Merge Feature/utility library (asu cidse 2025 fall) into main

[Daniel-Lopez246]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces the Cybercafe system, a captive portal and hotspot management solution comprising a backend daemon, infrastructure setup scripts, and a PHP-based web interface. The code review identifies several critical security vulnerabilities, specifically SQL injection risks across multiple PHP files where user input is directly concatenated into queries. Additionally, the feedback provides actionable improvements for the shell scripts, such as handling null results from database queries to prevent arithmetic errors, avoiding redundant trap registrations in loops, and replacing hardcoded interface names with environment variables for better configurability.

[gemini-code-assist]

The username is directly concatenated into the SQL query, making the application vulnerable to SQL injection. Use prepared statements to safely handle user input.

	$stmt = $db->prepare("SELECT 1 FROM users WHERE username=:username");
	$stmt->bindValue(':username', $username, SQLITE3_TEXT);
	$response = $stmt->execute();

[gemini-code-assist]

Directly embedding the $username variable into the SQL query is a security risk (SQL injection). Always use prepared statements for queries involving user-provided data.

	$stmt = $db->prepare("SELECT * FROM users WHERE username=:username");
	$stmt->bindValue(':username', $username, SQLITE3_TEXT);
	$response = $stmt->execute();

[gemini-code-assist]

The session ID from cookies is used directly in a database query without sanitization, leading to a potential SQL injection vulnerability.

		$stmt = $db->prepare("SELECT user_id FROM internet_sessions WHERE session_id=:session_id");
		$stmt->bindValue(':session_id', $cookies['session_id'], SQLITE3_TEXT);
		$response = $stmt->execute();

[gemini-code-assist]

This arithmetic expansion will fail if the internet_sessions table is empty, as MAX(table_index) will return an empty string (NULL). Additionally, the redirection > /dev/null is applied to the variable assignment itself, which is unconventional. Consider using IFNULL in the SQL query and splitting the assignment from the arithmetic.

Suggested change

	INDEX_LIMIT=$(($(sqlite3 "${DATABASE_PATH}" "SELECT MAX(table_index) FROM internet_sessions;")+1)) > /dev/null 2>> error.log #the maximum number of internet session entries
	INDEX_LIMIT=$(sqlite3 "${DATABASE_PATH}" "SELECT IFNULL(MAX(table_index), 0) FROM internet_sessions;") 2>> error.log #the maximum number of internet session entries
	INDEX_LIMIT=$(( INDEX_LIMIT + 1 ))

[gemini-code-assist]

Using arithmetic expansion $(()) directly on the output of a command pipeline is risky. If grep finds no matches, the resulting expression $(()) evaluates to 0 in Bash, but if it returns multiple values or unexpected characters, it will cause a syntax error. It's safer to capture the output into a variable first and provide a default value.

Suggested change

	SESSION_TX=$(($(iptables -t mangle -L iptmon_tx -vxn | grep "${USER_IP}" | awk '{print $2}')))
	SESSION_RX=$(($(iptables -t mangle -L iptmon_rx -vxn | grep "${USER_IP}" | awk '{print $2}')))
	SESSION_TX=$(iptables -t mangle -L iptmon_tx -vxn | grep "${USER_IP}" | awk '{print $2}')
	SESSION_TX=${SESSION_TX:-0}
	SESSION_RX=$(iptables -t mangle -L iptmon_rx -vxn | grep "${USER_IP}" | awk '{print $2}')
	SESSION_RX=${SESSION_RX:-0}

[gemini-code-assist]

The trap command is placed inside the while loop, which causes it to be re-registered on every iteration. It is more efficient to define the trap once before entering the loop.

[gemini-code-assist]

The interface name wlan0 is hardcoded here, but the script elsewhere uses the variable ${HS_INTERFACE}. This could lead to incorrect status checks if the hotspot is configured on a different interface.

Suggested change

	ip add show dev wlan0 | grep 192\.168\.43\. > /dev/null 2>> error.log # Does it appear the hotspot is active?
	ip add show dev "${HS_INTERFACE}" | grep 192\.168\.43\. > /dev/null 2>> error.log # Does it appear the hotspot is active?

[gemini-code-assist]

Parsing user input using a for loop over an unquoted variable is fragile as it relies on word splitting and does not handle quoted arguments correctly. Using read -a is a more robust way to populate an array from a string.

Suggested change

	args=()
	for i in $user_input; do
	args+=("$i")
	done
	read -r -a args <<< "$user_input"