Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get started #1

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Get started #1

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0ee6df3
initial prototype of backend andd admin apnnel
nkkumawat Aug 14, 2017
e453857
login page admin page created , speaker and video details insertion …
nkkumawat Aug 14, 2017
b450342
fix some issues which are from ansul sir , sanitizition before sql i…
nkkumawat Aug 15, 2017
4d5bffb
Added delete speaker and video features
nkkumawat Aug 18, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 29 additions & 8 deletions app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ var bodyParser = require('body-parser');
var session= require('express-session');
var multer = require('multer');
var mysql = require('mysql');
var sanitizeHtml = require('sanitize-html');
Copy link
Collaborator Author

@AnshulMalik AnshulMalik Aug 15, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is cool, we'd also like to prevent sql injections

var multiparty = require('multiparty');
var con = mysql.createConnection({
host: "localhost",
user: "root",
Expand All @@ -21,7 +23,7 @@ con.connect(function (err) {
});
app.use(express.static(path.join(__dirname, 'www')));
app.use(bodyParser.json() );
app.use(bodyParser.urlencoded({ extended: true}));
app.use(bodyParser.urlencoded({extended: true}));
app.use(session({
secret: 'ted-x-gawds',
resave: true,
Expand All @@ -32,7 +34,7 @@ var Storage = multer.diskStorage({
callback(null, "./www/images");
},
filename: function(req, file, callback) {
callback(null, file.fieldname + "_" + Date.now() + "_" + file.originalname);
callback(null, sanitizeHtml(req.body.speakername)+".jpg");
}
});
var upload = multer({
Expand Down Expand Up @@ -73,9 +75,8 @@ app.post("/speakerinsert", function(req, res) {
if (err) {
return res.end("Something went wrong!");
}
return res.end("File uploaded sucessfully!.");
insertSpeaker(req , res);
});
insertSpeaker(req , res);
});
app.get('/logout', function (req, res) {
req.session.destroy();
Expand All @@ -95,10 +96,15 @@ app.post('/blog' , function (req , res) {
res.send(jsonData);
});
});
app.post("/videoinsert", function(req, res) {
insertVideo(req , res);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Prefer not to use create functions if you are not reusing the code. Insert the code here itself.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You used the same style of coding everywhere. Change it wherever required.

});
function login(req,res){
var post = req.body;
Copy link
Member

@rewanthtammana rewanthtammana Aug 15, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use appropriate names is wherever required. Its the standard way of coding.

const body = req.body

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

var username = post.user;
var password = post.password;
username = sanitizeHtml(username);
password = sanitizeHtml(password);
var sql = "SELECT * FROM login WHERE username='"+username+"'";
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should play safe here, you must have heard of SQL Injection. @rewanth1997 knows better.
Let's sanitize user input before sending it to mysql.

con.query(sql, function (err, result, fields) {
var jsonString = JSON.stringify(result);
Expand All @@ -117,13 +123,28 @@ function insertSpeaker(req , res ) {
var name = post.speakername;
var topic = post.topic;
var description = post.description;
var sql = "INSERT INTO speaker(name, topic, description, pic_url) values('"+name+"','"+topic+"','"+description+"','/images/"+post.images+"')";
name = sanitizeHtml(name);
topic = sanitizeHtml(topic);
description = sanitizeHtml(description);
var sql = "INSERT INTO speaker(name, topic, description, pic_url) values('"+name+"','"+topic+"','"+description+"','/images/"+name+".jpg')";
con.query(sql, function (err, result, fields) {
res.redirect('/admin');
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stick with one convention, either double or single quotes.

A linter will be really helpful.

});
}
function insertVideo(req , res ) {
var post = req.body;
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's use let and const instead of var

var title = post.title;
var description = post.description;
var url = post.url;
title = sanitizeHtml(title);
description = sanitizeHtml(description);
var sql = "INSERT INTO videos(title, description, video_url) values('"+title+"','"+description+"','"+url+"')";
Copy link
Member

@rewanthtammana rewanthtammana Aug 15, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

url variable is not sanitized. This type of SQL query is easily prone to attacks. Make sure to sanitize each and every parameter.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

con.query(sql, function (err, result, fields) {
console.log(result);
res.redirect('/admin');
});
}
// Starting Server
server.listen(3000, function(){
const port = process.env.PORT || 3000;
server.listen(port, function(){
console.log('listening on *:3000');
});

6 changes: 4 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
"description": "backend for tedx nit k",
"main": "app.js",
"scripts": {
"test": "node app.js"
"start": "node app.js"
},
"author": "Narendra and Rishabh",
"license": "ISC",
Expand All @@ -14,8 +14,10 @@
"express": "^4.15.3",
"express-session": "^1.15.3",
"jquery": "^3.2.1",
"multer": "^1.2.0",
"multiparty": "^4.1.3",
"mysql": "^2.13.0",
"path": "^0.12.7",
"multer": "^1.2.0"
"sanitize-html": "^1.14.1"
}
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add new lines at EOF, asap.

8 changes: 4 additions & 4 deletions www/admin.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Admin Pannel</title>
<title>Admin Panel</title>
<link rel="stylesheet" href="/css/bootstrap.min.css">
<link rel="stylesheet" href="/css/main.css">
</head>
Expand All @@ -27,7 +27,7 @@
</ul>
<div class="tab-content">
<div id="menu1" class="tab-pane fade in active" >
<form class="form-inline" action="/speakerinsert" method="post" >
<form class="form-inline" action="/speakerinsert" method="post" enctype="multipart/form-data" >
<div class="form-group">
<input type="text" name="speakername" placeholder="Name" class="form-control fields" id="name">
</div><br><br>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Prefer to write new tags in a new line. Do not mix everything.

Expand All @@ -37,7 +37,7 @@
<div class="form-group">
<textarea type="text" name="description" placeholder="Description" class="form-control fields" id="description"></textarea>
</div><br><br>
<input type="file" placeholder="File" name="images" multiple id="file">
<input type="file" placeholder="File" name="images" multiple id="file">
<br>
<button type="submit" class="btn btn-default">Submit</button>
</form>
Expand Down Expand Up @@ -72,4 +72,4 @@
});
</script>
</body>
</html>
</html>
2 changes: 1 addition & 1 deletion www/blog.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,4 +21,4 @@
});
</script>
</body>
</html>
</html>
2 changes: 1 addition & 1 deletion www/login.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,4 +37,4 @@ <h2 class="form-signin-heading">TEDx NIT Kurukshetra</h2>
});
</script>
</body>
</html>
</html>
4 changes: 3 additions & 1 deletion www/speaker.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
<head>
<meta charset="UTF-8">
<title>Speakers</title>
<link rel="stylesheet" href="/css/bootstrap.min.css">
<link rel="stylesheet" href="/css/main.css">
</head>
<body>
<div class="container">
Expand All @@ -21,4 +23,4 @@
});
</script>s
</body>
</html>
</html>