From 1b0c92bb312952e7acfe1a1ed29b32a152064a82 Mon Sep 17 00:00:00 2001
From: "Marcel Kapfer (mmk2410)" <marcelmichaelkapfer@yahoo.co.nz>
Date: Tue, 17 May 2016 20:58:50 +0200
Subject: [PATCH 1/9] FIX: Disqus not migrated to new config

---
 res/php/Disqus.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/res/php/Disqus.php b/res/php/Disqus.php
index 45c1f20..9da0787 100644
--- a/res/php/Disqus.php
+++ b/res/php/Disqus.php
@@ -22,7 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
-<?php if ($blogdisqus) { // check if disqus is enabled ?>
+<?php if ($config['blog']['disqus']) { // check if disqus is enabled ?>
     <section class="card">
         <div id="disqus_thread"></div>
         <script type="text/javascript">

From 655b982f9d91232b9b5e572efa18e306c2be160d Mon Sep 17 00:00:00 2001
From: "Marcel Kapfer (mmk2410)" <marcelmichaelkapfer@yahoo.co.nz>
Date: Tue, 17 May 2016 20:59:54 +0200
Subject: [PATCH 2/9] FIX: Missing nodejs dependencies

---
 package.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package.json b/package.json
index e0379b9..fd0a239 100644
--- a/package.json
+++ b/package.json
@@ -21,6 +21,7 @@
   },
   "homepage": "https://gitlab.com/mmk2410/rangitaki#README",
   "devDependencies": {
+    "coffee-script": "^1.10.0",
     "del": "^2.2.0",
     "gulp": "^3.9.1",
     "gulp-coffee": "^2.3.2",

From 42f1992c97ad2dd83dfbda46d08bbbd8bb83d6f5 Mon Sep 17 00:00:00 2001
From: "Marcel Kapfer (mmk2410)" <marcelmichaelkapfer@yahoo.co.nz>
Date: Tue, 17 May 2016 22:34:33 +0200
Subject: [PATCH 3/9] Require SSL for the RCC.

Resolves T116
---
 rcc/index.php | 18 ++++++++++++------
 rcc/ssl.php   | 11 +++++++++++
 2 files changed, 23 insertions(+), 6 deletions(-)
 create mode 100644 rcc/ssl.php

diff --git a/rcc/index.php b/rcc/index.php
index e7cdf75..4dfe5d8 100644
--- a/rcc/index.php
+++ b/rcc/index.php
@@ -32,6 +32,17 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
+
+require '../vendor/autoload.php';
+require '../res/php/Config.php';
+
+use \mmk2410\rbe\config\Config as Config;
+
+$config = new Config("../config.yaml", '../vendor/autoload.php');
+$settings = $config->getConfig();
+
+include './ssl.php';
+
 ?>
 
 <!DOCTYPE html>
@@ -64,12 +75,7 @@
 
     <div class="main">
 <?php
-require '../res/php/Config.php';
-use mmk2410\rbe\config\Config as Config;
-
-$configParser = new Config('../config.yaml', '../vendor/autoload.php');
-
-$config = $configParser->getConfig();
+$config = $settings;
 
 if ($config["rcc"]["rcc"] == "on") {
     include 'password.php';
diff --git a/rcc/ssl.php b/rcc/ssl.php
new file mode 100644
index 0000000..0923208
--- /dev/null
+++ b/rcc/ssl.php
@@ -0,0 +1,11 @@
+<?php
+// Marcel Kapfer (mmk2410) / Wilson O'Sullivan
+// License: MIT License
+// SSL Verification
+
+if ($settings["rcc"]["debug"] != "on") {
+    if (empty($_SERVER['HTTPS']) || $_SERVER['HTTPS'] != "on") {
+        header('HTTP/1.1 400 Bad Request');
+        exit();
+    }
+}

From 5e45579ef101d433a8614936de0f5514bc3113a6 Mon Sep 17 00:00:00 2001
From: "Marcel Kapfer (mmk2410)" <marcelmichaelkapfer@yahoo.co.nz>
Date: Tue, 17 May 2016 22:36:26 +0200
Subject: [PATCH 4/9] Switch to HTTP Basic Auth

Resolves T115
---
 rcc/api/auth/DigestAuth.php | 52 -------------------------------------
 rcc/api/auth/auth.php       | 43 ++++++++++--------------------
 rcc/api/list/index.php      |  4 +--
 rcc/api/media/index.php     |  4 +--
 rcc/api/post/index.php      |  4 +--
 5 files changed, 19 insertions(+), 88 deletions(-)
 delete mode 100644 rcc/api/auth/DigestAuth.php

diff --git a/rcc/api/auth/DigestAuth.php b/rcc/api/auth/DigestAuth.php
deleted file mode 100644
index ed3ea1d..0000000
--- a/rcc/api/auth/DigestAuth.php
+++ /dev/null
@@ -1,52 +0,0 @@
-<?php
-/**
- * PHP Version 7
- *
- * Authentication Helper Class
- *
- * @category Authentication
- * @package  Rbe
- * @author   Marcel Kapfer (mmk2410) <marcelmichaelkapfer@yahoo.co.nz>
- * @license  MIT License
- * @link     http://marcel-kapfer.de/rangitaki
- */
-namespace mmk2410\rbe\digestAuth;
-
-/**
- * PHP Version 7
- *
- * Authentication Helper Class
- *
- * @category Authentication
- * @package  Rbe
- * @author   Marcel Kapfer (mmk2410) <marcelmichaelkapfer@yahoo.co.nz>
- * @license  MIT License
- * @link     http://marcel-kapfer.de/rangitaki
- */
-class DigestAuth
-{
-
-    /**
-     * parser for http digest
-     *
-     * @param $txt  data to parse
-     *
-     * @return parsed data or FALSE
-     */
-    public function httpDigestParse($txt)
-    {
-        // protect against missing data
-        $needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1);
-        $data = array();
-        $keys = implode('|', array_keys($needed_parts));
-
-        preg_match_all('@(' . $keys . ')=(?:([\'"])([^\2]+?)\2|([^\s,]+))@', $txt, $matches, PREG_SET_ORDER);
-
-        foreach ($matches as $m) {
-            $data[$m[1]] = $m[3] ? $m[3] : $m[4];
-            unset($needed_parts[$m[1]]);
-        }
-
-        return $needed_parts ? false : $data;
-    }
-}
diff --git a/rcc/api/auth/auth.php b/rcc/api/auth/auth.php
index f02646e..ab22d6c 100644
--- a/rcc/api/auth/auth.php
+++ b/rcc/api/auth/auth.php
@@ -1,39 +1,22 @@
 <?php
 // Marcel Kapfer (mmk2410)
 // License: MIT License
-// api digest auth
+// HTTP Basic Auth for the API
 
-require 'DigestAuth.php';
+$basedir = "../../../";
+
+require '../../ssl.php';
 
 require '../../password.php';
 
-use \mmk2410\rbe\digestAuth\DigestAuth as DigestAuth;
-
-$realm = 'Restricted area';
-
-$users = array($username => $password);
-
-if (empty($_SERVER['PHP_AUTH_DIGEST'])) {
+if (!isset($_SERVER['PHP_AUTH_USER'])) {
+    header('WWW-Authenticate: Basic realm="RCC API"');
     header('HTTP/1.1 401 Unauthorized');
-    header('WWW-Authenticate: Digest realm="'.$realm.
-           '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');
-
-    die('Access to RCC API not granted');
-}
-
-
-// analyze the PHP_AUTH_DIGEST variable
-if (!($data = DigestAuth::httpDigestParse($_SERVER['PHP_AUTH_DIGEST'])) ||
-    !isset($users[$data['username']])) {
-    die('Wrong Credentials!');
-}
-
-
-// generate the valid response
-$A1 = md5($data['username'] . ':' . $realm . ':' . $users[$data['username']]);
-$A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']);
-$valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2);
-
-if ($data['response'] != $valid_response) {
-    die('Wrong Credentials!');
+    echo "Access denied to the RCC API!";
+    exit;
+} elseif ($_SERVER['PHP_AUTH_USER'] != $username ||
+    !password_verify($_SERVER['PHP_AUTH_PW'], $password)) {
+        header('HTTP/1.1 401 Unauthorized');
+    echo "Wrong credentials: Access denied!";
+    exit;
 }
diff --git a/rcc/api/list/index.php b/rcc/api/list/index.php
index 287f073..f448a9e 100644
--- a/rcc/api/list/index.php
+++ b/rcc/api/list/index.php
@@ -9,13 +9,13 @@ use \Psr\Http\Message\ResponseInterface as Response;
 require '../../../vendor/autoload.php';
 require '../../../res/php/Config.php';
 
-include '../auth/auth.php';
-
 use \mmk2410\rbe\config\Config as Config;
 
 $config = new Config("../../../config.yaml", '../../../vendor/autoload.php');
 $settings = $config->getConfig();
 
+include '../auth/auth.php';
+
 if ($settings["rcc"]["api"] == "on" && $settings["rcc"]["rcc"] == "on") {
     $app = new \Slim\App();
 
diff --git a/rcc/api/media/index.php b/rcc/api/media/index.php
index fd6804c..c9efcbd 100644
--- a/rcc/api/media/index.php
+++ b/rcc/api/media/index.php
@@ -10,13 +10,13 @@ require '../../../vendor/autoload.php';
 require '../../../res/php/Config.php';
 require '../../../res/php/ArticleGenerator.php';
 
-include '../auth/auth.php';
-
 use \mmk2410\rbe\config\Config as Config;
 
 $config = new Config("../../../config.yaml", '../../../vendor/autoload.php');
 $settings = $config->getConfig();
 
+include '../auth/auth.php';
+
 if ($settings["rcc"]["api"] == "on" && $settings["rcc"]["rcc"] == "on") {
     $app = new \Slim\App();
 
diff --git a/rcc/api/post/index.php b/rcc/api/post/index.php
index cc04e70..4636083 100644
--- a/rcc/api/post/index.php
+++ b/rcc/api/post/index.php
@@ -10,13 +10,13 @@ require '../../../vendor/autoload.php';
 require '../../../res/php/Config.php';
 require '../../../res/php/ArticleGenerator.php';
 
-include '../auth/auth.php';
-
 use \mmk2410\rbe\config\Config as Config;
 
 $config = new Config("../../../config.yaml", '../../../vendor/autoload.php');
 $settings = $config->getConfig();
 
+include '../auth/auth.php';
+
 if ($settings["rcc"]["api"] == "on" && $settings["rcc"]["rcc"] == "on") {
     $app = new \Slim\App();
 

From fb937319db6e24b37a916d6eb99e84f500129551 Mon Sep 17 00:00:00 2001
From: "Marcel Kapfer (mmk2410)" <marcelmichaelkapfer@yahoo.co.nz>
Date: Tue, 17 May 2016 22:37:36 +0200
Subject: [PATCH 5/9] Store password as hash

Resolves T117
---
 bin/init_rcc.php | 8 +++++++-
 rcc/password.php | 4 ++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/bin/init_rcc.php b/bin/init_rcc.php
index 54f236f..94b74c2 100644
--- a/bin/init_rcc.php
+++ b/bin/init_rcc.php
@@ -23,8 +23,14 @@ if ($password == "") {
     exit();
 }
 
+$options = [
+    'cost' => 12
+];
+
+$password = password_hash($password, PASSWORD_BCRYPT, $options);
+
 $username = '$username = "' . $username . '";';
-$password = '$password = "' . $password . '";';
+$password = '$password = \'' . $password . '\';';
 
 $file = '<?php' . "\n" . $username . "\n" . $password . "\n";
 
diff --git a/rcc/password.php b/rcc/password.php
index d267c54..14d08f8 100644
--- a/rcc/password.php
+++ b/rcc/password.php
@@ -1,3 +1,3 @@
 <?php
-$username = "example";
-$password = "example";
+$username = "test";
+$password = '$2y$12$nHitKTwHqU4GmI3ADVE05eH/723fCNgdQ65kQ53FyZUVVB03BjfCO';

From 52835db8db9aedb6c80adf525444fa7654c860e4 Mon Sep 17 00:00:00 2001
From: "Marcel Kapfer (mmk2410)" <marcelmichaelkapfer@yahoo.co.nz>
Date: Wed, 18 May 2016 07:38:40 +0200
Subject: [PATCH 6/9] FIX: Go Back didn't work

---
 index.php             | 2 +-
 res/js/app.js         | 2 +-
 src/coffee/app.coffee | 4 ----
 3 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/index.php b/index.php
index d2ae689..5cef22f 100644
--- a/index.php
+++ b/index.php
@@ -214,7 +214,7 @@ if ($config["design"]["drawer"] == "on") {
             // If viewing a blog or a tag
             ?>
             <!-- Set a back item instead of the blogs. -->
-            <a class="nav-item" onclick="goBack()">Go back</a>
+            <a class="nav-item" onclick="history.go(-1);">Go back</a>
             <?php
         }
         if ($config["blog"]["home"] == "on") { // If a blog home is existend
diff --git a/res/js/app.js b/res/js/app.js
index 397dbcc..ca6efa6 100644
--- a/res/js/app.js
+++ b/res/js/app.js
@@ -1 +1 @@
-(function(){var n,t,a,e,r,i;r=function(){var e,r;return e=!1,$(".fabmenu").click(function(){return e?(a(),e=!1):(t(),e=!0)}),r=!1,$(".nav-img, .overlay, .nav-close").click(function(){return r?(n(),r=!1):(i(),r=!0)}),$(document).keyup(function(t){return r&&27===t.which?(n(),r=!1):r||77!==t.which?void 0:(i(),r=!0)}),$(".articletext a").attr("target","_blank")},$(document).ready(r),e=function(){return history.go(-1)},t=function(){return $(".subfab").fadeIn(125),$(".fab-img").fadeOut(60,function(){return $(".fab-img").attr("src","./res/img/close.svg"),$(".fab-img").fadeIn(60)})},a=function(){return $(".subfab").fadeOut(125),$(".fab-img").fadeOut(60,function(){return $(".fab-img").attr("src","./res/img/share.svg"),$(".fab-img").fadeIn(60)})},i=function(){return $(".nav").animate({left:"0px"},125),$(".overlay").show(),$(".overlay").animate({opacity:"0.4"},125)},n=function(){return $(".nav").animate({left:"-301px"},125),$(".overlay").animate({opacity:"0.0"},125,function(){return $(".overlay").hide})}}).call(this);
\ No newline at end of file
+(function(){var n,t,a,e,r;e=function(){var e,i;return e=!1,$(".fabmenu").click(function(){return e?(a(),e=!1):(t(),e=!0)}),i=!1,$(".nav-img, .overlay, .nav-close").click(function(){return i?(n(),i=!1):(r(),i=!0)}),$(document).keyup(function(t){return i&&27===t.which?(n(),i=!1):i||77!==t.which?void 0:(r(),i=!0)}),$(".articletext a").attr("target","_blank")},$(document).ready(e),t=function(){return $(".subfab").fadeIn(125),$(".fab-img").fadeOut(60,function(){return $(".fab-img").attr("src","./res/img/close.svg"),$(".fab-img").fadeIn(60)})},a=function(){return $(".subfab").fadeOut(125),$(".fab-img").fadeOut(60,function(){return $(".fab-img").attr("src","./res/img/share.svg"),$(".fab-img").fadeIn(60)})},r=function(){return $(".nav").animate({left:"0px"},125),$(".overlay").show(),$(".overlay").animate({opacity:"0.4"},125)},n=function(){return $(".nav").animate({left:"-301px"},125),$(".overlay").animate({opacity:"0.0"},125,function(){return $(".overlay").hide})}}).call(this);
\ No newline at end of file
diff --git a/src/coffee/app.coffee b/src/coffee/app.coffee
index 8e74441..e596e34 100644
--- a/src/coffee/app.coffee
+++ b/src/coffee/app.coffee
@@ -64,9 +64,6 @@ main = () ->
 
 $(document).ready main
 
-goBack = () ->
-  history.go -1
-
 fabFadeIn = () ->
   $('.subfab').fadeIn 125
   $('.fab-img').fadeOut 60, ->
@@ -88,4 +85,3 @@ closeNav = () ->
   $('.nav').animate {"left": "-301px"}, 125
   $('.overlay').animate {"opacity": "0.0"}, 125, ->
     $('.overlay').hide
-

From 007aea9b10a969f861b2f3c3bf901fcb9249d2a2 Mon Sep 17 00:00:00 2001
From: "Marcel Kapfer (mmk2410)" <marcelmichaelkapfer@yahoo.co.nz>
Date: Wed, 18 May 2016 07:39:41 +0200
Subject: [PATCH 7/9] FIX: Missing nodejs dependencies

---
 package.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index fd0a239..f4295da 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
     "gulp-size": "^2.1.0",
     "gulp-sourcemaps": "^2.0.0-alpha",
     "gulp-uglify": "^1.5.3",
-    "merge-stream": "^1.0.0"
+    "merge-stream": "^1.0.0",
+    "node-sass": "^3.7.0"
   }
 }

From d33ff8f984b5683b5f2681f13d574ddb9ea26e95 Mon Sep 17 00:00:00 2001
From: "Marcel Kapfer (mmk2410)" <marcelmichaelkapfer@yahoo.co.nz>
Date: Wed, 18 May 2016 13:32:44 +0200
Subject: [PATCH 8/9] Update script for 1.4.1

---
 update-scripts/1-4-0_1-4-1.sh | 70 +++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100755 update-scripts/1-4-0_1-4-1.sh

diff --git a/update-scripts/1-4-0_1-4-1.sh b/update-scripts/1-4-0_1-4-1.sh
new file mode 100755
index 0000000..9196dab
--- /dev/null
+++ b/update-scripts/1-4-0_1-4-1.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+# Update script for Rangitaki from version 1.4.0 to 1.4.1
+
+version="1.4.1"
+new="./rbe-new"
+
+echo -n "Downloading version $version from GitLab... "
+git clone -q https://gitlab.com/mmk2410/rangitaki.git "$new"
+
+if [[ $1 == "--debug" ]]; then
+    cd $new
+    git checkout master
+    cd ../
+fi
+echo "done"
+
+echo -n "Updating ressources... "
+rm -rf ./res/
+mv $new/res/ ./
+echo "done"
+
+echo -n "Updating binaries... "
+rm -rf ./bin
+mv $new/bin/ ./
+echo "done"
+
+echo -n "Updating source files... "
+rm -rf ./src
+mv $new/src/ ./
+echo "done"
+
+echo -n "Updating RCC... "
+rm -rf ./rcc
+mv $new/rcc ./
+rm ./rcc/password.php
+echo "done"
+
+echo -n "Updating core... "
+rm ./index.php
+mv $new/index.php ./
+echo "done"
+
+echo -n "Updating npm... "
+mv $new/package.json ./
+echo "done"
+
+echo -n "Updating Changelog... "
+
+if [ -f ./CHANGELOG.txt ]; then
+    rm CHANGELOG.txt
+fi
+
+mv $new/CHANGELOG.md ./
+echo "done"
+
+if [[  $1 != "--debug" ]]; then
+    echo -n "Cleaning up... "
+    rm -rf $new
+    echo "done"
+fi
+
+if [ -d "./update-scripts" ]; then
+    echo -n "Remove obsolete update scripts folder... "
+    rm -rf "./update-scripts"
+    echo "done"
+fi
+
+echo "$version" > ./VERSION
+
+echo "Your Rangitaki installation is updated to version $version"

From 3a8494417ecf8e91c3c9099484f206c3588f6ab2 Mon Sep 17 00:00:00 2001
From: "Marcel Kapfer (mmk2410)" <marcelmichaelkapfer@yahoo.co.nz>
Date: Wed, 18 May 2016 13:33:28 +0200
Subject: [PATCH 9/9] Version bump to 1.4.1

---
 CHANGELOG.md | 8 ++++++++
 package.json | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b914f39..20bb40c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,14 @@
 
  - [S] release are always compared to the previous [S] release.
 
+## Version 1.4.1 (2016-05-18) [S]
+ - Switch to HTTP Basic Auth for the RCC API
+ - Store password as hash
+ - Require SSL for using the RCC and the RCC API
+ - [FIX] Drawer "Go back" does not work
+ - [FIX] Missing nodejs dependencies
+ - [FIX] Disqus not completly migrated to new config
+
 ## Version 1.4.0 (2016-05-07) [S]
 
  - Fix: Feeds contain no text
diff --git a/package.json b/package.json
index f4295da..6765a59 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "rangitaki",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "A simple PHP blogging engine without any database dependencies",
   "main": "index.php",
   "scripts": {
