Giter VIP home page Giter VIP logo

twardokus / csec380-project Goto Github PK

View Code? Open in Web Editor NEW
0.0 0.0 0.0 19.21 MB

This is a containerized web application designed to demonstrate common web security issues such as SQL injection and server-side request forgery. Final project for CSEC 380 - Principles of Web Application Security at Rochester Institute of Technology.

License: MIT License

PHP 49.54% Hack 1.47% CSS 13.78% Dockerfile 1.09% HTML 0.24% Python 27.21% TSQL 6.23% Shell 0.45%

csec380-project's People

Contributors

andrewbluepiano avatar bnk5096 avatar ejp3496 avatar twardokus avatar

Watchers

 avatar  avatar  avatar

csec380-project's Issues

Ability to upload a video

As a user I want to be able to upload a video.

Developer Tasks

  • Move sql connection to single file to be used with 'include_once'
  • Create uploader.php
  • Update DB to have metadata
  • HASH VIDEO FILENAMES BEFORE STORING
  • Create downloader.php, probabally using file_get_contents()
  • Create Upload button
  • Enable php file upload to secure location in backend
  • Create backend action to upload the video with metadata stored in DB

Acceptance Criteria

  • User is able to upload a video by selecting a file from their machine
  • User is able to upload a video by entering a URL to download source video from
  • User can only upload files of extension *.mp4, *.webm, and other video file extensions.

Secure credential storage

As a user I want my credentials to be securely stored so I don't get hacked.

Developer Tasks

  • Create database for credentials
  • Secure credentials table with appropriate access control

Acceptance Criteria

  • Passwords are not stored in plaintext
  • Passwords are only stored as hashes

Ability to watch a video

As a user I want to be able to watch videos.

Developer Tasks

  • Create a page that lists videos available to watch with author names.
  • Create functionality to go to a video when a user clicks a link

Acceptance Criteria

  • User can watch a video
  • Existing videos from all users will be available to watch and should have some indication of the user who uploaded them
  • User can view list of videos and interact with it to get to a video

Create Agile Elements in Repo

As a developer I would like to layout my development path so that I can more successfully and quickly develop my application as a team.

Use:
‘Github Projects’ to represent ‘Epics’,
‘Github Milestones’ to represent ‘Sprints’,
‘Github Issues’ to represent ‘User Stories’.

Permissions error with video uploads

This happens whenever I try to upload a video from the disk. I suspect it's because docker isn't running the apache server as root. Going into the server with docker exec shows a UID of 1000 for /var/www/html, but no user in the docker image has that UID. Not sure how to resolve within docker - this thread might help: docker-library/wordpress#162.

image

Logout functionality

As a user I want to be able to log out so I can stop using the service.

Developer Tasks

  • Create log out button
  • Create log out functionality to handle button click by ending user's session

Acceptance Criteria

  • When user clicks on the log out button, their session is ended and they are redirected to the login screen
  • The log out button displays on every page except for the login page (i.e. when there is an authenticated session).

Login Functionality

As a user I want to be able to log in so I can use the service.

Developer Tasks

  • Create source file for login screen

Acceptance Criteria

  • User sees login screen
  • Log in screen is interactive with opportunity to enter username and password
  • When user clicks "Log In" and their credentials are valid they are taken to their home screen
  • When user click "Log in" and their credentials are invalid they are informed that their credentials were not accepted

Ability to delete video

As a user I want to be able to delete videos I uploaded.

Developer Tasks

  • create a "delete video" button
  • create delete video functionality

Acceptance Criteria

  • a user can delete a video that they have uploaded

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.