PIPULLV3-logo

PIPULLV3

❯ Felix Cenusa

repo-top-language repo-language-count

Built with the tools and technologies:

Overview

PIPULLV3 is a web application developed by Felix Cenusa that enables users to create, share, and manage digital labels with advanced security and privacy features. The platform offers seamless integration with Gmail, robust password security, admin controls, uploads and downloads, providing a user-friendly experience for both end-users and administrators.

Features

Web-App Features

Account:

Accounts can be created with a strong password and email confirmation or via direct Google authentication.
Accounts can be edited, deactivated, or deleted.
User information, including passwords, is securely hashed and salted for enhanced security.
Accounts will be automatically deactivated after 3 months of inactivity, with several reminder emails sent before deactivation.

Boxes:

Boxes can be created, edited, or deleted.
Contents of any file type can be added or removed from boxes.
Boxes can be shared with other users, made public or private.
Private boxes can be secured with a 6-digit code when shared.
Shared boxes are sent directly to the recipient’s email for easy access.

Admin Features:

Admins have access to all user data and storage usage information.
Admins can send marketing emails to users.
Admins can activate or deactivate user accounts as needed.

Personal Touches:

Integrated CAPTCHA for spam prevention during registration and login.
Added a statistics display, including total lines of code, on the homepage along with a leaderboard.
Implemented a Kanban board for task management and feature suggestions.
Added an architecture viewer for visualizing the project structure.

Security:

Input Validation & Sanitization:

Sanitizing User Inputs: All user inputs are cleaned up by removing potentially harmful HTML or JavaScript, preventing Cross-Site Scripting (XSS) attacks.
HTML Encoding: User-generated content is encoded so that special characters cannot be interpreted as executable code.
Regex Validation: Regular expressions are used to ensure fields like usernames, emails, and passwords meet specific security standards, reducing the risk of invalid or malicious data being submitted.

Password Security:

Hashing and Salting: Passwords are hashed and salted using bcrypt, ensuring they are never stored as plain text. This makes it difficult for attackers to retrieve passwords even if they gain access to the database.
Password Strength Requirements: Users must create strong passwords that include a mix of uppercase and lowercase letters, numbers, and special characters.

Session Security:

Secure Session Management: User sessions are securely tied to each user, and session cookies are configured to prevent cross-site scripting attacks.
Session Expiration: Sessions automatically expire after a period of inactivity, preventing unauthorized access if a user forgets to log out.

IP-Based View Counting:

Hashed IP Addresses: IP addresses are hashed before storage, maintaining user privacy while allowing the system to differentiate between unique and total page views.
Unique View Counting: By using hashed IPs, I can track unique visitors to provide accurate statistics without compromising user anonymity.
Rate Limiting: Will implement IP based rate limiting later, but for now captcha is very good at stopping bots.

File Upload Security:

File Size Limits: Limits are placed on file sizes to prevent oversized uploads that could harm system performance or be used for denial-of-service attacks.
File Path and Name Security: Uploaded files are renamed and stored securely, with path and filename sanitization ensuring no malicious paths or characters compromise the system.
MIME Type Checking: File uploads are validated by checking MIME types to ensure that the content matches the declared file extension, protecting against malicious content disguised as safe file types.

SQL Injection Prevention:

Parameterized Queries: All database queries use parameterized statements, preventing SQL injection attacks by ensuring user input is never directly inserted into SQL commands.

Ongoing Security Monitoring:

I continuously monitor the platform for vulnerabilities and apply updates as necessary. If any security issue is noticed, I am quick to address it to keep the platform secure.

Self-Hosted Features

Currently, a single Raspberry Pi hosts and stores all the data for the application.
The Pi automatically pulls the latest updates from this GitHub repository and runs the application using PM2.
I use cron jobs to handle repository pulls and to update Cloudflare with the Pi’s new IP address if it changes, ensuring continuous tunneling to keep the website public.
Tunneling data through Cloudflare ensures the site is accessible publicly, and I maintain secure remote access to the Pi using SSH.
HTTPS SSL key.
Automatically boots and runs the server again if it crashes or wifi goes down.

Future Expansion:

Once the new components arrive, I plan to expand to a network of 2 Raspberry Pis running the same data.
These Pis will synchronize using a custom program secured with private and public keys.
Each location will be configured for data redundancy, ensuring automatic data replication in case one server goes down, providing high availability and fault tolerance.

Built With

JavaScript
MySQL
EJS
A loooot of packages

Installation

Clone the Repository

git clone https://github.com/FelixCenusa/PiPullV3.git

Install Dependencies
```
cd PiPullV3
npm install
```
Set Up Database
- Create a MySQL database.
- Run the provided SQL scripts (setup.sql and createTables.sql) in the SQL folder to set up the necessary tables.
Configure Environment Variables
- Create a .env file.
- Add your database credentials, API keys, and other configuration settings.
Run the Application
```
node index.js
```

Usage

Registration/Login: Users can sign up using email/password or their Gmail accounts.
Creating Labels: After logging in, users can create new digital labels with customized content.
Sharing Labels: Labels can be shared via email or within the platform.
Privacy Controls: Users can set labels to private and manage PIN protection.
Admin Access: Admin users can log in to access the admin dashboard for user management.

Contributing

Contributions are welcome! Please follow these steps:

Fork the Repository (if you haven’t already) by going to the main repository on GitHub and clicking the “Fork” button at the top-right of the page.
Create a Feature Branch
```
git checkout -b feature/YourFeature
```
Commit Your Changes
```
git commit -m 'Add Your Feature'
```
Push to the Branch
```
git push origin feature/YourFeature
```

License

This project is licensed under the MIT License. See the LICENSE file for details.

Contact

Email: [email protected]
LinkedIn: Felix Cenusa
GitHub: FelixCenusa