Some security improvements

Author: dayofpay

controllers/analyticsController.js

@@ -6,7 +6,7 @@ const router = require('express').Router();
 const Site = require('../models/Sites');
 let cors = require('cors');
 const ipTools = require('../utils/ipTools');
-
+const security = require('../utils/security');
 let corsOptions = {
     origin: function (origin, callback) {
         if (whitelist.indexOf(origin) !== -1) {
@@ -20,6 +20,11 @@ router.post('/sites/:id', async (req, res) => {
     // Get Site URL
 
     try {
+        const checkProxy = await security.isProxy(req.ip);
+        if(checkProxy.isProxy){
+            res.status(403).send({SecurityException : 'You are not allowed to send analytics data using Proxy'});
+            return;
+        }
         const siteUrl = await Site.findById(req.params.id).exec();
         if (siteUrl) {
 

utils/security.js

@@ -0,0 +1,18 @@
+async function isProxy(ip){
+    const getData = await fetch(`https://proxycheck.io/v2/${ip}?vpn=1&asn=1`);
+
+    if(getData.ok){
+        const result = await getData.json();
+        if(result[ip]){
+            return {'IsProxy' : await result[ip].proxy === 'no' ? false : true}
+        }
+        else{
+            return {'isProxy' : false} // Error
+        }
+    }
+    else{
+        return {Result: 'Error while checking the ip'}
+    }
+}
+
+module.exports = {isProxy : isProxy}

views/index.hbs

@@ -81,7 +81,7 @@ document.addEventListener('DOMContentLoaded',(event) => {
 											<h1 class="mt-1 mb-3">{{siteData.visitors}}</h1>
 											<div class="mb-0">
 												<span class="text-success"> <i class="mdi mdi-arrow-bottom-right"></i>
-													5.25% </span>
+													0.00% </span>
 												<span class="text-muted">Since last week</span>
 											</div>
 										</div>
@@ -104,7 +104,7 @@ document.addEventListener('DOMContentLoaded',(event) => {
 											<h1 class="mt-1 mb-3">{{siteData.visits}}</h1>
 											<div class="mb-0">
 												<span class="text-success"> <i class="mdi mdi-arrow-bottom-right"></i>
-													5.25% </span>
+													0.00% </span>
 												<span class="text-muted">Since last week</span>
 											</div>
 										</div>
@@ -118,7 +118,7 @@ document.addEventListener('DOMContentLoaded',(event) => {
 						<div class="card flex-fill w-100">
 							<div class="card-header">
 
-								<h5 class="card-title mb-0">Recent Movement</h5>
+								<h5 class="card-title mb-0">Recent Movement ( EXAMPLE )</h5>
 							</div>
 							<div class="card-body py-3">
 								<div class="chart chart-sm">
@@ -168,7 +168,7 @@ document.addEventListener('DOMContentLoaded',(event) => {
 						<div class="card flex-fill w-100">
 							<div class="card-header">
 
-								<h5 class="card-title mb-0">Real-Time</h5>
+								<h5 class="card-title mb-0">Real-Time ( EXAMPLE )</h5>
 							</div>
 							<div class="card-body px-4">
 								<div id="world_map" style="height:350px;"></div>
@@ -254,7 +254,7 @@ document.addEventListener('DOMContentLoaded',(event) => {
 						<div class="card flex-fill w-100">
 							<div class="card-header">
 
-								<h5 class="card-title mb-0">Monthly Sales</h5>
+								<h5 class="card-title mb-0">Monthly Visitors ( Demo )</h5>
 							</div>
 							<div class="card-body d-flex w-100">
 								<div class="align-self-center chart chart-lg">