fix: fix the geoip localhost hack

Signed-off-by: deslokitty <deslokitty@desloratadyna.net>

bloom.js

@@ -1,3 +1,6 @@
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+
 const sqlite = require("better-sqlite3");
 const uuid = require("uuid");
 
@@ -10,7 +13,7 @@ database.prepare("DROP TABLE IF EXISTS fluff_logins;").run();
 
 database.prepare("CREATE TABLE fluff_authorised_services(id TEXT PRIMARY KEY, serviceId TEXT, userId TEXT, authorisedAt INTEGER);").run();
 database.prepare("CREATE TABLE fluff_authentication_base(id TEXT PRIMARY KEY, identifier TEXT UNIQUE, passhash TEXT, quote TEXT, admin INTEGER)").run();
-database.prepare("CREATE TABLE fluff_services(id TEXT PRIMARY KEY, displayName TEXT, shortDescription, tosLink TEXT, ppLink TEXT, ownerId TEXT, approved INT);").run();
+database.prepare("CREATE TABLE fluff_services(id TEXT PRIMARY KEY, displayName TEXT, shortDescription, tosLink TEXT, ppLink TEXT, endpointLink TEXT, ownerId TEXT, approved INT);").run();
 database.prepare("CREATE TABLE fluff_logins(id TEXT PRIMARY KEY, timestamp INTEGER, ip TEXT)").run();
 
 const deslokittyuuid = uuid.v7();
@@ -18,8 +21,10 @@ const chatuuid = uuid.v7();
 const authid = uuid.v7();
 
 database.prepare("INSERT INTO fluff_authentication_base(id, identifier, passhash, quote, admin) VALUES (?, ?, ?, ?, ?)").run(deslokittyuuid, "deslokitty", "$2b$12$GAfuSvAwwwmzRP3HOaZiIeuz0IQFTqDZH1wdD9xGIJ5FOkqim9QRS", "meow meow >w<", 1);
-database.prepare("INSERT INTO fluff_services(id, displayName, shortDescription, tosLink, ppLink, ownerId, approved) VALUES (?, ?, ?, ?, ?, ?, ?)").run(chatuuid, "chat domestique", "chat domestique is a heavily opinionated chat platform for silly kibbies >w<", "https://chatdomestique.fr/legal/termsofuse", "https://chatdomestique.fr/legal/privacypolicy", deslokittyuuid, 1);
+database.prepare("INSERT INTO fluff_services(id, displayName, shortDescription, tosLink, ppLink, endpointLink, ownerId, approved) VALUES (?, ?, ?, ?, ?, ?, ?, ?)").run(chatuuid, "chat domestique", "chat domestique is a heavily opinionated chat platform for silly kibbies >w<", "https://chatdomestique.fr/legal/termsofuse", "https://chatdomestique.fr/legal/privacypolicy", "https://internal.chatdomestique.fr/endpoint/desloratadyna", deslokittyuuid, 1);
 database.prepare("INSERT INTO fluff_authorised_services(id, serviceId, userId, authorisedAt) VALUES (?, ?, ?, ?)").run(authid, chatuuid, deslokittyuuid, Date.now());
 
+fs.writeFileSync("./hmacsecret", crypto.randomBytes(16).toString("base64url"));
+
 database.close();
 

index.js

@@ -53,7 +53,7 @@ function verifyToken(token) {
 	return split[0];
 }
 function sanitiseStringHTML(str) {
-	return str.replaceAll(">", "&gt;").replaceAll("<", "&lt;");
+	return str.replaceAll("&", "&amp;").replaceAll(">", "&gt;").replaceAll("<", "&lt;");
 }
 
 app.use(express.urlencoded());
@@ -75,6 +75,8 @@ app.use((req, res, next) => {
 });
 app.use((req, res, next) => {
 	req.userId = verifyToken(req.cookies.token);
+	if (!req.headers['x-forwarded-for']) return next();
+
 	const geo = geoip.lookup(req.headers['x-forwarded-for']);
 	console.log(geo);
 
@@ -165,6 +167,6 @@ app.get("/cgi-bin/primarypage", async (req, res, next) => {
 	res.end();
 });
 
-// haha almost 420
-app.listen(42424);
+// haha 420
+app.listen(42420);