no its in New York
#development
pine willow
Ah
quartz kindle
you forgot the parameter in the ()
pseudo grotto
ah so
console.log(raw);
});
alright
quartz kindle
rawr
basically, when you login, the first event you receive is a hello event, with an array of guild ids
solemn latch
pseudo grotto
basically, when you login, the first event you receive is a hello event, with an...
hm ok
quartz kindle
afterwards you will receive a number of GUILD_CREATE events equal to the number of guilds in the array
if there is a bugged guild, the GUILD_CREATE event for that guild will not arrive
after a while, djs will give up waiting and emit ready anyway
you can check which guild you are not receiving, that is your bugged guild
pseudo grotto
hmmm but if im sharding, the shard doesnt go ready
it times out
and then respawns the shard
quartz kindle
then thats a different issue
check if you receive anything at all in the raw events first
lament rock
@quartz kindle op HELLO is just the heartbeat timeout and some other data while the client is unauthenticated. The client authenticates then receives a READY event which has the guild ID Array and the current user info. Then GUILD_CREATEs
quartz kindle
<@180112943612952577> op HELLO is just the heartbeat timeout and some other data...
does djs emit the hello too?
lament rock
Idk
quartz kindle
i dont remember either, but yeah, hello then guild array then guild creates
lament rock
whyβ¦
pale vessel
console going crazy
that file's boutta be 1tb
pseudo grotto
wow
its 19 MB
thats crazy for a json
yeah my computer is not liking this json
quartz kindle
lmao
pseudo grotto
alr im switching to txt this json is very hard to read
pine willow
LMFAO
frosty gale
what did bro put in that json file π
quartz kindle
i have a geocoding database stored in 2 text files
one is 25mb, the other is 95mb
xd
quartz kindle
gotta stringify it bro
pine willow
quartz kindle
all gucci then
pine willow
Ye
pseudo grotto
π€· hopefully it stays this way
pine willow
It will stay that way
quartz kindle
for a whole 5 minutes
pine willow
quartz kindle
:^)
surreal sage
this seems so fake
(catbox.moe)
how is a file storage service
requiring 1.4k a month
a tb of google data storage is 23 dollars
server bills? you mean your rent? π
lament rock
You don't know who their provider is. For important data, you also wanna do 3-2-1. 3 different service providers with the data mirrored. 2 physical backups with 1 of them being offsite
Also stuff like CPU time isnt free
solemn latch
its a free upload service with 200mb files π
I'm spending over $100 a month for my webhook service right now... and it JUST forwards webhooks from top.gg to discord. not file storage, just redundancy and high availability makes it expensive
deft wolf
spark flint
requiring 1.4k a month
I can understand that
Bandwidth is expensive
Itβs a popular service too
For context, my api which literally just returns JSON uses over 1tb of bandwidth a month from a few million requests
sharp geyser
For context, my api which literally just returns JSON uses over 1tb of bandwidth...
time to turn that into 2tb
spark flint
lol
pseudo grotto
For context, my api which literally just returns JSON uses over 1tb of bandwidth...
Damn must be a lot of people using it. Are you sure there's no attacks there? Using cloudflare?
spark flint
CF, and no attacks
pseudo grotto
How many unique users every month?
spark flint
last 24h
spark flint
How many unique users every month?
2.3k
pseudo grotto
π
spark flint
last 30d
pseudo grotto
Must be a lot of users requesting data consistently
spark flint
pseudo grotto
What does the backend do
spark flint
just queries a datbase 
pseudo grotto
Query a database for information?
Ah ok
Are you using mongodb π
Redis π
Mysql / mariadb is meh
spark flint
mongodb and redis
pseudo grotto
Why do you need 2 databases?
I see a lot of people do it I'm confused why you would need it.
spark flint
its not 2 databases
redis is for caching frequently accessed items
to save on expensive database queries
pseudo grotto
So I can use redis to cache my mysql queries?
pseudo grotto
But how does that work in the backend you query redis and it checks cache and if it's not there it asks mongodb or mysql?
spark flint
yes
pseudo grotto
Hmmm I did not know this
pearl trail
what is redis' min ram+core requirement?
spark flint
const cached = await redis.get(`cache-key`)
if (cached) return cached
else {
const result = await db.query(`whatever`)
await redis.set(`cache-key`, JSON.stringify(result), "EX", 60 * 10)
return result
}```etc
that caches it for 10 minutes
radiant kraken
why use redis when you can just use a {} and a setTimeout
spark flint
you can remove the "EX" part and make it cache forever, but that relies on you resetting the value if the intended value changes
spark flint
why use redis when you can just use a `{}` and a `setTimeout`
less memory saving β
radiant kraken
wdym
spark flint
yes
radiant kraken
the rest are mongo
why not stick to one
radiant kraken
so pro
pearl trail
nnah ez
pearl trail
cassandra is bloated
fr?
spark flint
yes
civic scroll
devlopment
pearl trail
development
civic scroll
i got to channel manager
pearl trail
you just own a $2k pc takiyo
nah my free do vps can handle cassandra too 
pearl trail
socketio if you don't want to use native websocket or whatever it called in nodejs
radiant kraken
u use socketio?
pearl trail
my bad
spark flint
im using socket.io for my computer science NEA project
just because its so easy to setup and use
pearl trail
ooo
civic scroll
mfw insomnia doesn't support socket io
pearl trail
it's good for lazy people like me
spark flint
same
civic scroll
my last project was using that as well
pearl trail
ooo
spark flint
the auto reconnect is just... 
civic scroll
idk if i should switch to use postman
civic scroll
since postman supports socketio
the client frontend is not available yet and i wanna test it
sharp geyser
socket.io looks pretty nice
its not
sharp geyser
the auto reconnect is just... <:chefskiss:600065479910096925>
just use the ws library π
sharp geyser
yknow what
not a bad idea
tim knows the ws specification
i will just get him to do it /s
sharp geyser
might as well make your own Websocket implementation in C with OpenSSL fr fr /s
omw to rewrite cc in c
pine willow
pine willow
Hm?
spark flint
just use the ws library π
not for this
because im too lazy to properly intergrate all of that
since i dont get examined on the code, i get examined on the final product
spark flint
kahoot clone
spark flint
computer science project
has to be a working project that meets their specification requirements, and i have to write a 5k word thing to go with it
frosty gale
has to be a working project that meets their specification requirements, and i h...
all I'll say is don't choose an overambitious project
make a relatively simple but complex project that demonstrates all the cs buzzwords like oop, databases, etc
your report is what gets you the marks not really the project itself but you need a decent project so you can talk about it
frosty gale
your report is what gets you the marks not really the project itself but you nee...
if you somehow also fit agile development and methodologies the examiners will also start drooling
sharp geyser
ew redis
spark flint
all I'll say is don't choose an overambitious project
what, like my media project website 
they do mark you on the presentation of your website for this NEA
not the coding but just how it looks and how easy it is to use
and yes i am replacing the school bus with a tour bus
sharp geyser
what, like my media project website <:KEKW:829757927329628192>
not that ambitous
night oxide
Damn my bot literally turned off 3 minutes before someone reviewed it
neon leaf
why is implementing sftp so annoying tf
deft wolf
This is called "bad luck" 
green kestrel
<@957347862314905610> c++ macro abuse
MY EYES
green kestrel
lol
surreal sage
electron ughhhhh
lament rock
It could always be worse tbh
spark flint
not that ambitous
it gets better tho
lemme record a vid
ignore the fact it speeds up
thats a bug
lament rock
Not bad
spark flint
thats like a few hours work
restive trail
can I have role bot developer ?
spark flint
it might seem crazy what im about to say
restive trail
haha I am jokking
sharp geyser
it might seem crazy what im about to say
can I hab booster role
also they renamed the booster chat, why dont they rename the role as well
radiant kraken
also they renamed the booster chat, why dont they rename the role as well
what did they rename it to
lyric mountain
john hamburger
tired prawn
Hy, One question: How to Create Multi Language commands? Example: Select Eng Language slash command /help or select hun language /segitseg ?
deft wolf
What programming language do you use?
tired prawn
Node Js
pine willow
also they renamed the booster chat, why dont they rename the role as well
There is a Booster Chat?
sharp geyser
as far as making sure your command names/descriptions are localized you can do so easily as discord provides this ability for you and it will use the user's settings to determine that
pine willow
I don't have a Booster chat
sharp geyser
in regards to anything you set, you will need to use i18n
sharp geyser
I don't have a Booster chat
pine willow
Ty
tired prawn
https://discordjs.guide/slash-commands/advanced-creation.html#localizations
Thanks:>
deft wolf
civic scroll
script type
neon leaf
ai is gonna take over βΌοΈ
frosty gale
<#585529904330702848>
how do i get access without relinquishing control of a small portion of my funds (United States Dollars) to Discord Incorporated permanently?
pine willow
Boost
jade prairie
lyric mountain
script type
long loooooong var
quartz kindle
long loooooong var
long long long long long long long num = 999999999999999999999999999999999999999999;
quartz kindle
was referencing the long looooong man ad
lmao
lyric mountain
at LAST an useful feature
lament rock
"I am a professional artist and my dog is dying and I have cancer I need to pay medical bills"
quartz kindle
"I am a professional artist and my dog is dying and I have cancer I need to pay ...
i have an amazing investment opportunity for you, join my crypto company
lament rock
Shit if you say it's true I might
sharp geyser
i have an amazing investment opportunity for you, join my crypto company
Woah, can I get in on it
sharp geyser
its speaking in tongues
sharp geyser
looks good
eternal osprey
looks good
sharp geyser
that one I like more
spark flint
yes they are
thats a scsm
sharp geyser
@oak cliff is it your birthday in 10 days?
oak cliff
yas
oak cliff
spark flint
<@311553339261321216> is it your birthday in 10 days?
mines in 14 
sharp geyser
I didnt ask for your age
oak cliff
sharp geyser
nah im kidding happy early bday to you as well bun
spark flint
I didnt ask for your age
oak cliff
omg bun old enough for br
spark flint
mostly because i know the site so well and i want to help out
sharp geyser
I think I gotta apply again tbh cause all my other apps were on the old account
sharp geyser
mostly because i know the site so well and i want to help out <:KEKW:82975792732...
i've had tht channel muted for the past 3 years
spark flint
i try to help in support but people always snap in before me
i could literally use the site with a blindfold on tbh
sharp geyser
I am just up at all hours of the night so I literally am available 16/7
oak cliff
well idk when we'll need new brs but id be happy to have yall imo
sharp geyser
well idk when we'll need new brs but id be happy to have yall imo
here's to hoping
spark flint
got that grind
spark flint
more bri ish
spark flint
lol
sharp geyser
im so lonely
there was a night where you left and then an hour later someone posted malware
π
oak cliff
oopsies
solemn latch
im so lonely
am I not enough for you? π¦
oak cliff
we're so lonely*
quartz kindle
communism detected
sharp geyser
π
solemn latch
communism detected
Dont think I wont steal your role from you π
quartz kindle
Dont think I wont steal your role from you π
our role
quartz kindle
Dont think I wont steal your role from you π
we wont steal
sharp geyser
hidden gorge
Code always returns failure no matter what even when User and password is right
code:
const express = require("express");
const app = express();
const passport = require('passport');
const LocalStrategy = require('passport-local').Strategy;
const session = require('express-session');
const cors = require('cors');
const bodyParser = require('body-parser');
const User = require("./schemas/PanelUser.js");
const bcrypt = require('bcrypt');
const config = require('./env.json');
const connectDB = require('./db');
const fs = require('node:fs');
const path = require('node:path');
const { Client, Collection, GatewayIntentBits } = require('discord.js');
const client = new Client({ intents: [GatewayIntentBits.Guilds] });
require("./Deploy.js");
app.use(cors());
app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json());
app.use(session({
secret: 'SCPWebPanel-1',
resave: false,
saveUninitialized: true
}));
app.use(passport.initialize());
app.use(passport.session());
app.set('view engine', 'ejs');
app.set('views', __dirname + '/views');
passport.use(new LocalStrategy(
async (username, password, done) => {
try {
const user = await User.findOne({ username });
if (!user) {
return done(null, false, { message: 'Incorrect username.' });
}
const isMatch = await bcrypt.compare(password, user.password);
if (!isMatch) {
return done(null, false, { message: 'Incorrect password.' });
}
return done(null, user);
} catch (err) {
return done(err);
}
}
));
passport.serializeUser((user, done) => {
done(null, user.id);
});
passport.deserializeUser((id, done) => {
User.findById(id, (err, user) => {
done(err, user);
});
});
function isAuthenticated(req, res, next) {
if (req.isAuthenticated()) {
return next();
}
res.redirect('/');
}
app.post('/login', passport.authenticate('local', {
successRedirect: '/success',
failureRedirect: '/failure'
}));
app.get('/login', (req, res) => {
res.render('login');
});
app.get('/success', isAuthenticated, (req, res) => {
res.send('Login successful');
});
app.get('/failure', (req, res) => {
res.send('Login failed');
});
const PORT = 8040;
app.listen(PORT, () => {
console.log(`Server is running on port ${PORT}`);
});
quartz kindle
are you doing a get or a post? because you have passport on post, but only ejs on get
hidden gorge
are you doing a get or a post? because you have passport on post, but only ejs o...
im doing a post on the login page
sharp geyser
imagine using passport
well obviously you are failing at authenticating
Is the user & pass correct
worn pecan
passport isnβt horrible
hidden gorge
passport isnβt horrible
thank you
sharp geyser
it is for oauth2
worn pecan
yeah
sharp geyser
if you are using local then its fine
worn pecan
Not for this though
sharp geyser
Is the user & pass correct
anyway back to this
hidden gorge
this is to allow certain users to login into the developer pane;
sharp geyser
passport is failing because you are not entering the correct details
hidden gorge
ok this is the Local:
passport.use(new LocalStrategy(
async (username, password, done) => {
try {
const user = await User.findOne({ username });
if (!user) {
return done(null, false, { message: 'Incorrect username.' });
}
const isMatch = await bcrypt.compare(password, user.password);
if (!isMatch) {
return done(null, false, { message: 'Incorrect password.' });
}
return done(null, user);
} catch (err) {
return done(err);
}
}
));
i am?
sharp geyser
either that or your logic is fucked
quartz kindle
ok this is the Local:
```js
passport.use(new LocalStrategy(
async (username,...
add some console.logs to that
hidden gorge
add some console.logs to that
am now
quartz kindle
add logs after each new line
hidden gorge
for some reason its not logging
quartz kindle
after each new character
sharp geyser
Its not being called then
hidden gorge
could it be bc of the 2 login urls?
sharp geyser
I haven't used passport in a while so this is where I step out before I mislead ya
quartz kindle
could it be bc of the 2 login urls?
add logs to the routes themselves
sharp geyser
could it be bc of the 2 login urls?
unlikely, ones post the other is get
so it will show whatever is appropriate
if you are visiting it will render the login page, if you are posting it will do the other one
hidden gorge
ok so the Post isnt being called
sharp geyser
check your html
quartz kindle
ok so the Post isnt being called
check console log on the browser side
sharp geyser
^
hidden gorge
check console log on the browser side
quartz kindle
check network tab
quartz kindle
its correct
hidden gorge
thats normal?
sharp geyser
ye
quartz kindle
yes
hidden gorge
ok
quartz kindle
302 is temporary redirect
im checking the passport docs
in their examples they show how to define a "name" for your strategy
for example
quartz kindle
also
on the post route, try removing passport and adding a console.log for the raw body instead
just to check if the post route is receiving correct data
hidden gorge
thats something
quartz kindle
welp, user not found
sharp geyser
brody forgot to add himself
sharp geyser
thats an awefully short password
sharp geyser
dont tell me you are storing it plaintext
solemn latch
π
hidden gorge
you are not a developer
i didnt set the command to do that yet
solemn latch
Sounds like you're working out of order then
sharp geyser
seing capitalized db rows make me mad for some reason
hidden gorge
Sounds like you're working out of order then
its also just a data value not really used
solemn latch
the password is?
hidden gorge
what
sharp geyser
make sure you aren't passing along any whitespace
idk if the client lib handles that or if the db can handle it
but better to .trim
hidden gorge
i read that as .trip
quartz kindle
thats something
just to clafiry, this is the log for the username variable and the response from the User.findOne call?
hidden gorge
just to clafiry, this is the log for the `username` variable and the response fr...
yes
ive trimed it and still
quartz kindle
are the keys in the db case sensitive?
hidden gorge
are the keys in the db case sensitive?
uhh idk
quartz kindle
the key in the db is Username, but you search for { username }
try changing it to { Username: username }
quartz kindle
there you go
sharp geyser
hidden gorge
this hash and data error is annoying
hidden gorge
I HAVE
hidden gorge
oh wait
quartz kindle
how did you save the password in your db?
you're supposed to save the hash, not the password
hidden gorge
oh
quartz kindle
not anymore im guessing
sharp geyser
hopefully
sharp geyser
i hashed it
π
hidden gorge
apparently not me
quartz kindle
exdee
sharp geyser
the idea is, you hash the password, store the hash, then compare the plain text password they used to login, against the hash from the db
hashes are the same no matter where or how many times you hash it
for example you hash 123 it will always result in the same hash
providing you are using the same algo
and they aren't modifying it in someway
thats how bcrypt.compare works
hidden gorge
ok well now its broken
sharp geyser
it takes in a plaintext and a hashed password, it hashses the plain text and then compares the two hashes
quartz kindle
creating a password:
user -> "mypassword" -> hash() -> "giwuegf9w7gb99w7hg9wughowu" -> save in database
checking a password:
user -> "mypassword" -> hash() -> "giwuegf9w7gb99w7hg9wughowu" -> compare with hash in database
sharp geyser
thats how file checksums work as well
they generate a hash for the file and when you download it, you are meant to hash it as well to compare the two
and make sure what you downloaded is indeed the correct file
hidden gorge
WHY IS THIS COMMAND CRASHING
sharp geyser
show code
hidden gorge
show code
Command code:
const { ButtonBuilder, ActionRowBuilder, ButtonStyle, SlashCommandBuilder, EmbedBuilder, ModalBuilder, TextInputBuilder, TextInputStyle, PermissionFlagsBits } = require('discord.js');
const PanelUser = require("../../schemas/PanelUser")
module.exports = {
data: new SlashCommandBuilder()
.setName("adduser")
.setDescription("Add's a User to the Web Panel (TW Only)"),
async execute(interaction) {
if (interaction.user.id === "919674489581731842") {
const Modal = new ModalBuilder()
.setCustomId('AddUserModal')
.setTitle("Add a user to the panel")
const Username = new TextInputBuilder()
.setCustomId("Username")
.setLabel("Username of the New User")
.setStyle(TextInputStyle.Short)
const UserPass = new TextInputBuilder()
.setCustomId("Password")
.setLabel("Password of the New User")
.setStyle(TextInputStyle.Short)
const FRow = new ActionRowBuilder().addComponents(Username)
const SRow = new ActionRowBuilder().addComponents(UserPass)
Modal.addComponents(FRow, SRow)
await interaction.showModal(Modal)
} else {
return interaction.reply("L you tried lmao -tw")
}
}
}
interactionCreate:
const bcrypt = require('bcrypt');
const { Events } = require('discord.js');
const PanelUser = require("../schemas/PanelUser");
module.exports = {
name: Events.InteractionCreate,
async execute(interaction) {
if (!interaction.isModalSubmit()) return;
if (interaction.customId === "AddUserModal") {
const NUsername = interaction.fields.getTextInputValue("Username");
const NPassword = interaction.fields.getTextInputValue("Password");
const hashedPassword = await bcrypt.hash(NPassword, 10);
const UserData = new PanelUser({ Username: NUsername, Password: hashedPassword });
await UserData.save();
}
if (!interaction.isChatInputCommand()) return;
const command = interaction.client.commands.get(interaction.commandName);
if (!command) {
console.error(`No command matching ${interaction.commandName} was found.`);
return;
}
try {
await command.execute(interaction);
} catch (error) {
console.error(error);
if (interaction.replied || interaction.deferred) {
await interaction.followUp({ content: 'There was an error while executing this command!', ephemeral: true });
} else {
await interaction.reply({ content: 'There was an error while executing this command!', ephemeral: true });
}
}
},
};
there is a lot of places it can fail
wheat mesa
creating a password:
user -> "mypassword" -> hash() -> "giwuegf9w7gb99w7hg9wugho...
This is also why you can't just get a password for a site, you have to reset it entirely if you forget it. It's meant to be one-way, so that even if a leak happens, your password is still secure (Unless it gets bruteforced, hence why they usually like you to have a more complex password than something like "abcd")
hidden gorge
i finally started using event files
sharp geyser
well first off you are checking if isModalSubmit and returning if its not
quartz kindle
This is also why you can't just get a password for a site, you have to reset it ...
ye, also using secure hashes like bcrypt/scrypt/argon2 which are designed to be resistant against brute forcing by being slow on purpose
sharp geyser
so uh thats an issue
sharp geyser
yea
hidden gorge
already there
sharp geyser
I can read
thats the problem most likely
if they are using a slashcommand that will stop all execution
hidden gorge
no like it wont even prompt it
sharp geyser
buddy, if its not a modal submit then it returns stopping execution
wheat mesa
because modalSubmit is fired when the user fills out the modal
You can't submit the modal if you can't even trigger it
sharp geyser
AKA if I do /ping then that will be false and return
wheat mesa
A modal is a response to an interaction
hidden gorge
AHHHH
quartz kindle
lmao
sharp geyser
you should be checking if it is and doing something with it
quartz kindle
you are checking if ALL interactions are modal submit
sharp geyser
especially if you are wanting to handle a lot of cases
quartz kindle
and refusing to run them if they are not
sharp geyser
well obviously
quartz kindle
thats what we've been saying?
hidden gorge
cant even run another command im gonna try removing the hashing and see if it works?
sharp geyser
the issue is literally this
hidden gorge
oh
quartz kindle
lmao
sharp geyser
sharp geyser
yea
hidden gorge
nice
hidden gorge
ah
hidden gorge
yeah
hidden gorge
I made a postgres database wrapper
wait what
sharp geyser
hm?
I mean it wasn't wrapped around postgres itself
there was an api as the middle man
but it communicated with pg rather well
hidden gorge
wow
quartz kindle
yeah nobody here cares
hidden gorge
omfg
quartz kindle
they are also extremely hard to break
quartz kindle
but we aren't going to brute force your password for a roblox bot panel
watch it be literally 12345678
sharp geyser
make sure its not undefined
hidden gorge
sharp geyser
watch it be literally 12345678
I use 12345 as my test passwords
sharp geyser
user.Password
hidden gorge
oh yea
quartz kindle
so `user.Password`
^
sharp geyser
tim if you haven't noticed, this guy missed an entire conversation
sharp geyser
where we told him the problem with his interactionCreate
hidden gorge
where we told him the problem with his interactionCreate
no i fixed it
sharp geyser
yea after we told you again
hidden gorge
hidden gorge
yea after we told you *again*
i was watching fireworks
sharp geyser
0 and 4000 is crazy
hidden gorge
0 and 4000 is crazy
i dont care to add limits
sharp geyser
you should
quartz kindle
unbreakable for 1000 years
hidden gorge
im the only one who can run the cmd
sharp geyser
unbreakable for 1000 years
erm actually it'd be 1000 quintillion
hidden gorge
erm actually it'd be 1000 quintillion
i did it!
sharp geyser
neat
hidden gorge
was very easy lmao
passport.use('password', new LocalStrategy(
async (username, password, done) => {
try {
const saltRounds = 10
const trimmedUsername = username.trim();
const trimmedPassword = password.trim();
console.log('Looking for user:', trimmedUsername)
const user = await User.findOne({ Username: trimmedUsername });
if (!user) {
console.log('User not found');
return done(null, false, { message: 'Incorrect username.' });
}
console.log('User found:', user)
const Password = trimmedPassword
bcrypt.genSalt(saltRounds, function(err, salt) {
bcrypt.hash(Password, salt, function(err, hash) {
bcrypt.compare(Password, hash, function(err, result) {
return done(null, user);
})
})
})
} catch (err) {
console.log('Error during authentication:', err);
return done(err);
}
}
I am so confused
const trimmedPassword then const Password = trimmedPassword
Also what are you doing
sharp geyser
no
thats not what you are supposed to do
bcrypt.genSalt(saltRounds, function(err, salt) {
bcrypt.hash(Password, salt, function(err, hash) {
bcrypt.compare(Password, hash, function(err, result) {
return done(null, user);
})
})
})
this is wrong
entirely
lament rock
How it should be is that you're storing a hash of the password which it seems you are doing. You then hash what the browser sends and compare that hash with the existing hash
Alternatively, the browser can hash the password for transport safety
lament rock
Alternatively, the browser can hash the password for transport safety
I think
What you're currently doing is hashing the password the browser just sent and then comparing the password the browser just sent to the hash you just generated of said password
@hidden gorge
You don't check the result or if there are any errors of the compare
the only reason it works is because you continue regardless of the result
lament rock
Alternatively, the browser can hash the password for transport safety
Looks like this isnt recommended because you'd be exposing your salt
solemn latch
All the passwords should be sent via https anyway, which is encrypted
lament rock
Also looks like you need to store the salt in the DB since that's important?? Not too familiar with hashing
I'll just refrain from giving advice with generation specifically
What someone looks like they're describing is on hashed password creation, you store the hash itself and the salt and then when you check it, the browser sends the plaintext password and you use the previously generated salt and password to get the hash and compare against the existing hash
Someone more experienced in the subject please correct me if I'm wrong. I've only used token based systems
There seems to be a lot of contradicting info on the subject. Some going as far as saying even sending over plaintext in HTTPS isnt enough
sharp geyser
what hes doing is incorrect either way
hes hashing the plaintext password then comparing the hash against itself
he should be grabbing the hash from the db and comparing the hashed plaintext against that
civic scroll
```js
passport.use('password', new LocalStrategy(
async (username, password,...
the thing is, you can just compare directly
there's no need to regenerate the hash
compare(passwordInput, hash)
did you read the docs π
sharp geyser
the thing is, you can just compare directly
AM I the only one seeing that he is directly hashing the password from the user input, then comparing it AGAIN to the user input
civic scroll
yeah, there's that
sharp geyser
Basically he did
User Inputs Password -> Hashes that password -> Compares the user input password against the hash he generated with said password
sharp geyser
I mean if thats how he wants t odo it by all means go ahead
but he definitely is not getting hired anywhere dealing with cyber sec
π
civic scroll
if (!await bcrypt.compare(trimmedPassword, user.Password)) {
console.log('Incorrect password');
return done(null, false, { message: 'Incorrect password.' });
}
@hidden gorge
const trimmedUsername = username.trim();
const trimmedPassword = password.trim();
^^^^^^^^^^^^^^^
are those coming straight from user-controlled source?
or from your controller
a bit, yes
sharp geyser
I am trying to get Home to align to the end
I am using flex and I went through all the alignment options
sharp geyser
well that kind of works
sharp geyser
<MantineProvider theme={theme}>
<AppShell className="dark">
<AppShellHeader className="flex flex-row removeBorder shadow-sm shadow-night">
<h1 className="pl-3 text-3xl">CollegeCrafts</h1>
<div className="flex m-auto">
<p>Home</p>
</div>
</AppShellHeader>
<AppShellMain>
{children}
</AppShellMain>
</AppShell>
</MantineProvider>
I use a comp lib called mantine
civic scroll
make changes as follows
AppShellHeader class:+justify-between
div class:-m-auto
:o thanks
sharp geyser
ah
civic scroll
https://tailwindcss.com/docs if you need quick refs
sharp geyser
actually it might be the overhead from the div
sharp geyser
then why is it like that?
civic scroll
make changes as follows
AppShellHeader class:+items-center
civic scroll
then why is it like that?
by default, align item behaviour is stretch, which stretches the bounding box of children to fit the flex container on the off-axis
sharp geyser
This is the first time i've touched web dev in like 4 years
π
Im stressing out
sharp geyser
cmake is nothing compared to web
sharp geyser
i'd rather due cmake configuration than web development
sharp geyser
lets trade then
what are you needing to do
civic scroll
thank you sayu
i was surprised that you can read my language
civic scroll
also remove m-auto on that 2nd div
sharp geyser
+ class name
- class name
radiant kraken
Brain happened to be very helpful with providing documentation for linking with his library, but not sure for other libraries
radiant kraken
`+ class name`
`- class name`
what does the + and - mean
sharp geyser
add/remove?
civic scroll
if you use git, you will know
radiant kraken
git diff
civic scroll
sharp geyser
export default function Home() {
const items = [
<li>A</li>,
<li>B</li>,
<li>C</li>
]
return (
<div className="flex min-h-screen flex-col items-center justify-between p-24">
<h1>{...items}</h1>
</div>
);
}```
is this really how you gotta do itπ
civic scroll
hmm?
radiant kraken
@civic scroll sis do u know cmake
sharp geyser
If you had an array of items, you'd have to map it into the element you want it to list as
then to display it you'd have to spread it
right?
civic scroll
If you had an array of items, you'd have to map it into the element you want it ...
{<Array>.map(fn => JSX.Component)}
sharp geyser
huh
civic scroll
huh
const friends = ['misty', 'sayiyu', 'nully'];
return (
<div className="flex min-h-screen flex-col items-center justify-between p-24">
my friends are:
{friends.map(friend => (
<li>{friend}</li>
))}
</div>
);
<h1>{items.map(item => <li key={item}>{item}</li>)}</h1>
```?gaming
civic scroll
i don't rember much, check project settings
sharp geyser
my idea was to give each place its own subdomain
but nah
https://medium.com/@jfbaraky/using-subdomains-as-paths-on-next-js-e5aab5c28c28 yea nah this too much work
fuck that
civic scroll
how come we aren't added as friends
civic scroll
Youβre not accepting friend requests
try again
quartz kindle
```js
passport.use('password', new LocalStrategy(
async (username, password,...
did you test with a wrong password to see if the wrong password fails correctly?
hidden gorge
did you test with a wrong password to see if the wrong password fails correctly?
its fails if its wrong
sharp geyser
There is no possible way
the literal only fail point in that code is if the username is wrong
or it somehow generates the wrong hash
hidden gorge
frosty gale
i reckon there is at least 5 authentication bypass vulnerabilities in that code right there
hidden gorge
yea but did you enter the correct username
i didnt
hidden gorge
sharp geyser
does user e exist?
hidden gorge
FUCK
sharp geyser
hidden gorge
i entered my username and the wrong password and it still let me in
frosty gale
i entered my username and the wrong password and it still let me in
you are cooked
hidden gorge
want to know why?
yes
sharp geyser
Well here's the thing.
You are literally just hashing the password they entered, and then comparing that hash against the password they entered
quartz kindle
i entered my username and the wrong password and it still let me in
LMAO
sharp geyser
Thats not how you do that.
pine willow
i entered my username and the wrong password and it still let me in
LMAO
quartz kindle
LAMAO
pine willow
LOMA
hidden gorge
WHAT THE FUCK DO I DO
quartz kindle
kappa chungus deluxe
sharp geyser
I literally told you several times yesterday
pine willow
kappa chungus deluxe
quartz kindle
WHAT THE FUCK DO I DO
your code is all wrong, as you've been told yesterday, but you didnt listen
sharp geyser
you hash the password when they sign up, store that.
When they login, grab the HASHED password from the database, compare that hash against the password they entered
frosty gale
when i saw that code i didnt even need to look at it indepth to know it was cooked
but misty beat me to it
civic scroll
i entered my username and the wrong password and it still let me in
i wonder why
civic scroll
WHAT THE FUCK DO I DO
#development message
thought you'd read
turns out my asumptions disappointed me
sharp geyser
even before that we told him as well
π
and yet he still came up with that monstrosity
civic scroll
blud kept fucking around after finding out π
sage bobcat
i entered my username and the wrong password and it still let me in
One message removed from a suspended account.
One message removed from a suspended account.
hidden gorge
```
compare(passwordInput, hash)
```
What do I put for the hash
hidden gorge
what
sharp geyser
what
Time #1 #development message
Time #2 #development message
Time #3 #development message
Each time you completely ignored what i said
hidden gorge
like this?
passport.use('password', new LocalStrategy(
async (username, password, done) => {
try {
const trimmedUsername = username.trim();
const trimmedPassword = password.trim();
console.log('Looking for user:', trimmedUsername);
const user = await User.findOne({ Username: trimmedUsername });
if (!user) {
console.log('User not found');
return done(null, false, { message: 'Incorrect username.' });
}
console.log('User found:', user);
const isMatch = await bcrypt.compare(trimmedPassword, user.Password);
if (isMatch) {
return done(null, user);
} else {
return done(null, false, { message: 'Incorrect password.' });
}
} catch (err) {
console.log('Error during authentication:', err);
return done(err);
}
}
));
yea
but user.Password has to be a hashed password
so when they are signing up hash the password they used
hidden gorge
omfg
sharp geyser
the idea is, you store the hash in the db
then you grab the hash when they login and compare that against hte plaintext password they provide
hidden gorge
the idea is, you store the hash in the db
so i hash trimmedPassword?
sharp geyser
hidden gorge
YOUR MAKING NO SENSE
sharp geyser
I am making perfect sense
hidden gorge
not to me
sharp geyser
you just dont understand
hidden gorge
could u please simplify it for me?
sharp geyser
Remember when I said never store plain text passwords in your database?
hidden gorge
yes and i dont
sharp geyser
well...you were
hidden gorge
mines hashed tho
sharp geyser
oh good, now you hash them
hidden gorge
now im confused
sharp geyser
well since you already hash them then its fine
user.Password is the hash
trimmedPassword is the plaintext password
you compare the two and if it matches return the user, if not return an error
like yo uare currently doing
π
hidden gorge
why does it return failure tho?
sharp geyser
now im confused
I was still under the assumption that earlier when you weren't hashing the password
sharp geyser
why does it return failure tho?
password is incorrect
sage bobcat
One message removed from a suspended account.
sharp geyser
or username is
sharp geyser
well you have 3 points of failure.
Username wrong, Password Doesn't match, or that catch block
hidden gorge
it works!
sharp geyser
π
hidden gorge
thank you
sharp geyser
I'd definitely watch a video on password hashing just to brush up on it
hidden gorge
yeah im gonna
civic scroll
mines hashed tho
because your user password is hashed, you can use it directly in compare
hidden gorge
because your user password is hashed, you can use it directly in `compare`
yeah thx
pearl trail
π
frosty gale
there's probably a flaw where I can still log in without touching the login page
hidden gorge
finally working?
yeah and it works
pine willow
yeah and it works
whats the website
hidden gorge
whats the website
like the url?
pine willow
ye
eternal osprey
Remember when I said never store plain text passwords in your database?
can i save emails though
cuz i don't really see a way to send confirmation mails etc if it's hashed
quartz kindle
can i save emails though
yeah usually only the password is hashed, everything else is clear text, or at least with some sort of reversible encryption
although reversible encryptions are useless if their keys are stored in the same server
frosty gale
yeah usually only the password is hashed, everything else is clear text, or at l...
usually clear text because any reversible encryption in a database is pointless
though if the encryption key is in the source code and the database is encrypted with it, if your database is compromised the data is safe until it can be decrypted
wicked pivot
models :
const mongoose = require('mongoose');
const playerStatsSchema = new mongoose.Schema({
uuid: String,
data: [
{
date: String,
data: {
faction: String,
jobs: {
alchemist: {
level: Number,
xp: Number
},
farmer: {
level: Number,
xp: Number
},
hunter: {
level: Number,
xp: Number
},
miner: {
level: Number,
xp: Number
}
},
money: Number,
rank: String,
timePlayed: Number
}
}
]
});
module.exports = mongoose.model('PlayerStats', playerStatsSchema);```
My try
```js
const date = new Date();
const formattedDate = `${date.getDate()}-${date.getMonth() + 1}-${date.getFullYear()}`;
const listing = await Model.find({
'data.date': { $ne: formattedDate }
});
console.log(listing)
mongoose (mongodb) check user doesn't have date in array.
With this test it returns to me, all users even those who have the date
frosty gale
models :
```js
const mongoose = require('mongoose');
const playerStatsSchema ...
i dont think your schema is designed correctly
it doesnt make sense
you have an array called data which contains all of your data for each document?
mongodb isnt exactly designed for that kinda stuff
that query also makes no sense either
quartz kindle
thats basically storing json files in mongo
frosty gale
and im pretty sure you cant access and query elements inside of an array in mongo like that
this is extremely cursed
are you trying to just store statistics for each user? whats with the data array
wicked pivot
I want to store player data day after day.
Because she has changed in the meantime
frosty gale
I want to store player data day after day.
Because she has changed in the meanti...
i see
so you want to save and keep track of xp, levels, money, ranks, etc, for every day?
wicked pivot
so you want to save and keep track of xp, levels, money, ranks, etc, for every d...
Exactly, to do advanced statistics like graphs afterwards.
For now, I just need to find the "players" who do not have a precise date in the array
frosty gale
For now, I just need to find the "players" who do not have a precise date in the...
thing is your data entry is an array, which element in the data array do you want?
do you want the latest or something else
wicked pivot
The last one, if the last date != formattedDate I want it to add it.
quartz kindle
Exactly, to do advanced statistics like graphs afterwards.
recording data over time is known as timeseries
both mongo and mongoose have options for that
frosty gale
recording data over time is known as timeseries
interesting
wicked pivot
I didn't know I'll look thanks
frosty gale
The last one, if the last date != formattedDate I want it to add it.
ive had a look at this and i think you can do this in mongodb, but its very complicated and inefficient
for timeseries you should really move onto what tim posted above as its way more fit for purpose
you would have to do something like this here https://stackoverflow.com/a/43165645/11138133
but i personally wouldnt be happy with this answer
i dont really understand it either
mongodb also lets you insert javascript code as a where query but that only works on self-hosted mongodb (unless you paid for atlas) and it basically ruins any chances of database optimisations or indexing
this is partly why databases shouldnt be so lenient on schemas since it introduces problems like this and promotes terrible practices
eternal osprey
yeah usually only the password is hashed, everything else is clear text, or at l...
ahh i see
i mean i am using tls anyways so fack it
though, yeah in the database i might just use OTP.
The api on the backend will instead of directly saving the email, first encrypt it and then save it.
That way the key is not on the server side + the data stays encrypted
quartz kindle
hiding/generating keys inside the source code is not a bad move, makes it so compromising the database alone is not enough, would need to compromise the source code as well
especially if the code is compiled before deployment in a safe/private location
surreal sage
nextjs smh
sharp geyser
hiding/generating keys inside the source code is not a bad move, makes it so com...
Wym bro
quartz kindle
<:val_HUH:1112376582099697715>
wdym wdim?
sharp geyser
wdym wdim?
wdym wdym wdim?
quartz kindle
wat du yu min
sharp geyser
i no no
quartz kindle
you yes yes
pine willow
Both nah nah
sharp geyser
you yes yes
you no no
civic scroll
ai chan
civic scroll
channel only stores an id and name?
metadata, coming from CQL
civic scroll
basically table
sharp geyser
I guess there is no channel perms like discord
civic scroll
one stores the metadata (id, name) and graph database stores user list
civic scroll
I guess there is no channel perms like discord
there can be perms, but it's on another database
sharp geyser
ic
rough lynx
um
civic scroll
2
sharp geyser
what for
civic scroll
graph stores social relations (user -> user / channel)
pine willow
tender ermine
Is there someone online that could help me? I recently removed the message content intent since I have slash commands and my host canβt start my bot because it says βuser disallowed intentsβ despite reading I donβt need them. Discord keeps denying my application as well.
deft wolf
You must also remove this intent from your client in the code
Not only on discord.dev portal
Discord very rarely verifies apps with this intent unless you really have a very good reason to use it
sharp geyser
Is there someone online that could help me? I recently removed the message conte...
As NyNu said, remove the intent from your client options in code
pine willow
Discord very rarely verifies apps with this intent unless you really have a very...
Yea
mighty scroll
That's why im glad i got approved for all 3
tender ermine
That's why im glad i got approved for all 3
I got it fixed. Howβd you manage that? I got only members intent
frosty gale
its really not hard its not supposed to be a challenge to get all intents
they just want you to have a proper reason for wanting that intent
if you dont reasonably need it and a feature can do without it they wont give it to you
mighty scroll
Exactly.
But anyway, i see now they started to act like "they can use automod for that", we will not give you this intents
frosty gale
likely but automod is quite poor at the moment so it wont be until a while later
wary totem
hey, what permissions a bot needs to create permissions on a channel ?
in my case, the bot has ManageRoles and ManageChannels, but i have a missing permissions error, the bot can't access and edit the channels that it create
real rose
hey, what permissions a bot needs to create permissions on a channel ?
in my cas...
If you have a missing permissions error, when the bot has the correct perms, then it's likely how you coded the permission check
For example if you want to edit the permissions of a channel, your bot should only require the MANAGE_ROLES permission
wary totem
For example if you want to edit the permissions of a channel, your bot should on...
it has the permissions ManageRoles and ManageChannels...
urban delta
how do i dynamically subclass a class?
I'm planning to create a dynamically alocation of classes for things recepting ASCII and foreign language characters, for example:
Hiragana&KatakanaBNF = r"""
hiragana_args: ("{" (h-a|h-i|h-u|h-e|h-o|h-ka|h-ki) "}")+
h-a: "a"
h-i: "i"
h-u: "u"
h-e: "e"
h-o: "o"
h-ka: "ka"
h-ki: "ki"
"""
async def japanesescriptor(macro):
macro.replace("γ", "{ h-ka }")
...
class japanese_translator(Transformer):
async def h-ka(self,cmd):
return "γ"
in this example i wanna my class inherit dynamicallt the class japanese_translator, that coming can bring arabian, corean, chinese, vietnamese, and so oh, the BNF i already have plans for it by adding it to the final of my string that is used as a grammar, and for the japanese scriptor i'm planning it to get imported in some function and it allows me to convert special characters from other languages into their interpreter form, same for arab, corean and etc. Being all of those dynamically added like how cogs are added
wary totem
and whats the error
"missing permissions"
wary totem
from djs
real rose
show me
wary totem
show me
rawError: { message: 'Missing Permissions', code: 50013 },
0|main | code: 50013,
0|main | status: 403,
0|main | method: 'POST',
0|main | url: 'https://discord.com/api/v10/guilds/886624020580167781/channels'```well, you generate the source code for the class and call the classloader to load it
urban delta
well, you generate the source code for the class and call the classloader to loa...
generate the source code and call a classloader...
uhmm
can i see an example?
real rose
```ts
rawError: { message: 'Missing Permissions', code: 50013 },
0|main | ...
And what is it you're trying to get the bot to do. Just create channels perms? You're likely still missing something small
or the perms arent assigned properly
feel free to show the perms
wary totem
And what is it you're trying to get the bot to do. Just create channels perms? Y...
i create a category and text channels, but when i try to set permissions to the channel, my bot throw the error```ts
import { ChannelType, Client } from "discord.js";
import { Game } from "../models/game";
import { Roles, RolesData } from "../models/roles";
export default async function createRoleChannels(client: Client, game: Game): Promise<void> {
const roles = game.roles.filter(r => RolesData[r.type].start && game.players.filter(p => p.roles === r.type).length > 0);
const category = await (await client.guilds.fetch(game.guildId)).channels.create({name: `WEREWOLF ${game.gameId}`, type: ChannelType.GuildCategory});
for(let i = 0; i < roles.length; i++) {
const channel = await (await client.guilds.fetch(game.guildId)).channels.create({name: `${Object.entries(Roles).find(([key, value]) => value === roles[i].type)[0]}-roles`, type: ChannelType.GuildText});
await channel.setParent(category.id);
game.channels.push({channelId: channel.id, type: roles[i].type});
await channel.permissionOverwrites.create((await client.guilds.fetch(game.guildId)).roles.everyone, {ViewChannel: false, SendMessages: false, ReadMessageHistory: false});
game.players.filter(p => p.roles === roles[i].type).forEach(async p => await channel.permissionOverwrites.create(client.users.cache.get(p.userId), {ViewChannel: true, SendMessages: true, ReadMessageHistory: true}));
await channel.send(client.functions.sentences[roles[i].type.toString()](`${game.players.filter(p => p.roles === roles[i].type).map(p => `${client.users.cache.get(p.userId)}`).join(" ")}, you have the \`${Object.entries(Roles).find(([key, value]) => value === roles[i].type)[0]}\` role, here is what you need to do :\n> ${RolesData[roles[i].type].description}`));
};
client.games.set(game.gameId, game);
}; ```
lyric mountain
can i see an example?
solemn latch
i create a category and text channels, but when i try to set permissions to the ...
What permissions are you giving to the bot?
wary totem
What permissions are you giving to the bot?
Speak, Connect, SendMessages, ReadMessageHistory, ViewChannel, MuteMembers, AttachFiles, UseExternalEmojis, ManageMessages, ManageChannels, EmbedLinks, ManageRoles
solemn latch
Is it creating the category and channel before erroring?
shell tundra
it's the bot that i made you join vc for
yeah it creates the channel but no roles and just dies
pine willow
mhmmmm
wary totem
Is it creating the category and channel before erroring?
yeah
i can create channels, but can't set permissions
solemn latch
is the role you're editing below the bots highest role?
wary totem
is the role you're editing below the bots highest role?
the bot role is the highest role