tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity
59 Commits 2 Branches 0 Tags
c4fcef21aa3e1e3be832b0abafebad70dacde9d1
Commit Graph
15 Commits
Author SHA1 Message Date
tim 3df88e0b4c Check editor accounts. 
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
 2026-09-26 15:27:51 +02:00
tim be814a3ba5 Take redirects off the Host header. 
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
 2026-09-26 15:27:51 +02:00
tim 0f00cf8f49 Stop the page after each HTTPS redirect. 2026-09-25 21:45:19 +02:00
tim dfa6d71198 Hash editor passwords with Argon2id and upgrade old hashes. 
Old hashes are replaced at login. Widen the column before deploying:

  ALTER TABLE editors MODIFY password VARCHAR(255) NOT NULL;
 2026-09-25 21:41:36 +02:00
tim 41c46a43c6 Add CSRF protection to every form that changes data. 
The logout link carries the token too, and the cookies get SameSite=Lax.
 2026-09-25 21:38:22 +02:00
tim f6bdf10228 Escape request and database values in forms and links. 
Add form_value() in html.lib.php.
 2026-09-25 21:36:27 +02:00
tim c85f54116c Use bound parameters for every query that takes user data. 
The queue image query took $id without quotes or a check, which allowed
SQL injection.
 2026-09-25 21:29:09 +02:00
tim 00829a0c0d Port the code to PHP 8.5. 
Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().
 2026-09-25 21:18:58 +02:00
tim 15e81e17cc Lay out the forms on a grid. 
From the live site: the submission, login and add editor forms use a
two-column CSS grid in place of floats.
 2026-09-25 23:32:08 +02:00
tim dd43940366 Rework the layout for small screens. 
From the live site: local Noto Sans, a flexible layout up to 1000px, and
a slide-out sidebar menu on small screens. Remove the unused Genericons
font and logo images.
 2026-09-25 23:32:08 +02:00
tim 3b8f5e6599 Fix some layout problems, and caching issues. 2015-11-22 01:43:29 +02:00
tim 602d644181 Fix responsive layout. 2015-11-21 23:27:53 +02:00
tim f3fd6fd3f1 A number of changes to the CSS, page layout (moved to HTML5), and updated the editor. 2015-11-21 21:54:02 +02:00
tim a00c1b4c9d Fix some issues with secure cookies being overwritten by insecure site. 
Now, /publish/{edit,addeditor,login,logout} must be accessed via
https://; other pages should not be (but can be).
 2014-04-24 09:56:25 +02:00
tim 7fc40728f5 Initial commit. 2013-05-17 23:38:44 +02:00