TODO update, icons should be working now

[mirrors/Kyberia-bloodline.git] / doc / TODO

diff --git a/doc/TODO b/doc/TODO
index 135cc79bd20ad2eaac24801a806f59700237b898..612b0884a7a2d0c23e1c7b7ad0613ca816188d99 100644 (file)
--- a/doc/TODO
+++ b/doc/TODO
@@ -1,20 +1,55 @@
-- fix uploading of files
-- fix ALL sql injections
-- keep fixing XSS
-- documentantion/instalation guide (see README)
-- remove absolute paths from all source files (!) (over 50)
-- remove hard-coded kyberia.sk from:
-  ( ./inc/eventz/configure_email.inc )
-  ( ./inc/eventz/delete.inc )
-  ( ./inc/smarty/node_methodz/modifier.replaceLocalURLs.php )
-  ( ./inc/replaceLocalURLs.inc )
-  ( ./nodes.php )
-  ( ./cron/rssparse.php )
-  ( ./scripts/contentregexp.php ) (obsolete?)
+- When adding node, content is escaped twice(?)
+
+- Registration process -> Add welcome texts & move them to one file/node
+  Temporary requests node does not exists.
+  Nodes are created with bad vector
+  (during registration we should generate GnuPG keypair 
+   to user_gpg_prv and user_gpg_pub fields in table users) (harvie)
+
+- Fix uploading user images
+
+- User mail -> can't delete the mails...
+  Anyway move whole mail handling out of nodes.php (?)
+
+- SQL injections (many fixed, but some should be still there)
+
+- remove absolute paths from all source files (!)
+
+- remove hard-coded hostname from:
+  ( registration mails )
+  ( scripts in "scripts" directory (system paths))
+
+- Fix https vs http problem (url) 
 
 - Suspected security holes:
   ( cron/process-img.sh )
-  ( sms_payment.php  => yes, sqli but is it really used? )
-  ( inc/eventz/upload_data_node.php => Shell injections in .zip hanling, .jpg handling,
-    "strange" filenames like .htacess (to allow listing of folder)
+  ( ./inc/eventz/spamuj_ubik.inc )
+  ( ./inc/eventz/upload_own_template.inc ) (is even needed?)
+
+- Remove/fix not working eventz
+  ( ./inc/eventz/addClass.inc  )
+  ( ./inc/eventz/addEvent.inc )
+  ( ./inc/eventz/addAjax.inc )
+  ( ./inc/eventz/addPlugin.inc )
+  ( ./inc/eventz/kyberia.inc ) (wtf)
+ 
+- Refactor directory structure
+
+- Deprecated PHP features
+  ( Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 163 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 184 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 196 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 208 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 220 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 242 )
+
+- keep fixing XSS
+
+- Test & scale logarithmic threading
+
+- Remove templates from git (they should be only in sql)
+
+- Clean code => fix uninitialized variables
+
+- documentation/installation guide (see README)
+
+- Make PATH_INFO not changing contents of $_GET[] (it should affect some other variable instead - requires complex rewrite)
+- Switch completely to Base36 (Templates, Links, don't change $_GET[], queries should convert between base10 in db and base36 in kyberia automatically, etc...)
 
+- (IMHO we should use SHA1 or stronger algorithm instead of MD5 for storing passwords)
+  (I've implemented this partially. We can now login using various hash algorithms, it's backward compatible, but we still need to edit registration/password changing to use SHA1 when updating passwords in DB)