4 Commits
Author SHA1 Message Date
dominicf 9026b43c83 Update admin 2026-08-23 18:19:22 -04:00
dominicf 58b51e6e36 Fix err not propogating in GetAdmin 2026-08-23 18:09:11 -04:00
dominicf 16678c4e7a Patch XSS vuln 2026-08-23 18:06:29 -04:00
dominicf 6f3561a7ac Update favicon to comfychan 2026-08-23 17:21:33 -04:00
4 changed files with 32 additions and 35 deletions
+20 -20
View File
@@ -20,7 +20,7 @@ type Queryer interface {
func GetBoards(db *sql.DB) ([]Board, error) { func GetBoards(db *sql.DB) ([]Board, error) {
rows, err := db.Query(` rows, err := db.Query(`
SELECT id, name, slug, tag SELECT id, name, slug, tag
FROM boards ORDER BY slug`) FROM boards ORDER BY slug`)
if err != nil { if err != nil {
@@ -43,8 +43,8 @@ func GetBoards(db *sql.DB) ([]Board, error) {
func GetBoard(db *sql.DB, slug string) (Board, error) { func GetBoard(db *sql.DB, slug string) (Board, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT id, name, slug, tag SELECT id, name, slug, tag
FROM boards FROM boards
WHERE slug = ?`, slug) WHERE slug = ?`, slug)
var result Board var result Board
@@ -58,8 +58,8 @@ func GetBoard(db *sql.DB, slug string) (Board, error) {
func GetThreads(db *sql.DB, boardSlug string) ([]Thread, error) { func GetThreads(db *sql.DB, boardSlug string) ([]Thread, error) {
rows, err := db.Query(` rows, err := db.Query(`
SELECT id, board_slug, subject, created_at, bumped_at, pinned, locked SELECT id, board_slug, subject, created_at, bumped_at, pinned, locked
FROM threads FROM threads
WHERE board_slug = ?`, boardSlug) WHERE board_slug = ?`, boardSlug)
if err != nil { if err != nil {
@@ -84,8 +84,8 @@ func GetThreads(db *sql.DB, boardSlug string) ([]Thread, error) {
func GetThread(db *sql.DB, threadId int) (Thread, error) { func GetThread(db *sql.DB, threadId int) (Thread, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT id, board_slug, subject, created_at, bumped_at, pinned, locked SELECT id, board_slug, subject, created_at, bumped_at, pinned, locked
FROM threads FROM threads
WHERE id = ?`, threadId) WHERE id = ?`, threadId)
var t Thread var t Thread
@@ -212,9 +212,9 @@ func DeleteThread(db Queryer, threadId int) error {
func GetPosts(db *sql.DB, threadId int) ([]Post, error) { func GetPosts(db *sql.DB, threadId int) ([]Post, error) {
rows, err := db.Query(` rows, err := db.Query(`
SELECT id, thread_id, author, body, created_at, media_path, SELECT id, thread_id, author, body, created_at, media_path,
ip_hash, number, thumb_path, banned ip_hash, number, thumb_path, banned
FROM posts FROM posts
WHERE thread_id = ?`, threadId) WHERE thread_id = ?`, threadId)
if err != nil { if err != nil {
@@ -239,10 +239,10 @@ func GetPosts(db *sql.DB, threadId int) ([]Post, error) {
func GetOriginalPost(db *sql.DB, threadId int) (Post, error) { func GetOriginalPost(db *sql.DB, threadId int) (Post, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT id, thread_id, author, body, created_at, media_path, SELECT id, thread_id, author, body, created_at, media_path,
ip_hash, number, thumb_path, banned ip_hash, number, thumb_path, banned
FROM posts FROM posts
WHERE thread_id = ? WHERE thread_id = ?
ORDER BY created_at ASC LIMIT 1`, threadId) ORDER BY created_at ASC LIMIT 1`, threadId)
var r Post var r Post
@@ -257,9 +257,9 @@ func GetOriginalPost(db *sql.DB, threadId int) (Post, error) {
func GetPost(db *sql.DB, postId int) (Post, error) { func GetPost(db *sql.DB, postId int) (Post, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT id, thread_id, author, body, created_at, media_path, SELECT id, thread_id, author, body, created_at, media_path,
ip_hash, number, thumb_path, banned ip_hash, number, thumb_path, banned
FROM posts FROM posts
WHERE id = ?`, postId) WHERE id = ?`, postId)
var r Post var r Post
@@ -275,7 +275,7 @@ func GetPost(db *sql.DB, postId int) (Post, error) {
func PutPost(db Queryer, boardSlug string, threadId int, body string, mediaPath string, thumbPath string, ip_hash string) error { func PutPost(db Queryer, boardSlug string, threadId int, body string, mediaPath string, thumbPath string, ip_hash string) error {
row := db.QueryRow(` row := db.QueryRow(`
SELECT MAX(p.number) SELECT MAX(p.number)
FROM posts p FROM posts p
INNER JOIN threads t ON p.thread_id = t.id INNER JOIN threads t ON p.thread_id = t.id
WHERE t.board_slug = ?`, boardSlug) WHERE t.board_slug = ?`, boardSlug)
@@ -290,7 +290,7 @@ func PutPost(db Queryer, boardSlug string, threadId int, body string, mediaPath
} }
_, err := db.Exec(` _, err := db.Exec(`
INSERT INTO posts (thread_id, body, media_path, ip_hash, number, thumb_path) INSERT INTO posts (thread_id, body, media_path, ip_hash, number, thumb_path)
VALUES (?, ?, ?, ?, ?, ?)`, threadId, body, mediaPath, ip_hash, newPostNumber, thumbPath) VALUES (?, ?, ?, ?, ?, ?)`, threadId, body, mediaPath, ip_hash, newPostNumber, thumbPath)
if err != nil { if err != nil {
return err return err
@@ -337,7 +337,7 @@ func DeletePost(db *sql.DB, postId int) error {
// delete post // delete post
_, err := db.Exec(` _, err := db.Exec(`
DELETE FROM posts DELETE FROM posts
WHERE id = ?`, postId) WHERE id = ?`, postId)
if err != nil { if err != nil {
return err return err
@@ -364,7 +364,7 @@ var ErrBanNotFound = errors.New("ban not found")
func GetBan(db *sql.DB, ip string) (Ban, error) { func GetBan(db *sql.DB, ip string) (Ban, error) {
row := db.QueryRow(` row := db.QueryRow(`
SELECT ip_hash, reason, expiration SELECT ip_hash, reason, expiration
FROM bans FROM bans
where ip_hash = ?`, ip) where ip_hash = ?`, ip)
@@ -398,7 +398,7 @@ func GetAdmin(db *sql.DB, username string) (Admin, error) {
var result Admin var result Admin
if err := row.Scan(&result.Username, &result.Password); err != nil { if err := row.Scan(&result.Username, &result.Password); err != nil {
return Admin{}, nil return Admin{}, err
} }
return result, nil return result, nil
+5 -5
View File
@@ -11,8 +11,8 @@ CREATE TABLE IF NOT EXISTS boards (
tag TEXT NOT NULL tag TEXT NOT NULL
); );
CREATE TABLE IF NOT EXISTS threads ( CREATE TABLE IF NOT EXISTS threads (
id INTEGER PRIMARY KEY AUTOINCREMENT, id INTEGER PRIMARY KEY AUTOINCREMENT,
board_slug TEXT NOT NULL, board_slug TEXT NOT NULL,
subject TEXT NOT NULL DEFAULT '', subject TEXT NOT NULL DEFAULT '',
created_at DATETIME DEFAULT CURRENT_TIMESTAMP, created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
@@ -46,7 +46,7 @@ CREATE TABLE IF NOT EXISTS bans (
id INTEGER PRIMARY KEY AUTOINCREMENT, id INTEGER PRIMARY KEY AUTOINCREMENT,
ip_hash TEXT NOT NULL UNIQUE, ip_hash TEXT NOT NULL UNIQUE,
reason TEXT NOT NULL, reason TEXT NOT NULL,
expiration DATETIME NOT NULL expiration DATETIME NOT NULL
); );
-- ====================== -- ======================
@@ -55,10 +55,10 @@ CREATE TABLE IF NOT EXISTS bans (
-- Boards -- Boards
INSERT INTO boards (slug, name, tag) VALUES INSERT INTO boards (slug, name, tag) VALUES
('c', 'Comfy', 'Be comfy, fren'), ('c', 'Comfy', 'Be comfy, fren'),
('r', 'Robots', 'Beep, boop'), ('r', 'Robots', 'Beep, boop'),
('gn', 'Goon', 'God is watching'); ('gn', 'Goon', 'God is watching');
INSERT INTO admins (username, password) VALUES INSERT INTO admins (username, password) VALUES
('admin', '$2a$10$vRP4/9O6SwyUziEUtBLQM.r9C2WujIIZ6yEgqGjhlBaFPvtpfdHPC'); ('admin', '$2a$10$hzmcLK2ZrEz0NTxr7eVuV.gn8shW.tQxD0D0vYUgAwADZly3U/BZ.');
+7 -10
View File
@@ -50,16 +50,8 @@ func EnrichPost(body string) string {
var b strings.Builder var b strings.Builder
for _, rawLine := range strings.Split(body, "\n") { for _, rawLine := range strings.Split(body, "\n") {
line := urlRx.ReplaceAllStringFunc(rawLine, func(u string) string {
esc := template.HTMLEscapeString(u)
return fmt.Sprintf(
`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
esc,
)
})
var outLine string var outLine string
for i, rawWord := range strings.Split(line, " ") { for i, rawWord := range strings.Split(rawLine, " ") {
var outWord string var outWord string
if strings.HasPrefix(rawWord, ">>") { if strings.HasPrefix(rawWord, ">>") {
postId := strings.TrimPrefix(rawWord, ">>") postId := strings.TrimPrefix(rawWord, ">>")
@@ -68,8 +60,13 @@ func EnrichPost(body string) string {
`onmouseleave="highlightPost(%[1]s,event,false)" href="#post-%[1]s" class="reply-link">%[2]s</a>`, `onmouseleave="highlightPost(%[1]s,event,false)" href="#post-%[1]s" class="reply-link">%[2]s</a>`,
postId, template.HTMLEscapeString(rawWord), postId, template.HTMLEscapeString(rawWord),
) )
} else if urlRx.MatchString(rawWord) {
outWord = fmt.Sprintf(
`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
template.HTMLEscapeString(rawWord),
)
} else { } else {
outWord = rawWord outWord = template.HTMLEscapeString(rawWord)
} }
if i != 0 { if i != 0 {
outLine += " " outLine += " "
Binary file not shown.

Before

Width:  |  Height:  |  Size: 1.1 KiB

After

Width:  |  Height:  |  Size: 4.2 KiB