johndiiorio / bughouse Goto Github PK

Rate limit certain API endpoints, especially the login API.

https://github.com/nfriedly/express-rate-limit is a possibility.

User profile page should, at the minimum, display their username (with title if applicable), all three ratings (bullet, blitz, classical), and links to their games. Move route from /profile to /user/username. Potentially add editable fields, such as a bio and country.

Route the user away from /loading if selectedGame is null

If your teammate or their opponent makes a move, your own premove is canceled without being played.

This results in users landing on a blank page when attempting to play another game, with a refresh required to display the game boards correctly.

Update ratings for players on game end. Show UI for rating increase or decrease.

User reports that "both scrollbars in fullscreen on FullHD display in last
Firefox under Xubuntu."

There are also a number of UI bugs, including:

• The "Sign in" and "Reset Password" buttons overlap when the screen size shrinks.
• The lobby table glitches in Firefox
• The "empty" slots in the lobby pane could be a better color.

Both games ends when either game reaches a conclusion (checkmate, stalemate, resign, draw, time-out).

This requires adding a FENs array column to games table

Add a page that displays the highest ranked users on the site in all three categories (bullet, blitz, and classical).

Include a player's title (GM, IM, FM, etc.) wherever a username is displayed and colorized the title. This needs to be done on the game page, the lobby, and the user's profile page.

Use the NPM jsonschema package to validate all requests to API routes.

Create a better logging module that saves messages to a file.

Hello,
Your site bughousechess.org don't work:

Having a problem when running this on my local machine. OS - Arch Linux, browser(s) - Vivaldi, Firefox

Server is being hosted on port 3000 of my local machine, and when attempting to make a new account, users are unable to click "register" and the username is never verified.

When the game end, freeze both game boards, all clocks, and route to a permanent game location, i.e. /game/id. Should be viewable and not editable by all users.

A button should be added to the home page that generates a URL link where users can join instead of through the public lobby.

Export a completed game according to this standard: http://bughousedb.com/Lieven_BPGN_Standard.txt

It's possible to send arbitrary IDs in the "playerN field of the /games/ POST body.

These games will never finish and thus will simply clog the database.

More crucially, however, it's possibly to trivially determine the IDs of other players; they are given in the data fetched by the /player/<NAME> page.

This means I can target a single (or group of) players, such as here:

By making players 2, 3, and 4 all one player, I can raise my rating without actually playing, as the other player will simply time out.

Importantly, the other player cannot join this game to save themselves, since (according to the app) they are already in it. As long as I fill all the spots, I only have to wait 5 minutes to massively amp up my rating, for free.

This requires the ID of three users: a vict

Sample CURL command:

curl 'https://bughousechess.org/api/games' -H 'Host: bughousechess.org' -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0' -H 'Accept: application/json, text/plain, */*' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Referer: https://bughousechess.org/' -H 'Content-Type: application/json;charset=utf-8' -H 'Cookie: io=HhXxmxR3tCtC7nEMAABc' -H 'Connection: keep-alive' -H 'DNT: 1' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' --data '{"minutes":5,"increment":5,"joinRandom":true,"mode":"Rated","ratingRange":"1250 - 1750","player1":3,"player2":1,"player3":2,"player4":1}'

The important fields here are the playerN fields. Player 1 should be the attacker; players 2 and 4 the victims; and player 3 an ally (witting or no).

If multiple "copies" of one player are present it a game, it does not affect the leaderboard. Therefore, at least 2 high ranked players need to be victimized. Ample mid-ranked players (similar to the attacker's rank) make execution easier.

Instead of routing to /game, route to /game/id.

Every so often (5 minutes?), check and clean up open games where the only joined users are offline.

Requires implementing a way to check if a user is online.

Possibly depend upon https://www.npmjs.com/package/cron

Create a display for viewing a live or finished game at route /overview/game_id

Promotion to queen or knight fails

This only seems to happen for users in position 4.

This helps screen readers and also people like me who don't read hint text before pasting passwords

Display the number of players left to join a given game on the loading screen.