tryanzu / anzu Goto Github PK

This is the result: (loaded posts above pinned posts)

Make an endpoint that:

• Allows to add flags to posts, comments and users.

Comentarios negativos

Solo es cuestión de repetir la petición DELETE

votos negativos

Eso se provoca cuando se envían muchas peticiones de up y de down :v al mismo tiempo y obtienes votos falsos

https://buldar.com/p/MhJ9zD/5c52199746387662b20dd5bc/

https://api.spartangeek.com/v1/posts/5c52199746387662b20dd5bc

Make an endpoint that:

• Gets a paginated list of banned users sorted by ban date.

Make an endpoint that removes the ban from a user and tracks that action into the audit logs.

Hay parámetros que no limitan la cantidad de palabras, esto puede se algo parecido a (CVE-2018-6389) al usar una gran cantidad de contenido y al realizar varias peticiones debería desencadenarse en un DoS

ejemplo:

https://api.spartangeek.com/v1/users/58716be24638760a4fa5578c

https://thehackernews.com/2018/02/wordpress-dos-exploit.html

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6389

Si no se usa un proxy inverso se puede falsificar los headers " X-Forwarded-For: " esto permite darle ban a las ip de los usuarios

IP real

IP de la victima :v XD

when i try git submodule update --init --recursive or go get github.com/tryanzu/core i get error:

The authenticity of host 'github.com (140.82.118.4)' can't be established.
RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
No matching host key fingerprint found in DNS.
Are you sure you want to continue connecting (yes/no)? yes
# cd /root/go/src/github.com/tryanzu/core; git submodule update --init --recursive
fatal: clone of '[email protected]:tryanzu/frontend.git' into submodule path '/root/go/src/github.com/tryanzu/core/static/frontend' failed
Failed to clone 'static/frontend'. Retry scheduled
Cloning into '/root/go/src/github.com/tryanzu/core/static/frontend'...
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
fatal: clone of '[email protected]:tryanzu/frontend.git' into submodule path '/root/go/src/github.com/tryanzu/core/static/frontend' failed
Failed to clone 'static/frontend' a second time, aborting
package github.com/tryanzu/core: exit status 

Use something like https://github.com/disintegration/imaging to do some post processing on uploadable assets, the first goal is to have frontend optimized images (compressed and resized) for different use cases (maybe with suffixes like -80x80 160x60 -original).

A generic solution is preferred.

Currently we only upload new avatars && comment images.

Make an endpoint that:

• Gets a paginated list of audit logs sorted by date desc.
• The user has to be loaded per audit item.
• The related entity has to be loaded as well.

When uploading an image Anzu should check if file extension is in a whitelist (could be png, jpg, jpeg, gif, bmp, tiff, ico) and not only by the MIME Type algorithm.

https://github.com/tryanzu/core/blob/20e43b3bb8b6388c4bd8d47fad4d927676dbd185/board/legacy/post.go#L321-L324

At the moment AWS mitigates the problem, but anzu must validate the filetype if using a "driver" instead of directly saving to AWS (like https://github.com/graymeta/stow or https://github.com/spf13/afero or https://github.com/usmanhalalit/gost).

Create a new endpoint that:

• Checks permissions to ban a user
• Performs the ban

• Have a set of predefined reactions that categories will use...
• Frontend reactions will be linked to category's set of reactions.
• Categories endpoint will also return this information.

Reintegrate the password recovery email (it has been disabled)

The categories inside the forum will be updated through this endpoint as a whole. It will take the model currently used by GET /category and it will perform the needed updates to individual records in database.