Skip to content

Commit bbe2ff7

Browse files
TheSerapherTheSerapher
committed
Merge pull request #2219 from MPOS/development
UPDATE : Development to Master
2 parents 27391e6 + 363b742 commit bbe2ff7

File tree

23 files changed

+192
-83
lines changed

23 files changed

+192
-83
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
/logs/*
1515

1616
# Test configs
17+
/include/config/global.inc.test.php
1718
/include/config/global.inc.scrypt.php
1819
/include/config/global.inc.sha.php
1920

‎README.md

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Description [ ![Codeship Status for TheSerapher/php-mpos](https://www.codeship.io/projects/40fa7600-61a6-0131-3fd3-367b94dc0d60/status?branch=next)](https://www.codeship.io/projects/12276)
1+
Description
22
===========
33

44
MPOS is a web based Mining Portal for various crypto currencies. It was created by [TheSerapher](https://github.com/TheSerapher) and has hence grown quite large. Recently it was migrated into a Github Organization to make development easier. It's a community driven open source project. Support can be requested on IRC at https://webchat.freenode.net/?channels=#mpos
@@ -15,7 +15,10 @@ Donations to this project are going directly to [TheSerapher](https://github.com
1515

1616
* LTC address: `Lge95QR2frp9y1wJufjUPCycVsg5gLJPW8`
1717
* BTC address: `1HuYK6WPU8o3yWCrAaADDZPRpL5QiXitfv`
18-
* DOGE Address: `D6YtvxFGBmaD8Yq3i8LZsBQVPvCbZwCDzF`
18+
* DOGE address: `DANk8bnc3vHEf7Jthaxq1Xgn1BSiArNdjG`
19+
* 42Coin address: `4VxA6Ht59Mj6ikhA4gDXLiHuAaDCJEvYTZ`
20+
* FST address: `fiRqMgZyhjTN1GSEB3ZxV35JXsE5bjEaQ2`
21+
* FRK address: `FDcgGZjX2B29qevSuiuQVwXhkNhtQT4cEW`
1922
* Cryptsy Trade Key: `6ff7292142463b7b80cbbbdfc52334ba89727b11`
2023

2124
Website Footer
@@ -79,23 +82,22 @@ The following feature have been implemented so far:
7982

8083
* Fully re-written GUI with [Smarty][2] templates
8184
* Full file based template support
82-
* **NEW** SQL based templates
83-
* Mobile WebUI
84-
* Scrypt, SHA256, VARDIFF Support
85+
* VARDIFF Support
8586
* Reward Systems
8687
* Propotional, PPS and PPLNS
8788
* New Theme
8889
* Live Dashboard
8990
* AJAX Support
9091
* Overhauled API
92+
* Bootstrap
9193
* Web User accounts
9294
* Re-Captcha protected registration form
9395
* Worker accounts
9496
* Worker activity
9597
* Worker hashrates
9698
* Pool statistics
9799
* Block statistics
98-
* Pool donations, fees and block bonuses
100+
* Pool donations, bonuses, fees and block bonuses
99101
* Manual and auto payout
100102
* Transaction list
101103
* Admin Panel
@@ -105,7 +107,6 @@ The following feature have been implemented so far:
105107
* User Transactions
106108
* News Posts
107109
* Pool Settings
108-
* Templates
109110
* Pool Workers
110111
* User Reports
111112
* Template Overwrite
@@ -115,9 +116,11 @@ The following feature have been implemented so far:
115116
* Auto Payout
116117
* Manual Payout
117118
* User-to-user Invitation System
118-
* Support for various coins via config
119+
* Support for various coins via coin class and config
119120
* All scrypt coins
120121
* All sha256d coins
122+
* All x11 coins
123+
* Others may be supported by creating a custom coin class
121124

122125
Installation
123126
============
@@ -131,7 +134,7 @@ This project was meant to allow users to easily customize the system and templat
131134
If you are just using the system, there will be no need to adjust anything. Things will work out of the box! But if you plan on creating
132135
your own theme, things are pretty easy:
133136

134-
* Create a new theme folder in `public/templates/`
137+
* Create a new theme folder in `templates/`
135138
* Create a new site_assets folder in `public/site_assets`
136139
* Create your own complete custom template or copy from an existing one
137140
* Change your theme in the `Admin Panel` and point it to the newly created folder

‎include/classes/api.class.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,10 @@ function get_json($data, $force=false) {
3737
)), $force ? JSON_FORCE_OBJECT : 0
3838
);
3939
// JSONP support issue #1700
40-
if (isset($_REQUEST['callback']))
40+
if (isset($_REQUEST['callback']) && ctype_alpha($_REQUEST['callback'])) {
41+
header('Content-type: application/json; charset=utf-8');
4142
return $_REQUEST['callback'] . '(' . $json . ');';
43+
}
4244
return $json;
4345
}
4446

‎include/classes/share.class.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,8 +129,8 @@ function getMaxArchiveShareId() {
129129
* return array data Returns an array with usernames as keys for easy access
130130
**/
131131
function getArchiveShares($iCount) {
132-
$iMinId = $this->getMinArchiveShareId($iCount);
133132
$iMaxId = $this->getMaxArchiveShareId();
133+
$iMinId = $this->getMinArchiveShareId($iCount);
134134
$stmt = $this->mysqli->prepare("
135135
SELECT
136136
a.id,

‎include/classes/tools.class.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,11 @@ public function getOnlineVersions() {
1818
curl_setopt($curl, CURLOPT_HEADER, false);
1919
$data = curl_exec($curl);
2020
preg_match('/define\(\'MPOS_VERSION\', \'(.*)\'\);/', $data, $match);
21-
$mpos_versions['MPOS_VERSION'] = $match[1];
21+
$mpos_versions['MPOS_VERSION'] = @$match[1];
2222
preg_match('/define\(\'DB_VERSION\', \'(.*)\'\);/', $data, $match);
23-
$mpos_versions['DB_VERSION'] = $match[1];
23+
$mpos_versions['DB_VERSION'] = @$match[1];
2424
preg_match('/define\(\'CONFIG_VERSION\', \'(.*)\'\);/', $data, $match);
25-
$mpos_versions['CONFIG_VERSION'] = $match[1];
25+
$mpos_versions['CONFIG_VERSION'] = @$match[1];
2626
curl_close($curl);
2727
return $this->memcache->setCache($key, $mpos_versions, 30);
2828
} else {

‎include/classes/user.class.php

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -741,9 +741,11 @@ public function register($username, $coinaddress, $password1, $password2, $pin,
741741
$this->setErrorMessage('Username exceeding character limit');
742742
return false;
743743
}
744-
if (!$this->bitcoin->validateaddress($coinaddress)) {
745-
$this->setErrorMessage('Coin address is not valid');
746-
return false;
744+
if (!is_null($coinaddress)) {
745+
if (!$this->bitcoin->validateaddress($coinaddress)) {
746+
$this->setErrorMessage('Coin address is not valid');
747+
return false;
748+
}
747749
}
748750
if (preg_match('/[^a-z_\-0-9]/i', $username)) {
749751
$this->setErrorMessage('Username may only contain alphanumeric characters');
@@ -841,7 +843,7 @@ public function register($username, $coinaddress, $password1, $password2, $pin,
841843
} else {
842844
$this->setErrorMessage( 'Unable to register' );
843845
$this->debug->append('Failed to insert user into DB: ' . $this->mysqli->error);
844-
if ($stmt->sqlstate == '23000') $this->setErrorMessage( 'Username or email already registered' );
846+
if ($stmt->sqlstate == '23000') $this->setErrorMessage( 'Username, email or Coinaddress already registered' );
845847
return false;
846848
}
847849
return false;

‎include/config/global.inc.dist.php

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,20 @@
77
* https://github.com/MPOS/php-mpos/wiki/Config-Setup#wiki-config-version
88
**/
99
$config['version'] = '0.0.8';
10-
$config['version_url'] = 'https://raw.githubusercontent.com/MPOS/php-mpos/master/public/include/version.inc.php';
10+
$config['version_url'] = 'https://raw.githubusercontent.com/MPOS/php-mpos/master/include/version.inc.php';
1111

1212
/**
1313
* Unless you disable this, we'll do a quick check on your config first.
1414
* https://github.com/MPOS/php-mpos/wiki/Config-Setup#wiki-config-check
1515
*/
1616
$config['skip_config_tests'] = false;
1717

18+
/**
19+
* Unless you disable this, we'll do a check for a valid coin address on registration.
20+
* https://github.com/MPOS/php-mpos/wiki/Config-Setup#check-for-valid-wallet-address
21+
*/
22+
$config['check_valid_coinaddress'] = true;
23+
1824
/**
1925
* Defines
2026
* Debug setting and salts for hashing passwords

‎include/pages/admin/news.inc.php

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,31 @@
1010
// Include markdown library
1111
use \Michelf\Markdown;
1212

13-
if (@$_REQUEST['do'] == 'toggle_active')
14-
if ($news->toggleActive($_REQUEST['id']))
15-
$_SESSION['POPUP'][] = array('CONTENT' => 'News entry changed', 'TYPE' => 'alert alert-success');
13+
if (@$_REQUEST['do'] == 'toggle_active') {
14+
if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) {
15+
if ($news->toggleActive($_REQUEST['id'])) {
16+
$_SESSION['POPUP'][] = array('CONTENT' => 'News entry changed', 'TYPE' => 'alert alert-success');
17+
}
18+
}
19+
}
1620

1721
if (@$_REQUEST['do'] == 'add') {
18-
if ($news->addNews($_SESSION['USERDATA']['id'], $_POST['data'])) {
19-
$_SESSION['POPUP'][] = array('CONTENT' => 'News entry added', 'TYPE' => 'alert alert-success');
20-
} else {
21-
$_SESSION['POPUP'][] = array('CONTENT' => 'Failed to add new entry: ' . $news->getError(), 'TYPE' => 'alert alert-danger');
22+
if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) {
23+
if ($news->addNews($_SESSION['USERDATA']['id'], $_POST['data'])) {
24+
$_SESSION['POPUP'][] = array('CONTENT' => 'News entry added', 'TYPE' => 'alert alert-success');
25+
} else {
26+
$_SESSION['POPUP'][] = array('CONTENT' => 'Failed to add new entry: ' . $news->getError(), 'TYPE' => 'alert alert-danger');
27+
}
2228
}
2329
}
2430

2531
if (@$_REQUEST['do'] == 'delete') {
26-
if ($news->deleteNews((int)$_REQUEST['id'])) {
27-
$_SESSION['POPUP'][] = array('CONTENT' => 'Succesfully removed news entry', 'TYPE' => 'alert alert-success');
28-
} else {
29-
$_SESSION['POPUP'][] = array('CONTENT' => 'Failed to delete entry: ' . $news->getError(), 'TYPE' => 'alert alert-danger');
32+
if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) {
33+
if ($news->deleteNews((int)$_REQUEST['id'])) {
34+
$_SESSION['POPUP'][] = array('CONTENT' => 'Succesfully removed news entry', 'TYPE' => 'alert alert-success');
35+
} else {
36+
$_SESSION['POPUP'][] = array('CONTENT' => 'Failed to delete entry: ' . $news->getError(), 'TYPE' => 'alert alert-danger');
37+
}
3038
}
3139
}
3240

@@ -38,4 +46,4 @@
3846
}
3947
$smarty->assign("NEWS", $aNews);
4048
$smarty->assign("CONTENT", "default.tpl");
41-
?>
49+
?>

‎include/pages/admin/news_edit.inc.php

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,18 @@
1010
// Include markdown library
1111
use \Michelf\Markdown;
1212

13-
if (@$_REQUEST['do'] == 'save') {
14-
if ($news->updateNews($_REQUEST['id'], $_REQUEST['header'], $_REQUEST['content'], $_REQUEST['active'])) {
15-
$_SESSION['POPUP'][] = array('CONTENT' => 'News updated', 'TYPE' => 'alert alert-success');
16-
} else {
17-
$_SESSION['POPUP'][] = array('CONTENT' => 'News update failed: ' . $news->getError(), 'TYPE' => 'alert alert-danger');
13+
if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) {
14+
if (@$_REQUEST['do'] == 'save') {
15+
if ($news->updateNews($_REQUEST['id'], $_REQUEST['header'], $_REQUEST['content'], $_REQUEST['active'])) {
16+
$_SESSION['POPUP'][] = array('CONTENT' => 'News updated', 'TYPE' => 'alert alert-success');
17+
} else {
18+
$_SESSION['POPUP'][] = array('CONTENT' => 'News update failed: ' . $news->getError(), 'TYPE' => 'alert alert-danger');
19+
}
1820
}
1921
}
2022

2123
// Fetch news entry
2224
$aNews = $news->getEntry($_REQUEST['id']);
2325
$smarty->assign("NEWS", $aNews);
2426
$smarty->assign("CONTENT", "default.tpl");
25-
?>
27+
?>

‎include/pages/admin/settings.inc.php

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,15 @@
88
}
99

1010
if (@$_REQUEST['do'] == 'save' && !empty($_REQUEST['data'])) {
11-
$user->log->log("warn", @$_SESSION['USERDATA']['username']." changed admin settings");
12-
foreach($_REQUEST['data'] as $var => $value) {
13-
$setting->setValue($var, $value);
11+
if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) {
12+
$user->log->log("warn", @$_SESSION['USERDATA']['username']." changed admin settings");
13+
foreach($_REQUEST['data'] as $var => $value) {
14+
$setting->setValue($var, $value);
15+
}
16+
$_SESSION['POPUP'][] = array('CONTENT' => 'Settings updated', 'TYPE' => 'alert alert-success');
17+
} else {
18+
$_SESSION['POPUP'][] = array('CONTENT' => $csrftoken->getErrorWithDescriptionHTML(), 'TYPE' => 'alert alert-warning');
1419
}
15-
$_SESSION['POPUP'][] = array('CONTENT' => 'Settings updated', 'TYPE' => 'alert alert-success');
1620
}
1721

1822
// Load our available settings from configuration
@@ -23,4 +27,4 @@
2327

2428
// Tempalte specifics
2529
$smarty->assign("CONTENT", "default.tpl");
26-
?>
30+
?>

0 commit comments

Comments
 (0)