changes

foftickets.js

@@ -39,9 +39,9 @@ function hashPW(pw) {
     return(hash);
 }
 
-function hashQR(t,username) {
+function hashQR(t,ownername) {
     const hash0=crypto.createHash('sha256');
-    const hash1=hash0.update(pw+QRSalt);
+    const hash1=hash0.update(t+QRSalt+ownername);
     const hash=hash1.digest("base64").slice(0,6);
     return(hash);
 }
@@ -406,6 +406,16 @@ app.get('/logout', (req, res) => {
   });
 });
 
+app.post('/qrcode',requireLogin,async (req,res) => {
+    const username=req.session.username;
+    const ticket=req.body.ticket;
+    console.log("Body: ",req.body);
+    console.log("Tickets["+ticket+"]",tickets[ticket]);
+    if (tickets[ticket].owner!=username) return res.status(500).send("Only a ticket owner can generate a QR code");
+    const URL=await QRCode.toDataURL('localhost:3000/useticket?t='+ticket+'&h='+hashQR(ticket,username));
+    return res.send({ qrcode: URL });
+    })
+
 // Protected routes
 app.get('/products', requireLogin, (req, res) => {
   res.send(`