Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/bpatrik/pigallery2
Homepage: http://bpatrik.github.io/pigallery2/
This is a fast (like faster than your PC fast) directory-first photo gallery website, optimised for running on low resource servers (especially on raspberry pi).
✔️ Strengths:
⛔ Weakness:
Live Demo @ render: https://pigallery2.onrender.com/
Docker with docker-compose is the official and recommend way of installing and running Pigallery2. It contains all necessary dependencies, auto restarts on reboot, supports https, easy to upgrade to newer versions. For configuration and docker-compose files read more here or check all builds here.
As an alternative, you can also directly install Node.js and the app and run it natively.
Download and extract
curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -
sudo apt-get install -y nodejs
Full node install on raspberry pi description: https://www.w3schools.com/nodejs/nodejs_raspberrypi.asp
cd ~
wget https://github.com/bpatrik/pigallery2/releases/download/1.9.0/pigallery2-release.zip
unzip pigallery2-release.zip -d pigallery2
cd pigallery2
npm install
Note: A build requires a machine with around 2GB or memory.
cd ~
wget https://github.com/bpatrik/pigallery2/archive/master.zip
unzip master.zip
cd pigallery2-master # enter the unzipped directory
npm install
npm run build
Note: It is recommended to create a release version with npm run create-release
on a more powerful machine and deploy that to you server.
Note: you can use npm run create-release -- --languages=fr,ro
to restrict building to the listed languages (English is added by default)
npm start
To configure it, run PiGallery2
first to create config.json
file, then edit it and restart.
The app has a nice UI for settings, you may use that too.
Default user: admin
pass: admin
. (It is not possible to change the admin password, you need to create another user and delete the default admin
user, see #220)
Note: First run, you might have file access issues and port 80 issue, see #115.
Running npm start -- --Server-port=8080
will start the app on port 8080 that does not require root
Adding read/write permissions to all files can solve the file access issue chmod -R o-w .
, see #98.
You can run the app up as a service to run it on startup. Read more at #42
You can set up the app any of the following ways:
config.json
node start -- --Server-port=3000 --Client-authenticationRequired=false
config.json
for the config hierarchyServer-port
to 3000
Full list of configuration options are available at the MANPAGE.md.
It is recommended to use a reverse proxy like nginx before node https://stackoverflow.com/questions/5009324/node-js-nginx-what-now
With cerbot & nginx it is simple to set up secure connection. You have no excuse not doing so. https://certbot.eff.org/
If you get error during module installation, make sure you have everything to build node modules from source
apt-get install build-essential libkrb5-dev gcc g++
src/frontend/translate/messages.en.xls
to src/frontend/translate/messages.fr.xls
angular.json
projects->pigallery2->i18n->locales
section<target>
tagsnpm install
npm run build
npm start
Note: you can also build your own release with as described in 1.1.1-b Install from source;
See: http://bpatrik.github.io/pigallery2/
Unfortunately, I only have a limited time for this hobby project of mine. And I mostly focus on those features that are align with my needs. Sorry :(. Although, I try to fix bugs ASAP (that can still take from a few days to months). The recommended way of extending the projects is to implement the feature as an extension. See #743. If the extension framweork is not powerfull enough, so you can't implement your feature, you are welcome to open a FR bug and I will consider adding that. If you really want to contribute and think that your feature has a place in the mainapp, look at CONTRIBUTING.md for some guidance.
AllowEncodedSlashes On
in the configuration of the proxyI'm making this app for my own entertainment, but I like to share it with others as the contributions and bug reports make the app better and it also does not cost anything to me :)
There is no way to donate to this project at the moment. And I'm also not planning on monetizing it. But it warms my hearth seeing that it is useful for some people.
Crossbrowser testing sponsored by Browser Stack
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.