bufak-wiwi/bufakapi

API for the BuFaK System

bufakapi's Issues

Change Phases-Endpoint /conferences/phases/conference_id

Change Phases-Endpoint to accept conference_id from route

Self check in for attendees to program points

Attendees should scan an QR code and perform a self check in to the current program point.
The organizer should have the option to see the attendees and get an overview of the attendees.

• Database structure
• Api routes

WS suggestions require the user to already be registered for the conference.

This is problematic, because especially for online conferences the actual confirmation can come quite late.
Therefore, a setting should be added whether a workshop suggestion may also be submitted beforehand

Endpoint for changing Status of Applications in Bulk

If a administrator accepts 100 application. The Website has to perform 100 single updates. Problematic if the client loses connection to inertnet.

• Accept an array of status objects inside /api/Conference_Application/status like:
  [{ "uid": "string", "conferenceID": 0, "newStatus": 0 }]

Change LONGTEXT to MEDIUMTEXT in SQL for Descriptions or add validation

LONGTEXT in MySQL can store up to 4 GiB which can leads to security concerns in form of DoS attacks.
Whe should think about migrating to MEDIUMTEXT or validate a maximum text length in both api and administration-panel.

constructed exemplary attack: user submits 10 workshops with 4 GiB of text each in the description -> memory capacity exhausted

Change Status of Password for ApplicationAuth only when application is completed

It becomes a problem if a user cancels his registration. As a result, the password is no longer valid.

instead the password status should be changed when a application is completed.
--> Add an key field into the application object.

Get Councils will also return invalid councils

Filter councils where council.invalid = false before returning

Used Password for ApplicationAuth should return an http error

Using an already used password should return in an http error

Application Passwords should contain only distinguishable characters

e.g. l(small L), I(capital i) and |(pipe) look very similar when printed