totaljs / messenger

Node.js Open-Source Slack alternative

Installation

• Install Node.js platform
• Install GraphicsMagick
• Install latest version of Total.js $ npm install total.js
• License: MIT
• Live chat with professional support
• HelpDesk with professional support

First start

• set up configuration file /config
• run $ node debug.js (development) or $ node release.js (production)
• open http://127.0.0.1:8000/
• sign in user: [email protected], password: 123456 (credentials are stored in /databases/users.json)

How do I translate Messenger?

• install Total.js as global module npm install -g total.js
• then open Messenger directory cd messenger
• then perform this command totaljs --translate
• translate translated file translate.resource
• and copy the content to /resources/default.resource
• run app

How can I extend messenger independently?

Server-side

F.on('messenger.open', function(controller, client) {
    // open client
});

F.on('messenger.close', function(controller, client) {
    // disconnected client
});

F.on('messenger.data', function(controller, client, data) {
    // RAW data from websocket
    // data === OBJECT
});

F.on('messenger.message', function(controller, client, message) {
    // New message
    // message === OBJECT
});

// How to send a message?
options = {};

// REQUIRED
options.iduser = 'ID USER WHICH SENDS MESSAGE';
options.target = 'channel'; // or "user"
options.idtarget = 'idchannel' // or "iduser"
options.body = 'MARKDOWN MESSAGE'; // how to perform like? just send ":thumbs-up:" in body
options.secret = false; // is the message a secret message?

// OPTIONAL
options.id = 'ID MESSAGE'; // for editing of an existing message
options.users = ['iduser1', 'iduser2']; // optional, which users can by notified? (works with channels only)
options.files = [{ name: 'filename', url: 'url to download' }]; // optional, (it serves for file browser only)

OPERATION('send', options, function(err, response) {
    console.log('DONE');
});

Client-side

ON('messager.ready', function() {
    // messenger is ready
});

ON('messenger.message', function(message) {
    // message === OBJECT
});

ON('messenger.send', function(message) {

});

// You can register event
ON('messenger.render', function(message) {
    // message.message  - instance of retrieved message
    // message.html     - rendered HTML (can be modified)

    // Example:
    message.html = message.html.replace(/\,/g, ' --- ');
});

// How to send a message to the server via WebSocket?
SETTER('websocket', 'send', OBJECT);

HTML Formatting

+v2.0.0. Administrators have disabled xss protection, so each admin can inject a raw HTML into the markdown directly, example:

Only administrators can inject HTML directly via:

\```xss
 <b>THIS WILL BE BOLDED</b>
\```

Contributors

• Peter Širka (author) [email protected]
• Martin Smola (support) [email protected]

messenger's Issues

[Security] Stored XSS in private task

Tested version: latest

Steps to reproduce the vulnerability:

• Login in the application.
• Click on Add a Private task.
• Set "<script>alert(document.domain)</script> as task description and save.
• XSS will fire whenever task is reflected in page.

[Security] Stored XSS in channel description

Tested version: latest

Steps to reproduce the vulnerability:

• Login in the application.
• Click on Channels.
• Click on Add a new channel.
• Fill all the possible fields with payload "<script>alert(document.domain)</script> and save.
• XSS will fire whenever user info is reflected in page.

(SQL/NoSQL) database integration

First of all congratulation for such a job. As far as I understood, data is stored under database directory. I wonder how to integrate remote database (SQL or NoSQL) to this project.

Use bcrypt instead of SHA-1

You should store passwords using some modern hash algorithms like bcrypt.

accessing to APIs from back-end instead of making AJAX request

I have a question about schema

I know that I can send AJAX request from front-end like:

var user = {email: '[email protected]', password: '1234'};
AJAX('POST /api/login/', user, function(response) {...});

and I know that this request will responsed by something in back-end like:

F.route('/api/login/', json_exec, ['*Login', 'post', 'unauthorize']);
function json_exec(id) {
        this.id = id;
	this.$workflow('exec', this.callback());
}

note: login is a schema that has email and password fields (like user variable that sends from front-end)

now, my question is how can I do same thing from back-end (instead of sending AJAX request), for example when user type some url like: "http://mysite/{email}/{password}" in browser's url bar the same thing happend (when user sends that AJAX from front-end)
now, I know that I should first write this code:

F.route('/{email}/{password}', me, ['unauthorize']);
function me(email, password){	
        this.$workflow('exec', this.callback()); // I wanna the same thing like func() function and then get the result(in this $workflow I have SUCCESS(true) at the                                                                                         // end  ) then show a new html page based on result
        //an else if lines of code to show new html page based on result of above (this.view('...'))
}

note: and this is login schema:

NEWSCHEMA('Login').make(function(schema) {

	schema.define('email', 'Email', true);
	schema.define('password', 'String(30)', true);

	schema.addWorkflow('exec', function(error, model, options, callback, controller) {
		var user = F.global.users.findItem('email', model.email);
		if (user && user.password == model.password.sha1()) {
			if (user.blocked)
				error.push('error-user-blocked');
			else {
				controller.cookie(F.config.cookie, F.encrypt(user.id + '|' + controller.ip + '|' + F.datetime.getTime()), '1 month');
				NOSQL('users').counter.hit('all').hit(user.id);
			}
		} else
			error.push('error-user-credentials');
		callback(SUCCESS(true));
	});
)}

thank you

How add registration form?

Hello, i need to add registration form for making accounts, how i can make it?

https://messanger.mydomain.com fails to load through ssl connection

i have setup the messenger in SuperAdmin to work with ssl. unfortunately the login page does not load as it does in http correctly . do I miss some configuration at this point it seems that the framework is not loaded correctly through ssl.

Custom PFPs dont save

When I set up a new PFP it doesn't save into a database and it shows as a broken image icon. Please help!

I deployed the application into a web server, so all the data should be on that server, and not the computer.

Desktop version?

Hi there!

Wondering if Messenger is strictly a web-app, or if there's an option to build it into a desktop application like Slack is

[Security] Stored XSS in user fields

Tested version: latest

Steps to reproduce the vulnerability:

• Login in the application.
• Click on Direct messages.
• Click on Add a new user.
• Fill all the possible fields with payload "<script>alert(document.domain)</script> and save.
• XSS will fire whenever user info is reflected in page.