Example admin panel for updating a cinema app's Firebase Realtime Database. The screen is branded Cineworld23 and Saray. Auth0 is meant to guard the page. Writes go through Kreait's PHP Firebase SDK.
Published March 2019, last touched January 2020.
Setup, as originally described:
- Create an Auth0 application and put that quickstart (including
.env) under the login folder. The code expectsadminlogin/, notadminpanel/. - In
sender/, runcomposer installforkreait/firebase-php^4.18. - Fill
google-firebase.json(the readme used to saygoogle-services.json) with your own service account.db.jsonis only a sample of thecwsaloon,cwsoon,srsaloon, andsrsoonshape.
Do not deploy this tree as-is.
Reviewed again on this date. These points describe the code as it stands; they are not part of the original readme.
- Historical example. It is not being rewritten for current PHP, Auth0, or Kreait.
- No private key, client secret, or
.envis in the tree or the git history.google-firebase.jsonis an empty service-account template:project_id,private_key_id,client_email, andclient_idare blank, and there is noprivate_keyfield. Auth0 values are read withgetenv. - The repo cannot run from a clone.
adminlogin/login.php,logout.php,dotenv-loader.php, and bothvendor/directories are absent.sendMovie.phpcallswithDatabaseUri()with the URL commented out, so that file is not valid PHP. - The write gate in
sendMovie.phpisbase64_decode($myTurn) == ''. An empty name enters the Firebase block. A real signed-in name does not. The comment next to it says to put the allowed username there; it was left as an empty string. db.jsonis sample cinema listings (titles, genres, showtimes, trailer ids). It is not a credential file.- Bootstrap 4.1.3 and jQuery 1.12.4 are committed in the repo. Dependabot has two open medium XSS alerts on that jQuery. A session value from
sentDivIDis also written into a<script>tag inindex.phpwithout escaping. - There are no GitHub issues on this repository.