From 7b1d8995e1b1764a3967dad0e73df6f60ea3bbb8 Mon Sep 17 00:00:00 2001 From: adolfintel Date: Wed, 30 Jan 2019 10:16:28 +0100 Subject: [PATCH] Implemented ID obfuscation in telemetry.php and results/index.php --- .gitignore | 3 +-- example-telemetry-resultSharing.html | 4 ++-- results/index.php | 2 ++ speedtest_worker.js | 13 +++++------ speedtest_worker.min.js | 2 +- telemetry/idObfuscation.php | 34 ++++++++++++++++++++++++++++ telemetry/telemetry.php | 10 +++++--- telemetry/telemetry_settings.php | 1 + 8 files changed, 54 insertions(+), 15 deletions(-) create mode 100644 telemetry/idObfuscation.php diff --git a/.gitignore b/.gitignore index c0f3bef..13d4e88 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ -ugly.bat -wishlist.txt +telemetry/idObfuscation_salt.php diff --git a/example-telemetry-resultSharing.html b/example-telemetry-resultSharing.html index 7a0e743..eb89c7b 100644 --- a/example-telemetry-resultSharing.html +++ b/example-telemetry-resultSharing.html @@ -190,8 +190,8 @@ function startStop(){ if(status==4){ //if testId is present, show sharing panel, otherwise do nothing try{ - var testId=Number(data.testId); - if(!isNaN(testId)){ + var testId=data.testId; + if(testId!=null){ var shareURL=window.location.href.substring(0,window.location.href.lastIndexOf("/"))+"/results/?id="+testId; I("resultsImg").src=shareURL; I("resultsURL").value=shareURL; diff --git a/results/index.php b/results/index.php index 2e6a1da..475616e 100644 --- a/results/index.php +++ b/results/index.php @@ -52,6 +52,8 @@ $WATERMARK_TEXT="HTML5 Speedtest"; $id=$_GET["id"]; include_once('../telemetry/telemetry_settings.php'); +require '../telemetry/idObfuscation.php'; +if($enable_id_obfuscation) $id=deobfuscateId($id); $conn=null; $q=null; $ispinfo=null; $dl=null; $ul=null; $ping=null; $jit=null; if($db_type=="mysql"){ diff --git a/speedtest_worker.js b/speedtest_worker.js index 87077a5..3c0219a 100644 --- a/speedtest_worker.js +++ b/speedtest_worker.js @@ -173,7 +173,7 @@ this.addEventListener("message", function(e) { if (settings.telemetry_level > 0) sendTelemetry(function(id) { testStatus = 4; - if (id != -1) testId = id; + if (id != null) testId = id; }); else testStatus = 4; return; @@ -662,15 +662,14 @@ function sendTelemetry(done) { var parts = xhr.responseText.split(" "); if (parts[0] == "id") { try { - var id = Number(parts[1]); - if (!isNaN(id)) done(id); - else done(-1); + var id = parts[1]; + done(id); } catch (e) { - done(-1); + done(null); } - } else done(-1); + } else done(null); } catch (e) { - done(-1); + done(null); } }; xhr.onerror = function() { diff --git a/speedtest_worker.min.js b/speedtest_worker.min.js index e27e9ff..2ebd28e 100644 --- a/speedtest_worker.min.js +++ b/speedtest_worker.min.js @@ -1 +1 @@ -var testStatus=-1,dlStatus="",ulStatus="",pingStatus="",jitterStatus="",clientIp="",dlProgress=0,ulProgress=0,pingProgress=0,testId="noID",log="";function tlog(s){2<=settings.telemetry_level&&(log+=Date.now()+": "+s+"\n")}function tverb(s){3<=settings.telemetry_level&&(log+=Date.now()+": "+s+"\n")}function twarn(s){2<=settings.telemetry_level&&(log+=Date.now()+" WARN: "+s+"\n"),console.warn(s)}var settings={test_order:"IP_D_U",time_ul_max:15,time_dl_max:15,time_auto:!0,time_ulGraceTime:3,time_dlGraceTime:1.5,count_ping:10,url_dl:"garbage.php",url_ul:"empty.php",url_ping:"empty.php",url_getIp:"getIP.php",getIp_ispInfo:!0,getIp_ispInfo_distance:"km",xhr_dlMultistream:10,xhr_ulMultistream:3,xhr_multistreamDelay:300,xhr_ignoreErrors:1,xhr_dlUseBlob:!1,xhr_ul_blob_megabytes:20,garbagePhp_chunkSize:20,enable_quirks:!0,ping_allowPerformanceApi:!0,overheadCompensationFactor:1.06,useMebibits:!1,telemetry_level:0,url_telemetry:"telemetry/telemetry.php",telemetry_extra:""},xhr=null,interval=null,test_pointer=0;function url_sep(url){return url.match(/\?/)?"&":"?"}function clearRequests(){if(tverb("stopping pending XHRs"),xhr){for(var i=0;i=settings.test_order.length)0settings.time_dl_max||failed)&&((failed||isNaN(dlStatus))&&(dlStatus="Fail"),clearRequests(),clearInterval(interval),dlProgress=1,tlog("dlTest: "+dlStatus+", took "+((new Date).getTime()-startT)+"ms"),done())}else t>1e3*settings.time_dlGraceTime&&(0settings.time_ul_max||failed)&&((failed||isNaN(ulStatus))&&(ulStatus="Fail"),clearRequests(),clearInterval(interval),ulProgress=1,tlog("ulTest: "+ulStatus+", took "+((new Date).getTime()-startT)+"ms"),done())}else t>1e3*settings.time_ulGraceTime&&(0=settings.test_order.length)0settings.time_dl_max||failed)&&((failed||isNaN(dlStatus))&&(dlStatus="Fail"),clearRequests(),clearInterval(interval),dlProgress=1,tlog("dlTest: "+dlStatus+", took "+((new Date).getTime()-startT)+"ms"),done())}else t>1e3*settings.time_dlGraceTime&&(0settings.time_ul_max||failed)&&((failed||isNaN(ulStatus))&&(ulStatus="Fail"),clearRequests(),clearInterval(interval),ulProgress=1,tlog("ulTest: "+ulStatus+", took "+((new Date).getTime()-startT)+"ms"),done())}else t>1e3*settings.time_ulGraceTime&&(0>1)&0xFFFFFFFF)|(($id&0x00000001)<<31); + $salt=(($salt<<1)&0xFFFFFFFF)|(($salt&0xA0000000)>>31); + } + return $id; +} +function obfuscateId($id){ + return base_convert(obfdeobf($id),10,36); +} +function deobfuscateId($id){ + return obfdeobf(base_convert($id,36,10)); +} + +//IMPORTANT: DO NOT ADD ANYTHING BELOW THE PHP CLOSING TAG, NOT EVEN EMPTY LINES! +?> \ No newline at end of file diff --git a/telemetry/telemetry.php b/telemetry/telemetry.php index ca1a8ad..58825fa 100644 --- a/telemetry/telemetry.php +++ b/telemetry/telemetry.php @@ -1,5 +1,6 @@ bind_param("ssssssssss",$ip,$ispinfo,$extra,$ua,$lang,$dl,$ul,$ping,$jitter,$log) or die("3"); $stmt->execute() or die("4"); $stmt->close() or die("5"); - echo "id ".$conn->insert_id; + $id=$conn->insert_id; + echo "id ".($enable_id_obfuscation?obfuscateId($id):$id); $conn->close() or die("6"); }elseif($db_type=="sqlite"){ @@ -41,7 +43,8 @@ if($db_type=="mysql"){ "); $stmt = $conn->prepare("INSERT INTO speedtest_users (ip,ispinfo,extra,ua,lang,dl,ul,ping,jitter,log) VALUES (?,?,?,?,?,?,?,?,?,?)") or die("2"); $stmt->execute(array($ip,$ispinfo,$extra,$ua,$lang,$dl,$ul,$ping,$jitter,$log)) or die("3"); - echo "id ".$conn->lastInsertId(); + $id=$conn->lastInsertId(); + echo "id ".($enable_id_obfuscation?obfuscateId($id):$id); $conn = null; }elseif($db_type=="postgresql"){ // Prepare connection parameters for db connection @@ -53,7 +56,8 @@ if($db_type=="mysql"){ $conn = new PDO("pgsql:$conn_host;$conn_db;$conn_user;$conn_password") or die("1"); $stmt = $conn->prepare("INSERT INTO speedtest_users (ip,ispinfo,extra,ua,lang,dl,ul,ping,jitter,log) VALUES (?,?,?,?,?,?,?,?,?,?)") or die("2"); $stmt->execute(array($ip,$ispinfo,$extra,$ua,$lang,$dl,$ul,$ping,$jitter,$log)) or die("3"); - echo "id ".$conn->lastInsertId(); + $id=$conn->lastInsertId(); + echo "id ".($enable_id_obfuscation?obfuscateId($id):$id); $conn = null; } else die("-1"); diff --git a/telemetry/telemetry_settings.php b/telemetry/telemetry_settings.php index 04355e7..f2c3522 100644 --- a/telemetry/telemetry_settings.php +++ b/telemetry/telemetry_settings.php @@ -2,6 +2,7 @@ $db_type="mysql"; //Type of db: "mysql", "sqlite" or "postgresql" $stats_password="PASSWORD"; //password to login to stats.php. Change this!!! +$enable_id_obfuscation=true; //if set to true, test IDs will be obfuscated to prevent users from guessing URLs of other tests // Sqlite3 settings $Sqlite_db_file = "../../telemetry.sql";