tim
30b275b902
Send HSTS on HTTPS pages.
2026-09-26 15:27:51 +02:00
tim
b6a1eff3e6
Stop other sites from framing the pages.
2026-09-26 15:27:51 +02:00
tim
ed6f98e0ac
Limit a story to 64 KB before HTML Purifier runs.
...
A preview purified any posted story, even without a token or a captcha. A few megabytes took seconds and hundreds of megabytes.
2026-09-26 15:27:51 +02:00
tim
bf36ec25fd
Load a saved story into the form for editors only.
...
Visitors could post an id to /publish and read the author's email address.
2026-09-26 15:27:51 +02:00
tim
8f4851e576
Reject invalid uploads and expand flow tests.
2026-09-26 15:27:51 +02:00
tim
716a609f4e
Hide form parts with the hidden attribute.
2026-09-26 15:27:51 +02:00
tim
65426a327d
Remove Google Analytics.
...
Google shut down the Universal Analytics script that the pages loaded,
and we haven't used it probably a decade
2026-09-26 15:27:51 +02:00
tim
77800174c9
Use the reCAPTCHA Enterprise API.
2026-09-26 15:27:51 +02:00
tim
45bca9e76a
Use the default for an empty UPLOAD_DIR_LIMIT_MB.
...
An empty or bad value gave a limit of zero, so previews kept no images.
2026-09-26 15:27:51 +02:00
tim
504d363642
Limit each image to 1 MB.
...
UPLOAD_MAX_MB changes the limit, and UPLOAD_MAX_MB=none removes it.
2026-09-26 15:27:51 +02:00
tim
c4fcef21aa
Limit the images that previews keep.
...
A preview that fails the captcha or the form token keeps no image. A session keeps one image, the directory has a size limit, and abandoned images go at the next upload.
2026-09-26 15:27:51 +02:00
tim
fe30a0aaa1
Do not let caches keep queued or hidden images.
2026-09-26 15:27:51 +02:00
tim
3df88e0b4c
Check editor accounts.
...
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
2026-09-26 15:27:51 +02:00
tim
5d657d7e45
Take the site address from SITE_URL.
...
The feed links, the notification email, the webmaster address and the cookie domain now use it.
2026-09-26 15:27:51 +02:00
tim
52f4855850
Ignore request values that are not strings.
...
An array action or username no longer causes a PHP error.
2026-09-26 15:27:51 +02:00
tim
be814a3ba5
Take redirects off the Host header.
...
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
2026-09-26 15:27:51 +02:00
tim
4657088d23
Keep the space of the line-break note under the image box.
...
An invisible copy of the note sits under the image box, so the page
does not jump when the tabs change.
2026-09-26 15:27:51 +02:00
tim
ed959888b4
Add PHP unit tests and page tests.
...
Run "composer install", then "composer test".
2026-09-26 03:48:09 +02:00
tim