diff --git a/README.md b/README.md
index df8b55f..289d877 100644
--- a/README.md
+++ b/README.md
@@ -27,4 +27,10 @@ Kritbit uses the following projects
- [AES PHP support](http://stackoverflow.com/a/8232171/195722)
- [CRON expression](https://github.com/mtdowling/cron-expression) - MIT
- [phpoauthlib2](https://srchub.org/p/phpoauthlib2/) - MIT
-- [stacktraceprint](http://stackoverflow.com/a/4282133/195722)
\ No newline at end of file
+- [stacktraceprint](http://stackoverflow.com/a/4282133/195722)
+- [Twitter Bootstrap](http://getbootstrap.com/2.3.2/)
+- [jQuery](https://jquery.com/)
+- [jQuery confirm](http://craftpip.github.io/jquery-confirm/)
+- [bootstrap fullscreen](http://craftpip.github.io/bootstrap-fullscreen-select/)
+
+Made with <3 by Nathan Adams
\ No newline at end of file
diff --git a/scripts/runcommand.py b/scripts/runcommand.py
index 72f1e3a..0c17388 100644
--- a/scripts/runcommand.py
+++ b/scripts/runcommand.py
@@ -21,8 +21,17 @@ except ImportError:
except ImportError:
from io import StringIO
+#
+# REPLACE THESE VALUES
+#
+
SHARED_KEY = ""
HASH = ""
+URL = ""
+
+#
+#
+#
# source http://stackoverflow.com/a/8232171/195722
KEY_SIZE = 16
@@ -99,7 +108,6 @@ message = {}
message["nonce"] = nonce
message["message"] = json.dumps({"output":out, "time_taken": total, "result": exitcode})
message["signature"] = hashlib.sha256(message["message"] + nonce + HASH).hexdigest()
-print encrypt(SHARED_KEY, "test")
+print hashlib.sha256(message["message"]).hexdigest()
message["message"] = encrypt(SHARED_KEY, message["message"])
-print json.dumps(message)
-print curl_post("http://192.168.128.36:8080/service/upload/5/", {"data": json.dumps(message)}).getvalue()
\ No newline at end of file
+print curl_post(URL, {"data": json.dumps(message)}).getvalue()
\ No newline at end of file
diff --git a/web/application/config.php b/web/application/config.php
index a6171c6..ec21db7 100644
--- a/web/application/config.php
+++ b/web/application/config.php
@@ -1,7 +1,13 @@
',':','?'
+ ];
+ shuffle($keyChars);
+ shuffle($keyChars);
+ $sharedkey = "";
+ $bool = true;
+ for($i = 0; $i < 32; $i++) {
+ $sharedkey .= $keyChars[mt_rand(0, count($keyChars) - 1)];
+ }
+ //$sharedkey = bin2hex(openssl_random_pseudo_bytes(16, $bool));
$hash = bin2hex(openssl_random_pseudo_bytes(32, $bool));
echo $this->loadRender("add.html", ["hash" => $hash, "sharedkey" => $sharedkey]);
} else {
diff --git a/web/application/controllers/login.php b/web/application/controllers/login.php
index 67f0da6..5a85cd9 100644
--- a/web/application/controllers/login.php
+++ b/web/application/controllers/login.php
@@ -15,7 +15,7 @@ class login extends base {
$authProvider = new GoogleAuthProvider($_GET, [
"client_id" => $this->config["GOOGLE_OAUTH_ID"],
"client_secret" => $this->config["GOOGLE_OAUTH_SECRET"],
- "redirect_uri" => "http://localhost/login"
+ "redirect_uri" => "http://localhost:8080/login"
]);
$oauth = new OAuth($authProvider, $_GET);
diff --git a/web/application/controllers/service.php b/web/application/controllers/service.php
index 97c3097..2c66c71 100644
--- a/web/application/controllers/service.php
+++ b/web/application/controllers/service.php
@@ -24,24 +24,36 @@ class service extends base {
*/
public function upload($jobId) {
if ($jobId && is_numeric($jobId)) {
- try {
- /** @var \application\models\Jobs $job */
- $job = \application\models\Jobs::getByField("id", $jobId)[0];
- //decrypt message
- $data = json_decode($_POST["data"], true);
- $rawMessage = aes_decrypt($job->sharedkey, $data["message"]);
- } catch (\Exception $e) {
- echo $e;
- exit(1);
- }
+
+ /** @var \application\models\Jobs $job */
+ $job = \application\models\Jobs::getByField("id", $jobId)[0];
+ //decrypt message
+ $data = json_decode($_POST["data"], true);
+ $rawMessage = aes_decrypt($job->sharedkey, $data["message"]);
+ /*$rawMessage = str_replace("\\n", "", $rawMessage);
+ $rawMessage = str_replace("\\r", "", $rawMessage);
+ $rawMessage = str_replace("\\", "", $rawMessage);*/
+ $rawMessage = preg_replace('/[^(\x20-\x7F)]*/','', $rawMessage);
+
+
+
// if decryption was successful -
// check signature
if (hash("sha256", $rawMessage . $data["nonce"] . $job->hash) == $data["signature"]) {
// the message is verified
- $messageJson = json_decode($rawMessage);
- $history = \application\models\Histories::create($messageJson);
- $history->jobs_id = $job->id;
+ $message = json_decode($rawMessage, true);
+ $replayAttackCheck = DB::fetch("SELECT id FROM histories WHERE jobs_id = ? AND nonce = ?", [$job->id, $data["nonce"]]);
+ if (count($replayAttackCheck) == 0) {
+ $history = \application\models\Histories::create($message);
+ $history->run_date = date("Y-m-d H:i:s");
+ $history->jobs_id = $job->id;
+ $history->nonce = $data["nonce"];
+ $history->save();
+ $job->last_result = $history->result;
+ $job->last_run = $history->run_date;
+ $job->save();
+ }
}
}
}
diff --git a/web/application/migrations/3.php b/web/application/migrations/3.php
index 832d0c8..dd68932 100644
--- a/web/application/migrations/3.php
+++ b/web/application/migrations/3.php
@@ -9,7 +9,8 @@ DB::query("CREATE TABLE histories (
jobs_id INTEGER,
run_date DATETIME,
time_taken DECIMAL(10,5),
- result INTEGER
+ result INTEGER,
+ nonce VARCHAR(255)
);");
-DB::query("INSERT INTO histories VALUES (null, 'THIS IS ONLY A TEST', 1, '2015-01-01', 10, 0)");
\ No newline at end of file
+DB::query("INSERT INTO histories VALUES (null, 'THIS IS ONLY A TEST', 1, '2015-01-01', 10, 0, 'ABC')");
\ No newline at end of file
diff --git a/web/application/models/Histories.php b/web/application/models/Histories.php
index c8ab305..763184e 100644
--- a/web/application/models/Histories.php
+++ b/web/application/models/Histories.php
@@ -8,4 +8,5 @@ class Histories extends \system\engine\HF_Model {
public $run_date;
public $time_taken;
public $result;
+ public $nonce;
}
\ No newline at end of file
diff --git a/web/application/views/base.html b/web/application/views/base.html
index bfcbf40..a6185e5 100644
--- a/web/application/views/base.html
+++ b/web/application/views/base.html
@@ -7,6 +7,7 @@
+
@@ -16,6 +17,8 @@
+
+
{{title}}