Securing repo

[nilslice]

Hi @tonyalaribe -

I found this repo searching for ponzu's in the wild and wanted to let you know that the system.db (and other db files for that matter) should not be checked in to version control. the client_secret field is visible if you know where to look and would enable your cms to be compromised (if its the same in production).

Let me know if you need me to clarify or expand on anything above.

Thanks, Steve

[tonyalaribe]

Hello @nilslice,

Thanks for the tip. This repo was one of my first attempts at ponzu. Are you still looking for ponzus in the wild? I ended up rebuilding the site this repo is for, with the frontend plugin for serving the UI.
(https://github.com/tonyalaribe/calabar2018). https://calabar2018.com/

[nilslice]

That's awesome - thanks for pointing it out! It looks like you have Procfile and buildpack in the repo. Are you hosting this on Heroku?

[nilslice]

Also, you might find the Ponzu HTTP Go client useful if you end up using Ponzu for another Go project. https://github.com/ponzu-cms/go-client

Specifically for interacting with a Ponzu CMS from a Go front-end, like you do here: https://github.com/tonyalaribe/calabar2018/blob/master/content/home.go#L107

Could be roughly replaced with:

frontend.Router.HandleFunc("/register_individual", RecoverWrap(func(w http.ResponseWriter, r *http.Request) {
        cfg := client.Config{
            Host:         "http://localhost:8080",
            DisableCache: false, // defaults to false
        }

        // create a Ponzu client based on config
        cms := client.New(cfg)

        // handles all the multipart POST setup and makes request
    resp, err := cms.Create("RegisteredIndividuals", req.PostForm)
        // ... use the response & err 
}))

[tonyalaribe]

Thanks Steve,

I didnt know about go-client. I'm hosting on via dokku, which offers a self hosted environment similar to heroku. I dont have much experience with dockerfiles files, so I prefer to just deploy a prebuilt binary, and have dokku execute the binary.