Commit e62f7c70 authored by Mahesh Patil's avatar Mahesh Patil
Browse files

[rtub] Security Issues Fixes and Code Sniffer fixes.

parent dfcf442f

README.MD

+11 −4
Original line number Diff line number Diff line
@@ -13,9 +13,13 @@ CONTENTS OF THIS FILE 
INTRODUCTION

------------



This module tracks each user event like User Login, User Logout and User Nodeview events and also store these event data in your database. This data is then exposed to views so you can report on it if required.

This module tracks each user event like User Login,

User Logout and User Nodeview events and also store

these event data in your database. This data is then exposed to views

so you can report on it if required.



Note: Front Page/Home Page be tracked by default. We dont track Node view event for anonymous user.

Note: Front Page/Home Page be tracked by default.

We dont track Node view event for anonymous user.





REQUIREMENTS
@@ -49,8 +53,11 @@ following permission to track Login and Logout event for specific roles: 


For NodeView Event tracking



If you wish to track user nodeview event for certain content type only, then you can assign permission to track nodeView event for specific content type for specific user role.

If you wish to track user nodeview event for certain content type only,

then you can assign permission to track nodeView event for

specific content type for specific user role.



Views integration

You can access the data in the real time user behaviour tables either as a base view, or

You can access the data in the real time user behaviour

tables either as a base view, or

more usefully as a relationship against the user table.

js/rtub-ct.js

+4 −4
Original line number Diff line number Diff line
@@ -12,10 +12,10 @@ 
  function init() {

    if (!initialized) {

      initialized = true;

      var eData = drupalSettings.rtub.nodeview.event_data;

      var user_id = drupalSettings.rtub.nodeview.user_id;

      var eType = drupalSettings.rtub.nodeview.event_type;

      var newNode = {event: {eData: eData, user_id: user_id, eType: eType}};

      var eData = drupalSettings.rtub.nodeview.eventData;

      var eType = drupalSettings.rtub.nodeview.eventType;

      var eToken = drupalSettings.rtub.nodeview.eventToken;

      var newNode = {event: {eData: eData, eType: eType, eToken: eToken}};

      postNode(newNode);

    }

  }

rtub.module

+9 −5
Original line number Diff line number Diff line
@@ -8,6 +8,8 @@ 
 */



use Drupal\Core\Routing\RouteMatchInterface;

use Drupal\Component\Utility\Crypt;

use Drupal\Core\Site\Settings;



/**

 * Implements hook_help().
@@ -84,7 +86,6 @@ function rtub_preprocess_node(&$variables) { 
  $node = $variables['node'];

  $ntype = $node->getType();

  $user = \Drupal::currentUser();

  $event_time = \Drupal::time()->getRequestTime();

  // Do not track data for Anonymous users.

  if ($user->isAnonymous()) {

    return;
@@ -97,9 +98,12 @@ function rtub_preprocess_node(&$variables) { 
  if (!(\Drupal::service('path.matcher')->isFrontPage())) {

    // Do not track front page.

    $variables['#attached']['library'][] = 'rtub/rtub-js';

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['event_data'] = "User on " . $node->getTitle();

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['event_type'] = "nodeview";

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['user_id'] = $user->id();

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['event_ts'] = $event_time;

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['eventData'] = "User on " . $node->getTitle();

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['eventType'] = "nodeview";



    $str = "User on " . $node->getTitle() . " | nodeview";



    $eStr = Crypt::hmacBase64($str, Settings::getHashSalt());

    $variables['#attached']['drupalSettings']['rtub']['nodeview']['eventToken'] = $eStr;

  }

}

src/Controller/PostNodeDataController.php

+10 −2
Original line number Diff line number Diff line
@@ -11,6 +11,8 @@ use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; 
use Symfony\Component\HttpKernel\HttpKernelInterface;

use Drupal\Core\Database\Connection;

use Drupal\Component\Datetime\TimeInterface;

use Drupal\Core\Site\Settings;

use Drupal\Component\Utility\Crypt;



/**

 * Controller for the comment entity.
@@ -80,20 +82,26 @@ class PostNodeDataController extends ControllerBase { 
   * @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException

   */

  public function updateRealTimeData(Request $request) {



    if ($this->currentUser()->isAnonymous()) {

      throw new AccessDeniedHttpException();

    }



    $event = $request->request->get('event');

    if ($event) {

    $newStr = $event['eData'] . "|" . $event['eType'];

    $eStr = Crypt::hmacBase64($newStr, Settings::getHashSalt());



    if ($event['eToken'] == $eStr) {

      // Valid post request.

      $connection = $this->connection;

      $connection->insert('rtub')

        ->fields([

          'uid' => $event['user_id'],

          'uid' => $this->currentUser()->id(),

          'event_type' => $event['eType'],

          'event_timestamp' => $this->time->getRequestTime(),

          'event_data' => $event['eData'],

        ])->execute();



      $response['status'] = TRUE;

      return new JsonResponse($response);

    }