tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity
78 Commits 2 Branches 0 Tags
main
Commit Graph
78 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
tim 277ea4470c Fix favicon links 2026-09-26 15:27:51 +02:00
tim b68c2eb568 Give the feed of an empty site the current date. 
The feed passed NULL to strtotime() when there were no stories.
 2026-09-26 15:27:51 +02:00
tim 8d6282348c Show no date for a story without one. 
Such a story showed the date of the story before it, or caused a warning when it came first.
 2026-09-26 15:27:51 +02:00
tim 71f768bff2 Log out with a POST form. 
The logout link put the CSRF token in the URL, which goes into logs and the browser history.
 2026-09-26 15:27:51 +02:00
tim 061f9c1a37 Hash the password for an unknown username at login. 
An unknown username got a fast answer, which showed which usernames exist.
 2026-09-26 15:27:51 +02:00
tim c8030b759d Leave the image data out of the story lists. 
A page of 50 stories read 50 images from the database only to see which stories had one.
 2026-09-26 15:27:51 +02:00
tim ed8918e7fd Refuse session ids that PHP did not make. 2026-09-26 15:27:51 +02:00
tim 30b275b902 Send HSTS on HTTPS pages. 2026-09-26 15:27:51 +02:00
tim b6a1eff3e6 Stop other sites from framing the pages. 2026-09-26 15:27:51 +02:00
tim ed6f98e0ac Limit a story to 64 KB before HTML Purifier runs. 
A preview purified any posted story, even without a token or a captcha. A few megabytes took seconds and hundreds of megabytes.
 2026-09-26 15:27:51 +02:00
tim bf36ec25fd Load a saved story into the form for editors only. 
Visitors could post an id to /publish and read the author's email address.
 2026-09-26 15:27:51 +02:00
tim 8f4851e576 Reject invalid uploads and expand flow tests. 2026-09-26 15:27:51 +02:00
tim 716a609f4e Hide form parts with the hidden attribute. 2026-09-26 15:27:51 +02:00
tim 65426a327d Remove Google Analytics. 
Google shut down the Universal Analytics script that the pages loaded,
and we haven't used it probably a decade
 2026-09-26 15:27:51 +02:00
tim 77800174c9 Use the reCAPTCHA Enterprise API. 2026-09-26 15:27:51 +02:00
tim cc47d0ee51 Hide the word Menu on phones. 
The icon alone shows the menu, and page titles move closer to it.
 2026-09-26 15:27:51 +02:00
tim 45bca9e76a Use the default for an empty UPLOAD_DIR_LIMIT_MB. 
An empty or bad value gave a limit of zero, so previews kept no images.
 2026-09-26 15:27:51 +02:00
tim ae85b23ab0 Keep page titles clear of the mobile menu. 2026-09-26 15:27:51 +02:00
tim 504d363642 Limit each image to 1 MB. 
UPLOAD_MAX_MB changes the limit, and UPLOAD_MAX_MB=none removes it.
 2026-09-26 15:27:51 +02:00
tim c4fcef21aa Limit the images that previews keep. 
A preview that fails the captcha or the form token keeps no image. A session keeps one image, the directory has a size limit, and abandoned images go at the next upload.
 2026-09-26 15:27:51 +02:00
tim fe30a0aaa1 Do not let caches keep queued or hidden images. 2026-09-26 15:27:51 +02:00
tim 3df88e0b4c Check editor accounts. 
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
 2026-09-26 15:27:51 +02:00
tim 5d657d7e45 Take the site address from SITE_URL. 
The feed links, the notification email, the webmaster address and the cookie domain now use it.
 2026-09-26 15:27:51 +02:00
tim 52f4855850 Ignore request values that are not strings. 
An array action or username no longer causes a PHP error.
 2026-09-26 15:27:51 +02:00
tim be814a3ba5 Take redirects off the Host header. 
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
 2026-09-26 15:27:51 +02:00
tim 4657088d23 Keep the space of the line-break note under the image box. 
An invisible copy of the note sits under the image box, so the page
does not jump when the tabs change.
 2026-09-26 15:27:51 +02:00
tim f5b41a09d6 Give the image box the size of the story editor. 
The box is 450px wide and 337px high, as the editor is. On phones it
takes the full width and the editor's height with a wrapped toolbar.
 2026-09-26 15:27:51 +02:00
tim 2214a6ae38 Mark the active Text or Image tab. 
The active tab stays solid green, and the other tab is pale with green
text. A tab whose field failed validation now shows red text.
 2026-09-26 15:27:51 +02:00
tim ea5732ff83 Style the story search on the edit page. 
Round the input like the other form inputs, and add space above the list.
 2026-09-26 15:27:51 +02:00
tim 20d0610200 Lay out the publishing forms in one column on phones. 
Below 600px: labels above full-width inputs, 44px touch targets, 16px
text, and the tabs on the top border of the story box.
 2026-09-26 15:27:51 +02:00
tim 5593341b04 Add a README for the tests, and block the development files. 2026-09-26 15:27:51 +02:00
tim b7022ab486 Add JavaScript tests. 
Run "npm install", then "npm test".
 2026-09-26 03:48:09 +02:00
tim ed959888b4 Add PHP unit tests and page tests. 
Run "composer install", then "composer test".
 2026-09-26 03:48:09 +02:00
tim 848c447c5b Put a line break after a rule, and show a link as it was typed. 2026-09-26 03:48:09 +02:00
tim 7d8cd8a89d Refuse an upload name that ends in a new line. 2026-09-26 03:48:09 +02:00
tim a23f07cc48 Let the tests replace the database connection class. 2026-09-26 03:48:09 +02:00
tim 2c3a744e2e Turn the captcha off when RECAPTCHA_SITE_KEY is empty. 2026-09-26 00:19:21 +02:00
tim babe5361e7 Edit the story source in the textarea. 
Also close the special character window on a click outside it.
 2026-09-26 00:10:14 +02:00
tim 6c745ed6a9 Use solid borders and quieter colors in the forms and the editor. 2026-09-26 00:10:06 +02:00
tim a9daa6a792 Replace TinyMCE 4.2.8 with a small local editor. 
TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar
and writes the same HTML. The textarea still posts the story.
 2026-09-25 22:58:05 +02:00
tim aee8a830d7 Write the pager page size in words without PEAR. 2026-09-25 22:32:11 +02:00
tim 589ae4c1fa Give the Post button its own id. 2026-09-25 22:12:35 +02:00
tim 1c76245808 Mark the Comments label when it fails validation. 2026-09-25 22:12:27 +02:00
tim 94db52e20d Keep line breaks in the new-submission email. 2026-09-25 22:12:00 +02:00
tim 601df8a9be Apply the en dash to number ranges in stories. 
A typo ($stort) threw the result away.
 2026-09-25 22:11:31 +02:00
tim f78fd09710 Accept only whole numbers for start and show, and cap show at 50. 2026-09-25 22:11:03 +02:00
tim f97bdecbc1 Log database errors instead of showing them. 
display_errors is off unless DISPLAY_ERRORS is set in .env.
 2026-09-25 21:57:11 +02:00
tim bcba2e1ca3 Remove unused old libraries and archives. 
TinyMCE 3.3.8, HTML Purifier 3.0.0 and the archives. Their example
scripts could be reached from the web.
 2026-09-25 21:55:53 +02:00
tim 720bf91ff2 Escape RSS feed fields so the feed is valid XML. 2026-09-25 21:55:02 +02:00
tim 1468cf7138 Require a captcha for visitor submissions and for login. 
Without the form field, the check was skipped. A solved captcha lasts
30 minutes in the session.
 2026-09-25 21:54:14 +02:00