Giter Club home page Giter Club logo

learning-opentok-php's Introduction

OpenTok Getting Started Sample App

Tokbox is now known as Vonage

A simple server that uses the OpenTok PHP SDK to create sessions, generate tokens for those sessions, archive (or record) sessions, and download those archives.

Quick deploy to Heroku

Heroku is a PaaS (Platform as a Service) that can be used to deploy simple and small applications for free. To easily deploy this repository to Heroku, sign up for a Heroku account and click this button:

Deploy

Heroku will prompt you to add your OpenTok API key and OpenTok API secret, which you can obtain at the TokBox Dashboard.

Requirements

Installation & Running on localhost

  1. Clone the app by running the command

     git clone [email protected]:opentok/learning-opentok-php.git
    
  2. cd to the root directory.

  3. Run composer install command to fetch and install all dependencies.

  4. Next, copy the .env.dist file to .env and edit to add your API Key and Secret:

    TOKBOX_API_KEY=0000000
    TOKBOX_SECRET=abcdef1234567890abcdef01234567890abcdef
    

    Important: The archiving sample application uses archives that are stored in the OpenTok cloud. In your OpenTok Account page, ensure that the OpenTok project you use (corresponding to the API key and API secret you use here) is not set up to use cloud storage on Microsoft Azure or Amazon S3. However, in a production application, you will want to use an OpenTok project that has archive file cloud storage on Microsoft Azure or Amazon S3 enabled, since archives stored on the OpenTok cloud are only available for 72 hours.

  5. Start the server using composer:

`$ composer run --timeout 0 serve`
  1. Visit the URL http://localhost:3000/session in your browser. You should see a JSON response containing the OpenTok API key, session ID, and token.

Exploring the code

The web/index.php file contains setup and routing for the web service. The logic for each route is stored in src/Action/. The rest of this tutorial discusses code in these files.

In order to navigate clients to a designated meeting spot, we associate the Session ID to a room name which is easier for people to recognize and pass. For simplicity, we use a local file storage to implement the association where the room name is the file name and the Session ID is the contents. For production applications, you may want to configure a persistence (such as a database) to achieve this functionality.

Generate a Session and Token

The GET /room/:name route associates an OpenTok session with a "room" name. This route handles the passed room name and performs a check to determine whether the app should generate a new session ID or retrieve a session ID from the local file storage. Then, it generates an OpenTok token for that session ID. Once the API key, session ID, and token are ready, it sends a response with the body set to a JSON object containing the information.

$name = $args['name'];
// if a room name is already associated with a session ID
if ($this->storage->exists($name)) {
    // fetch the sessionId from local storage
    $sessionId = $this->storage[$name];

    // generate token
    $token = $this->opentok->generateToken($sessionId);
    $responseData = [
        'apiKey' => $this->apiKey,
        'sessionId' => $sessionId,
        'token'=>$token
    ];

    return new JsonResponse($responseData);
} else { // Generate a new session and store it off
    $session = $this->opentok->createSession([
        'mediaMode' => MediaMode::ROUTED
    ]);

    // store the sessionId into local
    $this->storage[$name] = $session->getSessionId();
    
    // generate token
    $token = $this->opentok->generateToken($session->getSessionId());
    $responseData = [
        'apiKey' => $this->apiKey,
        'sessionId' => $session->getSessionId(),
        'token'=>$token
    ];

    return new JsonResponse($responseData);
}

The GET /session route generates a convenient session for quick establishment of communication.

$parser = RouteContext::fromRequest($request)->getRouteParser();
return new RedirectResponse($parser->urlFor('room', ['name' => 'session']));

Start an Archive

A POST request to the /archive/start route starts an archive recording of an OpenTok session. The session ID OpenTok session is passed in as JSON data in the body of the request

// Start Archiving and return the Archive
$data = json_decode($request->getBody()->getContents(), true);
$sessionId = $data['sessionId'];
$archive = $this->opentok->startArchive($sessionId, 'Getting Started Sample Archive');

return new JsonResponse($archive->toJson());

You can only create an archive for sessions that have at least one client connected. Otherwise, the app will respond with an error.

Stop an Archive

A POST request to the /archive:archiveId/stop route stops an archive recording. The archive ID is returned by the call to the archive/start endpoint.

// Stop Archiving and return the Archive
$archive = $this->opentok->stopArchive($args['archiveId']);
return new JsonResponse($archive->toJson());

View an Archive

A GET request to '/archive/:archiveId/view' redirects the requested clients to a URL where the archive gets played.

// Download the archive
$archive = $this->opentok->getArchive($args['archiveId']);
if ($archive->status=='available') {
    return new RedirectResponse($archive->url);
}
else {
    return new HtmlResponse(file_get_contents($this->viewsDir . '/view.html'));
}

Get Archive information

A GET request to /archive/:archiveId returns a JSON object that contains all archive properties, including status, url, duration, etc. For more information, see here.

$archive = $this->opentok->getArchive($args['archiveId']);
return new JsonResponse($archive->toJson());

Fetch multiple Archives

A GET request to /archive with optional count and offset params returns a list of JSON archive objects. For more information, please check here.

Examples:

GET /archive // fetch up to 1000 archive objects
GET /archive?count=10  // fetch the first 10 archive objects
GET /archive?offset=10  // fetch archives but first 10 archive objetcs
GET /archive?count=10&offset=10 // fetch 10 archive objects starting from 11st

More information

This sample app does not provide client-side OpenTok functionality (for connecting to OpenTok sessions and for publishing and subscribing to streams). It is intended to be used with the OpenTok tutorials for Web, iOS, iOS-Swift, or Android:

Development and Contributing

Interested in contributing? We ❤️ pull requests! See the Contribution guidelines.

Getting Help

We love to hear from you so if you have questions, comments, or find a bug in the project, let us know! You can either:

Further Reading

learning-opentok-php's People

Contributors

aoberoi avatar dragonmantank avatar jeffswartz avatar lucashuang0802 avatar marabesi avatar marcioaffonso avatar michaeljolley avatar padmajaperi avatar tahaaaa avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

learning-opentok-php's Issues

laminas/laminas-diactoros-2.5.0: 1 vulnerabilities (highest severity is: 6.1) - autoclosed

Vulnerable Library - laminas/laminas-diactoros-2.5.0

PSR HTTP Message implementations

Library home page: https://api.github.com/repos/laminas/laminas-diactoros/zipball/4ff7400c1c12e404144992ef43c8b733fd9ad516

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (laminas/laminas-diactoros version) Remediation Possible**
CVE-2022-31109 Medium 6.1 laminas/laminas-diactoros-2.5.0 Direct 2.11.1

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-31109

Vulnerable Library - laminas/laminas-diactoros-2.5.0

PSR HTTP Message implementations

Library home page: https://api.github.com/repos/laminas/laminas-diactoros/zipball/4ff7400c1c12e404144992ef43c8b733fd9ad516

Dependency Hierarchy:

  • laminas/laminas-diactoros-2.5.0 (Vulnerable Library)

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Found in base branch: main

Vulnerability Details

laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request modified to reflect values from X-Forwarded-* headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the X-Forwarded-* headers do have valid use cases, particularly in clustered environments using a load balancer, the library offers mitigation measures only in the v2 releases, as doing otherwise would break these use cases immediately. Users of v2 releases from 2.11.1 can provide an additional argument to Laminas\Diactoros\ServerRequestFactory::fromGlobals() in the form of a Laminas\Diactoros\RequestFilter\RequestFilterInterface instance, including the shipped Laminas\Diactoros\RequestFilter\NoOpRequestFilter implementation which ignores the X-Forwarded-* headers. Starting in version 3.0, the library will reverse behavior to use the NoOpRequestFilter by default, and require users to opt-in to X-Forwarded-* header usage via a configured Laminas\Diactoros\RequestFilter\LegacyXForwardedHeaderFilter instance. Users are advised to upgrade to version 2.11.1 or later to resolve this issue. Users unable to upgrade may configure web servers to reject X-Forwarded-* headers at the web server level.

Publish Date: 2022-08-01

URL: CVE-2022-31109

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8274-h5jp-97vr

Release Date: 2022-05-19

Fix Resolution: 2.11.1

slim/slim-4.7.1: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - slim/slim-4.7.1

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (slim/slim version) Remediation Possible**
CVE-2022-24775 High 7.5 guzzlehttp/psr7-1.7.0 Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24775

Vulnerable Library - guzzlehttp/psr7-1.7.0

PSR-7 message implementation that also provides common utility methods

Library home page: https://api.github.com/repos/guzzle/psr7/zipball/53330f47520498c0ae1f61f7e2c90f55690c06a3

Dependency Hierarchy:

  • slim/slim-4.7.1 (Root Library)
    • guzzlehttp/psr7-1.7.0 (Vulnerable Library)

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Found in base branch: main

Vulnerability Details

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.

Publish Date: 2022-03-21

URL: CVE-2022-24775

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q7rv-6hp3-vh96

Release Date: 2022-03-21

Fix Resolution: 1.8.4,2.1.1

opentok/opentok-v4.6.1: 1 vulnerabilities (highest severity is: 8.1) - autoclosed

Vulnerable Library - opentok/opentok-v4.6.1

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (opentok/opentok-v4.6.1 version) Remediation Possible**
CVE-2022-29248 High 8.1 guzzlehttp/guzzle-7.2.0 Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-29248

Vulnerable Library - guzzlehttp/guzzle-7.2.0

Guzzle is a PHP HTTP client library

Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/0aa74dfb41ae110835923ef10a9d803a22d50e79

Dependency Hierarchy:

  • opentok/opentok-v4.6.1 (Root Library)
    • guzzlehttp/guzzle-7.2.0 (Vulnerable Library)

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Found in base branch: main

Vulnerability Details

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.

Publish Date: 2022-05-25

URL: CVE-2022-29248

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29248

Release Date: 2022-05-25

Fix Resolution: guzzlehttp/guzzle - 6.5.6,guzzlehttp/guzzle - 7.4.3

jquery-1.10.2.min.js: 4 vulnerabilities (highest severity is: 6.1) - autoclosed

Vulnerable Library - jquery-1.10.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jquery version) Remediation Possible**
CVE-2020-11023 Medium 6.1 jquery-1.10.2.min.js Direct jquery - 3.5.0;jquery-rails - 4.4.0
CVE-2020-11022 Medium 6.1 jquery-1.10.2.min.js Direct jQuery - 3.5.0
CVE-2019-11358 Medium 6.1 jquery-1.10.2.min.js Direct jquery - 3.4.0
CVE-2015-9251 Medium 5.5 jquery-1.10.2.min.js Direct jQuery - 3.0.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-11023

Vulnerable Library - jquery-1.10.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Dependency Hierarchy:

  • jquery-1.10.2.min.js (Vulnerable Library)

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

CVE-2020-11022

Vulnerable Library - jquery-1.10.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Dependency Hierarchy:

  • jquery-1.10.2.min.js (Vulnerable Library)

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

CVE-2019-11358

Vulnerable Library - jquery-1.10.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Dependency Hierarchy:

  • jquery-1.10.2.min.js (Vulnerable Library)

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Found in base branch: main

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

CVE-2015-9251

Vulnerable Library - jquery-1.10.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Dependency Hierarchy:

  • jquery-1.10.2.min.js (Vulnerable Library)

Found in HEAD commit: e16cf5584820c3957e941207568c886ce7eb84e0

Found in base branch: main

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - 3.0.0

bootstrap-4.0.0.min.js: 4 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - bootstrap-4.0.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.0.0/js/bootstrap.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Found in HEAD commit: 6ce28e32c646f40a437e43bdd53ae617f68e18a0

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (bootstrap version) Remediation Possible** Reachability
CVE-2019-8331 Medium 6.1 Not Defined 0.4% bootstrap-4.0.0.min.js Direct bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1
CVE-2018-14042 Medium 6.1 Not Defined 0.5% bootstrap-4.0.0.min.js Direct bootstrap - 3.4.0,4.1.2
CVE-2018-14041 Medium 6.1 Not Defined 0.4% bootstrap-4.0.0.min.js Direct org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:4.1.2
CVE-2018-14040 Low 3.7 Not Defined 0.8% bootstrap-4.0.0.min.js Direct bootstrap - 3.4.0,4.1.2

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-8331

Vulnerable Library - bootstrap-4.0.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.0.0/js/bootstrap.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Dependency Hierarchy:

  • bootstrap-4.0.0.min.js (Vulnerable Library)

Found in HEAD commit: 6ce28e32c646f40a437e43bdd53ae617f68e18a0

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1

CVE-2018-14042

Vulnerable Library - bootstrap-4.0.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.0.0/js/bootstrap.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Dependency Hierarchy:

  • bootstrap-4.0.0.min.js (Vulnerable Library)

Found in HEAD commit: 6ce28e32c646f40a437e43bdd53ae617f68e18a0

Found in base branch: main

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.5%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14042

Release Date: 2018-07-13

Fix Resolution: bootstrap - 3.4.0,4.1.2

CVE-2018-14041

Vulnerable Library - bootstrap-4.0.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.0.0/js/bootstrap.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Dependency Hierarchy:

  • bootstrap-4.0.0.min.js (Vulnerable Library)

Found in HEAD commit: 6ce28e32c646f40a437e43bdd53ae617f68e18a0

Found in base branch: main

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

Publish Date: 2018-07-13

URL: CVE-2018-14041

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:4.1.2

CVE-2018-14040

Vulnerable Library - bootstrap-4.0.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.0.0/js/bootstrap.min.js

Path to dependency file: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Path to vulnerable library: /vendor/opentok/opentok/sample/Archiving/templates/base.html

Dependency Hierarchy:

  • bootstrap-4.0.0.min.js (Vulnerable Library)

Found in HEAD commit: 6ce28e32c646f40a437e43bdd53ae617f68e18a0

Found in base branch: main

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.8%

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14040

Release Date: 2018-07-13

Fix Resolution: bootstrap - 3.4.0,4.1.2

Implement dotenv to make setting environment variables easier

This demo seems to assume that it is either being run via the scripts or from Heroku, but when deploying behind a standard web server it is not clear how to set up the environment variables.

Implementing a dotenv solution will allow a user to create a config file that can be used across the board to create the environment variables.

You must define an TOKBOX_API_KEY and TOKBOX_SECRET in the run-demo file

I added my api key and secret in run-demo file.

#!/bin/sh

if [ -z "$TOKBOX_API_KEY" ] || [ -z "$TOKBOX_SECRET" ]
then
export TOKBOX_API_KEY=00000000
export TOKBOX_SECRET=000000000000000000000000000
fi

if [ -d "storage" ]
then
rm -rf storage/
fi

php -S 0.0.0.0:8080 -t web web/index.php

and then run run-demo file in windows cmd. But it still saying
You must define an TOKBOX_API_KEY and TOKBOX_SECRET in the run-demo file

crash trying to render view.php

I used the learning-opentok-web archive branch to test out a 2 user video archive. I clicked "archive", "stop" then "view". The view button loaded a new page, presumably because the archive wasn't yet ready to view. But that page crashed with the following message:

exception 'RuntimeException' with message 'View cannot render `view.php` because the template does not exist' in /Users/marcel/proj/tmp/learning-opentok-php/vendor/slim/slim/Slim/View.php:272

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.