tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity
75 Commits 2 Branches 0 Tags
71f768bff29ed2835c98c52d65e84bbfe0c6f6d3
Commit Graph
13 Commits
Author SHA1 Message Date
tim ed8918e7fd Refuse session ids that PHP did not make. 2026-09-26 15:27:51 +02:00
tim fe30a0aaa1 Do not let caches keep queued or hidden images. 2026-09-26 15:27:51 +02:00
tim 3df88e0b4c Check editor accounts. 
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
 2026-09-26 15:27:51 +02:00
tim 5d657d7e45 Take the site address from SITE_URL. 
The feed links, the notification email, the webmaster address and the cookie domain now use it.
 2026-09-26 15:27:51 +02:00
tim f97bdecbc1 Log database errors instead of showing them. 
display_errors is off unless DISPLAY_ERRORS is set in .env.
 2026-09-25 21:57:11 +02:00
tim 1698680e24 Serve stored images safely and drop committed uploads. 
display.php takes the type from the image data, refuses anything else,
and sends nosniff. Remove the nine uploads in graphics/tmp.
 2026-09-25 21:48:17 +02:00
tim d8c05e82b1 Make the session cookie last until the browser closes. 
The lifetime was a timestamp, so the cookie expired in about 56 years.
 2026-09-25 21:42:56 +02:00
tim 41c46a43c6 Add CSRF protection to every form that changes data. 
The logout link carries the token too, and the cookies get SameSite=Lax.
 2026-09-25 21:38:22 +02:00
tim e881ddb458 Keep uploads outside the web root. 
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
 2026-09-25 21:31:47 +02:00
tim c85f54116c Use bound parameters for every query that takes user data. 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
 2026-09-25 21:29:09 +02:00
tim cda0602c95 Show the queue and hidden stories to editors only. 
With allow_queue_image in the session, queue=1 showed a visitor the whole
queue and the hidden stories. display.php now shows a visitor only the
image they submitted.
 2026-09-25 21:26:32 +02:00
tim 00829a0c0d Port the code to PHP 8.5. 
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
 2026-09-25 21:18:58 +02:00
tim 7fc40728f5 Initial commit. 2013-05-17 23:38:44 +02:00