First public release

.gitignore

+composer.lock
+node_modules
+.sass-cache
+config/config.json
+config/version.txt
+vendor/
+site/
+sessions/
+logs/
+package-lock.json
+uploads/
+staticCache/
+docs/
+import.php
+config/version.txt
+matrix-stats
+gpg
\ No newline at end of file

README.md

-# Website
+Full source code for Defend the Web, an online security platform.
 
-[Defend the Web](https://defendtheweb.net)
\ No newline at end of file
+## Docker
+There is a Docker image with instructions on how to get a test site setup quickly [here](docker).
+
+## Manual setup
+* Install nginx, php, mysql and setup
+* Install php packages php-mbstring php-sqlite3 php-imagick
+* Install redis server
+```
+unixsocket /tmp/redis.sock
+unixsocketperm 755
+```
+* Clone repo
+* Install node + npm + dependencies
+```
+cd DefendTheWeb
+curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -
+sudo apt-get install -y nodejs
+npm install
+```
+* Install composer and install dependencies
+```
+php composer.phar install --no-dev --optimize-autoloader
+```
+* Install discount markdown parser and gifsicle
+* Import MySQL
+```
+mysql -u dtwstage -p dtwstage < sql/schema.sql
+mysql -u dtwstage -p dtwstage < sql/data.sql
+```
+* Build project
+```
+./build.sh
+```
\ No newline at end of file

build.sh

+#!/bin/bash
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+printf "         ____  __ _       __\n        / __ \/ /| |     / /\n       / / / / __/ | /| / / \n      / /_/ / /_ | |/ |/ /  \n     /_____/\__/ |__/|__/   \n\n\n"
+
+configCheck () {
+    printf "Checking config... "
+    CONFIG=./config/config.json
+    EXAMPLE=./config/config.json.example
+
+    if [ -f $CONFIG ]; then
+        printf "${GREEN}file exists${NC}\n"
+    else
+        printf "${RED}file missing${NC}\n"
+
+        if configGenerate; then
+            configExample
+        fi
+    fi
+}
+
+configExample () {
+    read -p 'Use example config file? [Y/n] ' create
+
+    if [ "$create" = '' ]; then
+        create="Y"
+    fi
+
+    case $create in
+        [Yy]* )  echo "Creating config"; cp ${EXAMPLE} ${CONFIG};;
+        * ) echo "Ok, fine"
+    esac
+}
+
+configGenerate () {
+    read -p 'Generate config file? [Y/n] ' create
+
+    if [ "$create" = '' ]; then
+        create="Y"
+    fi
+
+    case $create in
+        [Nn]* ) return 0
+    esac
+
+    read -p 'Domain: ' domain;
+    echo "TODO: finish generator"
+
+    return 1
+}
+
+dirCheck () {
+    folders=( "site/staticCache" "logs" "sessions" "site/templates/cache" "uploads" "site/www/imgs/uploads" )
+    for i in "${folders[@]}"
+    do
+        mkdir -pm 777 $i
+        printf "Creating ${i}... ${GREEN}done${NC}\n"
+    done
+}
+
+buildCheck () {
+    printf "Checking composer... "
+    if ! [ -x "$(command -v composer)" ]; then
+        printf "${RED}not installed${NC}\n"
+        exit 1
+    else
+        printf "${GREEN}found${NC}\n"  
+    fi
+
+    printf "Checking NPM... "
+    if ! [ -x "$(command -v npm)" ]; then
+        printf "${RED}not installed${NC}\n"
+        exit 1
+    else
+        printf "${GREEN}found${NC}\n"  
+    fi
+}
+
+
+build () {
+    buildCheck
+
+    composer install
+    npm install
+    ./node_modules/.bin/gulp build
+    ./node_modules/.bin/gulp images
+}
+
+
+
+configCheck
+dirCheck
+build
\ No newline at end of file

composer.json

+{
+    "name": "dtw/website",
+    "version": "0.0.1",
+    "config": { 
+        "vendor-dir": "site/vendor"
+    },
+    "require-dev": {
+        "phpunit/phpunit": "5.0.*"
+    },
+    "require": {
+        "monolog/monolog": "1.0.*",
+        "twig/twig": "~1.0",
+        "hassankhan/config": "^0.10.0",
+        "klein/klein": "^2.1",
+        "lusitanian/oauth": "^0.8.9",
+        "ezyang/htmlpurifier": "^4.8",
+        "predis/predis": "^1.1",
+        "intervention/image": "^2.3",
+        "cloudinary/cloudinary_php": "^1.7",
+        "firebase/php-jwt": "^5.0",
+        "phpmailer/phpmailer": "^6.0",
+        "endroid/qr-code": "^2.5",
+        "dzango/twig-truncate-extension": "^1.1",
+        "stripe/stripe-php": "^6.38",
+        "mvieira/macaroons": "^0.0.1",
+        "pear/crypt_gpg": "^1.6",
+        "elasticsearch/elasticsearch": "^7.2"
+    },
+    "autoload": {
+        "psr-4": {
+            "dtw\\": "site/lib",
+            "dtw\\utils\\": "site/lib/utils"
+        }
+    }
+}

config/config.json.example

+{
+    "debug": true,
+    "showLog": true,
+    "maintenance": false,
+
+    "site": {
+        "domain": "http://dtw.local",
+        "static": "http://dtwstatic.local",
+        "version": 3
+    },
+
+    "db": {
+        "driver": "mysql",
+        "host": "127.0.0.1",
+        "username": "dtw",
+        "password": "dtw",
+        "database": "dtw"
+    },
+
+    "smtp": {
+        "server": "",
+        "port": 587,
+        "ssl": true,
+        "username": "",
+        "password": ""
+    },
+
+    "matrix": {
+        "homeserver": "defendtheweb.co.uk",
+        "jwt": null,
+        "macaroon": null
+    },
+
+    "elasticsearch": "127.0.0.1:9200",
+
+    "discount": "/usr/bin/markdown",
+
+    "redis": {
+        "server": "127.0.0.1:6379",
+        "prefix": "DtWdev"
+    },
+
+    "api": {
+        "key": "dockerrules"
+    },
+
+    "scalablePress": "...",
+    "stripe": "...",
+
+    "gpg": {
+        "directory": null,
+        "fingerprint": null,
+        "key": null
+    },
+
+    "amazon": [
+        {
+            "image": "https://images-na.ssl-images-amazon.com/images/I/51aChYK0VBL.jpg",
+            "name": "Computer hacking beginners guide",
+            "link": "https://amzn.to/2GAQAqG"
+        },
+        {
+            "image": "https://images-na.ssl-images-amazon.com/images/I/61VBaAS4IbL.jpg",
+            "name": "The art of exploitation",
+            "link": "https://amzn.to/2Ysdsmt"
+        },
+        {
+            "image": "https://images-na.ssl-images-amazon.com/images/I/612ybpJEisL.jpg",
+            "name": "The Hacker Playbook 3",
+            "link": "https://amzn.to/2LMySF2"
+        }
+    ],
+
+    "auth": {
+        "twitter": {
+            "key": "",
+            "secret": ""
+        },
+        "google": {
+            "ID": "",
+            "secret": "",
+            "callback": ""
+        },
+        "facebook": {
+            "ID": "",
+            "secret": ""
+        },
+        "github": {
+            "ID": "",
+            "secret": ""
+        }
+    },
+
+    "privileges": {
+        "admin": "green",
+
+        "discussions.flags": "bronze",
+        "discussions.post_delete": "gold",
+        "discussions.post_edit": "gold",
+        "discussions.thread_delete": "gold",
+        "discussions.thread_edit": "gold",
+        "discussions.thread_move": "silver",
+        "discussions.thread_stick": "gold",
+        "discussions.thread_lock": "silver",
+
+        "articles.edit": "silver",
+        "articles.publish": "silver",
+        "articles.delete": "silver",
+
+        "users.regenerate": "bronze",
+        "users.block": "gold",
+
+        "playground.edit": "green",
+
+        "tickets": "silver"
+    }
+}

config/news.json

+{
+    "Threatpost": "https://threatpost.com/feed/",
+    "Dark Reading": "http://www.darkreading.com/rss_simple.asp",
+    "Krebs on Security": "http://krebsonsecurity.com/feed/"
+}
\ No newline at end of file

config/nginx/base.conf

+index index.html index.php;
+server_tokens off;
+client_max_body_size 25M;
+
+# Force the latest IE version
+add_header "X-UA-Compatible" "IE=Edge";
+
+# gzip
+gzip  on;
+gzip_http_version 1.1;
+gzip_vary on;
+gzip_comp_level 6;
+gzip_proxied any;
+gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml application/javascript;
+gzip_buffers 16 8k;
+# Disable gzip for certain browsers.
+gzip_disable “MSIE [1-6].(?!.*SV1)”;
+
+# NGINX file caching
+open_file_cache          max=1000 inactive=20s;
+open_file_cache_valid    30s;
+open_file_cache_min_uses 2;
+open_file_cache_errors   off;
+
+add_header X-Frame-Options SAMEORIGIN always;
+add_header X-Content-Type-Options nosniff always;
+add_header Referrer-Policy no-referrer always;
+add_header X-XSS-Protection "1";
+
+add_header "Cache-Control" "no-transform";
+charset utf-8;
+
+error_page 404 /404.html;
+
+location ~* /\.(?!well-known\/) {
+    deny all;
+}
+
+location ~* (?:\.(?:bak|conf|dist|fla|in[ci]|log|psd|sh|sql|sw[op])|~)$ {
+    deny all;
+}
+
+location ~* \.(?:manifest|appcache|html?|xml|json)$ {
+    expires -1;
+}
+
+# Feed
+location ~* \.(?:rss|atom)$ {
+    expires 1h;
+    add_header "Cache-Control" "public";
+}
\ No newline at end of file

config/nginx/hackthis.conf

+server {
+    index index.php index.html;
+
+    server_name hackthis.co.uk;
+
+    listen 80;
+
+    access_log /var/log/nginx/hackthis.log;
+
+    rewrite ^/user/(.*)$ https://defendtheweb.net/profile/$1 permanent;
+    rewrite ^/article https://defendtheweb.net/$request_uri? permanent;
+    rewrite ^/forum https://defendtheweb.net/discussions permanent;
+
+    rewrite ^ https://defendtheweb.net?hackthis permanent;
+}
\ No newline at end of file

config/nginx/nginx.conf

+server {
+    root /home/dtw/site/www;
+    index index.php index.html;
+
+    server_name dtw.local;
+
+    listen 80;
+
+    access_log /var/log/nginx/dtw.log;
+
+    location ~ ^/(uploads|imgs|css|js|vendor) {
+        return 404;
+    }
+
+    location ~ ^/user/(.*)/userbar.png$ {
+        return 302 /api/1/user/bar?$args&id=$1;
+    }
+
+    location ~ ^/user/(.*)$ {
+        return 301 /profile/$1;
+    }
+
+    location ~ ^/forum/?$ {
+        return 301 /discussions;
+    }
+
+    location ~ ^/forum/.*/(.*)$ {
+        return 301 /discussion/$1;
+    }
+
+    location ~ ^/forum/(.*)$ {
+        return 301 /discussions;
+    }
+
+    location ~ ^/levels/?$ {
+        return 301 /playground;
+    }
+
+    location ~ ^/levels/(.*)$ {
+        return 301 /playground;
+    }
+
+    location = /medals.php {
+        return 301 /help/medals;
+    }
+
+    location = /donator.php {
+        return 301 /donations;
+    }
+
+    location = /leaderboards.php {
+        return 301 /statistics;
+    }
+
+    location = /contact {
+        return 301 /help/contact;
+    }
+
+    include base.conf;
+
+    location ~ ^/playground/ {
+        add_header "Content-Security-Policy" "";
+        add_header "Cache-Control" "no-cache";
+
+        index index.html index.php;
+        try_files $uri $uri/ /index.php$is_args$args;
+    }
+
+    location / {
+        add_header Content-Security-Policy "default-src 'self' http://dtwstatic.local https://www.youtube-nocookie.com  https://embed.spotify.com; img-src http://* https://* data: ; script-src 'self' https://zhr3.co.uk https://fonts.googleapis.com https://cdnjs.cloudflare.com ; style-src 'self' 'unsafe-inline' http://dtwstatic.local https://cdnjs.cloudflare.com https://maxcdn.bootstrapcdn.com https://fonts.googleapis.com; font-src 'self' http://dtwstatic.local https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com;";
+
+        try_files $uri $uri/ /index.php$is_args$args;
+    }
+
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        # 50x
+    }
+
+    location ~ \.php {
+        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+        include fastcgi_params;
+    }
+}
+
+
+server {
+    root /home/dtw/site/www;
+    server_name dtwstatic.local;
+
+    access_log off;
+
+    listen 80;
+
+    expires 1M;
+    add_header "Cache-Control" "public";
+
+    include base.conf;
+
+    location ~ ^/(css|js|vendor) {
+        add_header 'Access-Control-Allow-Origin' 'http://dtw.local';
+    }
+
+    location ~ ^/uploads {
+        try_files /imgs/$uri @generate;
+    }
+
+    location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        # allow
+        try_files /imgs/$uri =404;
+    }
+
+    location @generate {
+        expires -1;
+        fastcgi_hide_header "Set-Cookie";
+        fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME /home/dtw/site/www/index.php;
+        include fastcgi_params;
+    }
+
+    location / {
+        return 404;
+    }
+}
\ No newline at end of file

config/sidebar.json

+{
+    "dashboard": {
+        "title": "Dashboard",
+        "url": "/dashboard"
+    },
+    "articles": {
+        "title": "Articles",
+        "url": "/articles",
+        "items": []
+    },
+    "levels": {
+        "title": "Playground",
+        "url": "/playground",
+        "items": []
+    },
+    "community": {
+        "title": "Community",
+        "items": [
+            {
+                "title": "Discussions",
+                "url": "/discussions"
+            },
+            {
+                "title": "Chat",
+                "url": "/chat",
+                "privileges": "user",
+                "children": [
+                    {
+                        "title": "Statistics",
+                        "url": "/chat/statistics"
+                    }
+                ]
+            },
+            {
+                "title": "Private messages",
+                "url": "/messages",
+                "privileges": "user",
+                "children": [
+                    {
+                        "title": "New conversation",
+                        "url": "/messages/new"
+                    }
+                ]
+            },
+            {
+                "title": "Statistics",
+                "url": "/statistics"
+            }
+        ]
+    },
+    "extras": {
+        "items": [
+            {
+                "title": "Shop",
+                "url": "/shop"
+            },
+            {
+                "title": "Donations",
+                "url": "/donations"
+            },
+            {
+                "title": "Help",
+                "url": "/help",
+                "children": [
+                    {
+                        "title": "Contact us",
+                        "url": "/help/contact"
+                    }
+                ]
+            },
+            {
+                "title": "Legal",
+                "children": [
+                    {
+                        "title": "Privacy policy",
+                        "url": "/legal/privacy"
+                    },
+                    {
+                        "title": "Terms of use",
+                        "url": "/legal/terms"
+                    }
+                ]
+            },
+            {