From eb1fc154015d8477041aee70a05c2561f8983196 Mon Sep 17 00:00:00 2001 From: Joey Lai Date: Fri, 20 Jan 2017 12:32:39 +0100 Subject: [PATCH 01/11] script on right lines --- website/public/login.php | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/website/public/login.php b/website/public/login.php index 65babdf..3d37da7 100644 --- a/website/public/login.php +++ b/website/public/login.php @@ -7,6 +7,18 @@ include_once("../queries/checkInput.php") ?> + + - - - From bfdf9e989b2a724f505975d9ab79ccef106e937d Mon Sep 17 00:00:00 2001 From: "K. Nobel" Date: Fri, 20 Jan 2017 13:07:47 +0100 Subject: [PATCH 02/11] Fixed profile page, now shows current user when no username is given in get variable. --- website/public/profile.php | 61 ++++++------------------------------ website/queries/nicetime.php | 39 +++++++++++++++++++++++ 2 files changed, 49 insertions(+), 51 deletions(-) create mode 100644 website/queries/nicetime.php diff --git a/website/public/profile.php b/website/public/profile.php index f3f499b..0fe2feb 100644 --- a/website/public/profile.php +++ b/website/public/profile.php @@ -1,45 +1,16 @@ + + + + + + + $unix_date) { - $difference = $now - $unix_date; - $tense = "geleden"; - } else { - $difference = $unix_date - $now; - $tense = "vanaf nu"; - } - - for($i = 0; $difference >= $lengths[$i] && $i < count($lengths) - 1; $i++) { - $difference /= $lengths[$i]; - } - - $difference = round($difference); - - if($difference != 1) { - $period = $multiple_periods[$i]; - } else { - $period = $single_periods[$i]; - } - - return "$difference $period $tense"; -} +include("../queries/nicetime.php"); if(empty($_GET["username"])) { $userID = $_SESSION["userID"]; @@ -52,18 +23,6 @@ $profile_friends = selectAllFriends($userID); $profile_groups = selectAllUserGroups($userID); $posts = selectAllUserPosts($userID); -?> - - - - - - - - - $unix_date) { +$difference = $now - $unix_date; +$tense = "geleden"; +} else { +$difference = $unix_date - $now; +$tense = "vanaf nu"; +} + +for($i = 0; $difference >= $lengths[$i] && $i < count($lengths) - 1; $i++) { +$difference /= $lengths[$i]; +} + +$difference = round($difference); + +if($difference != 1) { +$period = $multiple_periods[$i]; +} else { +$period = $single_periods[$i]; +} + +return "$difference $period $tense"; +} \ No newline at end of file From 61c148e127bade2b031d75264504a84754b70200 Mon Sep 17 00:00:00 2001 From: Lars van Hijfte Date: Fri, 20 Jan 2017 13:30:40 +0100 Subject: [PATCH 03/11] Made chat xss prove --- website/public/API/loadMessages.php | 7 +++---- website/public/API/sendMessage.php | 15 +++++++-------- website/public/js/chat.js | 6 +----- 3 files changed, 11 insertions(+), 17 deletions(-) diff --git a/website/public/API/loadMessages.php b/website/public/API/loadMessages.php index fef9db7..1c6b942 100644 --- a/website/public/API/loadMessages.php +++ b/website/public/API/loadMessages.php @@ -3,11 +3,10 @@ session_start(); require_once("../../queries/connect.php"); require_once("../../queries/private_message.php"); +require_once("../../queries/checkInput.php"); if (isset($_POST["lastID"]) && $_POST["lastID"] != "") { - - echo getNewChatMessages($_POST["lastID"], $_POST["destination"]); - + echo getNewChatMessages(test_input($_POST["lastID"]), test_input($_POST["destination"])); } else { - echo getOldChatMessages($_POST["destination"]); + echo getOldChatMessages(test_input($_POST["destination"])); } \ No newline at end of file diff --git a/website/public/API/sendMessage.php b/website/public/API/sendMessage.php index d1bc758..c5d47d1 100644 --- a/website/public/API/sendMessage.php +++ b/website/public/API/sendMessage.php @@ -3,16 +3,15 @@ session_start(); require_once("../../queries/connect.php"); require_once("../../queries/private_message.php"); +require_once("../../queries/checkInput.php"); -if (isset($_POST["destination"]) && - isset($_POST["content"])) { - - if (sendMessage($_POST["destination"], $_POST["content"])) { - echo $_POST["content"] . " is naar " . $_POST["destination"] . " gestuurd"; +if (!empty(test_input($_POST["destination"])) && + !empty(test_input($_POST["content"]))) { + if (sendMessage(test_input($_POST["destination"]), test_input($_POST["content"]))) { + echo 1; } else { - echo "YOU FAILED!!!"; + echo 0; } - } else { - echo "maybe dont try to hax the system?"; + echo 0; } \ No newline at end of file diff --git a/website/public/js/chat.js b/website/public/js/chat.js index 75eb32e..6c420a1 100644 --- a/website/public/js/chat.js +++ b/website/public/js/chat.js @@ -10,7 +10,6 @@ function loadMessages() { $("#lastIDForm").serialize() ).done(function(data) { if (data && data != "[]") { - console.log(data); messages = JSON.parse(data); addMessages(messages); $("#lastID").val(messages[messages.length - 1].messageID); @@ -23,13 +22,10 @@ function loadMessages() { function sendMessage() { - console.log($("#sendMessageForm").serialize()); $.post( "API/sendMessage.php", $("#sendMessageForm").serialize() - ).done(function( data ) { - console.log(data); - }); + ); $("#newContent").val(""); } From b7620fe4dbe3cdaf595eb71087b485e4bbeaf81e Mon Sep 17 00:00:00 2001 From: "K. Nobel" Date: Fri, 20 Jan 2017 14:05:20 +0100 Subject: [PATCH 04/11] Moved .htaccess --- website/.htaccess | 14 -------------- website/public/.htaccess | 14 ++++++++++++++ 2 files changed, 14 insertions(+), 14 deletions(-) delete mode 100644 website/.htaccess create mode 100644 website/public/.htaccess diff --git a/website/.htaccess b/website/.htaccess deleted file mode 100644 index 5c0147b..0000000 --- a/website/.htaccess +++ /dev/null @@ -1,14 +0,0 @@ -Options +FollowSymLinks -RewriteEngine On - -ErrorDocument 404 /error404.jpg - -RewriteCond %{SCRIPT_FILENAME} !-d -RewriteCond %{SCRIPT_FILENAME} !-f - -# Resolve .php file for extensionless php urls -RewriteRule ^([^/.]+)$ $1.php [L] - -RewriteRule ^([^/.]+)\/$ $1.php [L] - -RewriteRule ^profile/([A-z0-9]+)\/?$ profile.php?username=$1 [NC] \ No newline at end of file diff --git a/website/public/.htaccess b/website/public/.htaccess new file mode 100644 index 0000000..69fda24 --- /dev/null +++ b/website/public/.htaccess @@ -0,0 +1,14 @@ +#Options +FollowSymLinks +#RewriteEngine On +# +#ErrorDocument 404 /error404.jpg +# +#RewriteCond %{SCRIPT_FILENAME} !-d +#RewriteCond %{SCRIPT_FILENAME} !-f +# +## Resolve .php file for extensionless php urls +#RewriteRule ^([^/.]+)$ $1.php [L] +# +#RewriteRule ^([^/.]+)\/$ $1.php [L] +# +#RewriteRule ^profile/([A-z0-9]+)\/?$ profile.php?username=$1 [NC] \ No newline at end of file From f9c55323ad54047ab80381499fef430b3f49fd8b Mon Sep 17 00:00:00 2001 From: "K. Nobel" Date: Fri, 20 Jan 2017 14:09:04 +0100 Subject: [PATCH 05/11] Made friends and groups clickable. --- website/views/profile.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/website/views/profile.php b/website/views/profile.php index 6c273a6..47b880d 100644 --- a/website/views/profile.php +++ b/website/views/profile.php @@ -13,7 +13,7 @@

fetch()) { - echo "${friend["username"]}"; + echo "${friend["username"]}"; } @@ -29,7 +29,7 @@

fetch()) { - echo "${group["name"]}s logo"; + echo "${group["name"]}s logo"; } if($groups->rowCount() === 0) { From 0e5f7dc9fb4e7581bef3d1f85ef1231ad9ad71c0 Mon Sep 17 00:00:00 2001 From: "K. Nobel" Date: Fri, 20 Jan 2017 14:10:32 +0100 Subject: [PATCH 06/11] Fixed no friends text and no groups text. --- website/views/profile.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/website/views/profile.php b/website/views/profile.php index 47b880d..83ac799 100644 --- a/website/views/profile.php +++ b/website/views/profile.php @@ -17,7 +17,7 @@ } - if($friends->rowCount() === 0) { + if($profile_friends->rowCount() === 0) { echo "

Deze gebruiker heeft nog geen vrienden gemaakt.

"; } ?> @@ -32,7 +32,7 @@ echo "${group["name"]}s logo"; } - if($groups->rowCount() === 0) { + if($profile_groups->rowCount() === 0) { echo "

Deze gebruiker is nog geen lid van een groep.

"; } ?> From adb7f2f37db78f7099b3fedbcfe48d783c9c91a7 Mon Sep 17 00:00:00 2001 From: "K. Nobel" Date: Fri, 20 Jan 2017 14:31:49 +0100 Subject: [PATCH 07/11] Fixed .htaccess --- website/public/.htaccess | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/website/public/.htaccess b/website/public/.htaccess index 69fda24..5c0147b 100644 --- a/website/public/.htaccess +++ b/website/public/.htaccess @@ -1,14 +1,14 @@ -#Options +FollowSymLinks -#RewriteEngine On -# -#ErrorDocument 404 /error404.jpg -# -#RewriteCond %{SCRIPT_FILENAME} !-d -#RewriteCond %{SCRIPT_FILENAME} !-f -# -## Resolve .php file for extensionless php urls -#RewriteRule ^([^/.]+)$ $1.php [L] -# -#RewriteRule ^([^/.]+)\/$ $1.php [L] -# -#RewriteRule ^profile/([A-z0-9]+)\/?$ profile.php?username=$1 [NC] \ No newline at end of file +Options +FollowSymLinks +RewriteEngine On + +ErrorDocument 404 /error404.jpg + +RewriteCond %{SCRIPT_FILENAME} !-d +RewriteCond %{SCRIPT_FILENAME} !-f + +# Resolve .php file for extensionless php urls +RewriteRule ^([^/.]+)$ $1.php [L] + +RewriteRule ^([^/.]+)\/$ $1.php [L] + +RewriteRule ^profile/([A-z0-9]+)\/?$ profile.php?username=$1 [NC] \ No newline at end of file From 6478ce920f56a1fe1b004b99ef253cdc6fe10a1e Mon Sep 17 00:00:00 2001 From: "K. Nobel" Date: Fri, 20 Jan 2017 14:40:21 +0100 Subject: [PATCH 08/11] Fixed .htaccess --- website/public/.htaccess | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/website/public/.htaccess b/website/public/.htaccess index 5c0147b..f08898a 100644 --- a/website/public/.htaccess +++ b/website/public/.htaccess @@ -9,6 +9,4 @@ RewriteCond %{SCRIPT_FILENAME} !-f # Resolve .php file for extensionless php urls RewriteRule ^([^/.]+)$ $1.php [L] -RewriteRule ^([^/.]+)\/$ $1.php [L] - -RewriteRule ^profile/([A-z0-9]+)\/?$ profile.php?username=$1 [NC] \ No newline at end of file +RewriteRule ^profile/([A-z0-9]+)$ profile.php?username=$1 [NC] \ No newline at end of file From ca28724274047a90649944303022a2d503cd45f7 Mon Sep 17 00:00:00 2001 From: "K. Nobel" Date: Fri, 20 Jan 2017 14:48:00 +0100 Subject: [PATCH 09/11] Fixed script tags and @import. Has to be absolute path in order to work with the .htaccess file. --- website/public/profile.php | 3 ++- website/views/head.php | 17 ++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/website/public/profile.php b/website/public/profile.php index 0fe2feb..6ede201 100644 --- a/website/public/profile.php +++ b/website/public/profile.php @@ -2,8 +2,9 @@ + diff --git a/website/views/head.php b/website/views/head.php index bb6eec4..4347650 100644 --- a/website/views/head.php +++ b/website/views/head.php @@ -1,17 +1,16 @@ MyHyvesbook+ - - - - + + + Date: Fri, 20 Jan 2017 15:02:05 +0100 Subject: [PATCH 10/11] Changed links to absolute path. --- website/views/adminpanel.php | 2 +- website/views/header.php | 12 ++++++------ website/views/login-view.php | 4 ++-- website/views/login_head.php | 6 +++--- website/views/menu.php | 2 +- website/views/profile.php | 2 +- website/views/register-view.php | 2 +- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/website/views/adminpanel.php b/website/views/adminpanel.php index fde8237..e8efe6f 100644 --- a/website/views/adminpanel.php +++ b/website/views/adminpanel.php @@ -3,7 +3,7 @@ Admin Panel - +
diff --git a/website/views/login-view.php b/website/views/login-view.php index 33fa7e9..7a023f0 100644 --- a/website/views/login-view.php +++ b/website/views/login-view.php @@ -1,6 +1,6 @@
MyHyvesbook+
@@ -46,6 +46,6 @@
diff --git a/website/views/login_head.php b/website/views/login_head.php index a41e87e..645f919 100644 --- a/website/views/login_head.php +++ b/website/views/login_head.php @@ -3,9 +3,9 @@ MyHyvesbook+ + href="/styles/main.css"> - + href="/styles/index.css"> + diff --git a/website/views/menu.php b/website/views/menu.php index 88ae076..c6b030a 100644 --- a/website/views/menu.php +++ b/website/views/menu.php @@ -51,7 +51,7 @@ echo "
  • -
    +
    - -