4 Commits
Author SHA1 Message Date
dominicf 9026b43c83 Update admin 2026-08-23 18:19:22 -04:00
dominicf 58b51e6e36 Fix err not propogating in GetAdmin 2026-08-23 18:09:11 -04:00
dominicf 16678c4e7a Patch XSS vuln 2026-08-23 18:06:29 -04:00
dominicf 6f3561a7ac Update favicon to comfychan 2026-08-23 17:21:33 -04:00
4 changed files with 32 additions and 35 deletions
+1 -1
View File
@@ -398,7 +398,7 @@ func GetAdmin(db *sql.DB, username string) (Admin, error) {
var result Admin var result Admin
if err := row.Scan(&result.Username, &result.Password); err != nil { if err := row.Scan(&result.Username, &result.Password); err != nil {
return Admin{}, nil return Admin{}, err
} }
return result, nil return result, nil
+1 -1
View File
@@ -61,4 +61,4 @@ INSERT INTO boards (slug, name, tag) VALUES
('gn', 'Goon', 'God is watching'); ('gn', 'Goon', 'God is watching');
INSERT INTO admins (username, password) VALUES INSERT INTO admins (username, password) VALUES
('admin', '$2a$10$vRP4/9O6SwyUziEUtBLQM.r9C2WujIIZ6yEgqGjhlBaFPvtpfdHPC'); ('admin', '$2a$10$hzmcLK2ZrEz0NTxr7eVuV.gn8shW.tQxD0D0vYUgAwADZly3U/BZ.');
+7 -10
View File
@@ -50,16 +50,8 @@ func EnrichPost(body string) string {
var b strings.Builder var b strings.Builder
for _, rawLine := range strings.Split(body, "\n") { for _, rawLine := range strings.Split(body, "\n") {
line := urlRx.ReplaceAllStringFunc(rawLine, func(u string) string {
esc := template.HTMLEscapeString(u)
return fmt.Sprintf(
`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
esc,
)
})
var outLine string var outLine string
for i, rawWord := range strings.Split(line, " ") { for i, rawWord := range strings.Split(rawLine, " ") {
var outWord string var outWord string
if strings.HasPrefix(rawWord, ">>") { if strings.HasPrefix(rawWord, ">>") {
postId := strings.TrimPrefix(rawWord, ">>") postId := strings.TrimPrefix(rawWord, ">>")
@@ -68,8 +60,13 @@ func EnrichPost(body string) string {
`onmouseleave="highlightPost(%[1]s,event,false)" href="#post-%[1]s" class="reply-link">%[2]s</a>`, `onmouseleave="highlightPost(%[1]s,event,false)" href="#post-%[1]s" class="reply-link">%[2]s</a>`,
postId, template.HTMLEscapeString(rawWord), postId, template.HTMLEscapeString(rawWord),
) )
} else if urlRx.MatchString(rawWord) {
outWord = fmt.Sprintf(
`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
template.HTMLEscapeString(rawWord),
)
} else { } else {
outWord = rawWord outWord = template.HTMLEscapeString(rawWord)
} }
if i != 0 { if i != 0 {
outLine += " " outLine += " "
Binary file not shown.

Before

Width:  |  Height:  |  Size: 1.1 KiB

After

Width:  |  Height:  |  Size: 4.2 KiB