tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity
78 Commits 2 Branches 0 Tags
277ea4470c5091d5924eb68acc4960072b9df4ad
Commit Graph
14 Commits
Author SHA1 Message Date
tim 277ea4470c Fix favicon links 2026-09-26 15:27:51 +02:00
tim 52f4855850 Ignore request values that are not strings. 
An array action or username no longer causes a PHP error.
 2026-09-26 15:27:51 +02:00
tim be814a3ba5 Take redirects off the Host header. 
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
 2026-09-26 15:27:51 +02:00
tim a9daa6a792 Replace TinyMCE 4.2.8 with a small local editor. 
TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar
and writes the same HTML. The textarea still posts the story.
 2026-09-25 22:58:05 +02:00
tim 0f00cf8f49 Stop the page after each HTTPS redirect. 2026-09-25 21:45:19 +02:00
tim 41c46a43c6 Add CSRF protection to every form that changes data. 
The logout link carries the token too, and the cookies get SameSite=Lax.
 2026-09-25 21:38:22 +02:00
tim 00829a0c0d Port the code to PHP 8.5. 
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
 2026-09-25 21:18:58 +02:00
tim dd43940366 Rework the layout for small screens. 
From the live site: local Noto Sans, a flexible layout up to 1000px, and
a slide-out sidebar menu on small screens. Remove the unused Genericons
font and logo images.
 2026-09-25 23:32:08 +02:00
tim 3b8f5e6599 Fix some layout problems, and caching issues. 2015-11-22 01:43:29 +02:00
tim 925a8572d0 Fix captchas 2015-11-22 00:22:34 +02:00
tim 602d644181 Fix responsive layout. 2015-11-21 23:27:53 +02:00
tim f3fd6fd3f1 A number of changes to the CSS, page layout (moved to HTML5), and updated the editor. 2015-11-21 21:54:02 +02:00
tim a00c1b4c9d Fix some issues with secure cookies being overwritten by insecure site. 
Now, /publish/{edit,addeditor,login,logout} must be accessed via
https://; other pages should not be (but can be).
 2014-04-24 09:56:25 +02:00
tim 7fc40728f5 Initial commit. 2013-05-17 23:38:44 +02:00