tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity
78 Commits 2 Branches 0 Tags
main
Commit Graph
78 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
tim 277ea4470c Fix favicon links 2026-09-26 15:27:51 +02:00
tim b68c2eb568 Give the feed of an empty site the current date. 
The feed passed NULL to strtotime() when there were no stories.
 2026-09-26 15:27:51 +02:00
tim 8d6282348c Show no date for a story without one. 
Such a story showed the date of the story before it, or caused a warning when it came first.
 2026-09-26 15:27:51 +02:00
tim 71f768bff2 Log out with a POST form. 
The logout link put the CSRF token in the URL, which goes into logs and the browser history.
 2026-09-26 15:27:51 +02:00
tim 061f9c1a37 Hash the password for an unknown username at login. 
An unknown username got a fast answer, which showed which usernames exist.
 2026-09-26 15:27:51 +02:00
tim c8030b759d Leave the image data out of the story lists. 
A page of 50 stories read 50 images from the database only to see which stories had one.
 2026-09-26 15:27:51 +02:00
tim ed8918e7fd Refuse session ids that PHP did not make. 2026-09-26 15:27:51 +02:00
tim 30b275b902 Send HSTS on HTTPS pages. 2026-09-26 15:27:51 +02:00
tim b6a1eff3e6 Stop other sites from framing the pages. 2026-09-26 15:27:51 +02:00
tim ed6f98e0ac Limit a story to 64 KB before HTML Purifier runs. 
A preview purified any posted story, even without a token or a captcha. A few megabytes took seconds and hundreds of megabytes.
 2026-09-26 15:27:51 +02:00
tim bf36ec25fd Load a saved story into the form for editors only. 
Visitors could post an id to /publish and read the author's email address.
 2026-09-26 15:27:51 +02:00
tim 8f4851e576 Reject invalid uploads and expand flow tests. 2026-09-26 15:27:51 +02:00
tim 716a609f4e Hide form parts with the hidden attribute. 2026-09-26 15:27:51 +02:00
tim 65426a327d Remove Google Analytics. 
Google shut down the Universal Analytics script that the pages loaded,
and we haven't used it probably a decade
 2026-09-26 15:27:51 +02:00
tim 77800174c9 Use the reCAPTCHA Enterprise API. 2026-09-26 15:27:51 +02:00
tim cc47d0ee51 Hide the word Menu on phones. 
The icon alone shows the menu, and page titles move closer to it.
 2026-09-26 15:27:51 +02:00
tim 45bca9e76a Use the default for an empty UPLOAD_DIR_LIMIT_MB. 
An empty or bad value gave a limit of zero, so previews kept no images.
 2026-09-26 15:27:51 +02:00
tim ae85b23ab0 Keep page titles clear of the mobile menu. 2026-09-26 15:27:51 +02:00
tim 504d363642 Limit each image to 1 MB. 
UPLOAD_MAX_MB changes the limit, and UPLOAD_MAX_MB=none removes it.
 2026-09-26 15:27:51 +02:00
tim c4fcef21aa Limit the images that previews keep. 
A preview that fails the captcha or the form token keeps no image. A session keeps one image, the directory has a size limit, and abandoned images go at the next upload.
 2026-09-26 15:27:51 +02:00
tim fe30a0aaa1 Do not let caches keep queued or hidden images. 2026-09-26 15:27:51 +02:00
tim 3df88e0b4c Check editor accounts. 
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
 2026-09-26 15:27:51 +02:00
tim 5d657d7e45 Take the site address from SITE_URL. 
The feed links, the notification email, the webmaster address and the cookie domain now use it.
 2026-09-26 15:27:51 +02:00
tim 52f4855850 Ignore request values that are not strings. 
An array action or username no longer causes a PHP error.
 2026-09-26 15:27:51 +02:00
tim be814a3ba5 Take redirects off the Host header. 
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
 2026-09-26 15:27:51 +02:00
tim 4657088d23 Keep the space of the line-break note under the image box. 
An invisible copy of the note sits under the image box, so the page
does not jump when the tabs change.
 2026-09-26 15:27:51 +02:00
tim f5b41a09d6 Give the image box the size of the story editor. 
The box is 450px wide and 337px high, as the editor is. On phones it
takes the full width and the editor's height with a wrapped toolbar.
 2026-09-26 15:27:51 +02:00
tim 2214a6ae38 Mark the active Text or Image tab. 
The active tab stays solid green, and the other tab is pale with green
text. A tab whose field failed validation now shows red text.
 2026-09-26 15:27:51 +02:00
tim ea5732ff83 Style the story search on the edit page. 
Round the input like the other form inputs, and add space above the list.
 2026-09-26 15:27:51 +02:00
tim 20d0610200 Lay out the publishing forms in one column on phones. 
Below 600px: labels above full-width inputs, 44px touch targets, 16px
text, and the tabs on the top border of the story box.
 2026-09-26 15:27:51 +02:00
tim 5593341b04 Add a README for the tests, and block the development files. 2026-09-26 15:27:51 +02:00
tim b7022ab486 Add JavaScript tests. 
Run "npm install", then "npm test".
 2026-09-26 03:48:09 +02:00
tim ed959888b4 Add PHP unit tests and page tests. 
Run "composer install", then "composer test".
 2026-09-26 03:48:09 +02:00
tim 848c447c5b Put a line break after a rule, and show a link as it was typed. 2026-09-26 03:48:09 +02:00
tim 7d8cd8a89d Refuse an upload name that ends in a new line. 2026-09-26 03:48:09 +02:00
tim a23f07cc48 Let the tests replace the database connection class. 2026-09-26 03:48:09 +02:00
tim 2c3a744e2e Turn the captcha off when RECAPTCHA_SITE_KEY is empty. 2026-09-26 00:19:21 +02:00
tim babe5361e7 Edit the story source in the textarea. 
Also close the special character window on a click outside it.
 2026-09-26 00:10:14 +02:00
tim 6c745ed6a9 Use solid borders and quieter colors in the forms and the editor. 2026-09-26 00:10:06 +02:00
tim a9daa6a792 Replace TinyMCE 4.2.8 with a small local editor. 
TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar
and writes the same HTML. The textarea still posts the story.
 2026-09-25 22:58:05 +02:00
tim aee8a830d7 Write the pager page size in words without PEAR. 2026-09-25 22:32:11 +02:00
tim 589ae4c1fa Give the Post button its own id. 2026-09-25 22:12:35 +02:00
tim 1c76245808 Mark the Comments label when it fails validation. 2026-09-25 22:12:27 +02:00
tim 94db52e20d Keep line breaks in the new-submission email. 2026-09-25 22:12:00 +02:00
tim 601df8a9be Apply the en dash to number ranges in stories. 
A typo ($stort) threw the result away.
 2026-09-25 22:11:31 +02:00
tim f78fd09710 Accept only whole numbers for start and show, and cap show at 50. 2026-09-25 22:11:03 +02:00
tim f97bdecbc1 Log database errors instead of showing them. 
display_errors is off unless DISPLAY_ERRORS is set in .env.
 2026-09-25 21:57:11 +02:00
tim bcba2e1ca3 Remove unused old libraries and archives. 
TinyMCE 3.3.8, HTML Purifier 3.0.0 and the archives. Their example
scripts could be reached from the web.
 2026-09-25 21:55:53 +02:00
tim 720bf91ff2 Escape RSS feed fields so the feed is valid XML. 2026-09-25 21:55:02 +02:00
tim 1468cf7138 Require a captcha for visitor submissions and for login. 
Without the form field, the check was skipped. A solved captcha lasts
30 minutes in the session.
 2026-09-25 21:54:14 +02:00
tim 1698680e24 Serve stored images safely and drop committed uploads. 
display.php takes the type from the image data, refuses anything else,
and sends nosniff. Remove the nine uploads in graphics/tmp.
 2026-09-25 21:48:17 +02:00
tim c5ce7661f5 Limit failed logins. 
At most 5 per username and address, 20 per address and 50 per username
in 15 minutes.
 2026-09-25 21:46:38 +02:00
tim 0f00cf8f49 Stop the page after each HTTPS redirect. 2026-09-25 21:45:19 +02:00
tim 1541ab8411 Clear the session cookie with the same domain on logout. 2026-09-25 21:44:42 +02:00
tim d8c05e82b1 Make the session cookie last until the browser closes. 
The lifetime was a timestamp, so the cookie expired in about 56 years.
 2026-09-25 21:42:56 +02:00
tim ee20dc6eda Store persistent-login keys as SHA-256 hashes. 
Each device now has its own row. Editors must log in again once after
deploying.
 2026-09-25 21:42:34 +02:00
tim dfa6d71198 Hash editor passwords with Argon2id and upgrade old hashes. 
Old hashes are replaced at login. Widen the column before deploying:

  ALTER TABLE editors MODIFY password VARCHAR(255) NOT NULL;
 2026-09-25 21:41:36 +02:00
tim 15ad07423a Match usernames and session keys with = instead of LIKE. 
A username of "%" matched the first editor.
 2026-09-25 21:39:25 +02:00
tim 36c7fe97c5 Give editors a new session id when they log in. 2026-09-25 21:39:06 +02:00
tim 41c46a43c6 Add CSRF protection to every form that changes data. 
The logout link carries the token too, and the cookies get SameSite=Lax.
 2026-09-25 21:38:22 +02:00
tim f6bdf10228 Escape request and database values in forms and links. 
Add form_value() in html.lib.php.
 2026-09-25 21:36:27 +02:00
tim 00e1829f8b Escape story fields and clean story HTML with HTML Purifier. 
Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.
 2026-09-25 21:34:10 +02:00
tim e881ddb458 Keep uploads outside the web root. 
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
 2026-09-25 21:31:47 +02:00
tim c85f54116c Use bound parameters for every query that takes user data. 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
 2026-09-25 21:29:09 +02:00
tim cda0602c95 Show the queue and hidden stories to editors only. 
With allow_queue_image in the session, queue=1 showed a visitor the whole
queue and the hidden stories. display.php now shows a visitor only the
image they submitted.
 2026-09-25 21:26:32 +02:00
tim 0e5e742210 Stop visitors from writing to the live table. 
save_data() trusted the action and id in the POST data. A visitor can
now only add a new story to the queue, and cannot delete.
 2026-09-25 21:25:43 +02:00
tim 00829a0c0d Port the code to PHP 8.5. 
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
 2026-09-25 21:18:58 +02:00
tim 15e81e17cc Lay out the forms on a grid. 
From the live site: the submission, login and add editor forms use a
two-column CSS grid in place of floats.
 2026-09-25 23:32:08 +02:00
tim dd43940366 Rework the layout for small screens. 
From the live site: local Noto Sans, a flexible layout up to 1000px, and
a slide-out sidebar menu on small screens. Remove the unused Genericons
font and logo images.
 2026-09-25 23:32:08 +02:00
tim b94dd648ec Ensure scripts work without PHP short tags. 2018-11-14 00:20:05 +02:00
tim 14ce02fcfc Fix for fluid width. 2015-11-22 12:18:15 +02:00
tim 2cf83531bd Add the actual font (mostly for historical record) 2015-11-22 02:26:16 +02:00
tim 3b8f5e6599 Fix some layout problems, and caching issues. 2015-11-22 01:43:29 +02:00
tim 925a8572d0 Fix captchas 2015-11-22 00:22:34 +02:00
tim 602d644181 Fix responsive layout. 2015-11-21 23:27:53 +02:00
tim f3fd6fd3f1 A number of changes to the CSS, page layout (moved to HTML5), and updated the editor. 2015-11-21 21:54:02 +02:00
tim a00c1b4c9d Fix some issues with secure cookies being overwritten by insecure site. 
Now, /publish/{edit,addeditor,login,logout} must be accessed via
https://; other pages should not be (but can be).
 2014-04-24 09:56:25 +02:00
tim 7fc40728f5 Initial commit. 2013-05-17 23:38:44 +02:00