Allow users to choose whether or not to reveal the provenance of the data to
consumers. This is intended to help protect data rights to portability and
access. If consumers start abusing or discriminating against Nightscout users
due to the source of the data, this allows users to conceal this information.
This change allows each route to express policies for interpreting and parsing
the request body. Before this change uploads to entries or treatments api
would error if they were larger than 100Kb due to the preference being set for
the whole server. This change removes the global preference in favor of
allowing each route to choose it's own request size limit.
We also refactor usage of body-parser to be more consistent throughout the code
base. Most routes can use jsonParser, rawPraser, and urlencodedParser provided
by the common wares component. Anything doing something else should be called
out as such. For example, treatments, activity, and entries allow uploads up
to 50Mb. Other v1 endpoints are using the common configuration set to 1Mb.
* upgrade mocha from 3.5.3 to 5.0.5
This resolves these security issues
Low Regular Expression Denial of Service
Package debug
Dependency of mocha [dev]
Path mocha > debug
More info https://nodesecurity.io/advisories/534
Critical Command Injection
Package growl
Dependency of mocha [dev]
Path mocha > growl
More info https://nodesecurity.io/advisories/146
* upgrade mocha and start modularizing lodash to make sure tests pass
* more lodash modularization
* upgrade mqtt to 2.18.3
* allow npm 6.2
* upgrade share2nightscout-bridge
* incorporate express-extension-to-accept into Nightscout
the packages seems not maintained (github page is 404) and has a security issue with mime package. so upgraded and included into Nightscout code.
if somebody knows a more efficient way of programming this with express4 please PR
* update jsdom for security fixes
* prevent wrapping of hour labels by removing the space
* Revert "update jsdom for security fixes"
This reverts commit 04f1f39d636d8d79c6b01b5f298f9a6cea3dc645.
* Revert "more lodash modularization"
This reverts commit c4fa5304db9f16b94f15c2b44793a5a11d595885.
* remove forever dependency
* Revert "Revert "more lodash modularization""
This reverts commit b13c274ebff0b5c3a48ffc0e610ca85a9f8d25bc.
* fix report.test.js with newer packages
sometimes a fix is very easy. This is to prevent:
```
Deprecation warning: value provided is not in a recognized RFC2822 or ISO format. moment construction falls back to js Date(), which is not reliable across all browsers and versions. Non RFC2822/ISO date formats are discouraged and will be removed in an upcoming major release. Please refer to http://momentjs.com/guides/#/warnings/js-date/ for more info.
Arguments:
[0] _isAMomentObject: true, _isUTC: true, _useUTC: true, _l: undefined, _i: T00:00:00, _f: undefined, _strict: undefined, _locale: [object Object]
Error
at Function.createFromInputFallback (XXX\cgm-remote-monitor\tmp\js\bundle.js:117408:98)
at configFromString (XXX\cgm-remote-monitor\tmp\js\bundle.js:119456:15)
```
We must use ISO8601 formatted strings and not use slashes in dates, see https://github.com/moment/moment/issues/1407#issuecomment-155630060
* upgrade webpack to 4.16.2
* Update package.json
* try again
* try with compression
* fix export
* try 1MB limit
* try with different version of body-parser
* try limits again
* try setting limit AGAIN
* keep trying
* try harder-er
* try alternate verisno
None of these attempts appeared fruitful, but hard to tell if they were
required or not.
Ben West
JakobandSulka Haro
PieterGitandSulka Haro
Jason Calabrese