Merged with 4.7.1

.gitignore

@@ -1,2 +1 @@
-ugly.bat
-wishlist.txt
+Frontend/telemetry/idObfuscation_salt.php

Frontend/example-telemetry-resultSharing.html

@@ -136,8 +136,8 @@ function startStop(){
 				if(status==4){
 					//if testId is present, show sharing panel, otherwise do nothing
 					try{
-						var testId=Number(data.testId);
-						if(!isNaN(testId)){
+						var testId=data.testId;
+						if(testId!=null){
 							var shareURL=window.location.href.substring(0,window.location.href.lastIndexOf("/"))+"/results/?id="+testId;
 							I("resultsImg").src=shareURL;
 							I("resultsURL").value=shareURL;

Frontend/results/index.php

@@ -52,6 +52,8 @@ $WATERMARK_TEXT="HTML5 Speedtest";
 
 $id=$_GET["id"];
 include_once('../telemetry/telemetry_settings.php');
+require '../telemetry/idObfuscation.php';
+if($enable_id_obfuscation) $id=deobfuscateId($id);
 $conn=null; $q=null;
 $ispinfo=null; $dl=null; $ul=null; $ping=null; $jit=null;
 if($db_type=="mysql"){

Frontend/speedtest_worker.js

@@ -1,5 +1,5 @@
 /*
-	HTML5 Speedtest v4.7 MPOT
+	HTML5 Speedtest v4.7.1 MPOT
 	by Federico Dossena
 	https://github.com/adolfintel/speedtest/
 	GNU LGPLv3 License
@@ -15,7 +15,7 @@ var clientIp = ""; // client's IP address as reported by getIP.php
 var dlProgress = 0; //progress of download test 0-1
 var ulProgress = 0; //progress of upload test 0-1
 var pingProgress = 0; //progress of ping+jitter test 0-1
-var testId = "noID"; //test ID (sent back by telemetry if used, the string 'noID' otherwise)
+var testId = null; //test ID (sent back by telemetry if used, null otherwise)
 
 var log = ""; //telemetry log
 function tlog(s) {
@@ -178,7 +178,7 @@ this.addEventListener("message", function(e) {
 				if (settings.telemetry_level > 0)
 					sendTelemetry(function(id) {
 						testStatus = 4;
-						if (id != -1) testId = id;
+						if (id != null) testId = id;
 					});
 				else testStatus = 4;
 				return;
@@ -465,21 +465,11 @@ function ulTest(done) {
 					}
 					if (ie11workaround) {
 						// IE11 workarond: xhr.upload does not work properly, therefore we send a bunch of small 256k requests and use the onload event as progress. This is not precise, especially on fast connections
-						xhr[i].onload = function() {
+						xhr[i].onload = xhr[i].onerror = function() {
 							tverb("ul stream progress event (ie11wa)");
 							totLoaded += reqsmall.size;
 							testStream(i, 0);
 						};
-						xhr[i].onerror = function() {
-							// error, abort
-							tverb("ul stream failed (ie11wa)");
-							if (settings.xhr_ignoreErrors === 0) failed = true; //abort
-							try {
-								xhr[i].abort();
-							} catch (e) {}
-							delete xhr[i];
-							if (settings.xhr_ignoreErrors === 1) testStream(i, 0); //restart stream
-						};
 						xhr[i].open("POST", settings.url_ul + url_sep(settings.url_ul) + "r=" + Math.random(), true); // random string to prevent caching
 						xhr[i].setRequestHeader("Content-Encoding", "identity"); // disable compression (some browsers may refuse it, but data is incompressible anyway)
 						xhr[i].send(reqsmall);
@@ -679,20 +669,19 @@ function sendTelemetry(done) {
 			var parts = xhr.responseText.split(" ");
 			if (parts[0] == "id") {
 				try {
-					var id = Number(parts[1]);
-					if (!isNaN(id)) done(id);
-					else done(-1);
+					var id = parts[1];
+					done(id);
 				} catch (e) {
-					done(-1);
+					done(null);
 				}
-			} else done(-1);
+			} else done(null);
 		} catch (e) {
-			done(-1);
+			done(null);
 		}
 	};
 	xhr.onerror = function() {
 		console.log("TELEMETRY ERROR " + xhr.status);
-		done(-1);
+		done(null);
 	};
 	xhr.open("POST", settings.url_telemetry + url_sep(settings.url_telemetry) + "r=" + Math.random(), true);
 	var telemetryIspInfo = {

Frontend/telemetry/idObfuscation.php

@@ -0,0 +1,38 @@
+<?php
+function getObfuscationSalt(){
+	$saltFile=dirname(__FILE__)."/idObfuscation_salt.php";
+	if(file_exists($saltFile)){
+		require $saltFile;
+	}else{
+		$bytes=openssl_random_pseudo_bytes(4);
+		$sf=fopen($saltFile,"w");
+		fwrite($sf,chr(60)."?php\n");
+		fwrite($sf,'$OBFUSCATION_SALT=0x'.bin2hex($bytes).";\n");
+		fwrite($sf,"?".chr(62));
+		fclose($sf);
+		require $saltFile;
+	}
+	return isset($OBFUSCATION_SALT)?$OBFUSCATION_SALT:0;
+}
+/*
+This is a simple reversible hash function I made for encoding and decoding test IDs.
+It is not cryptographically secure, don't use it to hash passwords or something!
+*/
+function obfdeobf($id){
+	$salt=getObfuscationSalt()&0xFFFFFFFF;
+	$id=$id&0xFFFFFFFF;
+	for($i=0;$i<16;$i++){
+		$id=$id^$salt;
+		$id=(($id>>1)&0xFFFFFFFF)|(($id&0x00000001)<<31);
+		$salt=(($salt<<1)&0xFFFFFFFF)|(($salt&0xA0000000)>>31);
+	}
+	return $id;
+}
+function obfuscateId($id){
+	return base_convert(obfdeobf($id),10,36);
+}
+function deobfuscateId($id){
+	return obfdeobf(base_convert($id,36,10));
+}
+//IMPORTANT: DO NOT ADD ANYTHING BELOW THE PHP CLOSING TAG, NOT EVEN EMPTY LINES!
+?>

Frontend/telemetry/stats.php

@@ -2,6 +2,9 @@
 session_start();
 error_reporting(0);
 header('Content-Type: text/html; charset=utf-8');
+header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
+header("Cache-Control: post-check=0, pre-check=0", false);
+header("Pragma: no-cache");
 ?>
 <!DOCTYPE html>
 <html>
@@ -54,6 +57,7 @@ header('Content-Type: text/html; charset=utf-8');
 <h1>HTML5 Speedtest - Stats</h1>
 <?php
 include_once("telemetry_settings.php");
+require "idObfuscation.php";
 if($stats_password=="PASSWORD"){
 	?>
 		Please set $stats_password in telemetry_settings.php to enable access.
@@ -61,7 +65,7 @@ if($stats_password=="PASSWORD"){
 }else if($_SESSION["logged"]===true){
 	if($_GET["op"]=="logout"){
 		$_SESSION["logged"]=false;
-		?><script type="text/javascript">window.location.search=""</script><?php
+		?><script type="text/javascript">window.location=location.protocol+"//"+location.host+location.pathname;</script><?php
 	}else{
 		$conn=null;
 		if($db_type=="mysql"){
@@ -76,20 +80,22 @@ if($stats_password=="PASSWORD"){
 			$conn = new PDO("pgsql:$conn_host;$conn_db;$conn_user;$conn_password");
 		}else die();
 ?>
-	<form action="stats.php?op=logout" method="POST"><input type="submit" value="Logout" /></form>
-	<form action="stats.php?op=id" method="POST">
+	<form action="stats.php" method="GET"><input type="hidden" name="op" value="logout" /><input type="submit" value="Logout" /></form>
+	<form action="stats.php" method="GET">
 		<h3>Search test results</h6>
+		<input type="hidden" name="op" value="id" />
 		<input type="text" name="id" id="id" placeholder="Test ID" value=""/>
 		<input type="submit" value="Find" />
 		<input type="submit" onclick="document.getElementById('id').value=''" value="Show last 100 tests" />
 	</form>
 	<?php
 		$q=null;
-		if($_GET["op"]=="id"&&!empty($_POST["id"])){
-			$id=$_POST["id"];
+		if($_GET["op"]=="id"&&!empty($_GET["id"])){
+			$id=$_GET["id"];
+			if($enable_id_obfuscation) $id=deobfuscateId($id);
 			if($db_type=="mysql"){
 				$q=$conn->prepare("select id,timestamp,ip,ispinfo,ua,lang,dl,ul,ping,jitter,log,extra from speedtest_users where id=?");
-				$q->bind_param("i",$_POST["id"]);
+				$q->bind_param("i",$id);
 				$q->execute();
 				$q->store_result();
 				$q->bind_result($id,$timestamp,$ip,$ispinfo,$ua,$lang,$dl,$ul,$ping,$jitter,$log,$extra);
@@ -129,7 +135,7 @@ if($stats_password=="PASSWORD"){
 			}else die();
 	?>
 		<table>
-			<tr><th>Test ID</th><td><?=htmlspecialchars($id, ENT_HTML5, 'UTF-8') ?></td></tr>
+			<tr><th>Test ID</th><td><?=htmlspecialchars(($enable_id_obfuscation?obfuscateId($id):$id), ENT_HTML5, 'UTF-8') ?></td></tr>
 			<tr><th>Date and time</th><td><?=htmlspecialchars($timestamp, ENT_HTML5, 'UTF-8') ?></td></tr>
 			<tr><th>IP and ISP Info</th><td><?=$ip ?><br/><?=htmlspecialchars($ispinfo, ENT_HTML5, 'UTF-8') ?></td></tr>
 			<tr><th>User agent and locale</th><td><?=$ua ?><br/><?=htmlspecialchars($lang, ENT_HTML5, 'UTF-8') ?></td></tr>
@@ -148,7 +154,7 @@ if($stats_password=="PASSWORD"){
 }else{
 	if($_GET["op"]=="login"&&$_POST["password"]===$stats_password){
 		$_SESSION["logged"]=true;
-		?><script type="text/javascript">window.location.search=""</script><?php
+		?><script type="text/javascript">window.location=location.protocol+"//"+location.host+location.pathname;</script><?php
 	}else{
 ?>
 	<form action="stats.php?op=login" method="POST">

Frontend/telemetry/telemetry.php

@@ -1,5 +1,6 @@
 <?php
 include_once('telemetry_settings.php');
+require 'idObfuscation.php';
 
 $ip=($_SERVER['REMOTE_ADDR']);
 $ispinfo=($_POST["ispinfo"]);
@@ -18,7 +19,8 @@ if($db_type=="mysql"){
     $stmt->bind_param("ssssssssss",$ip,$ispinfo,$extra,$ua,$lang,$dl,$ul,$ping,$jitter,$log) or die("3");
 	$stmt->execute() or die("4");
     $stmt->close() or die("5");
-	echo "id ".$conn->insert_id;
+	$id=$conn->insert_id;
+	echo "id ".($enable_id_obfuscation?obfuscateId($id):$id);
     $conn->close() or die("6");
 
 }elseif($db_type=="sqlite"){
@@ -41,7 +43,8 @@ if($db_type=="mysql"){
     ");
     $stmt = $conn->prepare("INSERT INTO speedtest_users (ip,ispinfo,extra,ua,lang,dl,ul,ping,jitter,log) VALUES (?,?,?,?,?,?,?,?,?,?)") or die("2");
     $stmt->execute(array($ip,$ispinfo,$extra,$ua,$lang,$dl,$ul,$ping,$jitter,$log)) or die("3");
-	echo "id ".$conn->lastInsertId();
+	$id=$conn->lastInsertId();
+	echo "id ".($enable_id_obfuscation?obfuscateId($id):$id);
     $conn = null;
 }elseif($db_type=="postgresql"){
     // Prepare connection parameters for db connection
@@ -53,7 +56,8 @@ if($db_type=="mysql"){
     $conn = new PDO("pgsql:$conn_host;$conn_db;$conn_user;$conn_password") or die("1");
     $stmt = $conn->prepare("INSERT INTO speedtest_users (ip,ispinfo,extra,ua,lang,dl,ul,ping,jitter,log) VALUES (?,?,?,?,?,?,?,?,?,?)") or die("2");
     $stmt->execute(array($ip,$ispinfo,$extra,$ua,$lang,$dl,$ul,$ping,$jitter,$log)) or die("3");
-	echo "id ".$conn->lastInsertId();
+	$id=$conn->lastInsertId();
+	echo "id ".($enable_id_obfuscation?obfuscateId($id):$id);
     $conn = null;
 }
 else die("-1");

Frontend/telemetry/telemetry_settings.php

@@ -2,6 +2,7 @@
 
 $db_type="mysql"; //Type of db: "mysql", "sqlite" or "postgresql"
 $stats_password="PASSWORD"; //password to login to stats.php. Change this!!!
+$enable_id_obfuscation=false; //if set to true, test IDs will be obfuscated to prevent users from guessing URLs of other tests
 
 // Sqlite3 settings
 $Sqlite_db_file = "../../telemetry.sql";

doc.md

@@ -1,7 +1,7 @@
 # HTML5 Speedtest - Multiple Points of Test
 
 > by Federico Dossena  
-> Version 4.7 MPOT
+> Version 4.7.1 MPOT
 > [https://github.com/adolfintel/speedtest/tree/mpot](https://github.com/adolfintel/speedtest/tree/mpot)
 
 ## Introduction