tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity
51 Commits 2 Branches 0 Tags
2214a6ae38806c2089ef3f96e2d1989e2a824cb5
Commit Graph
51 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
tim 2214a6ae38 Mark the active Text or Image tab. 
The active tab stays solid green, and the other tab is pale with green
text. A tab whose field failed validation now shows red text.
 2026-09-26 15:27:51 +02:00
tim ea5732ff83 Style the story search on the edit page. 
Round the input like the other form inputs, and add space above the list.
 2026-09-26 15:27:51 +02:00
tim 20d0610200 Lay out the publishing forms in one column on phones. 
Below 600px: labels above full-width inputs, 44px touch targets, 16px
text, and the tabs on the top border of the story box.
 2026-09-26 15:27:51 +02:00
tim 5593341b04 Add a README for the tests, and block the development files. 2026-09-26 15:27:51 +02:00
tim b7022ab486 Add JavaScript tests. 
Run "npm install", then "npm test".
 2026-09-26 03:48:09 +02:00
tim ed959888b4 Add PHP unit tests and page tests. 
Run "composer install", then "composer test".
 2026-09-26 03:48:09 +02:00
tim 848c447c5b Put a line break after a rule, and show a link as it was typed. 2026-09-26 03:48:09 +02:00
tim 7d8cd8a89d Refuse an upload name that ends in a new line. 2026-09-26 03:48:09 +02:00
tim a23f07cc48 Let the tests replace the database connection class. 2026-09-26 03:48:09 +02:00
tim 2c3a744e2e Turn the captcha off when RECAPTCHA_SITE_KEY is empty. 2026-09-26 00:19:21 +02:00
tim babe5361e7 Edit the story source in the textarea. 
Also close the special character window on a click outside it.
 2026-09-26 00:10:14 +02:00
tim 6c745ed6a9 Use solid borders and quieter colors in the forms and the editor. 2026-09-26 00:10:06 +02:00
tim a9daa6a792 Replace TinyMCE 4.2.8 with a small local editor. 
TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar
and writes the same HTML. The textarea still posts the story.
 2026-09-25 22:58:05 +02:00
tim aee8a830d7 Write the pager page size in words without PEAR. 2026-09-25 22:32:11 +02:00
tim 589ae4c1fa Give the Post button its own id. 2026-09-25 22:12:35 +02:00
tim 1c76245808 Mark the Comments label when it fails validation. 2026-09-25 22:12:27 +02:00
tim 94db52e20d Keep line breaks in the new-submission email. 2026-09-25 22:12:00 +02:00
tim 601df8a9be Apply the en dash to number ranges in stories. 
A typo ($stort) threw the result away.
 2026-09-25 22:11:31 +02:00
tim f78fd09710 Accept only whole numbers for start and show, and cap show at 50. 2026-09-25 22:11:03 +02:00
tim f97bdecbc1 Log database errors instead of showing them. 
display_errors is off unless DISPLAY_ERRORS is set in .env.
 2026-09-25 21:57:11 +02:00
tim bcba2e1ca3 Remove unused old libraries and archives. 
TinyMCE 3.3.8, HTML Purifier 3.0.0 and the archives. Their example
scripts could be reached from the web.
 2026-09-25 21:55:53 +02:00
tim 720bf91ff2 Escape RSS feed fields so the feed is valid XML. 2026-09-25 21:55:02 +02:00
tim 1468cf7138 Require a captcha for visitor submissions and for login. 
Without the form field, the check was skipped. A solved captcha lasts
30 minutes in the session.
 2026-09-25 21:54:14 +02:00
tim 1698680e24 Serve stored images safely and drop committed uploads. 
display.php takes the type from the image data, refuses anything else,
and sends nosniff. Remove the nine uploads in graphics/tmp.
 2026-09-25 21:48:17 +02:00
tim c5ce7661f5 Limit failed logins. 
At most 5 per username and address, 20 per address and 50 per username
in 15 minutes.
 2026-09-25 21:46:38 +02:00
tim 0f00cf8f49 Stop the page after each HTTPS redirect. 2026-09-25 21:45:19 +02:00
tim 1541ab8411 Clear the session cookie with the same domain on logout. 2026-09-25 21:44:42 +02:00
tim d8c05e82b1 Make the session cookie last until the browser closes. 
The lifetime was a timestamp, so the cookie expired in about 56 years.
 2026-09-25 21:42:56 +02:00
tim ee20dc6eda Store persistent-login keys as SHA-256 hashes. 
Each device now has its own row. Editors must log in again once after
deploying.
 2026-09-25 21:42:34 +02:00
tim dfa6d71198 Hash editor passwords with Argon2id and upgrade old hashes. 
Old hashes are replaced at login. Widen the column before deploying:

  ALTER TABLE editors MODIFY password VARCHAR(255) NOT NULL;
 2026-09-25 21:41:36 +02:00
tim 15ad07423a Match usernames and session keys with = instead of LIKE. 
A username of "%" matched the first editor.
 2026-09-25 21:39:25 +02:00
tim 36c7fe97c5 Give editors a new session id when they log in. 2026-09-25 21:39:06 +02:00
tim 41c46a43c6 Add CSRF protection to every form that changes data. 
The logout link carries the token too, and the cookies get SameSite=Lax.
 2026-09-25 21:38:22 +02:00
tim f6bdf10228 Escape request and database values in forms and links. 
Add form_value() in html.lib.php.
 2026-09-25 21:36:27 +02:00
tim 00e1829f8b Escape story fields and clean story HTML with HTML Purifier. 
Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.
 2026-09-25 21:34:10 +02:00
tim e881ddb458 Keep uploads outside the web root. 
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
 2026-09-25 21:31:47 +02:00
tim c85f54116c Use bound parameters for every query that takes user data. 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
 2026-09-25 21:29:09 +02:00
tim cda0602c95 Show the queue and hidden stories to editors only. 
With allow_queue_image in the session, queue=1 showed a visitor the whole
queue and the hidden stories. display.php now shows a visitor only the
image they submitted.
 2026-09-25 21:26:32 +02:00
tim 0e5e742210 Stop visitors from writing to the live table. 
save_data() trusted the action and id in the POST data. A visitor can
now only add a new story to the queue, and cannot delete.
 2026-09-25 21:25:43 +02:00
tim 00829a0c0d Port the code to PHP 8.5. 
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
 2026-09-25 21:18:58 +02:00
tim 15e81e17cc Lay out the forms on a grid. 
From the live site: the submission, login and add editor forms use a
two-column CSS grid in place of floats.
 2026-09-25 23:32:08 +02:00
tim dd43940366 Rework the layout for small screens. 
From the live site: local Noto Sans, a flexible layout up to 1000px, and
a slide-out sidebar menu on small screens. Remove the unused Genericons
font and logo images.
 2026-09-25 23:32:08 +02:00
tim b94dd648ec Ensure scripts work without PHP short tags. 2018-11-14 00:20:05 +02:00
tim 14ce02fcfc Fix for fluid width. 2015-11-22 12:18:15 +02:00
tim 2cf83531bd Add the actual font (mostly for historical record) 2015-11-22 02:26:16 +02:00
tim 3b8f5e6599 Fix some layout problems, and caching issues. 2015-11-22 01:43:29 +02:00
tim 925a8572d0 Fix captchas 2015-11-22 00:22:34 +02:00
tim 602d644181 Fix responsive layout. 2015-11-21 23:27:53 +02:00
tim f3fd6fd3f1 A number of changes to the CSS, page layout (moved to HTML5), and updated the editor. 2015-11-21 21:54:02 +02:00
tim a00c1b4c9d Fix some issues with secure cookies being overwritten by insecure site. 
Now, /publish/{edit,addeditor,login,logout} must be accessed via
https://; other pages should not be (but can be).
 2014-04-24 09:56:25 +02:00