Receive confessions and messages anonymously!

Overview

logo

About

umamin is an open-source platform for sending and receiving anonymous confessions! Each user can create a unique link to which others could send anonymous messages! Start receiving confessions and messages →

Contributing

If you like this project, please consider giving it a star! Want to contribute? Make sure to review our code of conduct.

Contributor List

Contributing Guide

  1. Fork this repository and clone your fork.
  2. Create a new branch for your changes:
$ cd your_cloned_fork
$ git checkout dev
$ git checkout -b my-new-branch
  1. Create a .env in apps/web file with this content:

Adjust the DATABASE_URL to your local MySQL database. Guide →

DATABASE_URL="mysql://johndoe:randompassword@localhost:3306/mydb"
NEXT_PUBLIC_GQL_ENDPOINT="http://localhost:3000/api/graphql"

NEXTAUTH_URL="http://localhost:3000"
NEXTAUTH_SECRET="mysupersecretkey"
  1. Create a .env in packages/db file with this content:
DATABASE_URL="mysql://johndoe:randompassword@localhost:3306/mydb"
  1. (optional) MySQL image with docker:
yarn docker:up # start up a MySQL image
yarn docker:down # stop MySQL image
  1. Sync database schema:
yarn workspace @umamin/db prisma db push

Or run a migration. Guide →

  1. To run locally:
# Only use yarn as your package manager
$ yarn
$ yarn dev
  1. Commit your changes and push your branch:
$ git add .
$ git commit -m "chore: some changes"
$ git push origin HEAD
  1. Submit a pull request on the dev branch. (resolve conflicts if present)

License

Licensed under the GPL-3.0 license.

Comments
  • feat: add swipe delete on messages

    feat: add swipe delete on messages

    This pull request resolve the delete button on messages #51 feature request. But instead of a delete button, I've used a swipe-to-delete method for a cleaner UI.

    Sample screenshot. Screenshot 2022-07-28 161834

    Also, I've updated the UI for when there are no messages in the inbox. Screenshot 2022-07-28 151620

    All test has passed. Screenshot 2022-07-28 162257

    feature 
    opened by isaacdarcilla 12
  • I can read anyone's private Umamin inbox with a little tinkering to the original GraphQL request

    I can read anyone's private Umamin inbox with a little tinkering to the original GraphQL request

    Describe the bug This vulnerability/bug is also known as Insecure Direct Object References (IDOR) Bug. This bug allows unauthorized users to view anyone's Private Messages by obtaining the target user's receiverId/userId

    To Reproduce Steps to reproduce the behavior:

    1. the endoint /api/graphql is the one vulnerable to this attack
    2. My POST request data is as follows:
    {"query":"mutation sendMessage($input: SendMessageInput!) {\n  sendMessage(input: $input) {\n     id\n    receiverId\n    content\n  }\n}\n","variables":{"input":{"receiverUsername":"TARGET_USERNAME","content":"CONTENT_HERE","receiverMsg":"Send me an anonymous message!"}},"operationName":"sendMessage"}
    
    1. (Explanation to the request above) I just added receiverId variable to the original graphQL request.
    2. The endpoint will unexpectedly respond with the private receiverId value like below:
    {"data":{"sendMessage":{"id":"yyyyy-yyy-yyyy-yyyy-yyyyyy","receiverId":"xxxxxx-xxx-xxxx-xxxx-xxxxxx","content":"CONTENT_HERE"}}}
    
    1. Now , send another POST request to the same endpoint /api/graphql
    {"query":"query getMessages($userId: ID!) {\n  messages(userId: $userId) {\n    id\n    content\n    isOpened\n    receiverMsg\n  }\n}\n","variables":{"userId":"THE_RECEIVERID_YOU_OBTAINED_EARLIER"},"operationName":"getMessages"}
    
    1. The endpoint will respond with the private messages corresponding to the userId you obtained
    {"data":{"messages":[{"id":"yyyyy-yyy-yyyy-yyyy-yyyyyy","content":"vvvvvvvvvv","isOpened":false,"receiverMsg":"Send me an anonymous message!"},{"id":"yyyyy-yyy-yyyy-yyyy-yyyyyy","content":"vvvvvvvvvv","isOpened":true,"receiverMsg":"Send me an anonymous message!"}]}}
    
    

    Expected behavior This endpoint should return an error and not allow anyone to just grab other's private userId AND/OR the endpoint should not allow the use of any valid userId to non-authorized users

    bug 
    opened by jmrcsnchz 4
  • where to host database?

    where to host database?

    Currently using railway.app in production for a PostgreSQL database.

    railway (left) vs planetscale (right)


    Railway will be nerfing free tier Read more

    Platnetscale has 1 billion row reads a month + 10 million row writes a month for free. Should we move to a Vitess/MySQL database w/ planetscale @princejoogie ?

    PS: umamin will be free and ad-free so I want to use free tiers.

    question 
    opened by joshxfi 3
  • Bug report

    Bug report

    Describe the bug i cant read anonymous message. It’s disappearing when Im trying to open it.

    To Reproduce Steps to reproduce the behavior:

    1. Go to '...'
    2. Click on '....'
    3. Scroll down to '....'
    4. See error

    Expected behavior I expected it will be fixed as soon as possible. I reported it earlier but its not working.

    Screenshots 16F5E5E1-FB2D-4FF3-9AD3-6BCAFD907E7E AFE07608-5D60-41FC-9D06-2679C8C95DAC

    Desktop (please complete the following information):

    • OS: [e.g. iOS]
    • Browser [e.g. chrome, safari]
    • Version [e.g. 22]

    Smartphone (please complete the following information):

    • Device: [e.g. iPhone 11 pro max]
    • OS: [e.g. iOS15.6]
    • Browser [e.g. safari]
    • Version [e.g. 15.6]

    Additional context Its keeping disappearing

    bug 
    opened by Kinyaomiii 2
  • Messages problem

    Messages problem

    Describe the bug I cannot see what anonymous messages me.

    To Reproduce Steps to reproduce the behavior:

    1. Go to '...'
    2. Click on '....'
    3. Scroll down to '....'
    4. See error

    Expected behavior Nothing much

    Screenshots 7D527EE3-5CC3-4C5F-8C33-AC0DA54C8D0E

    Desktop (please complete the following information):

    • OS: [e.g. iOS]
    • Browser [e.g. chrome, safari]
    • Version [e.g. 22]

    Smartphone (please complete the following information):

    • Device: [e.g. iPhone6]
    • OS: [e.g. iOS8.1]
    • Browser [e.g. stock browser, safari]
    • Version [e.g. 22]

    Additional context Add any other context about the problem here.

    bug duplicate 
    opened by Kinyaomiii 2
  • umamin bug

    umamin bug

    Describe the bug it shows that i have 3 umamin messages but i can't view any of them. all of them starts disappearing in a split second after refreshing.

    To Reproduce Steps to reproduce the behavior:

    1. Go to '...'
    2. Click on '....'
    3. Scroll down to '....'
    4. See error

    Expected behavior i expect to see my umamin messages after this.

    Screenshots Screenshot_20220730-222535_Chrome Screenshot_20220730-222537_Chrome

    Desktop (please complete the following information):

    • OS: [e.g. iOS]
    • Browser [e.g. chrome, safari]
    • Version [e.g. 22]

    Smartphone (please complete the following information):

    • Samsung Galaxy j4 plus
    • Android
    • Chrome
    • ver. 9

    Additional context Add any other context about the problem here.

    bug 
    opened by dxzvy 2
  • user in inbox not changing on first render

    user in inbox not changing on first render

    Describe the bug Account/user's inbox does not change after signing out and then logging in with a different account but only changes after a reload.

    To Reproduce Steps to reproduce the behavior:

    1. Login
    2. Logout
    3. Login with a different account
    4. You'll see that the user in the unique link was from the one you previously logged in

    Expected behavior The user in the inbox should be the one that is currently logged in on first render

    Screenshots

    • logged in as test but previously logged in as testuser. image
    bug 
    opened by joshxfi 2
  • share button

    share button

    image

    • add a share button in each message card
    • will export an image of the message card (used to post in ig story etc.)

    if possible,

    • a share button that directly creates a story instance in instagram
    feature 
    opened by princejoogie 2
  • release: v0.3.2

    release: v0.3.2

    • Update to Next 13
      • (temp): Use legacy Image & Link
    • Fix PWA
    • Move before interactive script to _document.tsx
    • Pass session ID in ApolloServer context
    chore fix release 
    opened by joshxfi 1
  • Nawawala ung mga message

    Nawawala ung mga message

    Describe the bug A clear and concise description of what the bug is.

    To Reproduce Steps to reproduce the behavior:

    1. Go to '...'
    2. Click on '....'
    3. Scroll down to '....'
    4. See error

    Expected behavior A clear and concise description of what you expected to happen.

    Screenshots If applicable, add screenshots to help explain your problem.

    Desktop (please complete the following information):

    • OS: [e.g. iOS]
    • Browser [e.g. chrome, safari]
    • Version [e.g. 22]

    Smartphone (please complete the following information):

    • Device: [e.g. iPhone6]
    • OS: [e.g. iOS8.1]
    • Browser [e.g. stock browser, safari]
    • Version [e.g. 22]

    Additional context Add any other context about the problem here.

    bug 
    opened by Reibaliw 0
  • Show location

    Show location

    My problem is I’m always wondering who the person who messaged me is or if it is still the same person who messaged me yesterday. Yes, I know this is anonymous for messages, so it really needs to be hidden, but I would like to suggest a solution to avoid confusion.

    The solution I would like to request is that when someone visits this site to confess, then their device location or the location of the person who sent me an anonymous message will be detected and notified to my notifications. Like, for example, the same thing with the Wix site app. If you visit the site, the location of those who visit my site can be detected and it will notify me. I mean, it is still anonymous because the real identity and username are still hidden, but the location is not hidden to avoid confusion and to be notified. It would be better if their location could be detected because then you would know if the person who messaged you yesterday is still the person who messaged you today.

    I will send screenshots of an example of this kind of solution and what it looks like. Trust me, this is better and will lead to a safer environment, especially since people nowadays love to message rude and mean confessions, so I hope this request will be processed soon.

    Screenshot_20220731-185111~2

    #request #safer

    feature request 
    opened by grei-19 3
Releases(v0.3.4)
  • v0.3.4(Dec 9, 2022)

    What's Changed

    • Disable PWA on dev
    • Show warning if current user is unauthenticated
    • Disable some buttons when session is loading

    Full Changelog: https://github.com/omsimos/umamin/compare/v0.3.3...v0.3.4

    Source code(tar.gz)
    Source code(zip)
  • v0.3.3(Dec 9, 2022)

    What's Changed

    • Add Download App button to install PWA
    • Implement updated next/link & next/image
    • Show Go to Inbox on /to if authenticated

    Full Changelog: https://github.com/omsimos/umamin/compare/v0.3.2...v0.3.3

    Source code(tar.gz)
    Source code(zip)
  • v0.3.2(Nov 21, 2022)

    What's Changed

    • Update to Next 13
      • (temp): Use legacy Image & Link
    • Fix PWA service worker
    • Move before interactive script to _document.tsx
    • Pass session ID in ApolloServer context
    • Use useRef for downloading images

    Full Changelog: https://github.com/omsimos/umamin/compare/v0.3.1...v0.3.2

    Source code(tar.gz)
    Source code(zip)
  • v0.3.1(Oct 21, 2022)

    What's Changed

    • Add credentials option for creating an account
    • Login attempts before giving the CAPTCHA
    • Update ad position
    • Add loaders on other pages

    Full Changelog: https://github.com/omsimos/umamin/compare/v0.3.0...v0.3.1

    Source code(tar.gz)
    Source code(zip)
  • v0.3.0(Sep 27, 2022)

    What's Changed

    • Add Discord & Google Authentication
    • Update ad positions
    • Add rate limiter using lru-cache
    • Implement new UI
    • Add reply feature
    • Add message tabs (recent, seen, sent)
    • Optimizations

    Full Changelog: https://github.com/omsimos/umamin/compare/v0.2.4...v0.3.0

    Source code(tar.gz)
    Source code(zip)
  • v0.2.4(Aug 17, 2022)

    What's Changed

    • Use edge for cache-control by @joshxfi in https://github.com/joshxfi/umamin/pull/97
    • Add maintenance title by @joshxfi in https://github.com/joshxfi/umamin/pull/98
    • Use different ad-slot id by @joshxfi in https://github.com/joshxfi/umamin/pull/99
    • Add Discord and Facebook button on the maintenance page
    • Update footer links

    Full Changelog: https://github.com/joshxfi/umamin/compare/v0.2.3...v0.2.4

    Source code(tar.gz)
    Source code(zip)
  • v0.2.3(Aug 7, 2022)

    What's Changed

    • Run ads only in production by @edmer664 in https://github.com/joshxfi/umamin/pull/92
    • Delete message button by @joshxfi in https://github.com/joshxfi/umamin/pull/94
    • Delete account button (under settings) by @joshxfi in https://github.com/joshxfi/umamin/pull/94
    • Remove Share to Instagram button
    • Fix flicker on settings

    New Contributors

    • @edmer664 made their first contribution in https://github.com/joshxfi/umamin/pull/92

    Full Changelog: https://github.com/joshxfi/umamin/compare/v0.2.2...v0.2.3

    Source code(tar.gz)
    Source code(zip)
  • v0.2.2(Aug 3, 2022)

    What's Changed

    • Add ad container by @joshxfi in https://github.com/joshxfi/umamin/pull/89
    • Change password by @joshxfi in https://github.com/joshxfi/umamin/pull/91
    • Fix empty custom message (add minLength)
    • Move toast at the bottom center

    Full Changelog: https://github.com/joshxfi/umamin/compare/v0.2.1...v0.2.2

    Source code(tar.gz)
    Source code(zip)
  • v0.2.1(Aug 2, 2022)

    What's Changed

    • Add origin to CORS by @joshxfi in https://github.com/joshxfi/umamin/pull/87
    • Replace dummy cards with loader to avoid confusion
    • Display time on the message card
    • Add Discord links
    • Add generate script

    Full Changelog: https://github.com/joshxfi/umamin/compare/v0.2.0...v0.2.1

    Source code(tar.gz)
    Source code(zip)
  • v0.2.0(Aug 1, 2022)

    What's Changed

    • Fix: update inbox pagination by @joshxfi in https://github.com/joshxfi/umamin/pull/71
    • Chores by @joshxfi in https://github.com/joshxfi/umamin/pull/74
      • Update next (12.2.3)
      • Add cache control (max-age: 60)
      • Extract PWA config
      • Update privacy policy
    • Security patches by @joshxfi in https://github.com/joshxfi/umamin/pull/83
      • CSRF prevention
      • CORS
      • Captcha
    • Migrate to turborepo by @princejoogie in https://github.com/joshxfi/umamin/pull/76

    Full Changelog: https://github.com/joshxfi/umamin/compare/v0.1.4...v0.2.0

    Source code(tar.gz)
    Source code(zip)
  • v0.1.4(Jul 30, 2022)

    What's Changed

    • Pagination by @joshxfi in https://github.com/joshxfi/umamin/pull/66
    • Change message min length to 3
    • Update email URL in footer
    • Convert fonts to woff2
    • Add NEXT_PUBLIC_MAINTENANCE_INFO on maintenance page

    Full Changelog: https://github.com/joshxfi/umamin/compare/v0.1.3...v0.1.4

    Source code(tar.gz)
    Source code(zip)
  • v0.1.3(Jul 29, 2022)

    What's Changed

    • Add maintenance page by @joshxfi in https://github.com/joshxfi/umamin/pull/61
    • Setup AdSense by @joshxfi in https://github.com/joshxfi/umamin/pull/63
    • Patch GraphQL endpoint vulnerability https://github.com/joshxfi/umamin/issues/59

    Full Changelog: https://github.com/joshxfi/umamin/compare/v0.1.2...v0.1.3

    Source code(tar.gz)
    Source code(zip)
  • v0.1.1(Jul 28, 2022)

    What's Changed

    • Optimizations v0.1.1 by @princejoogie in https://github.com/joshxfi/umamin/pull/52
      • Initialized migration folder
      • Add indexes on user and message model
      • Add github workflow to run prisma migrate deploy
    • Add schema migration CI @joshxfi in https://github.com/joshxfi/umamin/pull/56

    Full Changelog: https://github.com/joshxfi/umamin/compare/v0.1.0...v0.1.1

    Source code(tar.gz)
    Source code(zip)
  • v0.1.0(Jul 27, 2022)

    What's Changed

    • feat/add-user by @joshxfi in https://github.com/joshxfi/umamin/pull/2
    • copy link to clipboard feature by @hyamero in https://github.com/joshxfi/umamin/pull/4
    • feat/login-page by @hyamero in https://github.com/joshxfi/umamin/pull/6
    • fix ui issues by @hyamero in https://github.com/joshxfi/umamin/pull/7
    • login feature by @joshxfi in https://github.com/joshxfi/umamin/pull/8
    • dev to main by @joshxfi in https://github.com/joshxfi/umamin/pull/9
    • fix(readme): change URL to umamin by @joshxfi in https://github.com/joshxfi/umamin/pull/12
    • send message page ui by @hyamero in https://github.com/joshxfi/umamin/pull/13
    • send message feature by @joshxfi in https://github.com/joshxfi/umamin/pull/14
    • chore: add issue template by @joshxfi in https://github.com/joshxfi/umamin/pull/16
    • implement loader by @joshxfi in https://github.com/joshxfi/umamin/pull/15
    • fix: alignment issue by @hyamero in https://github.com/joshxfi/umamin/pull/17
    • feat: use next-auth by @princejoogie in https://github.com/joshxfi/umamin/pull/18
    • chores by @joshxfi in https://github.com/joshxfi/umamin/pull/20
    • dev to main by @joshxfi in https://github.com/joshxfi/umamin/pull/21
    • add footer by @joshxfi in https://github.com/joshxfi/umamin/pull/22
    • feat: message sent ui by @hyamero in https://github.com/joshxfi/umamin/pull/24
    • menu on mobile view by @joshxfi in https://github.com/joshxfi/umamin/pull/25
    • add SEO & PWA by @joshxfi in https://github.com/joshxfi/umamin/pull/27
    • add register page by @joshxfi in https://github.com/joshxfi/umamin/pull/26
    • add receiver message by @joshxfi in https://github.com/joshxfi/umamin/pull/28
    • update inbox ui by @hyamero in https://github.com/joshxfi/umamin/pull/29
    • save image & share to instagram by @joshxfi in https://github.com/joshxfi/umamin/pull/36
    • add analytics using firebase by @joshxfi in https://github.com/joshxfi/umamin/pull/37
    • seen indicator by @joshxfi in https://github.com/joshxfi/umamin/pull/38
    • feat: custom message by @joshxfi in https://github.com/joshxfi/umamin/pull/40
    • update message ui by @joshxfi in https://github.com/joshxfi/umamin/pull/41
    • add privacy policy by @joshxfi in https://github.com/joshxfi/umamin/pull/42
    • fix: message dialog padding css conflict by @hyamero in https://github.com/joshxfi/umamin/pull/44
    • add help center by @joshxfi in https://github.com/joshxfi/umamin/pull/45
    • minor changes by @joshxfi in https://github.com/joshxfi/umamin/pull/47
    • release: v0.1.0 by @joshxfi in https://github.com/joshxfi/umamin/pull/46

    New Contributors

    • @joshxfi made their first contribution in https://github.com/joshxfi/umamin/pull/2
    • @hyamero made their first contribution in https://github.com/joshxfi/umamin/pull/4
    • @princejoogie made their first contribution in https://github.com/joshxfi/umamin/pull/18

    Full Changelog: https://github.com/joshxfi/umamin/commits/v0.1.0

    Source code(tar.gz)
    Source code(zip)
Owner
Omsimos Collective
We build open-source projects for the community
Omsimos Collective
A chat logs online saver for discord bots to save messages history & cleared messages online

Chat Logs NPM package that saves messages online to view it later Useful for bots where users can save messages history & cleared messages online Supp

TARIQ 8 Dec 28, 2022
This branch is created to make receive and send data to api using async and await methods

Microverse-Leader-Board Project from module 2 week 4 This branch is created to make receive and send data to api using async and await methods Screens

Akshitha Reddy 6 Apr 22, 2022
The leaderboard website displays scores submitted by different players. It also allows you to send and receive data from API. Build with JavaScript, CSS and HTML.

Leadboard The leaderboard website displays scores submitted by different players. It also allows you to submit your score. All data is preserved using

Fatima Ezzahra elmenoun 4 Jan 31, 2022
Front-end for FireNearby service. View recent fires and sign up to receive alerts: caseymm.github.io/fire-nearby

fire-nearby (firenearby service front-end) This application is composed of three pages: Map of recent fires Sign up form to receive alerts About this

Casey Miller 4 Mar 30, 2022
Project to manage multiple emails at once with lots of customization. You can send and receive emails. Desktop notifications can be modified.

Technologies Used React Redux Tailwind CSS Features Admin dashboard User settings and or user dashboard send emails recive emails Connections through

Multi Email 9 Dec 17, 2022
Receive crypto payments from anywhere around the world, options including native tokens (MATIC, ETHER,BUSD), Tokens (USDT,BUSD), NFTs and more.

Receive payments for service rendered in crypto using different options. Go borderless with bonpay, gain access to varities of crypto assets, safe and

Johnson awah Alfred 6 Nov 11, 2022
Subscribe to rss feeds from anywhere, receive notifications from anywhere.

INK RSS 管理订阅,接收通知 示例网页 · 示例群组 · 报告Bug 介绍 特点 项目背景 TODO 注意事项 部署 额外附赠 使用建议 调查 贡献 作者 协议 介绍 INK RSS 提供及时且多样的 rss 通知服务,借助现有的接口你可以在任意位置订阅,并使用任意方式接收通知,并且所有服务均

null 253 Dec 28, 2022
Slack Integration to receive incoming webhooks from openpix.com.br

Slack Integration This is a aws lambda function to receive new transaction informations from OpenPix @ your company's slack workspace. Getting Started

Leandro Alencar 6 Sep 19, 2022
This is a bot for Telegram that can be used to receive webhook notifications from Gitlab. It is built with the Next.js API.

Telegram Bot for Gitlab Webhook ?? Note This project is still in development. Just relax ?? This is a bot for Telegram that can be used to receive web

M. Zakiyuddin Munziri 2 Oct 22, 2022
Send encrypted and decrypted messages with verifiable keys and human readable names.

zooko-msg Encrypt and decrypt messages using AES with a preshared ECDH key generated using keys associated with Handshake names. I noticed that there

Publius Federalist 31 Jul 27, 2022
An event-driven architecture wrapper for Wechaty that applies the CQS principle by using separate Query and Command messages to retrieve and modify the bot state, respectively.

CQRS Wechaty An event-driven architecture wrapper for Wechaty that applies the CQS principle by using separate Query and Command messages to retrieve

Wechaty 3 Mar 23, 2022
A messaging app built on top of Solana blockchain where you can store and view your messages.

Message App on Solana ?? This Message application written Rust using Anchor ⚓ Setting up the Environment: Rust Installation curl --proto '=https' --tl

Ritesh 10 Oct 2, 2022
A template repo that contains a NodeJS app that will consume messages from a RabbitMQ queue and immediately send them to an Azure EventHub.

README.md Summary This repo (RabbitMQ to EventHub Shovel) is a template that contains a NodeJS app that will consume messages from a RabbitMQ queue an

Valtech San Diego 6 Jul 2, 2022
Send messages to this bot and almacenate it on selected Notion's Database

Telegram to Notion Bot What can do this bot? With this bot you can authorize that it receive the text that you send and store it on one selected datab

Francisco Pessano 24 Dec 11, 2022
Adapter application for consuming web3 messages from ie. wallets, and passing them on to starknet

?? StarknNet web3 account Development setup Clone deps with submodules git clone --recurse-submodules [email protected]:software-mansion-labs/starknet-we

Software Mansion – Labs 20 Nov 21, 2022
Send encrypted messages and decrypt them without sharing keys. Built using the Handshake blockchain.

zmsg Encrypt and decrypt messages using AEAD with an ephemeral key Learn more by joining the Handshake Discord Community I noticed that there wasn't a

Publius Federalist 31 Jul 27, 2022
Colorconsole provides an interesting way to display colored info, success, warning and error messages on the developer console in your browser

ColorConsole NPM Package Colorconsole provides an interesting way to display colored info, success, warning and error messages on the developer consol

Hasin Hayder 17 Sep 19, 2022
Util for kafkajs to buffer messages and send them in batches, inspired by node-rdkafka

kafkjajs-buffer Plugin for kafkajs to buffer messages and send them in batches, inspired by node-rdkafka Overview kafkajs-buffer adds queue/buffer cap

Alberto Juan 7 Sep 7, 2022