No OneTemporary
Actions

Size

35 KB

Subscribers

None

View Options

	diff --git a/email.go b/email.go
	index da4590e..75a92b3 100644
	--- a/email.go
	+++ b/email.go
	@@ -1,462 +1,497 @@
	/*
	* Copyright © 2019-2021 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	+ "bytes"
	"database/sql"
	"encoding/json"
	"fmt"
	"html/template"
	"net/http"
	"strings"
	"time"

	"github.com/aymerick/douceur/inliner"
	"github.com/gorilla/mux"
	"github.com/mailgun/mailgun-go"
	stripmd "github.com/writeas/go-strip-markdown/v2"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/data"
	"github.com/writeas/web-core/log"
	"github.com/writefreely/writefreely/key"
	"github.com/writefreely/writefreely/spam"
	)

	const (
	emailSendDelay = 15
	)

	type (
	SubmittedSubscription struct {
	CollAlias string
	UserID int64

	Email string `schema:"email" json:"email"`
	Web bool `schema:"web" json:"web"`
	Slug string `schema:"slug" json:"slug"`
	From string `schema:"from" json:"from"`
	}

	EmailSubscriber struct {
	ID string
	CollID int64
	UserID sql.NullInt64
	Email sql.NullString
	Subscribed time.Time
	Token string
	Confirmed bool
	AllowExport bool
	acctEmail sql.NullString
	}
	)

	func (es EmailSubscriber) FinalEmail(keys key.Keychain) string {
	if !es.UserID.Valid \|\| es.Email.Valid {
	return es.Email.String
	}

	decEmail, err := data.Decrypt(keys.EmailKey, []byte(es.acctEmail.String))
	if err != nil {
	log.Error("Error decrypting user email: %v", err)
	return ""
	}
	return string(decEmail)
	}

	func (es *EmailSubscriber) SubscribedFriendly() string {
	return es.Subscribed.Format("January 2, 2006")
	}

	func handleCreateEmailSubscription(app App, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r)
	vars := mux.Vars(r)
	var err error

	ss := SubmittedSubscription{
	CollAlias: vars["alias"],
	}
	u := getUserSession(app, r)
	if u != nil {
	ss.UserID = u.ID
	}
	if reqJSON {
	// Decode JSON request
	decoder := json.NewDecoder(r.Body)
	err = decoder.Decode(&ss)
	if err != nil {
	log.Error("Couldn't parse new subscription JSON request: %v\n", err)
	return ErrBadJSON
	}
	} else {
	err = r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse new subscription form request: %v\n", err)
	return ErrBadFormData
	}

	err = app.formDecoder.Decode(&ss, r.PostForm)
	if err != nil {
	log.Error("Continuing, but error decoding new subscription form request: %v\n", err)
	//return ErrBadFormData
	}
	}

	c, err := app.db.GetCollection(ss.CollAlias)
	if err != nil {
	log.Error("getCollection: %s", err)
	return err
	}
	c.hostName = app.cfg.App.Host

	from := c.CanonicalURL()
	isAuthorBanned, err := app.db.IsUserSilenced(c.OwnerID)
	if isAuthorBanned {
	log.Info("Author is silenced, so subscription is blocked.")
	return impart.HTTPError{http.StatusFound, from}
	}

	if ss.Web {
	if u != nil && u.ID == c.OwnerID {
	from = "/" + c.Alias + "/"
	}
	from += ss.Slug
	}

	if r.FormValue(spam.HoneypotFieldName()) != "" \|\| r.FormValue("fake_password") != "" {
	log.Info("Honeypot field was filled out! Not subscribing.")
	return impart.HTTPError{http.StatusFound, from}
	}

	if ss.Email == "" && ss.UserID < 1 {
	log.Info("No subscriber data. Not subscribing.")
	return impart.HTTPError{http.StatusFound, from}
	}

	confirmed := app.db.IsSubscriberConfirmed(ss.Email)
	es, err := app.db.AddEmailSubscription(c.ID, ss.UserID, ss.Email, confirmed)
	if err != nil {
	log.Error("addEmailSubscription: %s", err)
	return err
	}

	// Send confirmation email if needed
	if !confirmed {
	err = sendSubConfirmEmail(app, c, ss.Email, es.ID, es.Token)
	if err != nil {
	log.Error("Failed to send subscription confirmation email: %s", err)
	return err
	}
	}

	if ss.Web {
	session, err := app.sessionStore.Get(r, userEmailCookieName)
	if err != nil {
	// The cookie should still save, even if there's an error.
	// Source: https://github.com/gorilla/sessions/issues/16#issuecomment-143642144
	log.Error("Getting user email cookie: %v; ignoring", err)
	}
	if confirmed {
	addSessionFlash(app, w, r, "<strong>Subscribed</strong>. You'll now receive future blog posts via email.", nil)
	} else {
	addSessionFlash(app, w, r, "Please check your email and <strong>click the confirmation link</strong> to subscribe.", nil)
	}
	session.Values[userEmailCookieVal] = ss.Email
	err = session.Save(r, w)
	if err != nil {
	log.Error("save email cookie: %s", err)
	return err
	}

	return impart.HTTPError{http.StatusFound, from}
	}
	return impart.WriteSuccess(w, "", http.StatusAccepted)
	}

	+func handleExportEmailSubscriptions(app App, w http.ResponseWriter, r http.Request) ([]byte, string, error) {
	+ vars := mux.Vars(r)
	+ var err error
	+ alias := vars["alias"]
	+ filename := ""
	+ u := getUserSession(app, r)
	+ if u == nil {
	+ return nil, filename, ErrNotLoggedIn
	+ }
	+ c, err := app.db.GetCollection(alias)
	+ if err != nil {
	+ return nil, filename, err
	+ }
	+
	+ // Verify permissions / ownership
	+ if u.ID != c.OwnerID {
	+ return nil, filename, ErrForbiddenCollectionAccess
	+ }
	+
	+ filename = "subscribers-" + alias + "-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")
	+
	+ subs, err := app.db.GetEmailSubscribers(c.ID, true)
	+ if err != nil {
	+ return nil, filename, err
	+ }
	+
	+ var data []byte
	+ for _, sub := range subs {
	+ data = append(data, []byte(sub.Email.String+"\n")...)
	+ }
	+ data = bytes.TrimRight(data, "\n")
	+ return data, filename, err
	+}
	+
	func handleDeleteEmailSubscription(app App, w http.ResponseWriter, r http.Request) error {
	alias := collectionAliasFromReq(r)

	vars := mux.Vars(r)
	subID := vars["subscriber"]
	email := r.FormValue("email")
	token := r.FormValue("t")
	slug := r.FormValue("slug")
	isWeb := r.Method == "GET"

	// Display collection if this is a collection
	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	log.Error("Get collection: %s", err)
	return err
	}

	from := c.CanonicalURL()

	if subID != "" {
	// User unsubscribing via email, so assume action is taken by either current
	// user or not current user, and only use the request's information to
	// satisfy this unsubscribe, i.e. subscriberID and token.
	err = app.db.DeleteEmailSubscriber(subID, token)
	} else {
	// User unsubscribing through the web app, so assume action is taken by
	// currently-auth'd user.
	var userID int64
	u := getUserSession(app, r)
	if u != nil {
	// User is logged in
	userID = u.ID
	if userID == c.OwnerID {
	from = "/" + c.Alias + "/"
	}
	}
	if email == "" && userID <= 0 {
	// Get email address from saved cookie
	session, err := app.sessionStore.Get(r, userEmailCookieName)
	if err != nil {
	log.Error("Unable to get email cookie: %s", err)
	} else {
	email = session.Values[userEmailCookieVal].(string)
	}
	}

	if email == "" && userID <= 0 {
	err = fmt.Errorf("No subscriber given.")
	log.Error("Not deleting subscription: %s", err)
	return err
	}

	err = app.db.DeleteEmailSubscriberByUser(email, userID, c.ID)
	}
	if err != nil {
	log.Error("Unable to delete subscriber: %v", err)
	return err
	}

	if isWeb {
	from += slug
	addSessionFlash(app, w, r, "<strong>Unsubscribed</strong>. You will no longer receive these blog posts via email.", nil)
	return impart.HTTPError{http.StatusFound, from}
	}
	return impart.WriteSuccess(w, "", http.StatusAccepted)
	}

	func handleConfirmEmailSubscription(app App, w http.ResponseWriter, r http.Request) error {
	alias := collectionAliasFromReq(r)
	subID := mux.Vars(r)["subscriber"]
	token := r.FormValue("t")

	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	log.Error("Get collection: %s", err)
	return err
	}

	from := c.CanonicalURL()

	err = app.db.UpdateSubscriberConfirmed(subID, token)
	if err != nil {
	addSessionFlash(app, w, r, err.Error(), nil)
	return impart.HTTPError{http.StatusFound, from}
	}

	addSessionFlash(app, w, r, "<strong>Confirmed</strong>! Thanks. Now you'll receive future blog posts via email.", nil)
	return impart.HTTPError{http.StatusFound, from}
	}

	func emailPost(app App, p PublicPost, collID int64) error {
	p.augmentContent()

	// Do some shortcode replacement.
	// Since the user is receiving this email, we can assume they're subscribed via email.
	p.Content = strings.Replace(p.Content, "<!--emailsub-->", `<p id="emailsub">You're subscribed to email updates.</p>`, -1)

	if p.HTMLContent == template.HTML("") {
	p.formatContent(app.cfg, false, false)
	}
	p.augmentReadingDestination()

	title := p.Title.String
	if title != "" {
	title = p.Title.String + "\n\n"
	}
	plainMsg := title + "A new post from " + p.CanonicalURL(app.cfg.App.Host) + "\n\n" + stripmd.Strip(p.Content)
	plainMsg += `

	---------------------------------------------------------------------------------

	Originally published on ` + p.Collection.DisplayTitle() + ` (` + p.Collection.CanonicalURL() + `), a blog you subscribe to.

	Sent to %recipient.to%. Unsubscribe: ` + p.Collection.CanonicalURL() + `email/unsubscribe/%recipient.id%?t=%recipient.token%`

	gun := mailgun.NewMailgun(app.cfg.Email.Domain, app.cfg.Email.MailgunPrivate)
	m := mailgun.NewMessage(p.Collection.DisplayTitle()+" <"+p.Collection.Alias+"@"+app.cfg.Email.Domain+">", stripmd.Strip(p.DisplayTitle()), plainMsg)
	replyTo := app.db.GetCollectionAttribute(collID, collAttrLetterReplyTo)
	if replyTo != "" {
	m.SetReplyTo(replyTo)
	}

	subs, err := app.db.GetEmailSubscribers(collID, true)
	if err != nil {
	log.Error("Unable to get email subscribers: %v", err)
	return err
	}
	if len(subs) == 0 {
	return nil
	}

	if title != "" {
	title = string(`<h2 id="title">` + p.FormattedDisplayTitle() + `</h2>`)
	}
	m.AddTag("New post")

	fontFam := "Lora, Palatino, Baskerville, serif"
	if p.IsSans() {
	fontFam = `"Open Sans", Tahoma, Arial, sans-serif`
	} else if p.IsMonospace() {
	fontFam = `Hack, consolas, Menlo-Regular, Menlo, Monaco, monospace, monospace`
	}

	// TODO: move this to a templated file and LESS-generated stylesheet
	fullHTML := `<html>
	<head>
	<style>
	body {
	font-size: 120%;
	font-family: ` + fontFam + `;
	margin: 1em 2em;
	}
	#article {
	line-height: 1.5;
	margin: 1.5em 0;
	white-space: pre-wrap;
	word-wrap: break-word;
	}
	h1, h2, h3, h4, h5, h6, p, code {
	display: inline
	}
	img, iframe, video {
	max-width: 100%
	}
	#title {
	margin-bottom: 1em;
	display: block;
	}
	.intro {
	font-style: italic;
	font-size: 0.95em;
	}
	div#footer {
	text-align: center;
	max-width: 35em;
	margin: 2em auto;
	}
	div#footer p {
	display: block;
	font-size: 0.86em;
	color: #666;
	}
	hr {
	border: 1px solid #ccc;
	margin: 2em 1em;
	}
	p#emailsub {
	text-align: center;
	display: inline-block !important;
	width: 100%;
	font-style: italic;
	}
	</style>
	</head>
	<body>
	<div id="article">` + title + `<p class="intro">From <a href="` + p.CanonicalURL(app.cfg.App.Host) + `">` + p.DisplayCanonicalURL() + `</a></p>

	` + string(p.HTMLContent) + `</div>
	<hr />
	<div id="footer">
	<p>Originally published on <a href="` + p.Collection.CanonicalURL() + `">` + p.Collection.DisplayTitle() + `</a>, a blog you subscribe to.</p>
	<p>Sent to %recipient.to%. <a href="` + p.Collection.CanonicalURL() + `email/unsubscribe/%recipient.id%?t=%recipient.token%">Unsubscribe</a>.</p>
	</div>
	</body>
	</html>`

	// inline CSS
	html, err := inliner.Inline(fullHTML)
	if err != nil {
	log.Error("Unable to inline email HTML: %v", err)
	return err
	}

	m.SetHtml(html)

	log.Info("[email] Adding %d recipient(s)", len(subs))
	for _, s := range subs {
	e := s.FinalEmail(app.keys)
	log.Info("[email] Adding %s", e)
	err = m.AddRecipientAndVariables(e, map[string]interface{}{
	"id": s.ID,
	"to": e,
	"token": s.Token,
	})
	if err != nil {
	log.Error("Unable to add receipient %s: %s", e, err)
	}
	}

	res, _, err := gun.Send(m)
	log.Info("[email] Send result: %s", res)
	if err != nil {
	log.Error("Unable to send post email: %v", err)
	return err
	}

	return nil
	}

	func sendSubConfirmEmail(app App, c Collection, email, subID, token string) error {
	if email == "" {
	return fmt.Errorf("You must supply an email to verify.")
	}

	// Send email
	gun := mailgun.NewMailgun(app.cfg.Email.Domain, app.cfg.Email.MailgunPrivate)

	plainMsg := "Confirm your subscription to " + c.DisplayTitle() + ` (` + c.CanonicalURL() + `) to start receiving future posts. Simply click the following link (or copy and paste it into your browser):

	` + c.CanonicalURL() + "email/confirm/" + subID + "?t=" + token + `

	If you didn't subscribe to this site or you're not sure why you're getting this email, you can delete it. You won't be subscribed or receive any future emails.`
	m := mailgun.NewMessage(c.DisplayTitle()+" <"+c.Alias+"@"+app.cfg.Email.Domain+">", "Confirm your subscription to "+c.DisplayTitle(), plainMsg, fmt.Sprintf("<%s>", email))
	m.AddTag("Email Verification")

	m.SetHtml(`<html>
	<body style="font-family:Lora, 'Palatino Linotype', Palatino, Baskerville, 'Book Antiqua', 'New York', 'DejaVu serif', serif; font-size: 100%%; margin:1em 2em;">
	<div style="font-size: 1.2em;">
	<p>Confirm your subscription to <a href="` + c.CanonicalURL() + `">` + c.DisplayTitle() + `</a> to start receiving future posts:</p>
	<p><a href="` + c.CanonicalURL() + `email/confirm/` + subID + `?t=` + token + `">Subscribe to ` + c.DisplayTitle() + `</a></p>
	<p>If you didn't subscribe to this site or you're not sure why you're getting this email, you can delete it. You won't be subscribed or receive any future emails.</p>
	</div>
	</body>
	</html>`)
	gun.Send(m)

	return nil
	}
	diff --git a/errors.go b/errors.go
	index f0d3099..96e1aef 100644
	--- a/errors.go
	+++ b/errors.go
	@@ -1,62 +1,63 @@
	/*
	* Copyright © 2018-2020 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"net/http"

	"github.com/writeas/impart"
	)

	// Commonly returned HTTP errors
	var (
	ErrBadFormData = impart.HTTPError{http.StatusBadRequest, "Expected valid form data."}
	ErrBadJSON = impart.HTTPError{http.StatusBadRequest, "Expected valid JSON object."}
	ErrBadJSONArray = impart.HTTPError{http.StatusBadRequest, "Expected valid JSON array."}
	ErrBadAccessToken = impart.HTTPError{http.StatusUnauthorized, "Invalid access token."}
	ErrNoAccessToken = impart.HTTPError{http.StatusBadRequest, "Authorization token required."}
	ErrNotLoggedIn = impart.HTTPError{http.StatusUnauthorized, "Not logged in."}

	ErrForbiddenCollection = impart.HTTPError{http.StatusForbidden, "You don't have permission to add to this collection."}
	+ ErrForbiddenCollectionAccess = impart.HTTPError{http.StatusForbidden, "You don't have permission to access this collection."}
	ErrForbiddenEditPost = impart.HTTPError{http.StatusForbidden, "You don't have permission to update this post."}
	ErrUnauthorizedEditPost = impart.HTTPError{http.StatusUnauthorized, "Invalid editing credentials."}
	ErrUnauthorizedGeneral = impart.HTTPError{http.StatusUnauthorized, "You don't have permission to do that."}
	ErrBadRequestedType = impart.HTTPError{http.StatusNotAcceptable, "Bad requested Content-Type."}
	ErrCollectionUnauthorizedRead = impart.HTTPError{http.StatusUnauthorized, "You don't have permission to access this collection."}

	ErrNoPublishableContent = impart.HTTPError{http.StatusBadRequest, "Supply something to publish."}

	ErrInternalGeneral = impart.HTTPError{http.StatusInternalServerError, "The humans messed something up. They've been notified."}
	ErrInternalCookieSession = impart.HTTPError{http.StatusInternalServerError, "Could not get cookie session."}

	ErrUnavailable = impart.HTTPError{http.StatusServiceUnavailable, "Service temporarily unavailable due to high load."}

	ErrCollectionNotFound = impart.HTTPError{http.StatusNotFound, "Collection doesn't exist."}
	ErrCollectionGone = impart.HTTPError{http.StatusGone, "This blog was unpublished."}
	ErrCollectionPageNotFound = impart.HTTPError{http.StatusNotFound, "Collection page doesn't exist."}
	ErrPostNotFound = impart.HTTPError{Status: http.StatusNotFound, Message: "Post not found."}
	ErrPostBanned = impart.HTTPError{Status: http.StatusGone, Message: "Post removed."}
	ErrPostUnpublished = impart.HTTPError{Status: http.StatusGone, Message: "Post unpublished by author."}
	ErrPostFetchError = impart.HTTPError{Status: http.StatusInternalServerError, Message: "We encountered an error getting the post. The humans have been alerted."}

	ErrUserNotFound = impart.HTTPError{http.StatusNotFound, "User doesn't exist."}
	ErrRemoteUserNotFound = impart.HTTPError{http.StatusNotFound, "Remote user not found."}
	ErrUserNotFoundEmail = impart.HTTPError{http.StatusNotFound, "Please enter your username instead of your email address."}

	ErrUserSilenced = impart.HTTPError{http.StatusForbidden, "Account is silenced."}

	ErrDisabledPasswordAuth = impart.HTTPError{http.StatusForbidden, "Password authentication is disabled."}
	)

	// Post operation errors
	var (
	ErrPostNoUpdatableVals = impart.HTTPError{http.StatusBadRequest, "Supply some properties to update."}
	)
	diff --git a/routes.go b/routes.go
	index a5b0f2f..a88f1e3 100644
	--- a/routes.go
	+++ b/routes.go
	@@ -1,249 +1,250 @@
	/*
	* Copyright © 2018-2021 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"net/http"
	"net/url"
	"path/filepath"
	"strings"

	"github.com/gorilla/csrf"
	"github.com/gorilla/mux"
	"github.com/writeas/go-webfinger"
	"github.com/writeas/web-core/log"
	"github.com/writefreely/go-nodeinfo"
	)

	// InitStaticRoutes adds routes for serving static files.
	// TODO: this should just be a func, not method
	func (app App) InitStaticRoutes(r mux.Router) {
	// Handle static files
	fs := http.FileServer(http.Dir(filepath.Join(app.cfg.Server.StaticParentDir, staticDir)))
	fs = cacheControl(fs)
	app.shttp = http.NewServeMux()
	app.shttp.Handle("/", fs)
	r.PathPrefix("/").Handler(fs)
	}

	// InitRoutes adds dynamic routes for the given mux.Router.
	func InitRoutes(apper Apper, r mux.Router) mux.Router {
	// Create handler
	handler := NewWFHandler(apper)

	// Set up routes
	hostSubroute := apper.App().cfg.App.Host[strings.Index(apper.App().cfg.App.Host, "://")+3:]
	if apper.App().cfg.App.SingleUser {
	hostSubroute = "{domain}"
	} else {
	if strings.HasPrefix(hostSubroute, "localhost") {
	hostSubroute = "localhost"
	}
	}

	if apper.App().cfg.App.SingleUser {
	log.Info("Adding %s routes (single user)...", hostSubroute)
	} else {
	log.Info("Adding %s routes (multi-user)...", hostSubroute)
	}

	// Primary app routes
	write := r.PathPrefix("/").Subrouter()

	// Federation endpoint configurations
	wf := webfinger.Default(wfResolver{apper.App().db, apper.App().cfg})
	wf.NoTLSHandler = nil

	// Federation endpoints
	// host-meta
	write.HandleFunc("/.well-known/host-meta", handler.Web(handleViewHostMeta, UserLevelReader))
	// webfinger
	write.HandleFunc(webfinger.WebFingerPath, handler.LogHandlerFunc(http.HandlerFunc(wf.Webfinger)))
	// nodeinfo
	niCfg := nodeInfoConfig(apper.App().db, apper.App().cfg)
	ni := nodeinfo.NewService(*niCfg, nodeInfoResolver{apper.App().cfg, apper.App().db})
	write.HandleFunc(nodeinfo.NodeInfoPath, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfoDiscover)))
	write.HandleFunc(niCfg.InfoURL, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfo)))

	// handle mentions
	write.HandleFunc("/@/{handle}", handler.Web(handleViewMention, UserLevelReader))

	configureSlackOauth(handler, write, apper.App())
	configureWriteAsOauth(handler, write, apper.App())
	configureGitlabOauth(handler, write, apper.App())
	configureGenericOauth(handler, write, apper.App())
	configureGiteaOauth(handler, write, apper.App())

	// Set up dynamic page handlers
	// Handle auth
	auth := write.PathPrefix("/api/auth/").Subrouter()
	if apper.App().cfg.App.OpenRegistration {
	auth.HandleFunc("/signup", handler.All(apiSignup)).Methods("POST")
	}
	auth.HandleFunc("/login", handler.All(login)).Methods("POST")
	auth.HandleFunc("/read", handler.WebErrors(handleWebCollectionUnlock, UserLevelNone)).Methods("POST")
	auth.HandleFunc("/me", handler.All(handleAPILogout)).Methods("DELETE")

	// Handle logged in user sections
	me := write.PathPrefix("/me").Subrouter()
	me.HandleFunc("/", handler.Redirect("/me", UserLevelUser))
	me.HandleFunc("/c", handler.Redirect("/me/c/", UserLevelUser)).Methods("GET")
	me.HandleFunc("/c/", handler.User(viewCollections)).Methods("GET")
	me.HandleFunc("/c/{collection}", handler.User(viewEditCollection)).Methods("GET")
	me.HandleFunc("/c/{collection}/stats", handler.User(viewStats)).Methods("GET")
	me.HandleFunc("/c/{collection}/subscribers", handler.User(handleViewSubscribers)).Methods("GET")
	me.Path("/delete").Handler(csrf.Protect(apper.App().keys.CSRFKey)(handler.User(handleUserDelete))).Methods("POST")
	me.HandleFunc("/posts", handler.Redirect("/me/posts/", UserLevelUser)).Methods("GET")
	me.HandleFunc("/posts/", handler.User(viewArticles)).Methods("GET")
	me.HandleFunc("/posts/export.csv", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
	me.HandleFunc("/posts/export.zip", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
	me.HandleFunc("/posts/export.json", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
	me.HandleFunc("/export", handler.User(viewExportOptions)).Methods("GET")
	me.HandleFunc("/export.json", handler.Download(viewExportFull, UserLevelUser)).Methods("GET")
	me.HandleFunc("/import", handler.User(viewImport)).Methods("GET")
	me.Path("/settings").Handler(csrf.Protect(apper.App().keys.CSRFKey)(handler.User(viewSettings))).Methods("GET")
	me.HandleFunc("/invites", handler.User(handleViewUserInvites)).Methods("GET")
	me.HandleFunc("/logout", handler.Web(viewLogout, UserLevelNone)).Methods("GET")

	write.HandleFunc("/api/me", handler.All(viewMeAPI)).Methods("GET")
	apiMe := write.PathPrefix("/api/me/").Subrouter()
	apiMe.HandleFunc("/", handler.All(viewMeAPI)).Methods("GET")
	apiMe.HandleFunc("/posts", handler.UserWebAPI(viewMyPostsAPI)).Methods("GET")
	apiMe.HandleFunc("/collections", handler.UserAPI(viewMyCollectionsAPI)).Methods("GET")
	apiMe.HandleFunc("/password", handler.All(updatePassphrase)).Methods("POST")
	apiMe.HandleFunc("/self", handler.All(updateSettings)).Methods("POST")
	apiMe.HandleFunc("/invites", handler.User(handleCreateUserInvite)).Methods("POST")
	apiMe.HandleFunc("/import", handler.User(handleImport)).Methods("POST")
	apiMe.HandleFunc("/oauth/remove", handler.User(removeOauth)).Methods("POST")

	// Sign up validation
	write.HandleFunc("/api/alias", handler.All(handleUsernameCheck)).Methods("POST")

	write.HandleFunc("/api/markdown", handler.All(handleRenderMarkdown)).Methods("POST")

	instanceURL, _ := url.Parse(apper.App().Config().App.Host)
	host := instanceURL.Host

	// Handle collections
	write.HandleFunc("/api/collections", handler.All(newCollection)).Methods("POST")
	apiColls := write.PathPrefix("/api/collections/").Subrouter()
	apiColls.HandleFunc("/monetization-pointer", handler.PlainTextAPI(handleSPSPEndpoint)).Methods("GET")
	apiColls.HandleFunc("/"+host, handler.AllReader(fetchCollection)).Methods("GET")
	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.AllReader(fetchCollection)).Methods("GET")
	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.All(existingCollection)).Methods("POST", "DELETE")
	apiColls.HandleFunc("/{alias}/posts", handler.AllReader(fetchCollectionPosts)).Methods("GET")
	apiColls.HandleFunc("/{alias}/posts", handler.All(newPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/posts/{post}", handler.AllReader(fetchPost)).Methods("GET")
	apiColls.HandleFunc("/{alias}/posts/{post:[a-zA-Z0-9]{10}}", handler.All(existingPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/posts/{post}/splitcontent", handler.AllReader(handleGetSplitContent)).Methods("GET", "POST")
	apiColls.HandleFunc("/{alias}/posts/{post}/{property}", handler.AllReader(fetchPostProperty)).Methods("GET")
	apiColls.HandleFunc("/{alias}/collect", handler.All(addPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/pin", handler.All(pinPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/unpin", handler.All(pinPost)).Methods("POST")
	+ apiColls.HandleFunc("/{alias}/email/subscribers/export.csv", handler.Download(handleExportEmailSubscriptions, UserLevelUser)).Methods("GET")
	apiColls.HandleFunc("/{alias}/email/subscribe", handler.All(handleCreateEmailSubscription)).Methods("POST")
	apiColls.HandleFunc("/{alias}/email/subscribe", handler.All(handleDeleteEmailSubscription)).Methods("DELETE")
	apiColls.HandleFunc("/{collection}/email/unsubscribe", handler.All(handleDeleteEmailSubscription)).Methods("GET")
	apiColls.HandleFunc("/{alias}/inbox", handler.All(handleFetchCollectionInbox)).Methods("POST")
	apiColls.HandleFunc("/{alias}/outbox", handler.AllReader(handleFetchCollectionOutbox)).Methods("GET")
	apiColls.HandleFunc("/{alias}/following", handler.AllReader(handleFetchCollectionFollowing)).Methods("GET")
	apiColls.HandleFunc("/{alias}/followers", handler.AllReader(handleFetchCollectionFollowers)).Methods("GET")

	// Handle posts
	write.HandleFunc("/api/posts", handler.All(newPost)).Methods("POST")
	posts := write.PathPrefix("/api/posts/").Subrouter()
	posts.HandleFunc("/claim", handler.All(addPost)).Methods("POST")
	posts.HandleFunc("/disperse", handler.All(dispersePost)).Methods("POST")
	posts.HandleFunc("/{post:[a-zA-Z0-9]+}", handler.AllReader(fetchPost)).Methods("GET")
	posts.HandleFunc("/{post:[a-zA-Z0-9]+}", handler.All(existingPost)).Methods("POST", "PUT")
	posts.HandleFunc("/{post:[a-zA-Z0-9]+}", handler.All(deletePost)).Methods("DELETE")
	posts.HandleFunc("/{post:[a-zA-Z0-9]+}/{property}", handler.AllReader(fetchPostProperty)).Methods("GET")

	write.HandleFunc("/auth/signup", handler.Web(handleWebSignup, UserLevelNoneRequired)).Methods("POST")
	write.HandleFunc("/auth/login", handler.Web(webLogin, UserLevelNoneRequired)).Methods("POST")

	write.HandleFunc("/admin", handler.Admin(handleViewAdminDash)).Methods("GET")
	write.HandleFunc("/admin/monitor", handler.Admin(handleViewAdminMonitor)).Methods("GET")
	write.HandleFunc("/admin/settings", handler.Admin(handleViewAdminSettings)).Methods("GET")
	write.HandleFunc("/admin/users", handler.Admin(handleViewAdminUsers)).Methods("GET")
	write.HandleFunc("/admin/user/{username}", handler.Admin(handleViewAdminUser)).Methods("GET")
	write.HandleFunc("/admin/user/{username}/delete", handler.Admin(handleAdminDeleteUser)).Methods("POST")
	write.HandleFunc("/admin/user/{username}/status", handler.Admin(handleAdminToggleUserStatus)).Methods("POST")
	write.HandleFunc("/admin/user/{username}/passphrase", handler.Admin(handleAdminResetUserPass)).Methods("POST")
	write.HandleFunc("/admin/pages", handler.Admin(handleViewAdminPages)).Methods("GET")
	write.HandleFunc("/admin/page/{slug}", handler.Admin(handleViewAdminPage)).Methods("GET")
	write.HandleFunc("/admin/update/config", handler.AdminApper(handleAdminUpdateConfig)).Methods("POST")
	write.HandleFunc("/admin/update/{page}", handler.Admin(handleAdminUpdateSite)).Methods("POST")
	write.HandleFunc("/admin/updates", handler.Admin(handleViewAdminUpdates)).Methods("GET")

	// Handle special pages first
	write.Path("/reset").Handler(csrf.Protect(apper.App().keys.CSRFKey)(handler.Web(viewResetPassword, UserLevelNoneRequired)))
	write.HandleFunc("/login", handler.Web(viewLogin, UserLevelNoneRequired))
	write.HandleFunc("/signup", handler.Web(handleViewLanding, UserLevelNoneRequired))
	write.HandleFunc("/invite/{code:[a-zA-Z0-9]+}", handler.Web(handleViewInvite, UserLevelOptional)).Methods("GET")
	// TODO: show a reader-specific 404 page if the function is disabled
	write.HandleFunc("/read", handler.Web(viewLocalTimeline, UserLevelReader))
	RouteRead(handler, UserLevelReader, write.PathPrefix("/read").Subrouter())

	draftEditPrefix := ""
	if apper.App().cfg.App.SingleUser {
	draftEditPrefix = "/d"
	write.HandleFunc("/me/new", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
	} else {
	write.HandleFunc("/new", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
	}

	// All the existing stuff
	write.HandleFunc(draftEditPrefix+"/{action}/edit", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
	write.HandleFunc(draftEditPrefix+"/{action}/meta", handler.Web(handleViewMeta, UserLevelUser)).Methods("GET")
	// Collections
	if apper.App().cfg.App.SingleUser {
	RouteCollections(handler, write.PathPrefix("/").Subrouter())
	} else {
	write.HandleFunc("/{prefix:[@~$!\\-+]}{collection}", handler.Web(handleViewCollection, UserLevelReader))
	write.HandleFunc("/{collection}/", handler.Web(handleViewCollection, UserLevelReader))
	RouteCollections(handler, write.PathPrefix("/{prefix:[@~$!\\-+]?}{collection}").Subrouter())
	// Posts
	}
	write.HandleFunc(draftEditPrefix+"/{post}", handler.Web(handleViewPost, UserLevelOptional))
	write.HandleFunc("/", handler.Web(handleViewHome, UserLevelOptional))

	return r
	}

	func RouteCollections(handler Handler, r mux.Router) {
	r.HandleFunc("/logout", handler.Web(handleLogOutCollection, UserLevelOptional))
	r.HandleFunc("/page/{page:[0-9]+}", handler.Web(handleViewCollection, UserLevelReader))
	r.HandleFunc("/archive/", handler.Web(handleViewCollection, UserLevelReader))
	r.HandleFunc("/{archive:archive}/page/{page:[0-9]+}", handler.Web(handleViewCollection, UserLevelReader))
	r.HandleFunc("/lang:{lang:[a-z]{2}}", handler.Web(handleViewCollectionLang, UserLevelOptional))
	r.HandleFunc("/lang:{lang:[a-z]{2}}/page/{page:[0-9]+}", handler.Web(handleViewCollectionLang, UserLevelOptional))
	r.HandleFunc("/tag:{tag}", handler.Web(handleViewCollectionTag, UserLevelReader))
	r.HandleFunc("/tag:{tag}/page/{page:[0-9]+}", handler.Web(handleViewCollectionTag, UserLevelReader))
	r.HandleFunc("/tag:{tag}/feed/", handler.Web(ViewFeed, UserLevelReader))
	r.HandleFunc("/sitemap.xml", handler.AllReader(handleViewSitemap))
	r.HandleFunc("/feed/", handler.AllReader(ViewFeed))
	r.HandleFunc("/email/confirm/{subscriber}", handler.All(handleConfirmEmailSubscription)).Methods("GET")
	r.HandleFunc("/email/unsubscribe/{subscriber}", handler.All(handleDeleteEmailSubscription)).Methods("GET")
	r.HandleFunc("/{slug}", handler.CollectionPostOrStatic)
	r.HandleFunc("/{slug}/edit", handler.Web(handleViewPad, UserLevelUser))
	r.HandleFunc("/{slug}/edit/meta", handler.Web(handleViewMeta, UserLevelUser))
	r.HandleFunc("/{slug}/", handler.Web(handleCollectionPostRedirect, UserLevelReader)).Methods("GET")
	}

	func RouteRead(handler Handler, readPerm UserLevelFunc, r mux.Router) {
	r.HandleFunc("/api/posts", handler.Web(viewLocalTimelineAPI, readPerm))
	r.HandleFunc("/p/{page}", handler.Web(viewLocalTimeline, readPerm))
	r.HandleFunc("/feed/", handler.Web(viewLocalTimelineFeed, readPerm))
	r.HandleFunc("/t/{tag}", handler.Web(viewLocalTimeline, readPerm))
	r.HandleFunc("/a/{post}", handler.Web(handlePostIDRedirect, readPerm))
	r.HandleFunc("/{author}", handler.Web(viewLocalTimeline, readPerm))
	r.HandleFunc("/", handler.Web(viewLocalTimeline, readPerm))
	}
	diff --git a/templates/user/subscribers.tmpl b/templates/user/subscribers.tmpl
	index 1e79ddb..60c33f9 100644
	--- a/templates/user/subscribers.tmpl
	+++ b/templates/user/subscribers.tmpl
	@@ -1,98 +1,102 @@
	{{define "subscribers"}}
	{{template "header" .}}

	<style>
	.toolbar {
	text-align: right;
	margin: 1em 0;
	}
	</style>

	<div class="snug content-container {{if not .CanEmailSub}}clean{{end}}">
	{{if .Silenced}}
	{{template "user-silenced"}}
	{{end}}

	{{if .Collection.Collection}}{{template "collection-breadcrumbs" .}}{{end}}

	<h1>Subscribers</h1>
	{{if .Collection.Collection}}
	{{template "collection-nav" .Collection}}

	<nav class="pager sub">
	<a href="/me/c/{{.Collection.Alias}}/subscribers" {{if eq .Filter ""}}class="selected"{{end}}>Email ({{len .EmailSubs}})</a>
	<a href="/me/c/{{.Collection.Alias}}/subscribers?filter=fediverse" {{if eq .Filter "fediverse"}}class="selected"{{end}}>Followers ({{len .Followers}})</a>
	</nav>
	{{end}}

	{{if .Flashes -}}
	<ul class="errors">
	{{range .Flashes}}<li class="urgent">{{.}}</li>{{end}}
	</ul>
	{{- end}}

	{{ if eq .Filter "fediverse" }}
	<table class="classy export">
	<tr>
	<th style="width: 60%">Username</th>
	<th colspan="2">Since</th>
	</tr>

	{{if and (gt (len .Followers) 0) (not .FederationEnabled)}}
	<div class="alert info">
	<p><strong>Federation is disabled on this server</strong>, so followers won't receive any new posts.</p>
	</div>
	{{end}}
	{{ if gt (len .Followers) 0 }}
	{{range $el := .Followers}}
	<tr>
	<td><a href="{{.ActorID}}">@{{.EstimatedHandle}}</a></td>
	<td>{{.CreatedFriendly}}</td>
	</tr>
	{{end}}
	{{ else }}
	<tr>
	<td colspan="2">No followers yet.</td>
	</tr>
	{{ end }}
	</table>
	{{ else }}
	{{if or .CanEmailSub .EmailSubs}}
	{{if not .CanEmailSub}}
	<div class="alert info">
	<p><strong>Email subscriptions are disabled on this server</strong>, so no new emails will be sent out.</p>
	</div>
	{{end}}
	- {{if not .EmailSubsEnabled}}
	+ {{if .EmailSubsEnabled}}
	+ <div class="row toolbar ends">
	+ <a href="/api/collections/{{.Collection.Alias}}/email/subscribers/export.csv">Export list</a>
	+ </div>
	+ {{else}}
	<div class="alert info">
	<p><strong>Email subscriptions are disabled</strong>. {{if .EmailSubs}}No new emails will be sent out.{{end}} To enable email subscriptions, turn the option on from your blog's <a href="/me/c/{{.Collection.Alias}}#updates">Customize</a> page.</p>
	</div>
	{{end}}
	<table class="classy export">
	<tr>
	<th style="width: 60%">Email Address</th>
	<th colspan="2">Since</th>
	</tr>

	{{ if .EmailSubs }}
	{{range $el := .EmailSubs}}
	<tr>
	<td><a href="mailto:{{.Email.String}}">{{.Email.String}}</a></td>
	<td>{{.SubscribedFriendly}}</td>
	</tr>
	{{end}}
	{{ else }}
	<tr>
	<td colspan="2">No subscribers yet.</td>
	</tr>
	{{ end }}
	</table>
	{{end}}
	{{ end }}

	</div>

	{{template "foot" .}}

	{{template "body-end" .}}
	{{end}}

File Metadata

Mime Type: text/x-diff
Expires: Sat, Aug 30, 8:04 PM (1 d, 9 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3372830

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions