-datasource/routes/install_extension.js
+++ b/node-datasource/routes/install_extension.js
@@ -15,6 +15,13 @@ regexp:true, undef:true, strict:true, trailing:true, white:true */
       extensionName = req.query.extensionName,
       username = req.session.passport.user.id,
       user = new SYS.User(),
+      validateInput = function (callback) {
+        if (!extensionName) {
+          callback("Error: empty extension name");
+          return;
+        }
+        callback();
+      },
       validateUser = function (callback) {
         user.fetch({
           id: username,
@@ -56,6 +63,7 @@ regexp:true, undef:true, strict:true, trailing:true, white:true */
       };
 
       async.series([
+        validateInput,
         validateUser,
         npmLoad,
         npmInstall,