fixing security issues found in onap admportal
[sdnc/oam.git] / admportal / server / router / routes / dbRoutes.js
index 34a90c7..af3859b 100644 (file)
@@ -262,45 +262,45 @@ console.log('checkDB');
 
 exports.saveUser = function(req,res){
 
-       pool.getConnection(function(err,connection){
+       var tkn = req.csrfToken();
+       var email = req.sanitize(req.body.nf_email);
+       var pswd = req.sanitize(req.body.nf_password);
+
+       pool.getConnection(function(err,connection)
+       {
                if(err){
                        console.error( String(err) ); // ALARM
-                       res.render("pages/signup", {result:{code:'error', msg:"Unable to get database connection. " + String(err)},header:process.env.MAIN_MENU});
+                       res.render("pages/signup", {csrfToken:tkn,result:{code:'error', msg:"Unable to get database connection. " + String(err)},header:process.env.MAIN_MENU});
                        return;
-       }
-               //var sql = "SELECT AES_DECRYPT(password, '" + enckey + "') password FROM PORTAL_USERS";
-               var sql = "SELECT email FROM PORTAL_USERS WHERE email='" + req.body.nf_email + "'";
-
-               console.log(sql);
+               }
+               var sql = "SELECT email FROM PORTAL_USERS WHERE email=" + connection.escape(email);
 
-               connection.query(sql, function(err,result){
+               connection.query(sql, function(err,result)
+               {
                        if(err){
                                connection.release();
-                               res.render("pages/signup", {result:{code:'error', msg:"Unable to get database connection. " + String(err)},header:process.env.MAIN_MENU});
+                               res.render("pages/signup", {csrfToken:tkn, result:{code:'error', msg:"Unable to get database connection. " + String(err)},header:process.env.MAIN_MENU});
                                return;
                        }
                        if (result.length == 1 || result.length > 1)
                        {
                                connection.release();
-                               res.render("pages/signup", {result:{code:'error', msg:'User Information already exists.'},header:process.env.MAIN_MENU});
+                               res.render("pages/signup", {csrfToken:tkn, result:{code:'error', msg:'User Information already exists.'},header:process.env.MAIN_MENU});
                                return;
                        }
-
                        sql = "INSERT INTO PORTAL_USERS (email,password,privilege) VALUES ("
-            +"'"+ req.body.nf_email + "',"
-            + "AES_ENCRYPT('" + req.body.nf_password + "','" + enckey + "'),"
-            +"'A')";
+            + connection.escape(email) + ","
+            + "AES_ENCRYPT(" + connection.escape(pswd) + ",'" + enckey + "'),'A')";
 
-                       console.log(sql);
-
-                       connection.query(sql, function(err,result){
+                       connection.query(sql, function(err,result)
+                       {
                                connection.release();
                                
                                if(err){
-                                       res.render("pages/signup", {result:{ code:'error', msg:String(err) },header:process.env.MAIN_MENU});;
+                                       res.render("pages/signup", {csrfToken:tkn, result:{ code:'error', msg:String(err) },header:process.env.MAIN_MENU});;
                                        return;
                                }
-                               res.render('pages/signup', {result:{code:'success', msg:'User created.  Please login.'},header:process.env.MAIN_MENU});
+                               res.render('pages/signup', {csrfToken:tkn, result:{code:'success', msg:'User created.  Please login.'},header:process.env.MAIN_MENU});
                                return;
                        });
                });
@@ -314,218 +314,256 @@ exports.deleteUser = function(req,res){
        var resultObj = { code:'', msg:'' };
        var privilegeObj = req.session.loggedInAdmin;
 
-    pool.getConnection(function(err,connection) {
-        if(err){
+  pool.getConnection(function(err,connection) {
+
+    if(err){
                        console.error( String(err) ); // ALARM
-            res.render("user/list", {rows: null, result:{code:'error', msg:"Unable to get database connection. Error:" + String(err), 
-                               privilege:privilegeObj },header:process.env.MAIN_MENU});
+      res.render("user/list", {rows: null, result:{code:'error', msg:"Unable to get database connection. Error:" + String(err), 
+                       privilege:privilegeObj },header:process.env.MAIN_MENU});
                        return;
-        }
-
-        var sqlUpdate = "DELETE FROM PORTAL_USERS WHERE email='" + req.query.email + "'";
+    }
 
+    var sqlUpdate = "DELETE FROM PORTAL_USERS WHERE email=" + connection.escape(req.query.email);
                console.log(sqlUpdate);
 
-        connection.query(sqlUpdate,function(err,result){
+    connection.query(sqlUpdate,function(err,result){
 
-            if(err){
-                 resultObj = {code:'error', msg:'Delete of user failed Error: '+ String(err) };
-            }
+      if(err){
+        resultObj = {code:'error', msg:'Delete of user failed Error: '+ String(err) };
+      }
 
-            // Need DB lookup logic here
-            connection.query("SELECT email,password,privilege FROM PORTAL_USERS", function(err, rows) {
-               connection.release();
-                if(!err) {
-                    if ( rows.length > 0 )
-                    {
+      // Need DB lookup logic here
+      connection.query("SELECT email,password,privilege FROM PORTAL_USERS", function(err, rows) {
+        connection.release();
+        if(!err) 
+                               {
+          if ( rows.length > 0 )
+          {
                                                resultObj = {code:'success',msg:'Successfully deleted user.'};
-                        res.render('user/list', { rows: rows, result:resultObj, privilege:privilegeObj,header:process.env.MAIN_MENU } );
+            res.render('user/list', { rows: rows, result:resultObj, privilege:privilegeObj,header:process.env.MAIN_MENU } );
                                                return;
-                    }else{
-                        res.render("user/list", { rows: null, result:{code:'error', msg:'Unexpected no rows returned from database, please try again.',
-                                                       privilege:privilegeObj },header:process.env.MAIN_MENU});
+          }else{
+            res.render("user/list", { rows: null, result:{code:'error', msg:'Unexpected no rows returned from database, please try again.',
+                                               privilege:privilegeObj },header:process.env.MAIN_MENU});
                                                return;
-                    }
-                } else {
-                    res.render("user/list", { rows: null, result:{code:'error', msg:'Unexpected no rows returned from database. Error: ' + String(err),
-                                                       privilege:privilegeObj },header:process.env.MAIN_MENU});
+          }
+        }
+                               else {
+          res.render("user/list", { rows: null, result:{code:'error', msg:'Unexpected no rows returned from database. Error: ' + String(err),
+                                       privilege:privilegeObj },header:process.env.MAIN_MENU});
                                        return;
-                }
-            }); //end query
-        });
-    }); // end of getConnection
+               }
+      }); //end query
+    });
+  }); // end of getConnection
 }
 
 // add User
 exports.addUser = function(req,res){
        
        var rows={};
-    var resultObj = { code:'', msg:'' };
+       var resultObj = { code:'', msg:'' };
        var privilegeObj = req.session.loggedInAdmin;
+       var privilege = req.sanitize(req.body.nf_privilege);
+       var email = req.sanitize(req.body.nf_email);
+  var pswd = req.sanitize(req.body.nf_password);
 
-    pool.getConnection(function(err,connection) {
-        if(err){
+
+       pool.getConnection(function(err,connection) 
+       {
+               if(err)
+               {
                        console.error( String(err) ); // ALARM
-            res.render("user/list", {rows: null, result:{code:'error', msg:"Unable to get database connection. "+ String(err),
-                               privilege:privilegeObj },header:process.env.MAIN_MENU});
+                       res.render("user/list", {rows: null, result:{code:'error', msg:"Unable to get database connection. "+ String(err),
+                       privilege:privilegeObj },header:process.env.MAIN_MENU});
                        return;
-        }
-
-        if( req.body.nf_privilege == "admin" ){
-            var char_priv = 'A';
-        }else if(req.body.nf_privilege == 'readonly'){
-            var char_priv = 'R';
-        }else{
-            var char_priv = 'A';
-        }
-
-
-        //connection.query(sqlRequest, function(err,result){
-        var sqlUpdate = "INSERT INTO PORTAL_USERS (email, password, privilege) VALUES ("
-            +"'"+ req.body.nf_email + "',"
-            + "AES_ENCRYPT('" + req.body.nf_password + "','" + enckey + "'),"
-            +"'"+ char_priv + "')";
-
-               console.log(sqlUpdate);
+               }
 
-        connection.query(sqlUpdate,function(err,result){
+               if( privilege == "admin" ){
+                       var char_priv = 'A';
+               }else if(privilege == 'readonly'){
+                       var char_priv = 'R';
+               }else{
+                       var char_priv = 'R';
+               }
 
-            if(err){
-                 resultObj = {code:'error', msg:'Add of user failed Error: '+err};
-            }
+               //connection.query(sqlRequest, function(err,result)
+               var sqlUpdate = "INSERT INTO PORTAL_USERS (email, password, privilege) VALUES ("
+                       + connection.escape(email) + ","
+                       + "AES_ENCRYPT(" + connection.escape(pswd) + ",'" + enckey + "'),"
+                       + "'" + char_priv + "')";
 
-            // Need DB lookup logic here
-            connection.query("SELECT email,AES_DECRYPT(password, '" + enckey + "') password,privilege FROM PORTAL_USERS", function(err, rows) {
 
-               connection.release();
-                if(!err) {
-                    if ( rows.length > 0 )
-                    {
+               connection.query(sqlUpdate,function(err,result)
+               {
+                       if(err){
+                               resultObj = {code:'error', msg:'Add of user failed Error: '+err};
+                       }
+                       // Need DB lookup logic here
+                       connection.query("SELECT email,AES_DECRYPT(password, '" + enckey + "') password,privilege FROM PORTAL_USERS", function(err, rows)
+                       {
+                               connection.release();
+                               if(!err)
+                               {
+                                       if ( rows.length > 0 )
+                                       {
                                                resultObj = {code:'success',msg:'Successfully added user.'};
-                        res.render('user/list', { rows: rows, result:resultObj, privilege:privilegeObj,header:process.env.MAIN_MENU } );
+                                               res.render('user/list', { rows: rows, result:resultObj, privilege:privilegeObj,header:process.env.MAIN_MENU } );
                                                return;
-                    }else{
-                        res.render("user/list", {rows: null, result:{code:'error', msg:'Unexpected no rows returned from database, please try again.',
+                                       }else{
+                                               res.render("user/list", {rows: null, result:{code:'error', msg:'Unexpected no rows returned from database, please try again.',
                                                        privilege:privilegeObj },header:process.env.MAIN_MENU});
                                                return;
-                    }
-                } else {
-                    res.render("user/list", {rows: null, result:{code:'error', msg:'Unexpected no rows returned from database. Error: '+ err ,
+                                       }
+                               }
+                               else {
+                                       res.render("user/list", {rows: null, result:{code:'error', msg:'Unexpected no rows returned from database. Error: '+ err ,
                                                privilege:privilegeObj },header:process.env.MAIN_MENU});
                                        return;
-                }
-            }); //end query
-        });
-
-    }); // end of getConnection
+                               }
+                       }); //end query
+               });
+       }); // end of getConnection
 }
 
 // updateUser
 exports.updateUser= function(req,res){
 
-    var rows={};
+       var rows={};
        var resultObj = { code:'', msg:'' };
        var privilegeObj = req.session.loggedInAdmin;
+       var email = req.sanitize(req.body.uf_email);
+       var key_email = req.sanitize(req.body.uf_key_email)
+  var pswd = req.sanitize(req.body.uf_password);
+  var privilege = req.sanitize(req.body.uf_privilege);
 
-    pool.getConnection(function(err,connection) {
-
-        if(err){
+       pool.getConnection(function(err,connection)
+       {
+               if(err){
                        console.error( String(err) ); // ALARM
-            res.render("user/list", {rows: null, result:{code:'error', msg:"Unable to get database connection. " + String(err),
+                       res.render("user/list", {rows: null, result:{code:'error', msg:"Unable to get database connection. " + String(err),
                                privilege:privilegeObj },header:process.env.MAIN_MENU});
                        return;
-        }
+               }
 
-               if( req.body.uf_privilege == "admin" ){
+               if( privilege == "admin" ){
                        var char_priv = 'A';
-               }else if(req.body.uf_privilege == 'readonly'){
+               }else if(privilege == 'readonly'){
                        var char_priv = 'R';
                }else{
-                       var char_priv = 'A';
+                       var char_priv = 'R';
                }
 
-
-        //connection.query(sqlRequest, function(err,result){
                var sqlUpdate = "UPDATE PORTAL_USERS SET "
-                       + "email = '" + req.body.uf_email + "',"
-                       + "password = " + "AES_ENCRYPT('" + req.body.uf_password + "','" + enckey + "'), "
-                       + "privilege = '"+ char_priv + "'"
-                       + " WHERE email = '" + req.body.uf_key_email + "'";
+                       + "email = " + connection.escape(email) + ","
+                       + "password = " + "AES_ENCRYPT(" + connection.escape(pswd) + ",'" + enckey + "'), "
+                       + "privilege = '" + char_priv + "'"
+                       + " WHERE email = " + connection.escape(key_email);
 
                console.log(sqlUpdate);
-
-        connection.query(sqlUpdate,function(err,result){
-
+               connection.query(sqlUpdate,function(err,result)
+               {
                        if(err){
-                                resultObj = {code:'error', msg:'Update of user failed Error: '+err};
+                               resultObj = {code:'error', msg:'Update of user failed Error: '+err};
                        }
-
-            // Need DB lookup logic here
-            connection.query("SELECT email, AES_DECRYPT(password,'" + enckey + "') password, privilege FROM PORTAL_USERS", function(err, rows) {
-               connection.release();
-                if(!err) {
-                    if ( rows.length > 0 )
-                    {
+                       // Need DB lookup logic here
+                       connection.query("SELECT email, AES_DECRYPT(password,'" + enckey + "') password, privilege FROM PORTAL_USERS", function(err, rows)
+                       {
+                               connection.release();
+                               if(!err)
+                               {
+                                       if ( rows.length > 0 )
+                                       {
                                                resultObj = {code:'success',msg:'Successfully updated user.'};
-                        res.render('user/list', { rows: rows, result:resultObj, privilege:privilegeObj,header:process.env.MAIN_MENU} );
-                               return;
-                    }else{
-                        res.render("user/list", {rows: null, result:{ code:'error', msg:'Unexpected no rows returned from database.',
+                                               res.render('user/list', { rows: rows, result:resultObj, privilege:privilegeObj,header:process.env.MAIN_MENU} );
+                                               return;
+                                       }else{
+                                               res.render("user/list", {rows: null, result:{ code:'error', msg:'Unexpected no rows returned from database.',
                                                        privilege:privilegeObj },header:process.env.MAIN_MENU});
                                                return;
-                    }
-                } else {
-                    res.render("user/list", {rows: null, result:{code:'error', msg:'Unexpected no rows returned from database. ' + String(err),
+                                       }
+                               } else {
+                                       res.render("user/list", {rows: null, result:{code:'error', msg:'Unexpected no rows returned from database. ' + String(err),
                                                privilege:privilegeObj },header:process.env.MAIN_MENU});
                                        return;
                                }
-            }); //end query
-        });
-    }); // end of getConnection
-};
+                       }); //end query
+               });
+       }); // end of getConnection
+}
 
 exports.listUsers = function(req,res,resultObj){
 
        var privilegeObj = req.session.loggedInAdmin;
-    var rows={};
-    pool.getConnection(function(err,connection) {
+       var rows={};
+       pool.getConnection(function(err,connection)
+       {
     
-        if(err){
+               if(err){
                        console.error( String(err) ); // ALARM
-            res.render("pages/list", {rows: null, result:{code:'error', msg:"Unable to get database connection. " + String(err),
-                               privilege:privilegeObj },header:process.env.MAIN_MENU});
+                       res.render("pages/list", 
+                       {
+                               rows: null, 
+                               result:{
+                                       code:'error', 
+                                       msg:"Unable to get database connection. " + String(err), 
+                                       privilege:privilegeObj },
+                                       header:process.env.MAIN_MENU
+                       });
                        return;
-        }
+               }
 
-        // Need DB lookup logic here
-       var selectUsers = "SELECT email, AES_DECRYPT(password,'" + enckey + "') password, privilege from PORTAL_USERS";
-       console.log(selectUsers);
-        connection.query(selectUsers, function(err, rows) {
+               // Need DB lookup logic here
+               var selectUsers = "SELECT email, AES_DECRYPT(password,'" 
+                       + enckey + "') password, privilege from PORTAL_USERS";
 
-                       connection.release();
-                       if(err){
-                                resultObj = {code:'error', msg:'Unable to SELECT users Error: '+err};
+               connection.query(selectUsers, function(err, rows) {
+
+               connection.release();
+               if(err){
+                       resultObj = {code:'error', msg:'Unable to SELECT users Error: '+err};
+               }
+               if(!err)
+               {
+                       if ( rows.length > 0 )
+                       {
+                               console.log(JSON.stringify(rows));
+                               res.render('user/list', 
+                               {
+                                       rows: rows, 
+                                       result:resultObj, 
+                                       privilege:privilegeObj,
+                                       header:process.env.MAIN_MENU 
+                               });
+                               return;
                        }
-               
-            if(!err) {
-                if ( rows.length > 0 )
-                {
-                    console.log(JSON.stringify(rows));
-                    res.render('user/list', { rows: rows, result:resultObj, privilege:privilegeObj,header:process.env.MAIN_MENU });
-                                       return;
-                }
-                else{
-                    res.render("user/list", {rows: null, result:{code:'error', msg:'Unexpected no rows returned from database.',
-                                               privilege:privilegeObj },header:process.env.MAIN_MENU});
-                                       return;
-                }
-            } else {
-                    res.render("user/list", {rows: null, result:{code:'error', msg:'Unexpected no rows returned from database. ' + String(err),
-                                               privilege:privilegeObj },header:process.env.MAIN_MENU});
-                                       return;
+                       else{
+                               res.render("user/list", 
+                               {
+                                       rows: null, 
+                                       result:{
+                                               code:'error', 
+                                               msg:'Unexpected no rows returned from database.',
+                                               privilege:privilegeObj },
+                                               header:process.env.MAIN_MENU
+                               });
+                               return;
                        }
-        }); //end query
-    }); // end getConnection
+               }
+               else
+               {
+                       res.render("user/list", 
+                       {
+                               rows: null, 
+                               result:{
+                                       code:'error', 
+                                       msg:'Unexpected no rows returned from database. ' + String(err),
+                                       privilege:privilegeObj },header:process.env.MAIN_MENU
+                       });
+                       return;
+               }
+               }); //end query
+       }); // end getConnection
 }
 
 exports.listSLA = function(req,res,resultObj){
@@ -558,57 +596,57 @@ exports.listSLA = function(req,res,resultObj){
 
 exports.executeSQL = function(sql,req,res,callback){
 
-    console.log(sql);
-
-    pool.getConnection(function(err,connection) {
-
-        if(err){
-            console.error( String(err) ); // ALARM
-            callback(err, 'Unable to get database connection.' + err);
-            return;
-        }
+       console.log(sql);
+       pool.getConnection(function(err,connection) {
 
-        connection.query(sql, function(err,result){
-            connection.release();
+               if(err){
+      console.error( String(err) ); // ALARM
+      callback(err, 'Unable to get database connection.' + err);
+      return;
+    }
+    connection.query(sql, function(err,result){
+      connection.release();
                        if (err) {
                                callback(err,'Database operation failed. ' + err );
+                               return;
                        }
-            else
-            {
-console.log('affectedRows='+result.affectedRows);
-                callback(null, result.affectedRows);
-            }
-       }); //end query
-    }); // end getConnection
+      else
+      {
+                               console.log('affectedRows='+result.affectedRows);
+        callback(null, result.affectedRows);
+                               return;
+      }
+    }); //end query
+  }); // end getConnection
 }
 
 
 // gamma - deleteParameter
 exports.deleteParameter = function(req,res,callback){
 
-    var sql = "DELETE FROM PARAMETERS WHERE name='" + req.query.name + "'";
-
-    console.log(sql);
-
-    pool.getConnection(function(err,connection) {
+       pool.getConnection(function(err,connection) {
 
-        if(err){
-            console.log( String(err) ); // ALARM
-            callback(err, 'Unable to get database connection.' + err);
-            return;
-        }
-        connection.query(sql, function(err,result){
-            connection.release();
-               if(err){
-                    console.log('Update failed. ' + err );
-                    callback(err,'Update failed. ' + err );
-               }
-               else
-               {
-                    callback(null,'');
-               }
-       }); //end query
-    }); // end getConnection
+       if(err){
+       console.log( String(err) ); // ALARM
+       callback(err, 'Unable to get database connection.' + err);
+       return;
+       }
+       var sql = "DELETE FROM PARAMETERS WHERE name=" + connection.escape(req.query.name);
+
+       console.log(sql);
+       connection.query(sql, function(err,result){
+       connection.release();
+       if(err){
+       callback(err,'Update failed. ' + err );
+                               return;
+       }
+       else
+       {
+       callback(null,'');
+                               return;
+       }
+       }); //end query
+  }); // end getConnection
 }
 
 
@@ -689,29 +727,29 @@ exports.getMetaTable = function(req,res,sql,rdestination,resultObj,privilegeObj)
 
 exports.getVnfProfile = function(req,res,resultObj,privilegeObj){
 
-    pool.getConnection(function(err,connection) {
-
-        if(err){
-            console.error( String(err) ); // ALARM
-            res.render("pages/err", {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
-            return;
-        }
-
-        connection.query("SELECT vnf_type,availability_zone_count,equipment_role "
-            + "FROM VNF_PROFILE ORDER BY VNF_TYPE", function(err, rows)
-        {
-            connection.release();
-            if(err) {
-                res.render("mobility/vnfProfile", {result:{code:'error',msg:'Database Error: '+ String(err)},header:process.env.MAIN_MENU});
-                return;
-            }
-            else {
-                res.render('mobility/vnfProfile', { rows: rows, result:resultObj, privilege:privilegeObj,header:process.env.MAIN_MENU } );
-                return;
-            }
-        }); //end query
-console.log('after query');
-    }); // end getConnection
+       pool.getConnection(function(err,connection)
+       {
+               if(err){
+                       console.error( String(err) ); // ALARM
+                       res.render("pages/err", {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
+                       return;
+               }
+               var sql = "SELECT vnf_type,availability_zone_count,equipment_role FROM VNF_PROFILE ORDER BY VNF_TYPE";
+               console.log(sql);
+               connection.query(sql, function(err, rows)
+               {
+                       connection.release();
+                       if(err) {
+                               res.render("mobility/vnfProfile", {result:{code:'error',msg:'Database Error: '+ String(err)},header:process.env.MAIN_MENU});
+                               return;
+                       }
+                       else {
+                               console.log('render vnfProfile');
+                               res.render('mobility/vnfProfile', { rows: rows, result:resultObj, privilege:privilegeObj,header:process.env.MAIN_MENU } );
+                               return;
+                       }
+               }); //end query
+       }); // end getConnection
 }
 
 
@@ -747,103 +785,102 @@ exports.getVnfPreloadData = function(req,res,dbtable,callback){
 
 
 
-exports.getVnfNetworkData = function(req,res,resultObj,privilegeObj){
-
-
-    pool.getConnection(function(err,connection) {
-
-        if(err){
-            console.error( String(err) ); // ALARM
-            res.render("pages/err", {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
-            return;
-        }
-
-        // Need DB lookup logic here
-        connection.query("SELECT id,svc_request_id,svc_action,status,filename,ts,preload_data "
-            + "FROM PRE_LOAD_VNF_NETWORK_DATA ORDER BY id", function(err, rows)
-        {
-            var msgArray = new Array();
-
-            connection.release();
-            if(err) {
-                msgArray = 'Database Error: '+ String(err);
-                res.render("mobility/vnfPreloadNetworkData", {
-                                       result:{code:'error',msg:msgArray},
-                                       preloadImportDirectory: properties.preloadImportDirectory,
-                                       header:process.env.MAIN_MENU
-                               });
-                return;
-            }
-            else {
-                var retData = [];
-                for( r=0; r<rows.length; r++)
-                {
-                    var rowObj = {};
-                    rowObj.row = rows[r];
-                    if ( rows[r].filename.length > 0 )
-                    {
-                        try{
-                                                       var buffer = rows[r].preload_data;
-                            var decode_buffer = decodeURI(buffer);
-                            var filecontent = JSON.parse(decode_buffer);
-                            rowObj.filecontent = filecontent;
-                            rowObj.network_name = filecontent.input["network-topology-information"]["network-topology-identifier"]["network-name"];
-                            rowObj.network_type = filecontent.input["network-topology-information"]["network-topology-identifier"]["network-type"];
-                        }
-                        catch(error){
-                            msgArray.push('File ' + rows[r].filename + ' has invalid JSON. Error:' + error);
-                        }
-                    }
-                    else {
-                        rowObj.filecontent = '';
-                    }
-                    retData.push(rowObj);
-                }
-                if(msgArray.length>0){
-                    resultObj.code = 'failure';
-                    resultObj.msg = msgArray;
-                }
-                res.render('mobility/vnfPreloadNetworkData', { 
+exports.getVnfNetworkData = function(req,res,resultObj,privilegeObj)
+{ 
+       pool.getConnection(function(err,connection)
+       {
+               if(err){
+                       console.error( String(err) ); // ALARM
+                       res.render("pages/err",
+                               {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
+                       return;
+               }
+               // Need DB lookup logic here
+               var sql = "SELECT id,svc_request_id,svc_action,status,filename,ts,preload_data FROM PRE_LOAD_VNF_NETWORK_DATA ORDER BY id";
+               console.log(sql);
+               connection.query(sql, function(err, rows)
+               {
+                       var msgArray = new Array();
+                       connection.release();
+                       if(err) {
+                               msgArray = 'Database Error: '+ String(err);
+                               res.render("mobility/vnfPreloadNetworkData", {
+                                       result:{code:'error',msg:msgArray},
+                                       privilege:privilegeObj,
+                                       preloadImportDirectory: properties.preloadImportDirectory,
+                                       header:process.env.MAIN_MENU
+                               });
+                               return;
+                       }
+                       else {
+                               var retData = [];
+                               for( r=0; r<rows.length; r++)
+                               {
+                                       var rowObj = {};
+                                       rowObj.row = rows[r];
+                                       if ( rows[r].filename.length > 0 )
+                                       {
+                                               try{
+                                                       var buffer = rows[r].preload_data;
+                                                       var decode_buffer = decodeURI(buffer);
+                                                       var filecontent = JSON.parse(decode_buffer);
+                                                       rowObj.filecontent = filecontent;
+                                                       rowObj.network_name = filecontent.input["network-topology-information"]["network-topology-identifier"]["network-name"];
+                                                       rowObj.network_type = filecontent.input["network-topology-information"]["network-topology-identifier"]["network-type"];
+                                               }
+                                               catch(error){
+                                                       msgArray.push('File ' + rows[r].filename + ' has invalid JSON. Error:' + error);
+                                               }
+                                       }
+                                       else {
+                                               rowObj.filecontent = '';
+                                       }
+                                       retData.push(rowObj);
+                               }//endloop
+                               if(msgArray.length>0){
+                                       resultObj.code = 'failure';
+                                       resultObj.msg = msgArray;
+                               }
+                               res.render('mobility/vnfPreloadNetworkData', { 
                                        retData:retData, 
                                        result:resultObj, 
                                        privilege:privilegeObj,
                                        preloadImportDirectory: properties.preloadImportDirectory,
                                        header:process.env.MAIN_MENU 
                                });
-                return;
-            }
-        }); //end query
-    }); // end getConnection
+                               return;
+                       }
+               }); //end query
+       }); // end getConnection
 }
 
-exports.getVnfData = function(req,res,resultObj,privilegeObj){
-
-
-    pool.getConnection(function(err,connection) {
-
-        if(err){
-            console.error( String(err) ); // ALARM
-            res.render("pages/err", {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
-            return;
-        }
-
-        // Need DB lookup logic here
-        connection.query("SELECT id,svc_request_id,svc_action,status,filename,ts,preload_data "
-            + "FROM PRE_LOAD_VNF_DATA ORDER BY id", function(err, rows) 
+exports.getVnfData = function(req,res,resultObj,privilegeObj)
+{
+       pool.getConnection(function(err,connection)
+       {
+               if(err){
+                       console.error( String(err) ); // ALARM
+                       res.render("pages/err", {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
+                       return;
+               }
+               // Need DB lookup logic here
+               var sql = "SELECT id,svc_request_id,svc_action,status,filename,ts,preload_data FROM PRE_LOAD_VNF_DATA ORDER BY id";
+               console.log(sql);
+               connection.query(sql,function(err, rows) 
                {
                        var msgArray = new Array();
-
-            connection.release();
-            if(err) {
+                       connection.release();
+                       if(err) {
                                msgArray = 'Database Error: '+ String(err);
-                res.render("mobility/vnfPreloadData", {
+                               res.render("mobility/vnfPreloadData", {
                                        result:{code:'error',msg:msgArray},
+                                       privilege:privilegeObj,
                                        preloadImportDirectory: properties.preloadImportDirectory,
                                        header:process.env.MAIN_MENU
                                });
-                return;
-            }
-            else {
+                               return;
+                       }
+                       else {
                                var retData = [];
                                for( r=0; r<rows.length; r++)
                                {
@@ -853,102 +890,101 @@ exports.getVnfData = function(req,res,resultObj,privilegeObj){
                                        {
                                                try{
                                                        var buffer = rows[r].preload_data;
-                            var s_buffer = decodeURI(buffer);
+                                                       var s_buffer = decodeURI(buffer);
                                                        var filecontent = JSON.parse(s_buffer);
                                                        rowObj.filecontent = filecontent;
                                                        rowObj.vnf_name = filecontent.input["vnf-topology-information"]["vnf-topology-identifier"]["vnf-name"];
                                                        rowObj.vnf_type = filecontent.input["vnf-topology-information"]["vnf-topology-identifier"]["vnf-type"];
                                                }
                                                catch(error){
-                            msgArray.push('File ' + rows[r].filename + ' has invalid JSON. Error:' + error);
+                                                       msgArray.push('File ' + rows[r].filename + ' has invalid JSON. Error:' + error);
                                                }
                                        }
                                        else {
                                                rowObj.filecontent = '';
                                        }
                                        retData.push(rowObj);
-                               }
+                               }//endloop
                                if(msgArray.length>0){
                                        resultObj.code = 'failure';
                                        resultObj.msg = msgArray;
                                }
-                res.render('mobility/vnfPreloadData',{ 
-                                               retData:retData, result:resultObj, 
-                                               privilege:privilegeObj,
-                                               header:process.env.MAIN_MENU, 
-                                               preloadImportDirectory: properties.preloadImportDirectory
+                               res.render('mobility/vnfPreloadData',{ 
+                                       retData:retData, result:resultObj, 
+                                       privilege:privilegeObj,
+                                       header:process.env.MAIN_MENU, 
+                                       preloadImportDirectory: properties.preloadImportDirectory
                                });
-                return;
-            }
-        }); //end query
-    }); // end getConnection
+                               return;
+                       }
+               }); //end query
+       }); // end getConnection
 }
 
 
 exports.findAdminUser = function(email,res,callback) {
 
-
        var adminUser={};
-       pool.getConnection(function(err,connection) {
-        if(err){
-                       console.error( String(err) ); // ALARM
-            res.render("pages/login", {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
+       pool.getConnection(function(err,connection)
+       {
+               if(err)
+               {
+      res.render("pages/err", {result:{code:'error', msg:err},header:process.env.MAIN_MENU});
                        return;
-        }
+               }
 
                // Need DB lookup logic here
-               connection.query("SELECT email, AES_DECRYPT(password, '" + enckey + "') password, privilege FROM PORTAL_USERS WHERE email='" + email + "'", function(err, rows) {
+               connection.query("SELECT email, AES_DECRYPT(password, '" + enckey + "') password, privilege FROM PORTAL_USERS WHERE email=" + connection.escape(email), function(err, rows) {
 
                        connection.release();
-               if(!err) {
-                               if ( rows.length > 0 )
-               {
-                       rows.forEach(function(row){
-                       adminUser = {
-                               "email" : row.email,
-                               "password" : row.password,
-                               "privilege" : row.privilege };
-                       });
-                       callback(adminUser);
-                                       return;
-               }else{
-                       console.log("no rows returned");
-                       res.render("pages/login", {result:{code:'error', msg:'User is not in database.'},header:process.env.MAIN_MENU});
-                                       return;
-               }
-            } else {
-                    res.render("pages/err", {result:{code:'error',msg:'Unexpected no rows returned from database. '+ String(err)},header:process.env.MAIN_MENU});
+                       if(err)
+                       {
+       res.render("pages/err", {result:{code:'error', msg:err},header:process.env.MAIN_MENU});
+                               return;
+                       }
+                       if ( rows.length > 0 )
+                       {
+                               rows.forEach(function(row){
+                                       adminUser = {
+                                               "email" : row.email,
+                                               "password" : row.password,
+                                               "privilege" : row.privilege };
+                                       });
+                               callback(adminUser);
+                               return;
+                       }
+                       else{
+               res.render("pages/err", {result:{code:'error', msg:'User is not in database.'},header:process.env.MAIN_MENU});
                                        return;
                        }
                }); //end query
-    }); // end getConnection
+  }); // end getConnection
 }
 
 
 exports.addRow = function(sql,req,res,callback){
 
-    console.log(sql);
-
-    pool.getConnection(function(err,connection) {
+       console.log(sql);
 
-        if(err){
-            console.error( String(err) ); // ALARM
-            callback(err, 'Unable to get database connection.' + err);
-            return;
-        }
+       pool.getConnection(function(err,connection) {
 
-        connection.query(sql, function(err,result){
-            connection.release();
-               if(err){
-                    console.debug('Database operation failed. ' + err );
-                    callback(err,'Database operation failed. ' + err );
-               }
-               else
-               {
-                       callback(null, result.affectedRows);
-               }
-       }); //end query
-    }); // end getConnection
+               if(err){
+                       console.error( String(err) ); // ALARM
+                       callback(err, 'Unable to get database connection.' + err);
+                       return;
+               }
+               connection.query(sql, function(err,result){
+                       connection.release();
+                       if(err){
+                               console.debug('Database operation failed. ' + err );
+                               callback(err,'Database operation failed. ' + err );
+                       }
+                       else
+                       {
+                               callback(null, result.affectedRows);
+                       }
+               }); //end query
+       }); // end getConnection
 }
 
 
@@ -993,6 +1029,121 @@ exports.addVnfProfile = function(row,res,callback){
     }); // end getConnection
 }
 
+exports.deleteVnfProfile = function(req,res,callback){
+
+       var privilegeObj = req.session.loggedInAdmin;
+       var rows={};
+
+       pool.getConnection(function(err,connection) {
+
+               var sql = 'DELETE FROM VNF_PROFILE WHERE vnf_type = ' + connection.escape(req.sanitize(req.query.vnf_type));
+               console.log(sql);
+               if(err){
+                       console.error( String(err) ); // ALARM
+                       res.render("pages/err", {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
+                       return;
+               }
+
+               //var vt = req.sanitize(req.query.vnf_type);
+               //var vnf_type = { vnf_type: vt };
+               //var vnf_type = connection.escape(vt);
+               //console.log('type='+vnf_type);
+               //connection.query('DELETE FROM VNF_PROFILE WHERE vnf_type = ?', vnf_type, function(err,result)
+               connection.query(sql, function(err,result)
+               {
+                       connection.release();
+      if (err) {
+        callback(err,'Database operation failed. ' + err );
+                               return;
+      }
+      else
+       {
+                               if (result.affectedRows == 0)
+                               {
+                                       callback('No rows deleted.');
+                                       return;
+                               }
+                               console.log('rows deleted: ' + result.affectedRows);
+                               callback(null, result.affectedRows);
+                               return;
+       }
+               });
+       }); // end of getConnection
+};
+
+exports.deleteVnfData = function(req,res,callback){
+
+       var privilegeObj = req.session.loggedInAdmin;
+       var rows={};
+
+       pool.getConnection(function(err,connection) {
+
+               var sql = 'DELETE FROM PRE_LOAD_VNF_DATA WHERE id =' + connection.escape(req.sanitize(req.query.id));
+               console.log(sql);
+               if(err){
+                       console.error( String(err) ); // ALARM
+                       res.render("pages/err", {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
+                       return;
+               }
+
+               connection.query(sql, function(err,result)
+               {
+                       connection.release();
+      if (err) {
+        callback(err,'Database operation failed. ' + err );
+                               return;
+      }
+      else
+       {
+                               if (result.affectedRows == 0)
+                               {
+                                       callback('No rows deleted.');
+                                       return;
+                               }
+                               console.log('rows deleted: ' + result.affectedRows);
+                               callback(null, result.affectedRows);
+                               return;
+       }
+               });
+       }); // end of getConnection
+};
+
+exports.deleteVnfNetworkData = function(req,res,callback){
+
+       var privilegeObj = req.session.loggedInAdmin;
+       var rows={};
+
+       pool.getConnection(function(err,connection) {
+
+               var sql = 'DELETE FROM PRE_LOAD_VNF_NETWORK_DATA WHERE id =' + connection.escape(req.sanitize(req.query.id));
+               console.log(sql);
+               if(err){
+                       console.error( String(err) ); // ALARM
+                       res.render("pages/err", {result:{code:'error', msg:"Unable to get database connection. "+ String(err)},header:process.env.MAIN_MENU});
+                       return;
+               }
+
+               connection.query(sql, function(err,result)
+               {
+                       connection.release();
+      if (err) {
+        callback(err,'Database operation failed. ' + err );
+                               return;
+      }
+      else
+       {
+                               if (result.affectedRows == 0)
+                               {
+                                       callback('No rows deleted.');
+                                       return;
+                               }
+                               console.log('rows deleted: ' + result.affectedRows);
+                               callback(null, result.affectedRows);
+                               return;
+       }
+               });
+       }); // end of getConnection
+};
 
 // Add to SVC_LOGIC table
 exports.addDG = function(_module, version, rpc, mode, xmlfile, req,res){
@@ -1059,131 +1210,193 @@ exports.addDG = function(_module, version, rpc, mode, xmlfile, req,res){
     }); // end of getConnection
 };
 
-exports.activate = function(req,res,_module,rpc,version,mode,callback){
+exports.updatePreloadStatus = function(sql,req,res,_module,rpc,version,mode,callback){
 
-       var sql = "UPDATE SVC_LOGIC SET active=\'Y\' WHERE module=\'"
-            + _module + "' AND rpc=\'"
-            + rpc + "' AND version=\'"
-            +  version + "' AND mode=\'"
-            +  mode + "'";
+       pool.getConnection(function(err,connection) {
+    
+    if(err){
+                       console.error( String(err) ); // ALARM
+      callback(err, 'Unable to get database connection.' + err);
+                       return;
+    }
 
-       console.log('SQL='+sql);
+               var sql = _sql + " WHERE id = " + connection.escape(req.query.id);
 
-    pool.getConnection(function(err,connection) {
+               console.log(sql);
+    connection.query(sql, function(err,result){
+
+       connection.release();
+                       if(err){
+        callback(err, 'Unable to get database connection.' + err);
+                               return;
+      }
+      else
+      {
+                               if (result.affectedRows == 0)
+                               {
+                                       callback('Unable to update preload status.');
+                                       return;
+                               }
+                               callback(null, result.affectedRows);
+                               return;
+      }
+    }); //end query
+  }); // end getConnection
+}
+
+exports.activate = function(req,res,_module,rpc,version,mode,callback){
+
+       pool.getConnection(function(err,connection) {
     
-        if(err){
+    if(err){
                        console.error( String(err) ); // ALARM
-            callback(err, 'Unable to get database connection.' + err);
+      callback(err, 'Unable to get database connection.' + err);
                        return;
-        }
+    }
 
-        connection.query(sql, function(err,result){
+               var sql = "UPDATE SVC_LOGIC SET active=\'Y\' WHERE "
+                       + "module = " + connection.escape(_module) + " AND "
+                       + "rpc = " + connection.escape(rpc) + " AND "
+                       + "version = " + connection.escape(version) + " AND "
+                       + "mode = " + connection.escape(mode);
 
-            connection.release();
+               console.log('SQL='+sql);
+    connection.query(sql, function(err,result){
+
+       connection.release();
                        if(err){
-               callback(err, 'Unable to get database connection.' + err);
-               }
-            else
-            {
-                 callback(null,'');
-            }
-       }); //end query
-    }); // end getConnection
+        callback(err, 'Unable to get database connection.' + err);
+                               return;
+      }
+      else
+      {
+                               if (result.affectedRows == 0)
+                               {
+                                       callback('Unable to activate directed graph.');
+                                       return;
+                               }
+                               console.log('rows deleted: ' + result.affectedRows);
+                               callback(null, result.affectedRows);
+                               return;
+      }
+    }); //end query
+  }); // end getConnection
 }
 
 
 exports.deactivate = function(req,res,_module,rpc,version,mode,callback){
 
-    var sql = "UPDATE SVC_LOGIC SET active=\'N\' WHERE module=\'"
-            + _module + "' AND rpc=\'"
-            + rpc + "' AND version=\'"
-            +  version + "' AND mode=\'"
-            +  mode + "'";
-
-       console.log('SQL='+sql);
-
-    pool.getConnection(function(err,connection) {
+       pool.getConnection(function(err,connection) {
 
-        if(err){
+               if(err){
                        console.error( String(err) ); // ALARM
-            callback(err, 'Unable to get database connection.' + err);
+      callback(err, 'Unable to get database connection.' + err);
                        return;
-        }
+    }
 
-        connection.query(sql, function(err,result){
+    var sql = "UPDATE SVC_LOGIC SET active=\'N\' WHERE "
+                       + "module = " + connection.escape(_module) + " AND "
+                       + "rpc = " + connection.escape(rpc) + " AND "
+                       + "version = " + connection.escape(version) + " AND "
+                       + "mode = " + connection.escape(mode);
 
-            connection.release();
-            if(err){
-                callback(err, 'Unable to get database connection.' + err);
-            }
-            else
-            {
-                 callback(null,'');
-            }
-       }); //end query
-    }); // end getConnection
+               console.log('SQL='+sql);
+               connection.query(sql, function(err,result){
+
+                       connection.release();
+      if(err){
+        callback(err, 'Unable to get database connection.' + err);
+                               return;
+      }
+      else
+      {
+                               if (result.affectedRows == 0)
+                               {
+                                       callback('Unable to deactivate directed graph.');
+                                       return;
+                               }
+                               console.log('rows deleted: ' + result.affectedRows);
+                               callback(null, result.affectedRows);
+                               return;
+      }
+    }); //end query
+  }); // end getConnection
 }
 
 exports.global_deactivate = function(req,res,_module,rpc,mode,callback){
 
-    var sql = "UPDATE SVC_LOGIC SET active=\'N\' WHERE module=\'"
-            + _module + "' AND rpc=\'"
-            + rpc + "' AND mode=\'"
-            +  mode + "'";
-
+       pool.getConnection(function(err,connection) {
 
-    pool.getConnection(function(err,connection) {
+               if(err){
+      callback(err, 'Unable to get database connection.' + err);
+      return;
+    }
 
-        if(err){
-            callback(err, 'Unable to get database connection.' + err);
-            return;
-        }
+               // deactivate all versions
+    var sql = "UPDATE SVC_LOGIC SET active=\'N\' WHERE "
+                       + "module = " + connection.escape(_module) + " AND "
+                       + "rpc = " + connection.escape(rpc) + " AND "
+                       + "mode = " + connection.escape(mode);
 
-        connection.query(sql, function(err,result){
+               console.log(sql);
+               connection.query(sql, function(err,result){
 
-            connection.release();
-            if(err){
-                callback(err, err);
-            }
-            else
-            {
-                 callback(null,'');
-            }
-       }); //end query
-    }); // end getConnection
+                       connection.release();
+      if(err){
+        callback(err, err);
+                               return;
+                       }
+      else
+      {
+                               if (result.affectedRows == 0)
+                               {
+                                       callback('Unable to set all versions to deactivate.');
+                                       return;
+                               }
+        callback(null,result.affectedRows);
+                               return;
+      }
+    }); //end query
+  }); // end getConnection
 }
 
 
 exports.deleteDG = function(req,res,_module,rpc,version,mode,callback){
 
-       var sql = "DELETE FROM SVC_LOGIC WHERE module=\'"
-            + _module + "' AND rpc=\'"
-            + rpc + "' AND version=\'"
-            +  version + "' AND mode=\'"
-            +  mode + "'";
-
-       console.log('SQL='+sql);
-
-    pool.getConnection(function(err,connection) {
+       pool.getConnection(function(err,connection) {
 
-        if(err){
+               if(err){
                        console.error( String(err) ); // ALARM
-            callback(err, 'Unable to get database connection.' + err);
+      callback(err, 'Unable to get database connection.' + err);
                        return;
-        }
+    }
 
-        connection.query(sql, function(err,result){
+               var sql = "DELETE FROM SVC_LOGIC WHERE "
+                       + "module = " + connection.escape(_module) + " AND "
+                       + "rpc = " + connection.escape(rpc) + " AND "
+                       + "version = " + connection.escape(version) + " AND "
+                       + "mode = " + connection.escape(mode);
 
-            connection.release();
-            if(err){
-                callback(err, 'Unable to get database connection.' + err);
-            }
-            else
-            {
-                 callback(null,'');
-            }
-       }); //end query
-    }); // end getConnection
+               console.log(sql);
+    connection.query(sql, function(err,result){
+
+       connection.release();
+      if(err){
+       callback(err, 'Unable to get database connection.' + err);
+                               return;
+      }
+      else
+      {
+                               if (result.affectedRows == 0)
+                               {
+                                       callback('No rows deleted.');
+                                       return;
+                               }
+        callback(null,result.affectedRows);
+                               return;
+      }
+    }); //end query
+  }); // end getConnection
 }