handlebars.js: Access has been denied to resolve the property "img" because it is not an "own property" of its parent.

Hello! I am a new in Node.js

Please, help me to rewrite my code

I have this problem with express-handlebars and mongoose

I tried to solve this problem with this webpage

But I got “Cannot find module ‘@handlebars/allow-prototype-access’” warning I am a new to rewrite it now, just help me, please!

index.js file


const express = require("express");
const path = require('path');
const mongoose = require('mongoose');
const exphbs =  require('express-handlebars');
const homeRouts = require('./routes/home');
const cartRoutes = require('./routes/cart');
const addRoutes = require('./routes/add');
const coursesRoutes = require('./routes/courses');

const app = express();
const hbs = exphbs.create({
  defaultLayout: 'main', 
  extname: 'hbs',
});
app.engine('hbs', hbs.engine); 
app.set('view engine', 'hbs');
app.set('views', 'views');

app.use(express.static(path.join(__dirname, 'public')));
app.use(express.urlencoded({extended: true}));
app.use('/', homeRouts);
app.use('/add', addRoutes);
app.use('/courses', coursesRoutes);
app.use('/cart', cartRoutes);

const PORT = process.env.PORT || 3000;

async function start() {
  try {
    const url = `****`;
    await mongoose.connect(url, {useUnifiedTopology: true, useNewUrlParser: true, useCreateIndex: true});
    app.listen(PORT, () => {
      console.log(`Listen to ${PORT}`);
    });
  } catch(e) {
    console.log(e)
  } 
};

start();

package.json file

{
...
  "dependencies": {
    "express": "^4.17.1",
    "express-handlebars": "^3.1.0",
    "handlebars": "^4.7.2",
    "mongoose": "^5.8.11",
    "uuid": "^3.4.0"
  },
  "devDependencies": {
    "nodemon": "^2.0.2"
  }
}

About this issue

Original URL
State: closed
Created 4 years ago
Comments: 23

Most upvoted comments

The rest of your code looks good, as long as your files have the extension .hbs. Try the following:

Run

npm install @handlebars/allow-prototype-access

add the following to the beginning of of your file.

const Handlebars = require('handlebars')
const {allowInsecurePrototypeAccess} = require('@handlebars/allow-prototype-access')

change the line

const hbs = exphbs.create({
  defaultLayout: 'main',  
  extname: 'hbs',
});

const hbs = exphbs.create({
  defaultLayout: 'main', 
  extname: 'hbs',
  handlebars: allowInsecurePrototypeAccess(Handlebars)
});

+175

nknapp on Feb 5, 2020

You helped me a lot! Thank you very much! You made me believe in miracles.

xreider on Feb 5, 2020

If you allow your users to create templates and execute those templates in your Node.js server, then your users may be able to crash your machine, or possibly inject code (if there is a new way of doing so, the publicly known ways should still be impossible with this setting).

nknapp on Apr 23, 2020

Thank for ur advice:)

BigUhoTape on Feb 6, 2020

Nils, that fix worked for me, I appreciate the help. I am indeed using .handlebars as my extension type for my templates. Providing ‘hbs’ as an argument even when using .handelbars as your extension name when using just the express-handlebars was working (and is actually what the express-handlebars documentation states) but I guess when using this updated package the app.set('view engine', ARG2) must be paired with the exact extension name. I appreciate your help on this, thank you.

craj1031tx on Feb 5, 2020

You are using

app.engine('hbs', ...

in one place and

app.set('view engine', 'handlebars')

in the other. Try using either handlebars or hbs, but do not mix

Update: Sorry, no, this is not the problem. I have used this code in the same way. I have to test it.

Update 2: I wasn’t that wrong… The solution is to use app.engine('handlebars', ...). You need to do this if you use .handlebars as extension of your views, and not .hbs.

nknapp on Feb 4, 2020