[mirrors/Kyberia-bloodline.git] / doc / TODO

- User mail is not working
 (seems to be fixed, but we still can't delete the mails...)
  Anyway move whole mail handling out of nodes.php (?)

- Registration process is not working
  (rewrite sending of reg. mails) (TEST)
  (during registration we should generate GnuPG keypair to user_gpg_prv and user_gpg_pub fields in table users)

- SQL injections (many fixed, but some should be still there)

- remove absolute paths from all source files (!)

- User images (icons) seems to be broken somehow

- remove hard-coded hostname from:
  ( registration mails )
  ( scripts in "scripts" directory (system paths))

- Fix https vs http problem (url) 

- Suspected security holes:
  ( cron/process-img.sh )
  ( ./inc/eventz/spamuj_ubik.inc )
  ( ./inc/eventz/upload_own_template.inc ) (is even needed?)

- Remove/fix not working eventz
  ( ./inc/eventz/addClass.inc  )
  ( ./inc/eventz/addEvent.inc )
  ( ./inc/eventz/addAjax.inc )
  ( ./inc/eventz/addPlugin.inc )
  ( ./inc/eventz/kyberia.inc ) (wtf)
 
- Refactor directory structure

- Deprecated PHP features
  ( Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 163 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 184 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 196 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 208 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 220 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 242 )

- keep fixing XSS

- Test & scale logarithmic threading

- some templates are fixed only in .tpl, not in sql database
  => synchronize .tpl vs SQL templates (permanently)

- Clean code => fix uninitialized variables

- documentation/installation guide (see README)

- Make PATH_INFO not changing contents of $_GET[] (it should affect some other variable instead - requires complex rewrite)
- Switch completely to Base36 (Templates, Links, don't change $_GET[], queries should convert between base10 in db and base36 in kyberia automatically, etc...)

- (IMHO we should use SHA1 or stronger algorithm instead of MD5 for storing passwords)
  (We really need this... I've cracked Hromi's password in few seconds (even when it was relatively secure))
  (I've implemented this partially. We can now login using various hash algorithms, it's backward compatible, but we still need to edit registration/password changing to use SHA1 when updating passwords in DB)
Commit	Line	Data
fe69da5f	1	- User mail is not working
fc77dffe	2	(seems to be fixed, but we still can't delete the mails...)
5b9c0808	3	Anyway move whole mail handling out of nodes.php (?)
fe69da5f	4
fe69da5f	5	- Registration process is not working
5b9c0808	6	(rewrite sending of reg. mails) (TEST)
fc77dffe	7	(during registration we should generate GnuPG keypair to user_gpg_prv and user_gpg_pub fields in table users)
fe69da5f	8
46c0767c	9	- SQL injections (many fixed, but some should be still there)
fe69da5f	10
5b9c0808	11	- remove absolute paths from all source files (!)
	12
	13	- User images (icons) seems to be broken somehow
fe69da5f	14
78cc8511	15	- remove hard-coded hostname from:
	16	( registration mails )
	17	( scripts in "scripts" directory (system paths))
5b9c0808	18
78cc8511	19	- Fix https vs http problem (url)
dcee7633	20
	21	- Suspected security holes:
	22	( cron/process-img.sh )
f657368b	23	( ./inc/eventz/spamuj_ubik.inc )
f657368b	24	( ./inc/eventz/upload_own_template.inc ) (is even needed?)
dcee7633	25
f657368b	26	- Remove/fix not working eventz
	27	( ./inc/eventz/addClass.inc )
	28	( ./inc/eventz/addEvent.inc )
	29	( ./inc/eventz/addAjax.inc )
	30	( ./inc/eventz/addPlugin.inc )
	31	( ./inc/eventz/kyberia.inc ) (wtf)
	32
d48685b8	33	- Refactor directory structure
2f9b4885 H	34
	35	- Deprecated PHP features
	36	( Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 163 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 184 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 196 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 208 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 220 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 242 )
fe69da5f	37
	38	- keep fixing XSS
	39
5b9c0808	40	- Test & scale logarithmic threading
	41
	42	- some templates are fixed only in .tpl, not in sql database
	43	=> synchronize .tpl vs SQL templates (permanently)
fe69da5f	44
fe69da5f	45	- Clean code => fix uninitialized variables
f657368b	46
5b9c0808	47	- documentation/installation guide (see README)
f657368b	48
bb6232c5 H	49	- Make PATH_INFO not changing contents of $_GET[] (it should affect some other variable instead - requires complex rewrite)
bb6232c5 H	50	- Switch completely to Base36 (Templates, Links, don't change $_GET[], queries should convert between base10 in db and base36 in kyberia automatically, etc...)
45a1b870	51
f657368b	52	- (IMHO we should use SHA1 or stronger algorithm instead of MD5 for storing passwords)
1ca26066 H	53	(We really need this... I've cracked Hromi's password in few seconds (even when it was relatively secure))
1ca26066 H	54	(I've implemented this partially. We can now login using various hash algorithms, it's backward compatible, but we still need to edit registration/password changing to use SHA1 when updating passwords in DB)