tim
41c46a43c6
Add CSRF protection to every form that changes data.
...
The logout link carries the token too, and the cookies get SameSite=Lax.
2026-09-25 21:38:22 +02:00
tim
f6bdf10228
Escape request and database values in forms and links.
...
Add form_value() in html.lib.php.
2026-09-25 21:36:27 +02:00
tim
00e1829f8b
Escape story fields and clean story HTML with HTML Purifier.
...
Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.
2026-09-25 21:34:10 +02:00
tim
e881ddb458
Keep uploads outside the web root.
...
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
2026-09-25 21:31:47 +02:00
tim
c85f54116c
Use bound parameters for every query that takes user data.
...
The queue image query took $id without quotes or a check, which allowed
SQL injection.
2026-09-25 21:29:09 +02:00
tim
cda0602c95
Show the queue and hidden stories to editors only.
...
With allow_queue_image in the session, queue=1 showed a visitor the whole
queue and the hidden stories. display.php now shows a visitor only the
image they submitted.
2026-09-25 21:26:32 +02:00
tim
0e5e742210
Stop visitors from writing to the live table.
...
save_data() trusted the action and id in the POST data. A visitor can
now only add a new story to the queue, and cannot delete.
2026-09-25 21:25:43 +02:00
tim
00829a0c0d
Port the code to PHP 8.5.
...
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
2026-09-25 21:18:58 +02:00
tim
15e81e17cc
Lay out the forms on a grid.
...
From the live site: the submission, login and add editor forms use a
two-column CSS grid in place of floats.
2026-09-25 23:32:08 +02:00
tim
dd43940366
Rework the layout for small screens.
...
From the live site: local Noto Sans, a flexible layout up to 1000px, and
a slide-out sidebar menu on small screens. Remove the unused Genericons
font and logo images.
2026-09-25 23:32:08 +02:00
tim
b94dd648ec
Ensure scripts work without PHP short tags.
2018-11-14 00:20:05 +02:00
tim
14ce02fcfc
Fix for fluid width.
2015-11-22 12:18:15 +02:00
tim
2cf83531bd
Add the actual font (mostly for historical record)
2015-11-22 02:26:16 +02:00
tim
3b8f5e6599
Fix some layout problems, and caching issues.
2015-11-22 01:43:29 +02:00
tim
925a8572d0
Fix captchas
2015-11-22 00:22:34 +02:00
tim
602d644181
Fix responsive layout.
2015-11-21 23:27:53 +02:00
tim
f3fd6fd3f1
A number of changes to the CSS, page layout (moved to HTML5), and updated the editor.
2015-11-21 21:54:02 +02:00
tim
a00c1b4c9d
Fix some issues with secure cookies being overwritten by insecure site.
...
Now, /publish/{edit,addeditor,login,logout} must be accessed via
https://; other pages should not be (but can be).
2014-04-24 09:56:25 +02:00
tim
7fc40728f5
Initial commit.
2013-05-17 23:38:44 +02:00
tim