jkieley/cse545-project

CSE545-Project

Setup

1. Install Virtual Box https://www.virtualbox.org/wiki/Downloads

2. Install Vagrant https://www.vagrantup.com/downloads.html

3. Run These commands from your terminal, inside the project directory

vagrant up

4. After vagrant up completes, you will be able to connect to your locally running MongoDB with this IP Adress: 192.168.33.10, Default port. You can use this tool if you like: https://robomongo.org/

Setup without Vagrant

1. Install python 2.7.11 python -m pip install django python -m pip install djangorestframework python -m pip uninstall markdown python -m pip uninstall django-filter

cse545-project's Issues

Missing function - Admin

Admin should authorize or decline internal user's requests. I don't see any page for this function under admin login.

Admin isn't able to see merchant accounts.

in view details page of Admin, merchant accounts aren't being displayed.

All URLs are openly accessible without logging in.

Hash password

Hash, when password is being stored, and also ensure password comparison also uses the hash

Download User Statements as PDF

External User needs to be notified via email when critical transactions occur and also at the time of account creation.

Hyperlink for accout in external user mode

logged in external user.
each account type being set a hyperlink but i click it and redirect to the login page.

Login One Time Password Service,(In the branch, need check and implement)

Transaction coding bugs

CSE545-Project/shared/back-end/src/main/java/com/securebank/bank/resources/TransactionsResource.java

Line 83 in aed03d4

Account toAccount = accountRepository.findById(transaction.getFromAccountId());

Should be getToAccountId() instead of getFromAccountId()

CSE545-Project/shared/back-end/src/main/java/com/securebank/bank/resources/TransactionsResource.java

Line 147 in aed03d4

if (my_account.getAmount() <= 0.0 || my_account.getAmount() < Math.abs(trans.getAmount())) {

All the IFs inside this if block is unnecessary. Remove them and just throw one error.

Checking/Saving transactions - Tier 1

Checking and Saving non-critical transactions requested by the consumer is not displayed under pending transactions for tier 1 employee. They only appear under tier 2 login.

I can only see credit transaction requests under tier 1 login.

Show application log file

not done yet

Logout

Prevent malicious login controls: (Limit Login attempts????)

From requirements doc: "Prevent malicious login controls"

We could limit login attempts, but then what do we do after attempts are exceeded? Lock account? how will we unlock?

Request Manager Not working - Tier 1

I think request manager (tier 1) should be same as create account (tier 2). The only difference is that tier 1 needs tier 2's approval to finish the task.
When tier 1 submit a task such as creating a transaction or an account, they should be sent to tier 2 for approval. Currently nothing happens when I try to create either of them.

External Users UI: (Consumer and Merchant)

UI: Manager

From merchant request for the consumer's payment

Front End Cleanup...

Im aware that theres some redundant code in front end... I'll try to clean it up if i have time... i know which page calls which function really well so i think its best that i do this myself...

Password is not encrypted

When /users is requested it returns plain text password.

/users should check user type explicitly

CSE545-Project/shared/back-end/src/main/java/com/securebank/bank/resources/UserResource.java

Line 73 in 103f2e9

else {

Expoliting Issue#7 user can update type field to some invalid value. If that happens this user can view the list of all users.

Merchant does not need authorization for transferring funds

WHen I tried to transfer funds between existing account, a request was sent to tier2, and upon the approval the balance got updated. Need to remove authorization for merchant

Non-Critical Transactions - Tier 1

For non-critical transactions, after tier 2 approves the transaction it should then be sent to tier 1 for final approval. Currently once tier 2 approves it, it will update the balance in consumer's account without tier 1 approval.

Based on the requirements: Tier 1 can view, create and authorize non-critical transactions upon
having authorization from the external users and tier 2 employee

Set Limit for Number of transactions per day for a user

Update user type

Is that Only tier1 and tie2 can update the external user type between consumer and merchant.
Is it, UI seems like with some problem.

System Log: Some Ideas for backend

• updateAccount function should log which user changed which account with amount before and after the change.

data encryption

all data sent should be encrypted.

Virtual keyboard for entering OTP

Delete external account

For Tier2, not only can delete the whole user but also Delete one of the user's account.
Api is ready there.
/accounts/{accountId}

Update Admin Settings Page

Delete Users

• Admin -> Can delete -> tier1,tier2
• Tier1 -> Cannot delete anything
• Tier2 -> Can delete -> individual/merchant
• individual/merchant -> Cannot delete anything

Front End and Backend

All transaction permission

CSE545-Project/shared/back-end/src/main/java/com/securebank/bank/resources/TransactionsResource.java

Line 65 in aed03d4

return transactionsRepository.findAll();

A User should be able to see transactions from only user with lower rank from his.

Potential security issue: Privacy

CSE545-Project/shared/back-end/src/main/java/com/securebank/bank/resources/TransactionsResource.java

Line 61 in aed03d4

if (roleLevel.get(loggedInUser.getType()) == 0 || roleLevel.get(loggedInUser.getType()) == 3) {

CSE545-Project/shared/back-end/src/main/java/com/securebank/bank/resources/TransactionsResource.java

Line 91 in aed03d4

else if (roleLevel.get(loggedInUser.getType()) == 1 || roleLevel.get(loggedInUser.getType()) == 2) {

Admin should have permission to see all transactions.

Can't Admin create external user?

CSE545-Project/shared/back-end/src/main/java/com/securebank/bank/resources/UserResource.java

Line 123 in 103f2e9

if (loggedInUser.getType().equals("tier1") || loggedInUser.getType().equals("tier2")) {

Frontend with typos, create account UI change

Please fix the typos like some page with the wrong title.

For internal user when they are creating the account for external user, in the creating page could you add a list to show all the external user so we don't need to change page and copy-paste the userID.

Credit Card Numbers and CVV

When a credit account is created, in addition to the account number, we have to generate a Credit card number and CVV.

Implement Password validations: Must be at least 10 characters, must have upper + lower + number + symbol ect ect

Add captcha at login page

To prevent Spam and Bots

Email notifications (critical transactions)

External User needs to be notified via email when critical transactions occur and also at the time of account creation.

Frontend UI and redirect

For everytime we call the api, if is valid please redirect to the main page or has some system log pop out to let user know what going on.
If invalid, also pop the error out to let user know.

@prashanth-murali In create user and create account, everytime i click create, it popped out "request receive, email sent" LOL

Create internal users by admin - Not working

I just tried to create an internal user by admin. When I hit submit, a box pops up saying: "Request sent. Check your Email." and if I hit "OK" nothing changes and it stays in the page with all the info I typed in the fields. After I hit "Submit or OK", it should clear all fields with a confirmation number/message that the user has been created.

I did not receive any email (I put my asu email), and also the user I tried to create is not listed there. I tried to log out/ refresh the page, but still can't see the new user.

User Settings (Edit your Own Info)

Tier 1 can't create transactions

"Internal Transactions Employee" not working for tier 1
It works for Tier 2

Prevent duplicate username

Need to add timeout-session function

After 10 minutes of inactivity, the user should be logged out automaticaly.

Get All Merchants as External Users

Email and/or text alert for critical transactions

Edit Users (not displayig users)- Tier2

When I click on Edit users under tier 2 employee login, no user is displayed in dropdown menu. I can't see any user.

Note: Tier 2 employee should be able to view, create, modify, and delete external users’ accounts
and view and modify internal users’ accounts

Update User: bugs and security flaws

Bugs:

1. Every user show be able to update their own profile.

Security issues:

1. No one should be able to update the ID of any user
2. When updating user type, the value should be valid.
3. A user can not update his/her own user type field

Edit Users for Tier2

Edit Users ---> Should give a list of existing users that can be edited.

Tier 2 employee:
can view, create, modify, and delete external users’ accounts
can view and modify internal users’ accounts

No error if you overdraw more money than what you have

Create User does not work for both tier 1 and 2

Create internal user by admin