updates to docs

notes.md

@@ -7,8 +7,9 @@
 - Load all orders of customer from db when selecting tickets and save to memory to check if ticket count has been exceeded or not.
 
 
-- Create function that updates currency for every event when updating currency globally.
+- Create function that updates currency for every event when updating currency.
 
+- Update files to import when deploying for included json files instead of secret.json files
 
 - Fix text field overflow (text too big for box)
 - Other optimization for seat plan editor

src/server/backend/db/mysqldb.js

@@ -61,7 +61,7 @@ class SQLDB {
     async setupDB ( ) {
         this.sqlConnection.query( 'SELECT @@default_storage_engine;', ( error, results ) => {
             if ( error ) throw error;
-            if ( results[ 0 ][ '@@default_storage_engine' ] !== 'InnoDB' ) return 'DB HAS TO USE InnoDB!';
+            if ( results[ 0 ][ '@@default_storage_engine' ] !== 'InnoDB' ) throw 'DB HAS TO USE InnoDB!';
         } );
         this.sqlConnection.query( 'CREATE TABLE libreevent_users ( account_id INT ( 10 ) NOT NULL AUTO_INCREMENT, email TINYTEXT NOT NULL, pass TEXT, name TEXT, first_name TEXT, two_fa TINYTEXT, user_data VARCHAR( 60000 ), mail_confirmed TINYTEXT, marketing TINYTEXT, PRIMARY KEY ( account_id ) ) ENGINE=INNODB;', ( error ) => {
             if ( error ) if ( error.code !== 'ER_TABLE_EXISTS_ERROR' ) throw error;

website/src/setup/installation.md

@@ -43,7 +43,7 @@ In JSON, data is stored in so-called Key-Value-Pairs. Look for "db" in there and
 ## Setting up a MySQL database
 At this point, we assume that you have already purchased webhosting and you are logged in to the administration panel of your webhosting provider. This guide will use the Web Control Panel called "Direct Admin", as it is fairly common, along with cPanel. Somewhere, there should be a button that says something like "MySQL Management". Click it, which will bring you to the MySQL-Database management page. Now, create a new database by clicking the "Create new database" (or similar) button which will bring up the database creation tool. Give the database any name you like and give the user any name you like. When creating a password, it is important that this password is long and complicated. What we recommend doing is using a password generator or to essentially "sit" onto your keyboard to get a random string of characters as the password. 
 
-TODO: Make setup better (including db setup)
+TODO: Make setup better (including db setup), add notes on setup key
 Now copy this password and open the download location of libreevent. Inside of the libreevent folder and open the "config" folder and open the file called "db.config.json" using a text editor (on Windows you could use Notepad, on MacOS TextEdit and on Linux, I personally like to use Nano or Vim, which are cli only or for graphical ones, use for example gedit). Now, paste the password between the empty quotes after "password". For the host value type your domain, for the "database" parameter, type the name of the database you just created (including any prefixes shown there) and for the database user, type the username you just created (again, including any prefixes shown in the admin panel). 
 
 Now hit "Create Database" to actually create the database.
@@ -52,7 +52,14 @@ And just like that, you have finished setting up your database.
 
 
 # Uploading libreevent
-It is now time to upload libreevent to your webhosting account. The recommended way of doing this is to download a FTP client like "FileZilla" and to connect to the hosting account in that way using the credentials provided by the hosting provider. In this guide we assume you use this way. Download and install FileZilla. It is a free and open source FTP client. Open it and you will see a few empty fields towards the top of the app. There you will need to fill in the information given by your hosting provider. Usually, the Host is ftp.yourDomain.com, the username and password are usually your admin account credentials and the port is usually 25552 or can be left empty. Then hit quick connect. At this point, a SSL warning might appear, as the certificate might not (yet) be configured correctly to also include FTP. Accept the certificate and you should be connected. Now create a new folder called "libreevent" by right clicking onto the empty space on the right pane (where it says "remote site") and selecting "create directory". Then on the left side (where it says "local side" navigate to the extracted libreevent folder and upload its contents by selecting it and right clicking to hitting "Upload"). Once that process is completed, you should be set to go to the next session.
+It is now time to upload libreevent to your webhosting account. The recommended way of doing this is to download a FTP client like "FileZilla" and to connect to the hosting account in that way using the credentials provided by the hosting provider. In this guide we assume you use this way. 
+
+Download and install FileZilla. It is a free and open source FTP client. Open it and you will see a few empty fields towards the top of the app. There you will need to fill in the information given by your hosting provider. Usually, the Host is ftp.yourDomain.com, the username and password are usually your admin account credentials and the port is usually 25552 or can be left empty. Then hit quick connect. At this point, a SSL warning might appear, as the certificate might not (yet) be configured correctly to also include FTP. Accept the certificate and you should be connected. 
+
+Now create a new folder called "libreevent" by right clicking onto the empty space on the right pane (where it says "remote site") and selecting "create directory". Then on the left side (where it says "local side" navigate to the extracted libreevent folder and upload its contents by selecting it and right clicking to hitting "Upload"). Once that process is completed, you should be set to go to the next session.
+
+**IMPORTANT:** Never upload libreevent into any public_html folders ever! This poses a SEVERE security risk and, if a JSON database is used, exposes ALL userdata to the internet! Always upload to a non-publicly accessible folder!
+
 
 ## npm install
 This project relies on a variety of different node.js modules that need to be installed on the server. Most webhosting providers give you an easy way to run *npm install*. If not, you might be required to upload the *node_modules* folder yourself. You can create such a folder either by downloading the *node_modules.zip* folder from the GitHub releases page or by installing npm on your local machine and then by running *npm i* in the terminal. 
@@ -65,4 +72,22 @@ For the Application startup file type "app.js".
 
 In the section "Environment variables" hit "Add Variable" and in the appearing fields type beneath "Name" the following: "PORT" (without the quotes!) and under "Value" "8080" (again without quotes). Then hit done and at the top "create". If you end up on the start page again, hit the little pencil icon to get to the application editor. Scroll down to the "Detected configuration files" section and click "Run NPM Install". Once it shows a success message (at the top!), hit "Restart". 
 
-CONGRATULATIONS! You are all set with the installation of libreevent! Now open a new tab in your webbrowser and type your domain name!
+CONGRATULATIONS! You are all set with the installation of libreevent! Now open a new tab in your webbrowser and type your domain name. If you can connect to your domain and libreevent is accessible, you are all set!
+
+# Troubleshooting
+Here are some tips for the most common problems that might arise from the installation
+
+## Not accessible, but running
+Some with some webhosting companies you need to remove the index.html file from the public_html directory of the domain you are running libreevent on. 
+
+## Can access all libreevent backend files
+You have most likely uploaded libreevent into the public_html file which you should NEVER do, as it poses an insane security risk. Delete it from that folder and put it into a different folder which is not publicly accessible. 
+
+## libreevent doesn't start
+On most webhosting accounts, there's a file created in the directory of libreevent called something like stderr.log. Have a look at that file and compare errors with the ones listed here:
+
+### DB HAS TO USE InnoDB!
+The MySQL database you are using is not supported by libreevent or is incorrectly configured. Please ensure that InnoDB is enabled. If you cannot enable it yourself, please contact the DB hosting provider.
+
+### Any other error
+Please click [here](https://github.com/simplePCBuilding/libreevent/issues/new) to head to GitHub and open a new issue. You will need to have a GitHub Account to open an issue. If you don't have a GitHub account, you may also contact me using my [Bug reporting tool](https://api.janishutz.com/contact/report?origin=libreevent?error=unkown?lang=en).

website/src/setup/security.md

@@ -1 +1,9 @@
 # Security best practices
+
+Whilst libreevent uses modern security features, no Software is perfect when it comes to security. This is why it is important to keep libreevent updated, as potential security issues are addressed with them, as well as potential bugs. Next to that, a incorrectly set up instance of libreevent might pose a security problem, but we try to make the attack surface as small as possible. The most significant security risk that can arise from improperly setting up libreevent is not using HTTPS for the server. 
+
+## Reverse Proxy
+For simplicity reasons, libreevent does not (yet) natively support SSL-Certificates. This is why libreevent should be put behind a reverse proxy to ensure that all users use SSL (Secure Sockets Layer) or TLS (Transport Layer Security) when connecting to it. Most webhosting plans are already behind a reverse proxy, you will just need to force a HTTPS redirect in the settings of the admin panel of the webhosting account. If you are manually deploying libreevent on a server without a reverse proxy, we urge you to use a reverse proxy with e.g. nginx or apache. There are a lot of guides out there on how to set a such up. Please also get yourself a Certificate for your domain and activate it. A common methods for acquiring such Certificates is to use the "Certbot" CLI application on Linux. It works with both apache and nginx and can automatically renew the certificate for you once it expires if set to run on a cronjob.
+
+## HTTPS
+As mentioned previously in the Reverse Proxy section, you should always have HTTPS enabled using a reverse proxy. Since most hosting accounts already have a reverse proxy installed, you just need to set it to automatically redirect HTTP to HTTPS in the webhosting admin panel.