azlux / simple-url-shortener Goto Github PK

If I may make a suggestion, where you refer to "Sign In" it would be better to say "Sign Up" since sign in means the same as log in, which is confusing. As I say, just a suggestion.

In the config.php file you can‘t change the URL_SIZE. I changed 5 characters to an other number but then the shortener doesn‘t work. There is a white page at shorten.php

Hello,
I've installed the software but it does not seems to work properly:
https://go.josephcosta.org/yUtA8

Also after login I have a white page.

You refer to an .htaccess file wich I can not find in the repository, could you please add it or give instructions in the README.md > Apache configuration (.htaccess) :?

Best regards
Joseph

Throughout the HTML code you use absolute URLs, e.g.

This breaks using SUS in a subdirectory, like "https://xyz.com/go/". So I propose to change this to relative URLs, like

<img src="assets/img/delete-icon.png"/>

Hi,

Loving this shortnener and it's really helped with some projects I'm working on for work. When setting this up in my env, I noted that the application isn't escaping html special characters nor stripping tags within the shorten.php file. This lead to me being able carry our a stored XSS on my own shortener.

Test case:
By adding the following to a new url to shorten, arbitrary JavaScript will be executed when viewing created links: https://google.com"><script>alert(0)</script>

Affected Code (lines 112-114):

$url = $_POST['url'];
$comment = (!empty($_POST['comment'])) ? $_POST['comment'] : NULL;
$custom = (!empty($_POST['custom'])) ? $_POST['custom'] : NULL;

I appended htmlspecialchars and strip_tags to the variables being accepted, which let to arbitrary JavaScript no longer executing. I'm sure there is probably a better way to do this, however, it is a quick fix.

Fixed Code:

$url = htmlspecialchars(strip_tags($_POST['url']));
$comment = (!empty($_POST['comment'])) ? htmlspecialchars(strip_tags($_POST['comment'])) : NULL;
$custom = (!empty($_POST['custom'])) ? htmlspecialchars(strip_tags($_POST['custom'])) : NULL;

I am happy to fork and submit a PR if that's easier.

Thanks,
0x0Banana

A couple of issues:

1. In common.css line 123 color: #878787; hides the text when using dark mode. I have removed that line and it seems fine.
2. There is no link back to the home page from link.php and shorten.php
3. It is no clear what the link Get link from no connected people does

I´m running an Apache Webserver on PHP version 7.2 and when trying to register the admin user it just gives the following exception:

Fatal error: Uncaught PDOException: SQLSTATE[HY000]: General error: 1 no such table: users in /www/htdocs/login.php:17 Stack trace: #0 /www/htdocs/login.php(17): PDO->query('SELECT count(*)...') #1 {main} thrown in /www/htdocs/login.php on line 17

The installation was done multiple times following your installation instructions.
Thank you for your help.

Thanks for this script! I have an issue, though. After running installation.php I am take to the home page - but where do I do to create a user??

Answer to this issue if you want to help me for this project.

Please add the preferred topic (At the moment, I mostly need UI help) :

• the UI (CSS, I want to avoid JS as much as possible)
• The code (PHP, not that clean)
• The DB (mariadb or sqlite3) - If you think I've miss something.