tim
c8030b759d
Leave the image data out of the story lists.
...
A page of 50 stories read 50 images from the database only to see which stories had one.
2026-09-26 15:27:51 +02:00
tim
ed6f98e0ac
Limit a story to 64 KB before HTML Purifier runs.
...
A preview purified any posted story, even without a token or a captcha. A few megabytes took seconds and hundreds of megabytes.
2026-09-26 15:27:51 +02:00
tim
8f4851e576
Reject invalid uploads and expand flow tests.
2026-09-26 15:27:51 +02:00
tim
77800174c9
Use the reCAPTCHA Enterprise API.
2026-09-26 15:27:51 +02:00
tim
45bca9e76a
Use the default for an empty UPLOAD_DIR_LIMIT_MB.
...
An empty or bad value gave a limit of zero, so previews kept no images.
2026-09-26 15:27:51 +02:00
tim
504d363642
Limit each image to 1 MB.
...
UPLOAD_MAX_MB changes the limit, and UPLOAD_MAX_MB=none removes it.
2026-09-26 15:27:51 +02:00
tim
c4fcef21aa
Limit the images that previews keep.
...
A preview that fails the captcha or the form token keeps no image. A session keeps one image, the directory has a size limit, and abandoned images go at the next upload.
2026-09-26 15:27:51 +02:00
tim
3df88e0b4c
Check editor accounts.
...
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
2026-09-26 15:27:51 +02:00
tim
5d657d7e45
Take the site address from SITE_URL.
...
The feed links, the notification email, the webmaster address and the cookie domain now use it.
2026-09-26 15:27:51 +02:00
tim
ed959888b4
Add PHP unit tests and page tests.
...
Run "composer install", then "composer test".
2026-09-26 03:48:09 +02:00
tim