tim
8f4851e576
Reject invalid uploads and expand flow tests.
2026-09-26 15:27:51 +02:00
tim
504d363642
Limit each image to 1 MB.
...
UPLOAD_MAX_MB changes the limit, and UPLOAD_MAX_MB=none removes it.
2026-09-26 15:27:51 +02:00
tim
c4fcef21aa
Limit the images that previews keep.
...
A preview that fails the captcha or the form token keeps no image. A session keeps one image, the directory has a size limit, and abandoned images go at the next upload.
2026-09-26 15:27:51 +02:00
tim
5d657d7e45
Take the site address from SITE_URL.
...
The feed links, the notification email, the webmaster address and the cookie domain now use it.
2026-09-26 15:27:51 +02:00
tim
94db52e20d
Keep line breaks in the new-submission email.
2026-09-25 22:12:00 +02:00
tim
601df8a9be
Apply the en dash to number ranges in stories.
...
A typo ($stort) threw the result away.
2026-09-25 22:11:31 +02:00
tim
f97bdecbc1
Log database errors instead of showing them.
...
display_errors is off unless DISPLAY_ERRORS is set in .env.
2026-09-25 21:57:11 +02:00
tim
1468cf7138
Require a captcha for visitor submissions and for login.
...
Without the form field, the check was skipped. A solved captcha lasts
30 minutes in the session.
2026-09-25 21:54:14 +02:00
tim
00e1829f8b
Escape story fields and clean story HTML with HTML Purifier.
...
Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.
2026-09-25 21:34:10 +02:00
tim
e881ddb458
Keep uploads outside the web root.
...
save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.
2026-09-25 21:31:47 +02:00
tim
c85f54116c
Use bound parameters for every query that takes user data.
...
The queue image query took $id without quotes or a check, which allowed
SQL injection.
2026-09-25 21:29:09 +02:00
tim
0e5e742210
Stop visitors from writing to the live table.
...
save_data() trusted the action and id in the POST data. A visitor can
now only add a new story to the queue, and cannot delete.
2026-09-25 21:25:43 +02:00
tim
00829a0c0d
Port the code to PHP 8.5.
...
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
2026-09-25 21:18:58 +02:00
tim
7fc40728f5
Initial commit.
2013-05-17 23:38:44 +02:00
tim