Calorific: Dead simple self-hosted calorie tracker reddit / selfhosted ---------------------------------------------------------------------- GlumWoodpecker · 2023-11-29 12:41 Threw together this in a few hours as all the mobile apps on offer are either bloated to heck and back, filled with ads and subscriptions, or both. The focus here is *simplicity*. Just add your calorie count and you're done. Aimed at people who just want an easy way to track calories but don't want to spend time on micro-managing all nutrition. Hope someone finds this useful :) ---------------------------------------------------------------------- HonestPrivacy · 2023-11-30 03:59 Seems useful, but I would be very careful exposing it as I don't see the use of prepared statements: [https://github.com/xdpirate/calorifi c/blob/main/php/addsavedingredient.php#L1](https://github.com/xdpirate /calorific/blob/main/php/addsavedingredient.php#L12) This leaves it open to sql injection: [https://stackoverflow.com/questions/32391315/is-mysqli-real-escape- string-enough-to-avoid-sql-injection-or-other-sql- attack](https://stackoverflow.com/questions/32391315/is-mysqli-real- escape-string-enough-to-avoid-sql-injection-or-other-sql-attack) For better deployment, I would recommend building the image with the files for the application rather than a mount on the os, passing through only configuration files as needed. This is just informational, I think it is great you made something that is useful! (A lot of people don't get that far) ---------------------------------------------------------------------- JayL1F3 · 2023-11-30 05:08 Love this so far. Totally agree about the fact that most calorie trackers nowadays are absolutely terrible. ---------------------------------------------------------------------- Gold-Supermarket-342 · 2023-11-30 05:40 TIL people who don't use prepared statements still exist in 2023. ---------------------------------------------------------------------- GlumWoodpecker · 2023-11-30 08:25 Thanks for the feedback. I'm a hobbyist programmer and haven't really used PHP in a good number of years before this and and a [similar project](https://github.com/xdpirate/gamehorizon), so mistakes slip through. I wasn't aware of prepared statements and will be looking into this for sure. I do however note this in the readme, it is not meant for public exposure and should be hidden behind a reverse proxy or server login. Thanks a lot for the input :) ---------------------------------------------------------------------- GlumWoodpecker · 2023-11-30 08:27 Thank you! ---------------------------------------------------------------------- mirisbowring · 2023-11-30 13:22 Probably you should throw a SAST scanner onto the thing in your pipelines or your IDE like semgrep, trivy or sth. else. They point you such possible security flaws ---------------------------------------------------------------------- GlumWoodpecker · 2023-11-30 15:17 Thanks for the tip, will be looking into this as well! ---------------------------------------------------------------------- mirisbowring · 2023-11-30 15:18 As soon as possible please :) Security must be part of the design and not a measure ---------------------------------------------------------------------- HonestPrivacy · 2023-12-05 21:41 We're all here to learn, and even if it isn't publicly exposed there are still many ways that can be used to attack someone if it is known they run it (as part of a targeted or multi-level attack). The read me seems to indicate more that there isn't authentication rather than possible security vulnerabilities being present. For example, if the database user/password someone uses is shared with another software, then one could cause damage to that data (shared hosting this used common, not sure anymore but likely still is) or gain access to data that otherwise wouldn't be possible to reach. There is a lot of information out there regarding the topic so I won't go too deep but definitely something to be aware of