Giter Club home page Giter Club logo

fishfry-google-square's Introduction

StMM Fish Fry - Google Sheets & Square

To be added here: CI status

Prerequisites

  • git - code repository
  • nodejs - used for build system
  • clasp - used to develop Google Apps locally

Square Maintenance

Add SQUARE_ACCESS_TOKEN

In order to sync with Square, you'll need the SQUARE_ACCESS_TOKEN for the respective storefront.

TODO:

Setup webhooks on Square

TODO:

Google Apps Maintenance

Main Google Documents

Setup webhooks on Google Apps

TODO:

How to edit Google Sheet scripts locally

If you want to make a copy, this should work (without being connected to square).

  1. Clone the Git repository:
    git clone https://github.com/kofc7186/fishfry-google-square.git
    cd fishfry-google-square
    npm install @google/clasp -g
  2. Make a copy of Master Fish Fry Sheet
  3. In the new copy that was just created:
    • select "File/Project Properties"
      • Under info tab, there is a field "script ID"
      • Copy the "script ID" to your clipboard
  4. Edit the .clasp.json in the root directory of the repo with the value you copied in the previous step
  5. Install the NodeJS package from the git repo:
    npm install
  6. Authenticate and authorize clasp to manipulate the project with the google account that has access to the new copy:
    clasp login
    This launches a browser and asks you to login via oauth.
  7. Enable Apps Script API by visiting Apps Script API and toggle Google Apps Script API to ON.
  8. Modify files locally, then push/pull the changes between your desktop and Google Apps
    • clasp push will push the code on your local machine to the Google App
    • clasp pull will pull the code from Google App to your local machine

API Documentation

The hosted JSDoc files can be found here.

To generate updated documentation:

TODO:

Google Apps JavaScript Classes

These are classes used to interact with the Google infrastructure.

  • Logger
    • used to write out text to the debugging logs
  • PropertiesService
    • Allows scripts to store simple data in key-value pairs scoped to one script, one user of a script, or one document in which an add-on is used.
    • Used to retrieve the SQUARE_ACCESS_TOKEN attribute to communicate with Square
  • HtmlService
    • Service for returning HTML and other text content from a script.
    • Used to render HTML forms for user input
    • Used to render response to websocket from Square
  • UrlFetchApp
    • Fetch resources and communicate with other hosts over the Internet.
    • Used to make RESTful calls to Square
  • SpreadsheetApp
    • This class allows users to open Google Sheets files and to create new ones.
    • Used to manipulate the main Google Sheet
  • DocumentApp
    • The document service creates and opens Documents that can be edited.
    • Used to retrieve the Print template, create new document based on data from Sheet
  • LockService
    • Prevents concurrent access to sections of code.
    • Used to retrive atomic human interpretable order number (i.e. auto-increment)
  • Utilities
    • This service provides utilities for string encoding/decoding, date formatting, JSON manipulation, and other miscellaneous tasks.
    • Used for date/time formatting

Source Code

└── src
    ├── FormatOrder.js - used to take input from Square API and format it to insert into Google Sheets
    ├── Worksheet.js - manipulation to the Worksheet Transactions
    ├── doPost.js - webhook callback for Square
    ├── html - form templates
    ├── menuItems.js - objects for items customers may order, and what ingredients are contained within each order
    ├── orm.js - helper functions to manipulate the Google Sheet and Workbooks within
    ├── printLabels.js - generate label from an order, as well as send the label to the printer spool
    ├── simulateSquare.js - testing helper to simulate data from Square
    ├── squareAPI.js - simulate responses from Square's RESTful APIs (used in test only) 
    └── triggers.js - JavaScript trigger functions (i.e. entry point for Google Sheets)

fishfry-google-square's People

Contributors

bobcallaway avatar marschneatcisco avatar szelenka avatar szelenka-cisco avatar thunderliortest[bot] avatar

fishfry-google-square's Issues

WS-2017-0195 Medium Severity Vulnerability detected by WhiteSource

WS-2017-0195 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.12.4.min.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

path: /fishfry-google-square/src/html/labelingSidebar.html

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)
jquery-1.12.4.min.js

JavaScript library for DOM operations

path: /fishfry-google-square/src/html/onlineCheckin.html

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js

Dependency Hierarchy:

  • jquery-1.12.4.min.js (Vulnerable Library)

Vulnerability Details

In v2.2.4 and previous, a lowercasing logic was used on the attribute names and was removed in v3.0.0.
Because of this, boolean attributes whose names were not all lowercase cause infinite recursion, and will exceed the stack call limit.

Publish Date: 2017-04-15

URL: WS-2017-0195

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: jquery/jquery@d12e13d

Release Date: 2016-05-29

Fix Resolution: Replace or update the following files: attr.js, attributes.js


Step up your Open Source Security Game with WhiteSource here

WS-2018-0096 High Severity Vulnerability detected by WhiteSource

WS-2018-0096 - High Severity Vulnerability

Vulnerable Library - base64url-2.0.0.tgz

For encoding to/from base64urls

path: /tmp/git/fishfry-google-square/node_modules/base64url/package.json

Library home page: https://registry.npmjs.org/base64url/-/base64url-2.0.0.tgz

Dependency Hierarchy:

  • clasp-1.1.1.tgz (Root Library)
    • googleapis-25.0.0.tgz
      • google-auth-library-1.3.1.tgz
        • jws-3.1.4.tgz
          • base64url-2.0.0.tgz (Vulnerable Library)

Vulnerability Details

Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.

Publish Date: 2018-05-16

URL: WS-2018-0096

CVSS 2 Score Details (7.1)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/321687

Release Date: 2019-01-24

Fix Resolution: 3.0.0


Step up your Open Source Security Game with WhiteSource here

WS-2019-0027 Medium Severity Vulnerability detected by WhiteSource

WS-2019-0027 - Medium Severity Vulnerability

Vulnerable Library - marked-0.3.16.tgz

A markdown parser built for speed

path: /tmp/git/fishfry-google-square/node_modules/marked/package.json

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.16.tgz

Dependency Hierarchy:

  • jsdoc-3.5.5.tgz (Root Library)
    • marked-0.3.16.tgz (Vulnerable Library)

Vulnerability Details

Versions 0.3.17 and earlier of marked has Four regexes were vulnerable to catastrophic backtracking. This leaves markdown servers open to a potential REDOS attack.

Publish Date: 2019-03-17

URL: WS-2019-0027

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: markedjs/marked@b15e42b

Release Date: 2019-03-17

Fix Resolution: 0.3.18


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 High Severity Vulnerability detected by WhiteSource

CVE-2018-16487 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

path: /tmp/git/fishfry-google-square/node_modules/lodash/package.json

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Dependency Hierarchy:

  • clasp-1.1.1.tgz (Root Library)
    • googleapis-25.0.0.tgz
      • async-2.6.0.tgz
        • lodash-4.17.5.tgz (Vulnerable Library)

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2017-16028 Medium Severity Vulnerability detected by WhiteSource

CVE-2017-16028 - Medium Severity Vulnerability

Vulnerable Library - randomatic-1.1.7.tgz

Generate randomized strings of a specified length, fast. Only the length is necessary, but you can optionally generate patterns using any combination of numeric, alpha-numeric, alphabetical, special or custom characters.

path: /tmp/git/fishfry-google-square/node_modules/randomatic/package.json

Library home page: https://registry.npmjs.org/randomatic/-/randomatic-1.1.7.tgz

Dependency Hierarchy:

  • clasp-1.1.1.tgz (Root Library)
    • anymatch-1.3.2.tgz
      • micromatch-2.3.11.tgz
        • braces-1.8.5.tgz
          • expand-range-1.8.2.tgz
            • fill-range-2.2.3.tgz
              • randomatic-1.1.7.tgz (Vulnerable Library)

Vulnerability Details

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).

Publish Date: 2018-06-04

URL: CVE-2017-16028

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/157

Release Date: 2017-04-14

Fix Resolution: Update to version 3.0.0 or later.


Step up your Open Source Security Game with WhiteSource here

WS-2018-0107 High Severity Vulnerability detected by WhiteSource

WS-2018-0107 - High Severity Vulnerability

Vulnerable Library - open-0.0.5.tgz

open a file or url in the user's preferred application

path: /tmp/git/fishfry-google-square/node_modules/open/package.json

Library home page: http://registry.npmjs.org/open/-/open-0.0.5.tgz

Dependency Hierarchy:

  • clasp-1.1.1.tgz (Root Library)
    • open-0.0.5.tgz (Vulnerable Library)

Vulnerability Details

All versions of open are vulnerable to command injection when unsanitized user input is passed in.

Publish Date: 2018-05-16

URL: WS-2018-0107

CVSS 2 Score Details (10.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/663

Release Date: 2018-05-16

Fix Resolution: No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.


Step up your Open Source Security Game with WhiteSource here

WS-2018-0210 Low Severity Vulnerability detected by WhiteSource

WS-2018-0210 - Low Severity Vulnerability

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

path: /tmp/git/fishfry-google-square/node_modules/lodash/package.json

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Dependency Hierarchy:

  • clasp-1.1.1.tgz (Root Library)
    • googleapis-25.0.0.tgz
      • async-2.6.0.tgz
        • lodash-4.17.5.tgz (Vulnerable Library)

Vulnerability Details

In the node_module "lodash" before version 4.17.11 the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.

Publish Date: 2018-11-25

URL: WS-2018-0210

CVSS 2 Score Details (3.5)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: lodash/lodash@90e6199

Release Date: 2018-08-31

Fix Resolution: Replace or update the following files: lodash.js, test.js


Step up your Open Source Security Game with WhiteSource here

WS-2019-0019 Medium Severity Vulnerability detected by WhiteSource

WS-2019-0019 - Medium Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

path: /tmp/git/fishfry-google-square/node_modules/braces/package.json

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Dependency Hierarchy:

  • clasp-1.1.1.tgz (Root Library)
    • anymatch-1.3.2.tgz
      • micromatch-2.3.11.tgz
        • braces-1.8.5.tgz (Vulnerable Library)

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2019-02-21

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16492 High Severity Vulnerability detected by WhiteSource

CVE-2018-16492 - High Severity Vulnerability

Vulnerable Library - extend-3.0.1.tgz

Port of jQuery.extend for node.js and the browser

path: /tmp/git/fishfry-google-square/node_modules/extend/package.json

Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz

Dependency Hierarchy:

  • clasp-1.1.1.tgz (Root Library)
    • googleapis-25.0.0.tgz
      • google-auth-library-1.3.1.tgz
        • gcp-metadata-0.6.1.tgz
          • extend-3.0.1.tgz (Vulnerable Library)

Vulnerability Details

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16492

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/381185

Release Date: 2019-02-01

Fix Resolution: v3.0.2,v2.0.2


Step up your Open Source Security Game with WhiteSource here

CVE-2016-7103 Medium Severity Vulnerability detected by WhiteSource

CVE-2016-7103 - Medium Severity Vulnerability

Vulnerable Library - jquery-ui-1.11.4.min.js

A curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery JavaScript Library.

path: /fishfry-google-square/src/html/labelingSidebar.html

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.11.4/jquery-ui.min.js

Dependency Hierarchy:

  • jquery-ui-1.11.4.min.js (Vulnerable Library)

Vulnerability Details

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

Publish Date: 2017-03-15

URL: CVE-2016-7103

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/127

Release Date: 2016-07-21

Fix Resolution: Upgrade to jQuery-UI 1.12.0 or later.


Step up your Open Source Security Game with WhiteSource here

CVE-2015-9251 Medium Severity Vulnerability detected by WhiteSource

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.12.4.min.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

path: /fishfry-google-square/src/html/labelingSidebar.html

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)
jquery-1.12.4.min.js

JavaScript library for DOM operations

path: /fishfry-google-square/src/html/onlineCheckin.html

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js

Dependency Hierarchy:

  • jquery-1.12.4.min.js (Vulnerable Library)

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: jquery/jquery@b078a62#diff-bee4304906ea68bebadfc11be4368419

Release Date: 2015-10-12

Fix Resolution: Replace or update the following files: script.js, ajax.js, ajax.js


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.