|
|
@@ -1,71 +1,119 @@
|
|
1
|
|
-This is BioTorrents.de's version of Gazelle
|
|
|
1
|
+# BioTorrents.de Gazelle
|
|
2
|
2
|
|
|
3
|
|
-Below are some lists of differences between this version of Gazelle and What.cd's. Please note that these lists are far from complete.
|
|
|
3
|
+This software is twice removed from the original
|
|
|
4
|
+[What.cd Gazelle](https://github.com/WhatCD/Gazelle):
|
|
|
5
|
+it's based on the security hardened PHP7 fork
|
|
|
6
|
+[Oppaitime Gazelle](https://git.oppaiti.me/Oppaitime/Gazelle).
|
|
|
7
|
+The goal is to organize a functional database with pleasant interfaces,
|
|
|
8
|
+and render insightful views using data from robust external sources.
|
|
4
|
9
|
|
|
5
|
|
-## Major Changes
|
|
|
10
|
+# Changelog: OT → Bio
|
|
6
|
11
|
|
|
7
|
|
-#### Integrated Database Encryption
|
|
|
12
|
+## Bearer token authorization
|
|
8
|
13
|
|
|
9
|
|
-Using a database key [provided by staff](sections/tools/misc/database_key.php) and only ever stored as a hash in memory (via APCu), the [integrated database encryption](classes/crypto.class.php) is used to encrypt sensitive user data like IP addresses, emails, and private messages regardless of the underlying system gazelle is running on.
|
|
|
14
|
+[API Docs](https://docs.biotorrents.de).
|
|
|
15
|
+API tokens can be generated in the
|
|
|
16
|
+[user security settings](sections/user/token.php)
|
|
|
17
|
+and used with the JSON API.
|
|
10
|
18
|
|
|
11
|
|
-The rest of gazelle must be aware that some of the data it fetches from the DB is encrypted, and must have a fallback if that data is unavailable (the key is not in memory). You will see plenty of `if (!apcu_exists('DBKEY')) {` in this codebase.
|
|
|
19
|
+## Good typography
|
|
|
20
|
+
|
|
|
21
|
+BioTorrents.de supports an array of
|
|
|
22
|
+[unobtrusive fonts](static/styles/assets/scss/fonts.scss)
|
|
|
23
|
+with the appropriate bold/italic glyphs and monospace.
|
|
|
24
|
+These options are available to every theme.
|
|
|
25
|
+Font Awesome 5 is also universally available.
|
|
|
26
|
+
|
|
|
27
|
+## Markdown support
|
|
|
28
|
+
|
|
|
29
|
+[SimpleMDE markdown editor](https://simplemde.com)
|
|
|
30
|
+with extended custom editor interface.
|
|
|
31
|
+All the Markdown Extra features supported by
|
|
|
32
|
+[Parsedown Extra](https://github.com/erusev/parsedown-extra)
|
|
|
33
|
+are documented and the useful ones exposed in the editor interface.
|
|
|
34
|
+Support for the default Gazelle recursive regex BBcode parser.
|
|
|
35
|
+
|
|
|
36
|
+## $ENV recursive singleton
|
|
|
37
|
+
|
|
|
38
|
+[The site configuration](classes/config.template.php)
|
|
|
39
|
+is being migrated to a format govered by
|
|
|
40
|
+[the ENV special class](classes/env.class.php)
|
|
|
41
|
+for modified ArrayObjects.
|
|
|
42
|
+This is useful for several reasons:
|
|
|
43
|
+
|
|
|
44
|
+- prevents multiple configs loaded in memory;
|
|
|
45
|
+- ensures the config's immutability;
|
|
|
46
|
+- doesn't pollute the constants table;
|
|
|
47
|
+- allows public (echoed) and private (accessed) values;
|
|
|
48
|
+- supports large, nested static metadata structures;
|
|
|
49
|
+- able to scope access to the function level;
|
|
|
50
|
+- easy to extend ENV with new class methods;
|
|
|
51
|
+- good interoperability potential with JSON; and
|
|
|
52
|
+- native PHP ArrayObject support with Array compatibility.
|
|
12
|
53
|
|
|
13
|
|
-#### Authorized Login Locations
|
|
|
54
|
+## Twig template system
|
|
14
|
55
|
|
|
15
|
|
-Whenever a login occurs from a location (determined by ASN) that hasn't logged into that account before, an email is sent to the account owner requesting that they authorize that location before the login will go through.
|
|
|
56
|
+Similar to ENV,
|
|
|
57
|
+[the Twig interface](classes/twig.class.php)
|
|
|
58
|
+operates as a singleton because it's an external module with its own cache.
|
|
|
59
|
+Twig provides a security benefit by escaping rendered output,
|
|
|
60
|
+and a secondary benefit of clarifying the PHP running the site sections.
|
|
|
61
|
+Several custom filters are available from
|
|
|
62
|
+[Orpheus Gazelle](https://github.com/OPSnet/Gazelle).
|
|
16
|
63
|
|
|
17
|
|
-This prevents most attacks that would be otherwise successful, as it requires an attacker to access the site from the same locations the actual user uses to login.
|
|
|
64
|
+# Changelog: WCD → OT
|
|
18
|
65
|
|
|
19
|
|
-#### Two-Factor Authentication
|
|
|
66
|
+## Integrated Database Encryption
|
|
|
67
|
+
|
|
|
68
|
+Using a database key [provided by staff](sections/tools/misc/database_key.php) and only ever stored as a hash in memory (via APCu), the [integrated database encryption](classes/crypto.class.php) is used to encrypt sensitive user data like IP addresses, emails, and private messages regardless of the underlying system gazelle is running on.
|
|
|
69
|
+
|
|
|
70
|
+The rest of gazelle must be aware that some of the data it fetches from the DB is encrypted, and must have a fallback if that data is unavailable (the key is not in memory). You will see plenty of `if (!apcu_exists('DBKEY')) {` in this codebase.
|
|
|
71
|
+
|
|
|
72
|
+## Two-Factor Authentication
|
|
20
|
73
|
|
|
21
|
74
|
Despite our other (less intrusive) methods of protecting user accounts being more than sufficient for virtually all feasible attacks, we also ship optional 2FA should users feel the need to enable it.
|
|
22
|
75
|
|
|
23
|
|
-#### Universal 2nd Factor
|
|
|
76
|
+## Universal 2nd Factor
|
|
24
|
77
|
|
|
25
|
78
|
Support for physical U2F tokens has also been added as an optional alternative to normal 2FA. U2F allows users to protect their account with something less likely to be lost or erased than 2FA keys stored on a phone.
|
|
26
|
79
|
|
|
27
|
|
-#### Unique Infohashes
|
|
|
80
|
+## Unique Infohashes
|
|
28
|
81
|
|
|
29
|
82
|
Upon upload, torrent files are modified to contain a "source" field in the info dict containing the concatination of the site name and some generated junk data (unique per-torrent). This prevents infohash collisions with torrents cross-seeded from other sites in the same client, and also helps protect against some not particularly likely peer-leaking attacks.
|
|
30
|
83
|
|
|
31
|
|
-#### Expunge Requests
|
|
32
|
|
-
|
|
33
|
|
-Users are able to view the data kept on them and [issue requests for the deletion of old information](sections/delete) to staff through a simple interface.
|
|
34
|
|
-
|
|
35
|
|
-#### Resource Proxying
|
|
|
84
|
+## Resource Proxying
|
|
36
|
85
|
|
|
37
|
86
|
All external resources that may appear on a page are fetched and served by the server running gazelle. This prevents the leak of user information to third parties hosting content that has been included on a page through an image tag or similar.
|
|
38
|
87
|
|
|
39
|
|
-#### Scheduler
|
|
|
88
|
+## Scheduler
|
|
40
|
89
|
|
|
41
|
90
|
The [scheduler](sections/schedule) has been broken up into more manageable parts and has additional selective runtime features for manual execution.
|
|
42
|
91
|
|
|
43
|
|
-#### Bonus Points
|
|
|
92
|
+## Bonus Points
|
|
44
|
93
|
|
|
45
|
94
|
Like most gazelle forks, we've added a [bonus point system](sections/schedule/hourly/bonus_points.php) and [store](sections/store).
|
|
46
|
95
|
|
|
47
|
|
-#### Modern password hashing
|
|
|
96
|
+## Modern password hashing
|
|
48
|
97
|
|
|
49
|
98
|
We use modern PHP password hashing features that automatically rehash your password when a better hashing algorithm is made available and employ prehashing to allow you to use a secure password of any length. Original gazelle would effectively truncate your password after around 72 characters (if the tracker even allowed you to use a password that long). This codebase does not have the same problem, and allows passwords of virtually unlimited length (over 30,000 characters by default) that remain useful after a few tens of characters.
|
|
50
|
99
|
|
|
51
|
100
|
## Minor Changes
|
|
52
|
101
|
|
|
53
|
|
-* When a torrent is trumped, the new torrent is made freeleech to users who snatched the old torrent for a few days.
|
|
54
|
|
-* Sends headers to tell cloudflare to use HTTP/2 Server Push for most resources.
|
|
55
|
|
-* ~~BTN-style magnet link support.~~
|
|
56
|
|
-* Support for optional per-user stylesheet additions and tweaks
|
|
57
|
|
-* This codebase expects to run over https only.
|
|
|
102
|
+- When a torrent is trumped, the new torrent is made freeleech to users who snatched the old torrent for a few days.
|
|
|
103
|
+- Sends headers to tell cloudflare to use HTTP/2 Server Push for most resources.
|
|
|
104
|
+- Support for optional per-user stylesheet additions and tweaks
|
|
|
105
|
+- This codebase expects to run over https only.
|
|
58
|
106
|
|
|
59
|
|
-## Mascot
|
|
|
107
|
+# Mascot
|
|
60
|
108
|
|
|
61
|
|
-<img align="left" alt="Gracie Gazelle" src="https://git.oppaiti.me/Oppaitime/Gazelle/raw/branch/master/static/common/mascot.png">
|
|
|
109
|
+
|
|
62
|
110
|
|
|
63
|
111
|
**Gracie Gazelle**
|
|
64
|
112
|
|
|
65
|
113
|
Gracie is a veteran pirate of the Digital Ocean. On land, predators form companies to hunt down prey. But in the lawless water, prey attack the predators' transports. Gracies steals resources from the rich and shares them with the poor and isolated people. Her great eyesight sees through the darkest corners of the Internet for her next target. Her charisma attracts countless salty goats to join her fleet. She proudly puts the forbidden share symbols on her hat and belt, and is now one of the most wanted women in the world.
|
|
66
|
114
|
|
|
67
|
|
-<small>High resolution downloads [here](https://git.oppaiti.me/Oppaitime/Gazelle/issues/34#issuecomment-99)</small>
|
|
|
115
|
+High resolution downloads [here](https://git.oppaiti.me/Oppaitime/Gazelle/issues/34#issuecomment-99)
|
|
68
|
116
|
|
|
69
|
|
-<small>Character design and bio by Tyson Tan, who offers mascot design services for free and open source software, free of charge, under a free license.</small>
|
|
|
117
|
+Character design and bio by Tyson Tan, who offers mascot design services for free and open source software, free of charge, under a free license.
|
|
70
|
118
|
|
|
71
|
|
-<small>Contact: [tysontan.com](https://tysontan.com) / <tysontan@mail.com></small>
|
|
|
119
|
+Contact: [tysontan.com](https://tysontan.com) / <tysontan@mail.com>
|
biotorrents
3 years ago