tim
601df8a9be
Apply the en dash to number ranges in stories.
...
A typo ($stort) threw the result away.
2026-09-25 22:11:31 +02:00
tim
f97bdecbc1
Log database errors instead of showing them.
...
display_errors is off unless DISPLAY_ERRORS is set in .env.
2026-09-25 21:57:11 +02:00
tim
1468cf7138
Require a captcha for visitor submissions and for login.
...
Without the form field, the check was skipped. A solved captcha lasts
30 minutes in the session.
2026-09-25 21:54:14 +02:00
tim
00e1829f8b
Escape story fields and clean story HTML with HTML Purifier.
...
Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.
2026-09-25 21:34:10 +02:00
tim
e881ddb458
Keep uploads outside the web root.
...
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
2026-09-25 21:31:47 +02:00
tim
c85f54116c
Use bound parameters for every query that takes user data.
...
The queue image query took $id without quotes or a check, which allowed
SQL injection.
2026-09-25 21:29:09 +02:00
tim
0e5e742210
Stop visitors from writing to the live table.
...
save_data() trusted the action and id in the POST data. A visitor can
now only add a new story to the queue, and cannot delete.
2026-09-25 21:25:43 +02:00
tim
00829a0c0d
Port the code to PHP 8.5.
...
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
2026-09-25 21:18:58 +02:00
tim
7fc40728f5
Initial commit.
2013-05-17 23:38:44 +02:00
tim