Switched from mac address to machine id

[thomasjacquin]

The PR switches the unique ID from Mac Address to Machine ID.

This is to address the fact that in some cases, the RPi can have multiple interfaces enabled and there's a need to parse the output and select only one mac address. Furthermore, if the user switches from wlan0 to eth0, they would have a different mac address.

The Machine ID documentation can be found here: https://man7.org/linux/man-pages/man5/machine-id.5.html

[AndreasLMeg]

Yes, this should work - but not tested

pi@allsky:~ $ MACHINE_ID="$(cat /etc/machine-id)"
pi@allsky:~ $ echo $MACHINE_ID
6b5d3aff9e7742a0923061180d7be273
pi@allsky:~ $ digit="${MACHINE_ID: -1}"
pi@allsky:~ $ echo $digit
3

Does your php do security checks?
I fear there is a possibility of making your server unusable here - with a targeted call (curl) it is easy to make the database/map unusable.
In fact, I exploited this vulnerability.

[AndreasLMeg]

@thomasjacquin: I know I'm paranoid, but the urls should also be checked to see if there really is an allsky page behind them.
I hope only honest people will hang around here, but you can never be sure...

[thomasjacquin]

Good call @AndreasLMeg. I'm an eternal optimist so I'm always hoping things will go just fine :)
I can make sure to only allow one request per IP address per day to limit curl requests in a loop.
I can also check that the targeted website contains a certain file/variable. That should filter most of the requests.

[EricClaeys]

@thomasjacquin, @AndreasLMeg ,
The server could look for <websiteurl>/config.js and to be even safer, check that it contains imageName. And if you really want to be cool, check if camera: "some camera" is the same as the camera variable passed to the server.

[thomasjacquin]

@EricClaeys I was thinking about config.js but then I realized that some people post images to their website but don't always have the allsky-website code installed on it. Some users just post to their Wordpress page.

[EricClaeys]

@thomasjacquin Good point. Funny - I'm currently doing that so it would have failed with me!
I guess that means we should allow website_url to be null but image_url to contain something.