devslop / pixi Goto Github PK

View Code? Open in Web Editor NEW

110.0 110.0 80.0 19.32 MB

The Pixi module is a MEAN Stack web app with wildly insecure APIs!

License: Apache License 2.0

JavaScript 52.38% HTML 47.00% Dockerfile 0.62%

pixi's People

Contributors

Stargazers

Watchers

Forkers

kingthorin security-prince 42crunch jaydeepc magnologan manjula-aw isamauny zaz65 deblakhat bbhunter jostheneutralgood wistke dsotnikov infomaven devpra58 xufuou dco-hackerzero enosrecanati jnicastrovc idangindi sara-kathryn chackoabraham12 marcianobarros20 rpaul80 ingridl-santos shehackspurple scuttlephish martinbdz-test-benchmarks sheldonr1 dylantestorg akashrindhe hub4j-test-org nanzgdemo igorgvero-sec simplicode0229 leftrightleft parroty-exp itserverstack nikchillz tejas999agarwal agong358 stephaniem05 tw-ankit malirezai polling-repo-continua slooppe yarosim marcostolosa dstew178 vulnerable-apps tmadrms kiiru4reals 1crazymoney gibaoson xavierlamjunjie nishnair82 haerin-l 4kp3n setonjay alvacoder tiferet pierre-1paquette henridecock neuralegion justinklein2001 ivf1219 lkc0626 heshaam-42c davidsyckle saraiva hugotokes vulnerable-apis mohsecurity254 brenosantanabruno

pixi's Issues

swagger.json static host definition

Pixi/app/public/swagger.json

Line 1 in 5e20ede

{"swagger":"2.0","info":{"description":"Pixi Photo Sharing API","version":"1.0.0","title":"Pixi App API","contact":{"email":"[email protected]"},"license":{"name":"Apache 2.0","url":"http://www.apache.org/licenses/LICENSE-2.0.html"}},"tags":[{"name":"admins","description":"Secured Admin-only calls"},{"name":"users","description":"Operations available to regular, logged in users"},{"name":"anyone","description":"Operations available to anyone"}],"paths":{"/api/pictures":{"get":{"tags":["users"],"summary":"gets all pixi photos","parameters":[{"name":"token","in":"query","description":"JWT token","type":"string","required":true},{"in":"header","name":"x-access-token","description":"Users JWT token","required":true,"type":"string"}],"description":"This will return the entirety of photos available in Pixi\n","produces":["application/json"],"responses":{"200":{"description":"json all pixi photos","schema":{"type":"array","items":{"$ref":"#/definitions/PicturesItem"}}},"400":{"description":"bad input parameter"}}}},"/api/picture/{picture_id}":{"get":{"tags":["users"],"summary":"get information about a specific photo","parameters":[{"in":"header","name":"x-access-token","description":"Users JWT token","required":true,"type":"string"},{"in":"query","name":"token","description":"JWT token","type":"string","required":true},{"in":"path","name":"picture_id","description":"ID of picture","required":true,"type":"integer"}],"operationId":"useruploadedpictures","description":"user can get all photos they uploaded","produces":["application/json"],"responses":{"200":{"description":"successful authentication user photo json object","schema":{"type":"array","items":{"$ref":"#/definitions/PicturesItem"}}},"403":{"description":"invalid or missing token"}}}},"/api/picture/delete":{"delete":{"tags":["users"],"summary":"delete a specified picture","parameters":[{"in":"header","name":"x-access-token","type":"string","description":"Users JWT Token","required":true},{"in":"query","name":"picture_id","type":"number","description":"?picture_id=xxx"}],"operationId":"delete picture","description":"user can delete a photo","produces":["application/json"],"responses":{"200":{"description":"successful authentication user photo json object"},"403":{"description":"invalid or missing token"}}}},"/api/picture/delete/{picture_id}":{"get":{"tags":["users"],"summary":"delete a specified picture","parameters":[{"in":"header","name":"x-access-token","description":"Users JWT Token","required":true,"type":"string"},{"in":"query","name":"picture","type":"number","description":"ID of picture to be deleted"},{"in":"path","name":"picture_id","required":true,"type":"number","description":"ID of picture to be deleted"}],"description":"user can delete a photo","produces":["application/json"],"responses":{"200":{"description":"successful authentication user photo json object"},"403":{"description":"invalid or missing token"}}}},"/api/picture/{picture_id}/likes":{"get":{"tags":["users"],"summary":"get a list of loves by user","parameters":[{"in":"header","name":"x-access-token","description":"Users JWT Token","required":true,"type":"string"},{"in":"path","name":"picture_id","required":true,"type":"number","minimum":1,"description":"in URL string"}],"operationId":"userloves","description":"user can get a list of all their loves","produces":["application/json"],"responses":{"200":{"description":"successful authentication user photo json object"},"403":{"description":"invalid or missing token"}}}},"/api/picture/{picture_id}/loves":{"get":{"tags":["users"],"summary":"get a list of loves by user","parameters":[{"in":"header","name":"x-access-token","description":"Users JWT Token","required":true,"type":"string"},{"in":"path","name":"picture_id","required":true,"type":"number","description":"in URL string"}],"description":"user can get a list of all their loves","produces":["application/json"],"responses":{"200":{"description":"successful authentication user photo json object"},"403":{"description":"invalid or missing token"}}}},"/api/pictures/love":{"get":{"tags":["users"],"summary":"send a love to a picture","description":"love a picture initiates a .05 micropayment to creator.","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","description":"Users JWT Token","required":true,"type":"string"},{"in":"query","type":"number","name":"picture_id","description":"?picture_id=xxx"}],"responses":{"200":{"description":"successful authentication user photo json object"},"202":{"description":"missing picture_id parameter"},"403":{"description":"invalid or missing token"}}}},"/api/pictures/like":{"get":{"tags":["users"],"summary":"send a like to a picture","description":"you can only like a picture once if you like it again you will unlike it.","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","description":"Users JWT Token","required":true,"type":"string"},{"in":"query","type":"number","name":"picture_id","description":"?picture_id=xxx"}],"responses":{"200":{"description":"successful authentication user photo json object"},"202":{"description":"missing picture_id parameter"},"403":{"description":"invalid or missing token"}}}},"/api/picture/upload":{"post":{"tags":["users"],"summary":"delete a specified picture","description":"user can get all photos they uploaded","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","description":"Users JWT Token","required":true,"type":"string"},{"in":"body","name":"file","description":"pictures object","required":true,"schema":{"$ref":"#/definitions/PicturesItem"}}],"responses":{"200":{"description":"successful authentication user photo json object"},"403":{"description":"invalid or missing token"}}}},"/api/login":{"post":{"tags":["anyone"],"summary":"login successfully and receive json web token.","parameters":[{"name":"user","in":"body","description":"userobject","required":true,"schema":{"$ref":"#/definitions/UsersItem"}}],"operationId":"authenticate","description":"user supplies user name and password and receives a json web token","produces":["application/json"],"responses":{"200":{"description":"successfully logged in, get JWT"},"202":{"description":"successfully request, but invalid password"},"422":{"description":"missing parameters"}}}},"/api/register":{"post":{"tags":["anyone"],"summary":"register for an account and receive token","operationId":"register","description":"user supplies email and password to register and receives a json web token.","produces":["application/json"],"parameters":[{"in":"body","name":"user","required":true,"schema":{"$ref":"#/definitions/UsersItem"}}],"responses":{"200":{"description":"successfully registered, token received"},"202":{"description":"email address already registered"}}}},"/api/search":{"get":{"tags":["users"],"summary":"search pixi photos","parameters":[{"in":"header","name":"x-access-token","description":"Users JWT token","required":true,"type":"string"}],"description":"This will search entirety of photos available in Pixi\n","produces":["application/json"],"responses":{"200":{"description":"pictures that match search","schema":{"type":"array","items":{"$ref":"#/definitions/PicturesItem"}}},"202":{"description":"missing search parameter"}}}},"/api/user/info":{"get":{"tags":["users"],"summary":"get user information","operationId":"userinfo","description":"user supplies valid token and receives all user info","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","description":"Users JWT Token","required":true,"type":"string"}],"responses":{"200":{"description":"successful authentication sent user information"},"403":{"description":"invalid or missing token"}}}},"/api/user/edit_info":{"put":{"tags":["users"],"summary":"edit user information","operationId":"edituserinfo","description":"user supplies valid token and receives all user info","produces":["application/json"],"parameters":[{"name":"user","in":"body","description":"userobject","required":true,"schema":{"$ref":"#/definitions/UsersItem"}}],"responses":{"200":{"description":"successful authentication sent user information"},"403":{"description":"invalid or missing token"}}}},"/api/user/pictures":{"get":{"tags":["users"],"summary":"get all photos uploaded by user","description":"user can get all photos they uploaded","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","type":"string","required":true}],"responses":{"200":{"description":"successful authentication user photo json object"},"403":{"description":"invalid or missing token"}}}},"/api/user/likes":{"get":{"tags":["users"],"summary":"get a list of likes by user","operationId":"userlikes","description":"user can get a list of all their likes","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","type":"string","required":true}],"responses":{"200":{"description":"successful authentication user photo json object","schema":{"type":"array","items":{"$ref":"#/definitions/LikesItem"}}},"403":{"description":"invalid or missing token"}}}},"/api/user/loves":{"get":{"tags":["users"],"summary":"get a list of loves by user","description":"user can get a list of all their loves","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","type":"string","required":true}],"responses":{"200":{"description":"successful authentication user photo json object","schema":{"type":"array","items":{"$ref":"#/definitions/LovesItem"}}},"403":{"description":"invalid or missing token"}}}},"/api/admin/users/search":{"get":{"tags":["admins"],"summary":"get a list of loves by user","description":"user can get a list of all their loves","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","type":"string","required":true},{"in":"query","name":"search","type":"string","description":"search query ?search=xxx","required":true}],"responses":{"200":{"description":"successful authentication user photo json object","schema":{"type":"array","items":{"$ref":"#/definitions/UsersItem"}}},"403":{"description":"invalid or missing token"}}}},"/api/admin/loves/search":{"get":{"tags":["admins"],"summary":"get a list of all loves by user","description":"user can get a list of all their loves","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","type":"string","required":true},{"in":"query","name":"search","type":"string","description":"search query ?search=xxx","required":true}],"responses":{"200":{"description":"successful authentication user photo json object"},"403":{"description":"invalid or missing token"}}}},"/api/admin/likes/search":{"get":{"tags":["admins"],"summary":"more money for users","description":"user can get a list of all their loves","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","required":true,"type":"string"},{"in":"query","name":"search","type":"string","description":"search query ?search=xxx","required":true}],"responses":{"200":{"description":"successful authentication user photo json object"},"403":{"description":"invalid or missing token"}}}},"/api/admin/money":{"post":{"tags":["admins"],"summary":"bonanza","description":"user can get a list of all their loves","produces":["application/json"],"parameters":[{"in":"header","name":"x-access-token","type":"string","required":true},{"in":"body","name":"user","description":"userobject","required":true,"schema":{"$ref":"#/definitions/UsersItem"}}],"responses":{"200":{"description":"successful authentication user photo json object"},"403":{"description":"invalid or missing token"}}}}},"definitions":{"UsersItem":{"type":"object","required":["user","pass"],"properties":{"id":{"type":"number","format":"number","example":1},"user":{"type":"string","format":"email","example":"[email protected]"},"pass":{"type":"string","format":"string","example":"p@ssword1"},"name":{"type":"string","example":"Johnny Appleseed"},"is_admin":{"description":"is admin","type":"boolean"},"account_balance":{"description":"remaning balance","type":"number"}}},"PicturesItem":{"type":"object","required":["filename"],"properties":{"filename":{"type":"object","format":"jpg","example":"file.jpg"},"name":{"type":"string","example":"Johnny Appleseed"},"email":{"type":"string","format":"email","example":"email"},"creator_id":{"$ref":"#/definitions/UsersItem"}}},"LikesItem":{"type":"object","required":["user_id","picture_id"],"properties":{"user_id":{"$ref":"#/definitions/UsersItem"},"picture_id":{"$ref":"#/definitions/PicturesItem"}}},"LovesItem":{"type":"object","required":["user_id","picture_id"],"properties":{"user_id":{"$ref":"#/definitions/UsersItem"},"picture_id":{"$ref":"#/definitions/PicturesItem"}}}},"host":"104.131.115.192:8090","basePath":"/","schemes":["http"]}

Defines:

"host":"104.131.115.192:8090"

Which will be problematic for docker containers, etc.

Per: https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#schema

The host (name or ip) serving the API. This MUST be the host only and does not include the scheme nor sub-paths. It MAY include a port. If the host is not included, the host serving the documentation is to be used (including the port). The host does not support path templating.

So this probably shouldn't be specified.

Cannot GET /secret.conf

When accessing http://localhost:8000/secret.conf I get this message: "Cannot GET /secret.conf"
The same when I access http://localhost:8000/ADMIN/search?search[$ne]=1 I get Cannot GET /ADMIN/search

Admin Panel Typos and Errors

"Loves Search" default text says "Likes":

"User Search" results in an error:

I believe the form action is wrong:
<form action="/admin/search" method="GET"> should be <form action="/admin/users/search" method="GET">

Docker Error

To run this application use Linux based docker because windows based docker uses V. 1.22.0 and this application needs 1.24.0 or above

Cannot fetch JWT Token in Swagger UI

When I enter my credentials via the /api/login endpoint in the swagger.json. I receive an error:

😱 Could not render this component, see the console.

TypeError: Cannot read properties of undefined (reading 'get')
at t.value (swagger-ui-bundle.js:73079:1)
at I.n.render (swagger-ui-bundle.js:26726:1)
at p._renderValidatedComponentWithoutOwnerOrContext (swagger-ui-bundle.js:40921:1)
at p._renderValidatedComponent (swagger-ui-bundle.js:40921:1)
at p._updateRenderedComponent (swagger-ui-bundle.js:40921:1)
at p._performComponentUpdate (swagger-ui-bundle.js:40921:1)
at p.updateComponent (swagger-ui-bundle.js:40921:1)
at p.receiveComponent (swagger-ui-bundle.js:40921:1)
at Object.receiveComponent (swagger-ui-bundle.js:34033:1)
at Object.receiveComponent (renderer.js:267:1)

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.