stanleymasinde / events254-api-archive Goto Github PK

					'events.startDate AS eventDate', // TODO: change this to start date

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/ticketController.js#L168

When getting the current authenticated user, an undefined parameter is passed to the database when the token is not available.

• validate the token header before trying to get the user information from the database.

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/database/migrations/20201201194502_create_groups_table.cjs#L21

					// TODO this is a temp fix

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/groupController.js#L312

Expected Json Object instead of Array

To Reproduce
https://events.opensource254.co.ke/api/p/events

Expected behavior
app is expecting json objects not arrays

we have a small issue on signup page
no progress bar
mothing is showing up

using google chrome on ubuntu

			// TODO add attachments and refactor

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/eventsController.js#L319

          should we remove the installed mysql plugin?

Originally posted by @StanleyMasinde in #402 (comment)

		// TODO modularize this search

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/searchController.js#L11

What is this men?

I'm using this as my todo because I'm always here

Okay but whats the problem?

Oooh yeah. The email sending methods are so spaghetti that they make me wanna carry tomato sauce.

What do you wanna do?

I'm I'm gonna refactor it to a reusable class for easy maintenance

Okay when?

Soon son. Soon

		// TODO add this middleware

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/eventsController.js#L222

Superagent version seems too old

		// TODO add this middleware

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/groupController.js#L390

When a user is requested, the body contains the password Hash. This can be exploited

https://events.opensource254.co.ke/api/p/events

[ { "image": "http://placeimg.com/640/480/abstract" } ]

since android security cant allow users to load links with http

change to

[ { "image": "https://placeimg.com/640/480/abstract" } ]

Describe the bug
getting error while including additional slash to API

To Reproduce
https://events.opensource254.co.ke//api/p/events

with an extra slash we get a 404 request page

1. Go to 'browser type api url with a slash 'https://events.opensource254.co.ke/api//p/events
2. Click on 'on it'
3. See error
   404 not found

suggestion
API should get 404 error in JSON formart

Hi friends,

Problem?
We need more security in the authentication process and cross-domain access.

Solution?
we need to implement token authentication for API access (JWT).

Extra info

1. Tokens a more secure than using usernames and passwords for authentication.
2. We won't require session storage.
3. In case we have another service on different ports, we won't need to keep logging in. We can easily use the tokens.

If the client-side validation fails for some reason, This can open up a lophole for SQL injection

Problem

The current API auth is using an API key which is not so good because a smart guy can just copy from the browser and use it else where.

Plan

Use referrer header for web applications to check the legitimacy of the request.
Only allow requests from events254.co.ke domain and subdomains

This also fixes the below problem

			body.slug = slugify(body.name) // TODO make sure the slug is unique

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/groupController.js#L134

Update the migrations to match the files

Describe the bug
when new user is registered the app directs to a black page with

To Reproduce
Steps to reproduce the behavior:

1. Go to 'event254 website '
2. Click on 'Register'
3. Enter Credeitial click sign up
4. See error

Expected behavior
to show all events or landing page

Desktop (please complete the following information):

• OS: [Linux]
• Browser [chrome]
• Version [Version 88.0.4324.182 (Official Build) (64-bit)]

this issue is under investigation

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/usersController.js#L101

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/groupController.js#L73

https://github.com/opensource254/events254/blob/80e7ba2bc79080e7796dce04a9c2e0e8e82c67a4/package.json#L51

you can fix it by npm i -D supertest

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/eventsController.js#L64

Describe the bug
An event's datetime needs to include the timezone of the event for easy conversion. for now the default timezone is Africa/Nairobi so that when someone views the event in another timezone, they get the event time is their local timezone. The problem is that the server is storing the timezone as UTC.
So if you set an event for 6:45 AM the time you see on the client side us 9:45

To Reproduce
Steps to reproduce the behavior:

1. Got to events.opensource254.co.ke/events/create
2. Create an event
3. View the time in the created event
4. The time will be +3hrs

Expected behavior
If you are in Kenya/East Africa, You are supposed to see the exact time you set the event. eg 0945

Screenshots
N/a

Desktop (please complete the following information):
N/A
Smartphone (please complete the following information):
N/A

Additional context
N/A

Create a relational database Schema for the application

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/auth/createToken.js#L23

Add a community feature

A get request to /events returns a 500 error. Currently working on it

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/eventsController.js#L144

What?

The auto CI is not working. I had to manually deploy to see changes

The API key was meant to protect sensitive user data.
To remove this means we need to filter sensitive data from responses to clients and only share what's needed.

• Add middleware to filter sensitive data
• Remove the API key auth for clients

https://github.com/Events254/events254/blob/8bf68f157153e1253276ff0e655d8bbb6a5bbb64/app/controllers/ticketController.js#L95