Updated script added some security and readme features added $yourIP

core/config.php

@@ -2,13 +2,16 @@
 // Donation account
 $don_faucet = "FaucetDonations";
 
+// your private IP to access private server stats
+$yourIP ="127.0.0.1";
+
 // RPC Settings
 $btclogin = array("username" => "username", "password" => "pass",
     "host" => "localhost", "port" => "8332");
 
 // DB Settings
 $sqlogin = array("host" => "localhost", "dbname" => "faucet", "username" =>
-    "root", "password" => "�ass");
+    "root", "password" => "�ass");
 
 // sending settings ..
 $minleft = 0.01; // minimum left on account
@@ -17,10 +20,10 @@
 // NOT IMPLEMENTED YET ...
 $minfee = 0.1; // min. hard fee on all transactions
 $feeperc = 0.5; // fee for outgoing transactions in percentage
-$fee_account = "KgHL1urqk1roN0eX67sC"; // set to your own KEY to recieve fee�s there
+$fee_account = "KgHL1urqk1roN0eX67sC"; // set to your own KEY to recieve fee�s there
 
 
 $adscaptchaID = 3170;
 $adspubkey = "d655966c-541e-44c8-9a7d-a4f48a3d51a3";
 $adsprivkey = "484fa3ac-8fcb-470f-8ee4-a3a91568071c";
-?>
+?>

readme.txt

@@ -4,18 +4,58 @@ Forum Thread: https://bitcointalk.org/index.php?topic=101407.0
 this is the simplest version of it, other might get released in time
 
 made by Greedi 2012 (c)
+updated by Joseph White 2013-2014 (c) joesfreicoinpool@gmail.com http://pool.cr.rs
 
 
-INSTALL:
-put files in www dir, edit config.php with proper values
-and dont forget faucet.sql for the db...
-in templates/header.php you have to set you're IP, so you can see server link.
-the same in server.php, set you're IP, so you can access to page.
+INSTALL
+===============
+Clone this repository with git
+Put files in www dir (or subdirectory if you so wish)
+Edit core/config.php with proper values (server address, username, bitcoin rpc info)
+
+Create the faucet database
+$ mysql -u username -p -h host faucet < faucet.sql
+> create database faucet;
+
+Import faucet.sql into mysql
+
+$ mysql -u username -p -h host faucet < faucet.sql
+
+If you wish to be able to see your servers statistics then you need to edit the
+$yourIP in the config file is your private ip address of the computer you will access the faucet with
+set you're IP, so you can access the server.php page
+
+Create a faucet donation account on bitcoind as well as a a sendout account
+"FaucetDonations" - Faucet donation account
+$ bitcoind getnewaddress FaucetDonations
+
+"SendOut" - Sendout account
+$ bitcoind getnewaddress SendOut
 
 NOTE: Some wil maybe have to create the faucet donation account in there bitcoind
 account have to be FaucetDonations and/or SendOut
 
+NOTES
+===============
+This should work for any coin that uses RPC commands, just change the rpc ports and passwords
+as needed.
+
+This has been noted to work on FreiCoin and properly takes demurrage in to account
 
-Donate: 
+This updated code has not been throughly tested, use at your own risk.
+
+Do make sure to add more security checks. This is most likely still insecure.
+
+
+
+Donations
+===============
+Greedi's addresses 
 LTC: Lh4c3cYcmvoksUNJLFT2Z5zsUmKUFgAUF5
-BTC: 1MFH5dY85Ve4Q6KYPGJnfPmiHP2UxmXend
+BTC: 1MFH5dY85Ve4Q6KYPGJnfPmiHP2UxmXend
+
+Joe's address (FreiCoin FRC Please)
+FRC: 1FRCJoeWXbYe47cmuW3do8VoqAr9HuWbpJ
+
+Joe's FreiCoin Faucet (running a much more heavily modified and secured version of this script)
+http://frc.now.im

server.php

@@ -10,12 +10,13 @@
 $uptime = $uptime[0] . ', ' . $uptime[1];
 
 include ("core/wallet.php");
+include("core/config.php");
 include ('templates/header.php');
 ?>
         <div class="row">
         <div class="span10">
 <?php
-if ($_SERVER['REMOTE_ADDR'] != "127.0.0.1") {
+if ($_SERVER['REMOTE_ADDR'] != $yourIP) {
     echo '<div class="alert-message error" data-alert="alert" style="margin-right: 20px;"><a class="close" onclick="\$().alert()" href="#">&times</a><p>Access Denied.</p></div>';
 } else {
     $finishing_divs = "</div></div>";

submitted.php

@@ -3,8 +3,24 @@
 /**
  * @author Greedi
  * @copyright 2012
+ * This update by Joseph White joesfreicoinpool@gmail.com pool.cr.rs
+ *
+ * "clean_input" function from "crafter" of stackoverflow.com
+ * http://stackoverflow.com/a/10558896
+ *
  */
- error_reporting(E_ALL);
+function clean_input($instr) {
+
+     // Note that PHP performs addslashes() on GET/POST data.
+     // Avoid double escaping by checking the setting before doing this.
+    if(get_magic_quotes_gpc()) {
+        $str = stripslashes($instr);
+    }
+    return mysql_real_escape_string(strip_tags(trim($instr)));
+}
+//we don't want errors to be reported for now it just adds more vulnerability 
+// error_reporting(E_ALL);
+
 include ('core/banned.php');
 include_once ("core/wallet.php");
 include_once ('templates/header.php');
@@ -42,7 +58,9 @@ function ordinal($a)
         include ('templates/footer.php');
         die();
     } else {
-    $ltcaddress = $_POST['BTC'];
+    //sanitize $ltcaddress a bit to increase security
+    //this is still able to be broken. please fix it further. this is just a quick patch
+    $ltcaddress = clean_input($_POST['BTC']);
             mysql_query("INSERT INTO dailyltc (ltcaddress, ip)
     SELECT * FROM (SELECT '$ltcaddress', '$ip') AS tmp
     WHERE NOT EXISTS (

templates/footer.php

@@ -4,7 +4,9 @@
 
  <footer>
 <center><p style="font-size: 11px;">Donate to Faucet: <?=$btclient->getaccountaddress($don_faucet);?> (recv: <?=$btclient->getbalance($don_faucet,0)?> BTC)</p>
-<center><p>Made By Greedi &copy; 2012</p>
+<center><p>Original Bitcoin Version Made By Greedi &copy; 2012</p>
+<center><p>This Version By Joseph White &copy; 2013-2014 <a href="http://pool.cr.rs">http://pool.cr.rs</a>. Mine with me!</p>
+
 </footer>
 </center>
 

templates/header.php

@@ -1,5 +1,6 @@
 <?
 //ini_set("display_errors", 1);
+include("core/config.php");
 ?>
 <!DOCTYPE html>
 
@@ -85,9 +86,9 @@
           <?
 // menu
  mnu_btn("index.php", "Faucet");
-if ($_SERVER['REMOTE_ADDR'] == "127.0.0.1")
+if ($_SERVER['REMOTE_ADDR'] == $yourIP) {
     mnu_btn("server.php", "Server");
-
+}
 
 
 function mnu_btn($link, $title, $preg = false)