707 lines
19 KiB
Go
707 lines
19 KiB
Go
package main
|
|
|
|
import (
|
|
"database/sql"
|
|
"errors"
|
|
"fmt"
|
|
"github.com/dominicf2001/comfychan/internal/database"
|
|
"github.com/dominicf2001/comfychan/internal/util"
|
|
"github.com/dominicf2001/comfychan/web/views"
|
|
"github.com/dominicf2001/comfychan/web/views/admin"
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/go-chi/chi/v5/middleware"
|
|
_ "github.com/mattn/go-sqlite3"
|
|
"golang.org/x/crypto/bcrypt"
|
|
"io"
|
|
"log"
|
|
"mime/multipart"
|
|
"net/http"
|
|
"path/filepath"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
func AdminOnlyMiddleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
c, err := r.Cookie("comfy_admin")
|
|
if !util.DevMode && (err != nil || !util.IsAdminSessionValid(c.Value)) {
|
|
// Check if it's an HTMX request
|
|
if r.Header.Get("HX-Request") == "true" {
|
|
w.Header().Set("HX-Redirect", "/authorize")
|
|
w.WriteHeader(http.StatusOK)
|
|
} else {
|
|
http.Redirect(w, r, "/authorize", http.StatusSeeOther)
|
|
}
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func disableCacheInDevMode(next http.Handler) http.Handler {
|
|
if !util.DevMode {
|
|
return next
|
|
}
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func isAdmin(r *http.Request) bool {
|
|
if util.DevMode {
|
|
return true
|
|
}
|
|
|
|
admin := false
|
|
if c, err := r.Cookie("comfy_admin"); err == nil {
|
|
admin = util.IsAdminSessionValid(c.Value)
|
|
}
|
|
return admin
|
|
}
|
|
|
|
func main() {
|
|
// -----------------
|
|
// SETUP
|
|
// -----------------
|
|
|
|
db, err := sql.Open("sqlite3", "internal/database/comfychan.db")
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
defer db.Close()
|
|
|
|
r := chi.NewRouter()
|
|
|
|
r.Use(middleware.Logger)
|
|
|
|
r.Handle("/static/*",
|
|
disableCacheInDevMode(
|
|
http.StripPrefix("/static",
|
|
http.FileServer(http.Dir("web/static")))))
|
|
|
|
// -----------------
|
|
|
|
// -----------------
|
|
// MAIN ROUTES
|
|
// -----------------
|
|
|
|
// INDEX PAGE
|
|
r.Get("/", func(w http.ResponseWriter, r *http.Request) {
|
|
views.Index().Render(r.Context(), w)
|
|
})
|
|
|
|
// MAIN BOARD PAGE
|
|
r.Get("/{slug}", func(w http.ResponseWriter, r *http.Request) {
|
|
slug := chi.URLParam(r, "slug")
|
|
|
|
board, err := database.GetBoard(db, slug)
|
|
if err != nil {
|
|
http.NotFound(w, r)
|
|
log.Printf("Board %q not found: %v", slug, err)
|
|
return
|
|
}
|
|
|
|
views.Board(board, isAdmin(r)).Render(r.Context(), w)
|
|
})
|
|
|
|
// THREAD PAGE
|
|
r.Get("/{slug}/threads/{threadId}", func(w http.ResponseWriter, r *http.Request) {
|
|
slug := chi.URLParam(r, "slug")
|
|
threadIdStr := chi.URLParam(r, "threadId")
|
|
threadId, err := strconv.Atoi(threadIdStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid thread id", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
board, err := database.GetBoard(db, slug)
|
|
if err != nil {
|
|
http.NotFound(w, r)
|
|
log.Printf("Board %q not found: %v", slug, err)
|
|
return
|
|
}
|
|
|
|
thread, err := database.GetThread(db, threadId)
|
|
if err != nil {
|
|
http.Error(w, "Failed to get thread", http.StatusInternalServerError)
|
|
log.Printf("Failed to get thread %q: %v", threadIdStr, err)
|
|
return
|
|
}
|
|
|
|
posts, err := database.GetPosts(db, threadId)
|
|
if err != nil {
|
|
http.Error(w, "Failed to get posts", http.StatusInternalServerError)
|
|
log.Printf("Failed to get thread %q posts: %v", threadIdStr, err)
|
|
return
|
|
}
|
|
|
|
if len(posts) == 0 || posts[0].MediaPath == "" {
|
|
http.Error(w, "Malformed thread", http.StatusInternalServerError)
|
|
log.Printf("Thread %d has no posts or no OP image", threadId)
|
|
return
|
|
}
|
|
|
|
views.Thread(board, thread, posts, views.ThreadContext{
|
|
IsAdmin: isAdmin(r),
|
|
}).Render(r.Context(), w)
|
|
})
|
|
|
|
// CREATE THREAD
|
|
r.Post("/{slug}/threads", func(w http.ResponseWriter, r *http.Request) {
|
|
slug := chi.URLParam(r, "slug")
|
|
ipHash := util.HashIp(util.GetIP(r))
|
|
|
|
// guard banned ips
|
|
ban, err := database.GetBan(db, ipHash)
|
|
if err != nil {
|
|
if !errors.Is(err, database.ErrBanNotFound) {
|
|
http.Error(w, "Failed to get ban", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
} else {
|
|
msg := fmt.Sprintf("You are banned until: %s. Reason: %s",
|
|
ban.Expiration.Format("2006-01-02 15:04"),
|
|
ban.Reason)
|
|
http.Error(w, msg, http.StatusForbidden)
|
|
return
|
|
}
|
|
|
|
// check cooldown
|
|
timeRemaining := util.GetRemainingCooldown(ipHash, util.ThreadCooldowns, util.THREAD_COOLDOWN)
|
|
if timeRemaining > 0 && !isAdmin(r) {
|
|
response := fmt.Sprintf("Please wait %.0f seconds", timeRemaining.Seconds())
|
|
io.Copy(io.Discard, r.Body)
|
|
http.Error(w, response, http.StatusTooManyRequests)
|
|
return
|
|
}
|
|
|
|
// parse form
|
|
r.Body = http.MaxBytesReader(w, r.Body, util.MAX_REQUEST_BYTES)
|
|
if err := r.ParseMultipartForm(util.FILE_MEM_LIMIT); err != nil {
|
|
var maxErr *http.MaxBytesError
|
|
if errors.As(err, &maxErr) {
|
|
http.Error(w, fmt.Sprintf("File too large (max %s)", util.FormatBytes(util.FILE_MEM_LIMIT)), http.StatusRequestEntityTooLarge)
|
|
return
|
|
}
|
|
|
|
if errors.Is(err, multipart.ErrMessageTooLarge) {
|
|
http.Error(w, fmt.Sprintf("File too large (max %s)", util.FormatBytes(util.FILE_MEM_LIMIT)), http.StatusRequestEntityTooLarge)
|
|
return
|
|
}
|
|
http.Error(w, "Failed to parse form", http.StatusBadRequest)
|
|
log.Printf("ParseMultipartForm: %v", err)
|
|
return
|
|
}
|
|
|
|
// validate inputs
|
|
subject := strings.TrimSpace(r.FormValue("subject"))
|
|
body := strings.TrimSpace(r.FormValue("body"))
|
|
|
|
if len(subject) > util.MAX_SUBJECT_LEN {
|
|
http.Error(w, fmt.Sprintf("Subject exceeds %d characters", util.MAX_SUBJECT_LEN), http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
if body == "" {
|
|
http.Error(w, "Body is empty", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
if len(body) > util.MAX_BODY_LEN {
|
|
http.Error(w, fmt.Sprintf("Body exceeds %d characters", util.MAX_BODY_LEN), http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
file, header, err := r.FormFile("file")
|
|
if err != nil {
|
|
http.Error(w, "Failed to retrive file from form", http.StatusBadRequest)
|
|
log.Printf("FormFile: %v", err)
|
|
return
|
|
}
|
|
defer file.Close()
|
|
|
|
if header.Size > util.FILE_MEM_LIMIT {
|
|
http.Error(w, fmt.Sprintf("File too large (max %s)", util.FormatBytes(util.FILE_MEM_LIMIT)), http.StatusRequestEntityTooLarge)
|
|
return
|
|
}
|
|
|
|
mediaType, err := util.DetectPostFileType(file)
|
|
if err != nil {
|
|
http.Error(w, "Failed to detect if file is a video", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
file.Seek(0, io.SeekStart)
|
|
|
|
if mediaType == util.PostFileUnsupported {
|
|
http.Error(w, "Unsupported media type", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
filename := strconv.FormatInt(time.Now().UnixNano(), 10) + filepath.Ext(header.Filename)
|
|
err, savedMediaPath, savedThumbPath := util.SavePostFile(file, filename)
|
|
if err != nil {
|
|
http.Error(w, "Failed to save file", http.StatusInternalServerError)
|
|
log.Printf("savePostFile: %v", err)
|
|
return
|
|
}
|
|
|
|
threadId, err := database.PutThread(db, slug, subject, body, savedMediaPath, savedThumbPath, ipHash)
|
|
if err != nil {
|
|
http.Error(w, "Failed to create thread", http.StatusInternalServerError)
|
|
log.Printf("PutThread: %v", err)
|
|
return
|
|
}
|
|
|
|
util.BeginCooldown(ipHash, util.ThreadCooldowns, util.THREAD_COOLDOWN)
|
|
|
|
// Check if it's an HTMX request
|
|
redirectUrl := fmt.Sprintf("/%s/threads/%d", slug, threadId)
|
|
if r.Header.Get("HX-Request") == "true" {
|
|
w.Header().Set("HX-Redirect", redirectUrl)
|
|
w.WriteHeader(http.StatusOK)
|
|
} else {
|
|
http.Redirect(w, r, redirectUrl, http.StatusSeeOther)
|
|
}
|
|
})
|
|
|
|
// CREATE POST
|
|
r.Post("/{slug}/threads/{threadId}", func(w http.ResponseWriter, r *http.Request) {
|
|
slug := chi.URLParam(r, "slug")
|
|
ipHash := util.HashIp(util.GetIP(r))
|
|
|
|
// guard banned ips
|
|
ban, err := database.GetBan(db, ipHash)
|
|
if err != nil {
|
|
if !errors.Is(err, database.ErrBanNotFound) {
|
|
http.Error(w, "Failed to get ban", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
} else {
|
|
msg := fmt.Sprintf("You are banned until: %s. Reason: %s",
|
|
ban.Expiration.Format("2006-01-02 15:04"),
|
|
ban.Reason)
|
|
http.Error(w, msg, http.StatusForbidden)
|
|
return
|
|
}
|
|
|
|
// check cooldown
|
|
timeRemaining := util.GetRemainingCooldown(ipHash, util.PostCooldowns, util.POST_COOLDOWN)
|
|
if timeRemaining > 0 && !isAdmin(r) {
|
|
response := fmt.Sprintf("Please wait %.0f seconds", timeRemaining.Seconds())
|
|
io.Copy(io.Discard, r.Body)
|
|
http.Error(w, response, http.StatusTooManyRequests)
|
|
return
|
|
}
|
|
|
|
// parse form
|
|
r.Body = http.MaxBytesReader(w, r.Body, util.MAX_REQUEST_BYTES)
|
|
if err := r.ParseMultipartForm(util.FILE_MEM_LIMIT); err != nil {
|
|
var maxErr *http.MaxBytesError
|
|
if errors.As(err, &maxErr) {
|
|
http.Error(w, fmt.Sprintf("File too large (max %s)", util.FormatBytes(util.FILE_MEM_LIMIT)), http.StatusRequestEntityTooLarge)
|
|
return
|
|
}
|
|
|
|
if errors.Is(err, multipart.ErrMessageTooLarge) {
|
|
http.Error(w, fmt.Sprintf("File too large (max %s)", util.FormatBytes(util.FILE_MEM_LIMIT)), http.StatusRequestEntityTooLarge)
|
|
return
|
|
}
|
|
http.Error(w, "Failed to parse form", http.StatusBadRequest)
|
|
log.Printf("ParseMultipartForm: %v", err)
|
|
return
|
|
}
|
|
|
|
// validate inputs
|
|
body := strings.TrimSpace(r.FormValue("body"))
|
|
mediaPath := ""
|
|
thumbPath := ""
|
|
|
|
if body == "" {
|
|
http.Error(w, "Body is empty", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
if len(body) > util.MAX_BODY_LEN {
|
|
http.Error(w, fmt.Sprintf("Body exceeds %d characters", util.MAX_BODY_LEN), http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
file, header, err := r.FormFile("file")
|
|
if err != nil {
|
|
if !errors.Is(err, http.ErrMissingFile) {
|
|
http.Error(w, "Failed to retrieve file from form", http.StatusBadRequest)
|
|
log.Printf("FormFile: %v", err)
|
|
return
|
|
}
|
|
} else {
|
|
defer file.Close()
|
|
|
|
if header.Size > util.FILE_MEM_LIMIT {
|
|
http.Error(w, fmt.Sprintf("File too large (max %s)", util.FormatBytes(util.FILE_MEM_LIMIT)), http.StatusRequestEntityTooLarge)
|
|
return
|
|
}
|
|
|
|
mediaType, err := util.DetectPostFileType(file)
|
|
if err != nil {
|
|
http.Error(w, "Failed to detect if file is a video", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
file.Seek(0, io.SeekStart)
|
|
|
|
if mediaType == util.PostFileUnsupported {
|
|
http.Error(w, "Unsupported media type", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
filename := strconv.FormatInt(time.Now().UnixNano(), 10) + filepath.Ext(header.Filename)
|
|
err, savedMediaPath, savedThumbPath := util.SavePostFile(file, filename)
|
|
if err != nil {
|
|
http.Error(w, "Failed to save file", http.StatusInternalServerError)
|
|
log.Printf("savePostFile: %v", err)
|
|
return
|
|
}
|
|
mediaPath = savedMediaPath
|
|
thumbPath = savedThumbPath
|
|
}
|
|
|
|
// put post into DB
|
|
threadIdStr := chi.URLParam(r, "threadId")
|
|
threadId, err := strconv.Atoi(threadIdStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid thread id", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
if err := database.PutPost(db, slug, threadId, body, mediaPath, thumbPath, ipHash); err != nil {
|
|
http.Error(w, "Failed to create post", http.StatusInternalServerError)
|
|
log.Printf("PutPost: %v", err)
|
|
return
|
|
}
|
|
|
|
util.BeginCooldown(ipHash, util.PostCooldowns, util.POST_COOLDOWN)
|
|
})
|
|
|
|
// -----------------
|
|
|
|
// -----------------
|
|
// PARTIAL ROUTES (htmx)
|
|
// -----------------
|
|
|
|
// CATALOG
|
|
r.Get("/hx/{slug}/catalog", func(w http.ResponseWriter, r *http.Request) {
|
|
slug := chi.URLParam(r, "slug")
|
|
threads, err := database.GetThreads(db, slug)
|
|
if err != nil {
|
|
http.Error(w, "Failed to get threads", http.StatusInternalServerError)
|
|
log.Printf("GetThreads: %v", err)
|
|
return
|
|
}
|
|
|
|
previews := make([]views.CatalogThreadPreview, 0, len(threads))
|
|
for _, thread := range threads {
|
|
posts, err := database.GetPosts(db, thread.Id)
|
|
if err != nil {
|
|
http.Error(w, "Failed to get posts", http.StatusBadRequest)
|
|
log.Printf("GetOriginalPost: %v", err)
|
|
return
|
|
}
|
|
op := posts[0]
|
|
|
|
if op.MediaPath == "" {
|
|
http.Error(w, "Malformed thread", http.StatusInternalServerError)
|
|
log.Printf("Thread %d has no OP image", thread.Id)
|
|
return
|
|
}
|
|
|
|
uniqueIpHashes := map[string]bool{}
|
|
for _, post := range posts {
|
|
uniqueIpHashes[post.IpHash] = true
|
|
}
|
|
|
|
previews = append(previews, views.CatalogThreadPreview{
|
|
Subject: thread.Subject,
|
|
Body: op.Body,
|
|
ThreadId: thread.Id,
|
|
ThreadURL: fmt.Sprintf("/%s/threads/%d", slug, thread.Id),
|
|
ThumbPath: op.ThumbPath,
|
|
ReplyCount: len(posts),
|
|
IpCount: len(uniqueIpHashes),
|
|
Pinned: thread.Pinned,
|
|
Locked: thread.Locked,
|
|
BumpedAt: thread.BumpedAt,
|
|
})
|
|
}
|
|
|
|
views.ThreadsCatalog(previews, views.CatalogContext{
|
|
IsAdmin: isAdmin(r),
|
|
BoardSlug: slug,
|
|
}).Render(r.Context(), w)
|
|
})
|
|
|
|
// THREAD POSTS
|
|
r.Get("/hx/{slug}/threads/{threadId}/posts", func(w http.ResponseWriter, r *http.Request) {
|
|
// slug := chi.URLParam(r, "slug")
|
|
threadIdStr := chi.URLParam(r, "threadId")
|
|
threadId, err := strconv.Atoi(threadIdStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid thread id", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
thread, err := database.GetThread(db, threadId)
|
|
if err != nil {
|
|
http.Error(w, "Failed to get thread", http.StatusBadRequest)
|
|
log.Printf("GetThread: %v", err)
|
|
return
|
|
}
|
|
|
|
posts, err := database.GetPosts(db, threadId)
|
|
if err != nil {
|
|
http.Error(w, "Failed to get posts", http.StatusBadRequest)
|
|
log.Printf("GetPosts: %v", err)
|
|
return
|
|
}
|
|
|
|
if len(posts) == 0 || posts[0].MediaPath == "" {
|
|
http.Error(w, "Malformed thread", http.StatusInternalServerError)
|
|
log.Printf("Thread %d has no posts or no OP image", threadId)
|
|
return
|
|
}
|
|
|
|
// dont pass the op post. only replies
|
|
views.Posts(posts, thread, views.ThreadContext{
|
|
IsAdmin: isAdmin(r),
|
|
}).Render(r.Context(), w)
|
|
})
|
|
|
|
// -----------------
|
|
|
|
// -----------------
|
|
// ADMIN ROUTES (htmx)
|
|
// -----------------
|
|
|
|
r.Get("/authorize", func(w http.ResponseWriter, r *http.Request) {
|
|
admin.AdminLogin().Render(r.Context(), w)
|
|
})
|
|
|
|
r.Post("/authorize", func(w http.ResponseWriter, r *http.Request) {
|
|
username := r.FormValue("username")
|
|
password := r.FormValue("password")
|
|
|
|
admin, err := database.GetAdmin(db, username)
|
|
if err != nil {
|
|
http.Error(w, "Invalid login", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
err = bcrypt.CompareHashAndPassword([]byte(admin.Password), []byte(password))
|
|
if err != nil {
|
|
http.Error(w, "Invalid login", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
token, err := util.GenToken()
|
|
if err != nil {
|
|
http.Error(w, "Failed to generate token", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
tokenValidUntil := time.Now().Add(time.Hour)
|
|
util.CreateAdminSession(token, util.AdminSession{
|
|
Username: username,
|
|
Expiration: tokenValidUntil,
|
|
})
|
|
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: "comfy_admin",
|
|
Value: token,
|
|
HttpOnly: true,
|
|
Secure: !util.DevMode,
|
|
Expires: tokenValidUntil,
|
|
SameSite: http.SameSiteStrictMode,
|
|
Path: "/",
|
|
})
|
|
|
|
})
|
|
|
|
r.Route("/admin", func(r chi.Router) {
|
|
r.Use(AdminOnlyMiddleware)
|
|
|
|
r.Patch("/threads/{threadId}/lock", func(w http.ResponseWriter, r *http.Request) {
|
|
threadIdStr := chi.URLParam(r, "threadId")
|
|
threadId, err := strconv.Atoi(threadIdStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid thread id", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
lockedStr := r.URL.Query().Get("locked")
|
|
locked, err := strconv.ParseBool(lockedStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid values for 'locked'", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
_, err = db.Exec(`UPDATE threads SET locked = ? WHERE id = ?`, locked, threadId)
|
|
if err != nil {
|
|
log.Println("Updating thread 'locked': ", err)
|
|
http.Error(w, "Failed to lock thread: "+threadIdStr, http.StatusInternalServerError)
|
|
return
|
|
}
|
|
})
|
|
|
|
r.Patch("/threads/{threadId}/pin", func(w http.ResponseWriter, r *http.Request) {
|
|
threadIdStr := chi.URLParam(r, "threadId")
|
|
threadId, err := strconv.Atoi(threadIdStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid thread id", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
pinnedStr := r.URL.Query().Get("pinned")
|
|
pinned, err := strconv.ParseBool(pinnedStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid values for 'pinned'", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
_, err = db.Exec(`UPDATE threads SET pinned = ? WHERE id = ?`, pinned, threadId)
|
|
if err != nil {
|
|
log.Println("Updating thread 'pinned': ", err)
|
|
http.Error(w, "Failed to pin thread: "+threadIdStr, http.StatusInternalServerError)
|
|
return
|
|
}
|
|
})
|
|
|
|
r.Delete("/threads/{threadId}", func(w http.ResponseWriter, r *http.Request) {
|
|
threadIdStr := chi.URLParam(r, "threadId")
|
|
threadId, err := strconv.Atoi(threadIdStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid thread id", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
err = database.DeleteThread(db, threadId)
|
|
if err != nil {
|
|
log.Println("DeleteThread: ", err)
|
|
http.Error(w, "Failed to delete thread: "+threadIdStr, http.StatusInternalServerError)
|
|
return
|
|
}
|
|
})
|
|
|
|
r.Delete("/posts/{postId}", func(w http.ResponseWriter, r *http.Request) {
|
|
postIdStr := chi.URLParam(r, "postId")
|
|
postId, err := strconv.Atoi(postIdStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid post id", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
err = database.DeletePost(db, postId)
|
|
if err != nil {
|
|
log.Println("DeletePost: ", err)
|
|
http.Error(w, "Failed to delete post: "+postIdStr, http.StatusInternalServerError)
|
|
return
|
|
}
|
|
})
|
|
|
|
// bans the ip stored in the post id
|
|
r.Post("/ban/{postId}", func(w http.ResponseWriter, r *http.Request) {
|
|
postIdStr := chi.URLParam(r, "postId")
|
|
postId, err := strconv.Atoi(postIdStr)
|
|
if err != nil {
|
|
http.Error(w, "Invalid post id", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
_, err = db.Exec(`UPDATE posts SET banned = 1 WHERE id = ?`, postId)
|
|
if err != nil {
|
|
http.Error(w, "Failed update post to banned", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
post, err := database.GetPost(db, postId)
|
|
if err != nil {
|
|
log.Println("GetPost: ", err)
|
|
http.Error(w, "Failed to get post: "+postIdStr, http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
ipToBan := post.IpHash
|
|
reason := r.FormValue("reason")
|
|
|
|
expirationInput := r.FormValue("expiration")
|
|
expiration, err := time.Parse("2006-01-02T15:04", expirationInput)
|
|
if err != nil {
|
|
http.Error(w, "Invalid expiration datetime value", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
err = database.BanIp(db, ipToBan, reason, expiration)
|
|
if err != nil {
|
|
log.Println("BanIp: ", err)
|
|
http.Error(w, "Failed to ban ip: ", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
})
|
|
|
|
r.Post("/logout", func(w http.ResponseWriter, r *http.Request) {
|
|
if c, err := r.Cookie("comfy_admin"); err == nil {
|
|
util.DeleteAdminSession(c.Value)
|
|
}
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: "comfy_admin",
|
|
Value: "",
|
|
HttpOnly: true,
|
|
Secure: !util.DevMode,
|
|
Expires: time.Now(),
|
|
SameSite: http.SameSiteStrictMode,
|
|
Path: "/",
|
|
})
|
|
})
|
|
})
|
|
|
|
// -----------------
|
|
|
|
// -----------------
|
|
// CLEANUP
|
|
// -----------------
|
|
|
|
go func() {
|
|
ticker := time.NewTicker(10 * time.Second)
|
|
defer ticker.Stop()
|
|
|
|
for range ticker.C {
|
|
// cleanup cooldowns
|
|
util.CooldownMutex.Lock()
|
|
for ip, t := range util.PostCooldowns {
|
|
if time.Since(t) >= util.POST_COOLDOWN {
|
|
delete(util.PostCooldowns, ip)
|
|
}
|
|
}
|
|
for ip, t := range util.ThreadCooldowns {
|
|
if time.Since(t) >= util.THREAD_COOLDOWN {
|
|
delete(util.ThreadCooldowns, ip)
|
|
}
|
|
}
|
|
util.CooldownMutex.Unlock()
|
|
|
|
// cleanup admin sessions
|
|
util.AdminMutex.Lock()
|
|
for token, s := range util.AdminSessions {
|
|
if time.Now().After(s.Expiration) {
|
|
delete(util.AdminSessions, token)
|
|
}
|
|
}
|
|
util.AdminMutex.Unlock()
|
|
}
|
|
}()
|
|
|
|
// -----------------
|
|
|
|
fmt.Println("Listening on :8080")
|
|
http.ListenAndServe(":8080", r)
|
|
}
|