2 Commits
Author SHA1 Message Date
dominicf 58b51e6e36 Fix err not propogating in GetAdmin 2026-08-23 18:09:11 -04:00
dominicf 16678c4e7a Patch XSS vuln 2026-08-23 18:06:29 -04:00
2 changed files with 27 additions and 30 deletions
+20 -20
View File
@@ -20,7 +20,7 @@ type Queryer interface {
func GetBoards(db *sql.DB) ([]Board, error) { func GetBoards(db *sql.DB) ([]Board, error) {
rows, err := db.Query(` rows, err := db.Query(`
SELECT id, name, slug, tag SELECT id, name, slug, tag
FROM boards ORDER BY slug`) FROM boards ORDER BY slug`)
if err != nil { if err != nil {
@@ -43,8 +43,8 @@ func GetBoards(db *sql.DB) ([]Board, error) {
func GetBoard(db *sql.DB, slug string) (Board, error) { func GetBoard(db *sql.DB, slug string) (Board, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT id, name, slug, tag SELECT id, name, slug, tag
FROM boards FROM boards
WHERE slug = ?`, slug) WHERE slug = ?`, slug)
var result Board var result Board
@@ -58,8 +58,8 @@ func GetBoard(db *sql.DB, slug string) (Board, error) {
func GetThreads(db *sql.DB, boardSlug string) ([]Thread, error) { func GetThreads(db *sql.DB, boardSlug string) ([]Thread, error) {
rows, err := db.Query(` rows, err := db.Query(`
SELECT id, board_slug, subject, created_at, bumped_at, pinned, locked SELECT id, board_slug, subject, created_at, bumped_at, pinned, locked
FROM threads FROM threads
WHERE board_slug = ?`, boardSlug) WHERE board_slug = ?`, boardSlug)
if err != nil { if err != nil {
@@ -84,8 +84,8 @@ func GetThreads(db *sql.DB, boardSlug string) ([]Thread, error) {
func GetThread(db *sql.DB, threadId int) (Thread, error) { func GetThread(db *sql.DB, threadId int) (Thread, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT id, board_slug, subject, created_at, bumped_at, pinned, locked SELECT id, board_slug, subject, created_at, bumped_at, pinned, locked
FROM threads FROM threads
WHERE id = ?`, threadId) WHERE id = ?`, threadId)
var t Thread var t Thread
@@ -212,9 +212,9 @@ func DeleteThread(db Queryer, threadId int) error {
func GetPosts(db *sql.DB, threadId int) ([]Post, error) { func GetPosts(db *sql.DB, threadId int) ([]Post, error) {
rows, err := db.Query(` rows, err := db.Query(`
SELECT id, thread_id, author, body, created_at, media_path, SELECT id, thread_id, author, body, created_at, media_path,
ip_hash, number, thumb_path, banned ip_hash, number, thumb_path, banned
FROM posts FROM posts
WHERE thread_id = ?`, threadId) WHERE thread_id = ?`, threadId)
if err != nil { if err != nil {
@@ -239,10 +239,10 @@ func GetPosts(db *sql.DB, threadId int) ([]Post, error) {
func GetOriginalPost(db *sql.DB, threadId int) (Post, error) { func GetOriginalPost(db *sql.DB, threadId int) (Post, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT id, thread_id, author, body, created_at, media_path, SELECT id, thread_id, author, body, created_at, media_path,
ip_hash, number, thumb_path, banned ip_hash, number, thumb_path, banned
FROM posts FROM posts
WHERE thread_id = ? WHERE thread_id = ?
ORDER BY created_at ASC LIMIT 1`, threadId) ORDER BY created_at ASC LIMIT 1`, threadId)
var r Post var r Post
@@ -257,9 +257,9 @@ func GetOriginalPost(db *sql.DB, threadId int) (Post, error) {
func GetPost(db *sql.DB, postId int) (Post, error) { func GetPost(db *sql.DB, postId int) (Post, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT id, thread_id, author, body, created_at, media_path, SELECT id, thread_id, author, body, created_at, media_path,
ip_hash, number, thumb_path, banned ip_hash, number, thumb_path, banned
FROM posts FROM posts
WHERE id = ?`, postId) WHERE id = ?`, postId)
var r Post var r Post
@@ -275,7 +275,7 @@ func GetPost(db *sql.DB, postId int) (Post, error) {
func PutPost(db Queryer, boardSlug string, threadId int, body string, mediaPath string, thumbPath string, ip_hash string) error { func PutPost(db Queryer, boardSlug string, threadId int, body string, mediaPath string, thumbPath string, ip_hash string) error {
row := db.QueryRow(` row := db.QueryRow(`
SELECT MAX(p.number) SELECT MAX(p.number)
FROM posts p FROM posts p
INNER JOIN threads t ON p.thread_id = t.id INNER JOIN threads t ON p.thread_id = t.id
WHERE t.board_slug = ?`, boardSlug) WHERE t.board_slug = ?`, boardSlug)
@@ -290,7 +290,7 @@ func PutPost(db Queryer, boardSlug string, threadId int, body string, mediaPath
} }
_, err := db.Exec(` _, err := db.Exec(`
INSERT INTO posts (thread_id, body, media_path, ip_hash, number, thumb_path) INSERT INTO posts (thread_id, body, media_path, ip_hash, number, thumb_path)
VALUES (?, ?, ?, ?, ?, ?)`, threadId, body, mediaPath, ip_hash, newPostNumber, thumbPath) VALUES (?, ?, ?, ?, ?, ?)`, threadId, body, mediaPath, ip_hash, newPostNumber, thumbPath)
if err != nil { if err != nil {
return err return err
@@ -337,7 +337,7 @@ func DeletePost(db *sql.DB, postId int) error {
// delete post // delete post
_, err := db.Exec(` _, err := db.Exec(`
DELETE FROM posts DELETE FROM posts
WHERE id = ?`, postId) WHERE id = ?`, postId)
if err != nil { if err != nil {
return err return err
@@ -364,7 +364,7 @@ var ErrBanNotFound = errors.New("ban not found")
func GetBan(db *sql.DB, ip string) (Ban, error) { func GetBan(db *sql.DB, ip string) (Ban, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT ip_hash, reason, expiration SELECT ip_hash, reason, expiration
FROM bans FROM bans
where ip_hash = ?`, ip) where ip_hash = ?`, ip)
@@ -398,7 +398,7 @@ func GetAdmin(db *sql.DB, username string) (Admin, error) {
var result Admin var result Admin
if err := row.Scan(&result.Username, &result.Password); err != nil { if err := row.Scan(&result.Username, &result.Password); err != nil {
return Admin{}, nil return Admin{}, err
} }
return result, nil return result, nil
+7 -10
View File
@@ -50,16 +50,8 @@ func EnrichPost(body string) string {
var b strings.Builder var b strings.Builder
for _, rawLine := range strings.Split(body, "\n") { for _, rawLine := range strings.Split(body, "\n") {
line := urlRx.ReplaceAllStringFunc(rawLine, func(u string) string {
esc := template.HTMLEscapeString(u)
return fmt.Sprintf(
`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
esc,
)
})
var outLine string var outLine string
for i, rawWord := range strings.Split(line, " ") { for i, rawWord := range strings.Split(rawLine, " ") {
var outWord string var outWord string
if strings.HasPrefix(rawWord, ">>") { if strings.HasPrefix(rawWord, ">>") {
postId := strings.TrimPrefix(rawWord, ">>") postId := strings.TrimPrefix(rawWord, ">>")
@@ -68,8 +60,13 @@ func EnrichPost(body string) string {
`onmouseleave="highlightPost(%[1]s,event,false)" href="#post-%[1]s" class="reply-link">%[2]s</a>`, `onmouseleave="highlightPost(%[1]s,event,false)" href="#post-%[1]s" class="reply-link">%[2]s</a>`,
postId, template.HTMLEscapeString(rawWord), postId, template.HTMLEscapeString(rawWord),
) )
} else if urlRx.MatchString(rawWord) {
outWord = fmt.Sprintf(
`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
template.HTMLEscapeString(rawWord),
)
} else { } else {
outWord = rawWord outWord = template.HTMLEscapeString(rawWord)
} }
if i != 0 { if i != 0 {
outLine += " " outLine += " "