No OneTemporary
Actions

Size

76 KB

Subscribers

None

View Options

	diff --git a/admin.go b/admin.go
	index 5f7d244..99124ae 100644
	--- a/admin.go
	+++ b/admin.go
	@@ -1,530 +1,556 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"database/sql"
	"fmt"
	"net/http"
	"runtime"
	"strconv"
	"strings"
	"time"

	"github.com/gorilla/mux"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/log"
	"github.com/writeas/web-core/passgen"
	"github.com/writeas/writefreely/appstats"
	"github.com/writeas/writefreely/config"
	)

	var (
	appStartTime = time.Now()
	sysStatus systemStatus
	)

	const adminUsersPerPage = 30

	type systemStatus struct {
	Uptime string
	NumGoroutine int

	// General statistics.
	MemAllocated string // bytes allocated and still in use
	MemTotal string // bytes allocated (even if freed)
	MemSys string // bytes obtained from system (sum of XxxSys below)
	Lookups uint64 // number of pointer lookups
	MemMallocs uint64 // number of mallocs
	MemFrees uint64 // number of frees

	// Main allocation heap statistics.
	HeapAlloc string // bytes allocated and still in use
	HeapSys string // bytes obtained from system
	HeapIdle string // bytes in idle spans
	HeapInuse string // bytes in non-idle span
	HeapReleased string // bytes released to the OS
	HeapObjects uint64 // total number of allocated objects

	// Low-level fixed-size structure allocator statistics.
	// Inuse is bytes used now.
	// Sys is bytes obtained from system.
	StackInuse string // bootstrap stacks
	StackSys string
	MSpanInuse string // mspan structures
	MSpanSys string
	MCacheInuse string // mcache structures
	MCacheSys string
	BuckHashSys string // profiling bucket hash table
	GCSys string // GC metadata
	OtherSys string // other system allocations

	// Garbage collector statistics.
	NextGC string // next run in HeapAlloc time (bytes)
	LastGC string // last run in absolute time (ns)
	PauseTotalNs string
	PauseNs string // circular buffer of recent GC pause times, most recent at [(NumGC+255)%256]
	NumGC uint32
	}

	type inspectedCollection struct {
	CollectionObj
	Followers int
	LastPost string
	}

	type instanceContent struct {
	ID string
	Type string
	Title sql.NullString
	Content string
	Updated time.Time
	}

	func (c instanceContent) UpdatedFriendly() string {
	/*
	// TODO: accept a locale in this method and use that for the format
	var loc monday.Locale = monday.LocaleEnUS
	return monday.Format(u.Created, monday.DateTimeFormatsByLocale[loc], loc)
	*/
	return c.Updated.Format("January 2, 2006, 3:04 PM")
	}

	func handleViewAdminDash(app App, u User, w http.ResponseWriter, r *http.Request) error {
	updateAppStats()
	p := struct {
	*UserPage
	SysStatus systemStatus
	Config config.AppCfg

	Message, ConfigMessage string
	}{
	UserPage: NewUserPage(app, r, u, "Admin", nil),
	SysStatus: sysStatus,
	Config: app.cfg.App,

	Message: r.FormValue("m"),
	ConfigMessage: r.FormValue("cm"),
	}
	-
	showUserPage(w, "admin", p)
	return nil
	}

	func handleViewAdminUsers(app App, u User, w http.ResponseWriter, r *http.Request) error {
	p := struct {
	*UserPage
	Config config.AppCfg
	Message string

	Users *[]User
	CurPage int
	TotalUsers int64
	TotalPages []int
	}{
	UserPage: NewUserPage(app, r, u, "Users", nil),
	Config: app.cfg.App,
	Message: r.FormValue("m"),
	}

	p.TotalUsers = app.db.GetAllUsersCount()
	ttlPages := p.TotalUsers / adminUsersPerPage
	p.TotalPages = []int{}
	for i := 1; i <= int(ttlPages); i++ {
	p.TotalPages = append(p.TotalPages, i)
	}

	var err error
	p.CurPage, err = strconv.Atoi(r.FormValue("p"))
	if err != nil \|\| p.CurPage < 1 {
	p.CurPage = 1
	} else if p.CurPage > int(ttlPages) {
	p.CurPage = int(ttlPages)
	}

	p.Users, err = app.db.GetAllUsers(uint(p.CurPage))
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get users: %v", err)}
	}

	showUserPage(w, "users", p)
	return nil
	}

	func handleViewAdminUser(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	username := vars["username"]
	if username == "" {
	return impart.HTTPError{http.StatusFound, "/admin/users"}
	}

	p := struct {
	*UserPage
	Config config.AppCfg
	Message string

	User *User
	Colls []inspectedCollection
	LastPost string
	NewPassword string
	TotalPosts int64
	ClearEmail string
	}{
	Config: app.cfg.App,
	Message: r.FormValue("m"),
	Colls: []inspectedCollection{},
	}

	var err error
	p.User, err = app.db.GetUserForAuth(username)
	if err != nil {
	if err == ErrUserNotFound {
	return err
	}
	log.Error("Could not get user: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, err.Error()}
	}

	flashes, _ := getSessionFlashes(app, w, r, nil)
	for _, flash := range flashes {
	if strings.HasPrefix(flash, "SUCCESS: ") {
	p.NewPassword = strings.TrimPrefix(flash, "SUCCESS: ")
	p.ClearEmail = p.User.EmailClear(app.keys)
	}
	}
	p.UserPage = NewUserPage(app, r, u, p.User.Username, nil)
	p.TotalPosts = app.db.GetUserPostsCount(p.User.ID)
	lp, err := app.db.GetUserLastPostTime(p.User.ID)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user's last post time: %v", err)}
	}
	if lp != nil {
	p.LastPost = lp.Format("January 2, 2006, 3:04 PM")
	}

	colls, err := app.db.GetCollections(p.User, app.cfg.App.Host)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user's collections: %v", err)}
	}
	for _, c := range *colls {
	ic := inspectedCollection{
	CollectionObj: CollectionObj{Collection: c},
	}

	if app.cfg.App.Federation {
	folls, err := app.db.GetAPFollowers(&c)
	if err == nil {
	// TODO: handle error here (at least log it)
	ic.Followers = len(*folls)
	}
	}

	app.db.GetPostsCount(&ic.CollectionObj, true)

	lp, err := app.db.GetCollectionLastPostTime(c.ID)
	if err != nil {
	log.Error("Didn't get last post time for collection %d: %v", c.ID, err)
	}
	if lp != nil {
	ic.LastPost = lp.Format("January 2, 2006, 3:04 PM")
	}

	p.Colls = append(p.Colls, ic)
	}

	showUserPage(w, "view-user", p)
	return nil
	}

	func handleAdminToggleUserStatus(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	username := vars["username"]
	if username == "" {
	return impart.HTTPError{http.StatusFound, "/admin/users"}
	}

	user, err := app.db.GetUserForAuth(username)
	if err != nil {
	log.Error("failed to get user: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user from username: %v", err)}
	}
	if user.IsSilenced() {
	err = app.db.SetUserStatus(user.ID, UserActive)
	} else {
	err = app.db.SetUserStatus(user.ID, UserSilenced)
	}
	if err != nil {
	log.Error("toggle user silenced: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not toggle user status: %v", err)}
	}
	return impart.HTTPError{http.StatusFound, fmt.Sprintf("/admin/user/%s#status", username)}
	}

	func handleAdminResetUserPass(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	username := vars["username"]
	if username == "" {
	return impart.HTTPError{http.StatusFound, "/admin/users"}
	}

	// Generate new random password since none supplied
	pass := passgen.NewWordish()
	hashedPass, err := auth.HashPass([]byte(pass))
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not create password hash: %v", err)}
	}

	userIDVal := r.FormValue("user")
	log.Info("ADMIN: Changing user %s password", userIDVal)
	id, err := strconv.Atoi(userIDVal)
	if err != nil {
	return impart.HTTPError{http.StatusBadRequest, fmt.Sprintf("Invalid user ID: %v", err)}
	}

	err = app.db.ChangePassphrase(int64(id), true, "", hashedPass)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not update passphrase: %v", err)}
	}
	log.Info("ADMIN: Successfully changed.")

	addSessionFlash(app, w, r, fmt.Sprintf("SUCCESS: %s", pass), nil)

	return impart.HTTPError{http.StatusFound, fmt.Sprintf("/admin/user/%s", username)}
	}

	func handleViewAdminPages(app App, u User, w http.ResponseWriter, r *http.Request) error {
	p := struct {
	*UserPage
	Config config.AppCfg
	Message string

	Pages []*instanceContent
	}{
	UserPage: NewUserPage(app, r, u, "Pages", nil),
	Config: app.cfg.App,
	Message: r.FormValue("m"),
	}

	var err error
	p.Pages, err = app.db.GetInstancePages()
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get pages: %v", err)}
	}

	// Add in default pages
	var hasAbout, hasPrivacy bool
	for i, c := range p.Pages {
	if hasAbout && hasPrivacy {
	break
	}
	if c.ID == "about" {
	hasAbout = true
	if !c.Title.Valid {
	p.Pages[i].Title = defaultAboutTitle(app.cfg)
	}
	} else if c.ID == "privacy" {
	hasPrivacy = true
	if !c.Title.Valid {
	p.Pages[i].Title = defaultPrivacyTitle()
	}
	}
	}
	if !hasAbout {
	p.Pages = append(p.Pages, &instanceContent{
	ID: "about",
	Title: defaultAboutTitle(app.cfg),
	Content: defaultAboutPage(app.cfg),
	Updated: defaultPageUpdatedTime,
	})
	}
	if !hasPrivacy {
	p.Pages = append(p.Pages, &instanceContent{
	ID: "privacy",
	Title: defaultPrivacyTitle(),
	Content: defaultPrivacyPolicy(app.cfg),
	Updated: defaultPageUpdatedTime,
	})
	}

	showUserPage(w, "pages", p)
	return nil
	}

	func handleViewAdminPage(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	slug := vars["slug"]
	if slug == "" {
	return impart.HTTPError{http.StatusFound, "/admin/pages"}
	}

	p := struct {
	*UserPage
	Config config.AppCfg
	Message string

	Banner *instanceContent
	Content *instanceContent
	}{
	Config: app.cfg.App,
	Message: r.FormValue("m"),
	}

	var err error
	// Get pre-defined pages, or select slug
	if slug == "about" {
	p.Content, err = getAboutPage(app)
	} else if slug == "privacy" {
	p.Content, err = getPrivacyPage(app)
	} else if slug == "landing" {
	p.Banner, err = getLandingBanner(app)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get banner: %v", err)}
	}
	p.Content, err = getLandingBody(app)
	p.Content.ID = "landing"
	} else if slug == "reader" {
	p.Content, err = getReaderSection(app)
	} else {
	p.Content, err = app.db.GetDynamicContent(slug)
	}
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get page: %v", err)}
	}
	title := "New page"
	if p.Content != nil {
	title = "Edit " + p.Content.ID
	} else {
	p.Content = &instanceContent{}
	}
	p.UserPage = NewUserPage(app, r, u, title, nil)

	showUserPage(w, "view-page", p)
	return nil
	}

	func handleAdminUpdateSite(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	id := vars["page"]

	// Validate
	if id != "about" && id != "privacy" && id != "landing" && id != "reader" {
	return impart.HTTPError{http.StatusNotFound, "No such page."}
	}

	var err error
	m := ""
	if id == "landing" {
	// Handle special landing page
	err = app.db.UpdateDynamicContent("landing-banner", "", r.FormValue("banner"), "section")
	if err != nil {
	m = "?m=" + err.Error()
	return impart.HTTPError{http.StatusFound, "/admin/page/" + id + m}
	}
	err = app.db.UpdateDynamicContent("landing-body", "", r.FormValue("content"), "section")
	} else if id == "reader" {
	// Update sections with titles
	err = app.db.UpdateDynamicContent(id, r.FormValue("title"), r.FormValue("content"), "section")
	} else {
	// Update page
	err = app.db.UpdateDynamicContent(id, r.FormValue("title"), r.FormValue("content"), "page")
	}
	if err != nil {
	m = "?m=" + err.Error()
	}
	return impart.HTTPError{http.StatusFound, "/admin/page/" + id + m}
	}

	func handleAdminUpdateConfig(apper Apper, u User, w http.ResponseWriter, r http.Request) error {
	apper.App().cfg.App.SiteName = r.FormValue("site_name")
	apper.App().cfg.App.SiteDesc = r.FormValue("site_desc")
	apper.App().cfg.App.Landing = r.FormValue("landing")
	apper.App().cfg.App.OpenRegistration = r.FormValue("open_registration") == "on"
	mul, err := strconv.Atoi(r.FormValue("min_username_len"))
	if err == nil {
	apper.App().cfg.App.MinUsernameLen = mul
	}
	mb, err := strconv.Atoi(r.FormValue("max_blogs"))
	if err == nil {
	apper.App().cfg.App.MaxBlogs = mb
	}
	apper.App().cfg.App.Federation = r.FormValue("federation") == "on"
	apper.App().cfg.App.PublicStats = r.FormValue("public_stats") == "on"
	apper.App().cfg.App.Private = r.FormValue("private") == "on"
	apper.App().cfg.App.LocalTimeline = r.FormValue("local_timeline") == "on"
	if apper.App().cfg.App.LocalTimeline && apper.App().timeline == nil {
	log.Info("Initializing local timeline...")
	initLocalTimeline(apper.App())
	}
	apper.App().cfg.App.UserInvites = r.FormValue("user_invites")
	if apper.App().cfg.App.UserInvites == "none" {
	apper.App().cfg.App.UserInvites = ""
	}
	apper.App().cfg.App.DefaultVisibility = r.FormValue("default_visibility")

	m := "?cm=Configuration+saved."
	err = apper.SaveConfig(apper.App().cfg)
	if err != nil {
	m = "?cm=" + err.Error()
	}
	return impart.HTTPError{http.StatusFound, "/admin" + m + "#config"}
	}

	func updateAppStats() {
	sysStatus.Uptime = appstats.TimeSincePro(appStartTime)

	m := new(runtime.MemStats)
	runtime.ReadMemStats(m)
	sysStatus.NumGoroutine = runtime.NumGoroutine()

	sysStatus.MemAllocated = appstats.FileSize(int64(m.Alloc))
	sysStatus.MemTotal = appstats.FileSize(int64(m.TotalAlloc))
	sysStatus.MemSys = appstats.FileSize(int64(m.Sys))
	sysStatus.Lookups = m.Lookups
	sysStatus.MemMallocs = m.Mallocs
	sysStatus.MemFrees = m.Frees

	sysStatus.HeapAlloc = appstats.FileSize(int64(m.HeapAlloc))
	sysStatus.HeapSys = appstats.FileSize(int64(m.HeapSys))
	sysStatus.HeapIdle = appstats.FileSize(int64(m.HeapIdle))
	sysStatus.HeapInuse = appstats.FileSize(int64(m.HeapInuse))
	sysStatus.HeapReleased = appstats.FileSize(int64(m.HeapReleased))
	sysStatus.HeapObjects = m.HeapObjects

	sysStatus.StackInuse = appstats.FileSize(int64(m.StackInuse))
	sysStatus.StackSys = appstats.FileSize(int64(m.StackSys))
	sysStatus.MSpanInuse = appstats.FileSize(int64(m.MSpanInuse))
	sysStatus.MSpanSys = appstats.FileSize(int64(m.MSpanSys))
	sysStatus.MCacheInuse = appstats.FileSize(int64(m.MCacheInuse))
	sysStatus.MCacheSys = appstats.FileSize(int64(m.MCacheSys))
	sysStatus.BuckHashSys = appstats.FileSize(int64(m.BuckHashSys))
	sysStatus.GCSys = appstats.FileSize(int64(m.GCSys))
	sysStatus.OtherSys = appstats.FileSize(int64(m.OtherSys))

	sysStatus.NextGC = appstats.FileSize(int64(m.NextGC))
	sysStatus.LastGC = fmt.Sprintf("%.1fs", float64(time.Now().UnixNano()-int64(m.LastGC))/1000/1000/1000)
	sysStatus.PauseTotalNs = fmt.Sprintf("%.1fs", float64(m.PauseTotalNs)/1000/1000/1000)
	sysStatus.PauseNs = fmt.Sprintf("%.3fs", float64(m.PauseNs[(m.NumGC+255)%256])/1000/1000/1000)
	sysStatus.NumGC = m.NumGC
	}

	func adminResetPassword(app App, u User, newPass string) error {
	hashedPass, err := auth.HashPass([]byte(newPass))
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not create password hash: %v", err)}
	}

	err = app.db.ChangePassphrase(u.ID, true, "", hashedPass)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not update passphrase: %v", err)}
	}
	return nil
	}
	+
	+func handleViewAdminUpdates(app App, u User, w http.ResponseWriter, r *http.Request) error {
	+ check := r.URL.Query().Get("check")
	+
	+ if check == "now" && app.cfg.App.UpdateChecks {
	+ app.updates.CheckNow()
	+ }
	+
	+ p := struct {
	+ *UserPage
	+ LastChecked string
	+ LatestVersion string
	+ LatestReleaseURL string
	+ UpdateAvailable bool
	+ }{
	+ UserPage: NewUserPage(app, r, u, "Updates", nil),
	+ }
	+ if app.cfg.App.UpdateChecks {
	+ p.LastChecked = app.updates.lastCheck.Format("January 2, 2006, 3:04 PM")
	+ p.LatestVersion = app.updates.LatestVersion()
	+ p.LatestReleaseURL = app.updates.ReleaseURL()
	+ p.UpdateAvailable = app.updates.AreAvailable()
	+ }
	+
	+ showUserPage(w, "app-updates", p)
	+ return nil
	+}
	diff --git a/app.go b/app.go
	index 170c321..dd05c95 100644
	--- a/app.go
	+++ b/app.go
	@@ -1,880 +1,883 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"crypto/tls"
	"database/sql"
	"fmt"
	"html/template"
	"io/ioutil"
	"net/http"
	"net/url"
	"os"
	"os/signal"
	"path/filepath"
	"regexp"
	"strings"
	"syscall"
	"time"

	"github.com/gorilla/mux"
	"github.com/gorilla/schema"
	"github.com/gorilla/sessions"
	"github.com/manifoldco/promptui"
	stripmd "github.com/writeas/go-strip-markdown"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/converter"
	"github.com/writeas/web-core/log"
	"github.com/writeas/writefreely/author"
	"github.com/writeas/writefreely/config"
	"github.com/writeas/writefreely/key"
	"github.com/writeas/writefreely/migrations"
	"github.com/writeas/writefreely/page"
	"golang.org/x/crypto/acme/autocert"
	)

	const (
	staticDir = "static"
	assumedTitleLen = 80
	postsPerPage = 10

	serverSoftware = "WriteFreely"
	softwareURL = "https://writefreely.org"
	)

	var (
	debugging bool

	// Software version can be set from git env using -ldflags
	softwareVer = "0.11.2"

	// DEPRECATED VARS
	isSingleUser bool
	)

	// App holds data and configuration for an individual WriteFreely instance.
	type App struct {
	router *mux.Router
	shttp *http.ServeMux
	db *datastore
	cfg *config.Config
	cfgFile string
	keys *key.Keychain
	sessionStore sessions.Store
	formDecoder *schema.Decoder
	+ updates *updatesCache

	timeline *localTimeline
	}

	// DB returns the App's datastore
	func (app App) DB() datastore {
	return app.db
	}

	// Router returns the App's router
	func (app App) Router() mux.Router {
	return app.router
	}

	// Config returns the App's current configuration.
	func (app App) Config() config.Config {
	return app.cfg
	}

	// SetConfig updates the App's Config to the given value.
	func (app App) SetConfig(cfg config.Config) {
	app.cfg = cfg
	}

	// SetKeys updates the App's Keychain to the given value.
	func (app App) SetKeys(k key.Keychain) {
	app.keys = k
	}

	func (app *App) SessionStore() sessions.Store {
	return app.sessionStore
	}

	func (app *App) SetSessionStore(s sessions.Store) {
	app.sessionStore = s
	}

	// Apper is the interface for getting data into and out of a WriteFreely
	// instance (or "App").
	//
	// App returns the App for the current instance.
	//
	// LoadConfig reads an app configuration into the App, returning any error
	// encountered.
	//
	// SaveConfig persists the current App configuration.
	//
	// LoadKeys reads the App's encryption keys and loads them into its
	// key.Keychain.
	type Apper interface {
	App() *App

	LoadConfig() error
	SaveConfig(*config.Config) error

	LoadKeys() error

	ReqLog(r *http.Request, status int, timeSince time.Duration) string
	}

	// App returns the App
	func (app App) App() App {
	return app
	}

	// LoadConfig loads and parses a config file.
	func (app *App) LoadConfig() error {
	log.Info("Loading %s configuration...", app.cfgFile)
	cfg, err := config.Load(app.cfgFile)
	if err != nil {
	log.Error("Unable to load configuration: %v", err)
	os.Exit(1)
	return err
	}
	app.cfg = cfg
	return nil
	}

	// SaveConfig saves the given Config to disk -- namely, to the App's cfgFile.
	func (app App) SaveConfig(c config.Config) error {
	return config.Save(c, app.cfgFile)
	}

	// LoadKeys reads all needed keys from disk into the App. In order to use the
	// configured `Server.KeysParentDir`, you must call initKeyPaths(App) before
	// this.
	func (app *App) LoadKeys() error {
	var err error
	app.keys = &key.Keychain{}

	if debugging {
	log.Info(" %s", emailKeyPath)
	}
	app.keys.EmailKey, err = ioutil.ReadFile(emailKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", cookieAuthKeyPath)
	}
	app.keys.CookieAuthKey, err = ioutil.ReadFile(cookieAuthKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", cookieKeyPath)
	}
	app.keys.CookieKey, err = ioutil.ReadFile(cookieKeyPath)
	if err != nil {
	return err
	}

	return nil
	}

	func (app App) ReqLog(r http.Request, status int, timeSince time.Duration) string {
	return fmt.Sprintf("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, timeSince, r.UserAgent())
	}

	// handleViewHome shows page at root path. It checks the configuration and
	// authentication state to show the correct page.
	func handleViewHome(app App, w http.ResponseWriter, r http.Request) error {
	if app.cfg.App.SingleUser {
	// Render blog index
	return handleViewCollection(app, w, r)
	}

	// Multi-user instance
	forceLanding := r.FormValue("landing") == "1"
	if !forceLanding {
	// Show correct page based on user auth status and configured landing path
	u := getUserSession(app, r)

	if app.cfg.App.Chorus {
	// This instance is focused on reading, so show Reader on home route if not
	// private or a private-instance user is logged in.
	if !app.cfg.App.Private \|\| u != nil {
	return viewLocalTimeline(app, w, r)
	}
	}

	if u != nil {
	// User is logged in, so show the Pad
	return handleViewPad(app, w, r)
	}

	if land := app.cfg.App.LandingPath(); land != "/" {
	return impart.HTTPError{http.StatusFound, land}
	}
	}

	return handleViewLanding(app, w, r)
	}

	func handleViewLanding(app App, w http.ResponseWriter, r http.Request) error {
	forceLanding := r.FormValue("landing") == "1"

	p := struct {
	page.StaticPage
	Flashes []template.HTML
	Banner template.HTML
	Content template.HTML

	ForcedLanding bool
	}{
	StaticPage: pageForReq(app, r),
	ForcedLanding: forceLanding,
	}

	banner, err := getLandingBanner(app)
	if err != nil {
	log.Error("unable to get landing banner: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get banner: %v", err)}
	}
	p.Banner = template.HTML(applyMarkdown([]byte(banner.Content), "", app.cfg))

	content, err := getLandingBody(app)
	if err != nil {
	log.Error("unable to get landing content: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get content: %v", err)}
	}
	p.Content = template.HTML(applyMarkdown([]byte(content.Content), "", app.cfg))

	// Get error messages
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// Ignore this
	log.Error("Unable to get session in handleViewHome; ignoring: %v", err)
	}
	flashes, _ := getSessionFlashes(app, w, r, session)
	for _, flash := range flashes {
	p.Flashes = append(p.Flashes, template.HTML(flash))
	}

	// Show landing page
	return renderPage(w, "landing.tmpl", p)
	}

	func handleTemplatedPage(app App, w http.ResponseWriter, r http.Request, t *template.Template) error {
	p := struct {
	page.StaticPage
	ContentTitle string
	Content template.HTML
	PlainContent string
	Updated string

	AboutStats *InstanceStats
	}{
	StaticPage: pageForReq(app, r),
	}
	if r.URL.Path == "/about" \|\| r.URL.Path == "/privacy" {
	var c *instanceContent
	var err error

	if r.URL.Path == "/about" {
	c, err = getAboutPage(app)

	// Fetch stats
	p.AboutStats = &InstanceStats{}
	p.AboutStats.NumPosts, _ = app.db.GetTotalPosts()
	p.AboutStats.NumBlogs, _ = app.db.GetTotalCollections()
	} else {
	c, err = getPrivacyPage(app)
	}

	if err != nil {
	return err
	}
	p.ContentTitle = c.Title.String
	p.Content = template.HTML(applyMarkdown([]byte(c.Content), "", app.cfg))
	p.PlainContent = shortPostDescription(stripmd.Strip(c.Content))
	if !c.Updated.IsZero() {
	p.Updated = c.Updated.Format("January 2, 2006")
	}
	}

	// Serve templated page
	err := t.ExecuteTemplate(w, "base", p)
	if err != nil {
	log.Error("Unable to render page: %v", err)
	}
	return nil
	}

	func pageForReq(app App, r http.Request) page.StaticPage {
	p := page.StaticPage{
	AppCfg: app.cfg.App,
	Path: r.URL.Path,
	Version: "v" + softwareVer,
	}

	// Add user information, if given
	var u *User
	accessToken := r.FormValue("t")
	if accessToken != "" {
	userID := app.db.GetUserID(accessToken)
	if userID != -1 {
	var err error
	u, err = app.db.GetUserByID(userID)
	if err == nil {
	p.Username = u.Username
	}
	}
	} else {
	u = getUserSession(app, r)
	if u != nil {
	p.Username = u.Username
	p.IsAdmin = u != nil && u.IsAdmin()
	p.CanInvite = canUserInvite(app.cfg, p.IsAdmin)
	}
	}
	p.CanViewReader = !app.cfg.App.Private \|\| u != nil

	return p
	}

	var fileRegex = regexp.MustCompile("/([^/]\\.[^/])$")

	// Initialize loads the app configuration and initializes templates, keys,
	// session, route handlers, and the database connection.
	func Initialize(apper Apper, debug bool) (*App, error) {
	debugging = debug

	apper.LoadConfig()

	// Load templates
	err := InitTemplates(apper.App().Config())
	if err != nil {
	return nil, fmt.Errorf("load templates: %s", err)
	}

	// Load keys and set up session
	initKeyPaths(apper.App()) // TODO: find a better way to do this, since it's unneeded in all Apper implementations
	err = InitKeys(apper)
	if err != nil {
	return nil, fmt.Errorf("init keys: %s", err)
	}
	+ apper.App().InitUpdates()
	+
	apper.App().InitSession()

	apper.App().InitDecoder()

	err = ConnectToDatabase(apper.App())
	if err != nil {
	return nil, fmt.Errorf("connect to DB: %s", err)
	}

	// Handle local timeline, if enabled
	if apper.App().cfg.App.LocalTimeline {
	log.Info("Initializing local timeline...")
	initLocalTimeline(apper.App())
	}

	return apper.App(), nil
	}

	func Serve(app App, r mux.Router) {
	log.Info("Going to serve...")

	isSingleUser = app.cfg.App.SingleUser
	app.cfg.Server.Dev = debugging

	// Handle shutdown
	c := make(chan os.Signal, 2)
	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
	go func() {
	<-c
	log.Info("Shutting down...")
	shutdown(app)
	log.Info("Done.")
	os.Exit(0)
	}()

	// Start web application server
	var bindAddress = app.cfg.Server.Bind
	if bindAddress == "" {
	bindAddress = "localhost"
	}
	var err error
	if app.cfg.IsSecureStandalone() {
	if app.cfg.Server.Autocert {
	m := &autocert.Manager{
	Prompt: autocert.AcceptTOS,
	Cache: autocert.DirCache(app.cfg.Server.TLSCertPath),
	}
	host, err := url.Parse(app.cfg.App.Host)
	if err != nil {
	log.Error("[WARNING] Unable to parse configured host! %s", err)
	log.Error(`[WARNING] ALL hosts are allowed, which can open you to an attack where
	clients connect to a server by IP address and pretend to be asking for an
	incorrect host name, and cause you to reach the CA's rate limit for certificate
	requests. We recommend supplying a valid host name.`)
	log.Info("Using autocert on ANY host")
	} else {
	log.Info("Using autocert on host %s", host.Host)
	m.HostPolicy = autocert.HostWhitelist(host.Host)
	}
	s := &http.Server{
	Addr: ":https",
	Handler: r,
	TLSConfig: &tls.Config{
	GetCertificate: m.GetCertificate,
	},
	}
	s.SetKeepAlivesEnabled(false)

	go func() {
	log.Info("Serving redirects on http://%s:80", bindAddress)
	err = http.ListenAndServe(":80", m.HTTPHandler(nil))
	log.Error("Unable to start redirect server: %v", err)
	}()

	log.Info("Serving on https://%s:443", bindAddress)
	log.Info("---")
	err = s.ListenAndServeTLS("", "")
	} else {
	go func() {
	log.Info("Serving redirects on http://%s:80", bindAddress)
	err = http.ListenAndServe(fmt.Sprintf("%s:80", bindAddress), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	http.Redirect(w, r, app.cfg.App.Host, http.StatusMovedPermanently)
	}))
	log.Error("Unable to start redirect server: %v", err)
	}()

	log.Info("Serving on https://%s:443", bindAddress)
	log.Info("Using manual certificates")
	log.Info("---")
	err = http.ListenAndServeTLS(fmt.Sprintf("%s:443", bindAddress), app.cfg.Server.TLSCertPath, app.cfg.Server.TLSKeyPath, r)
	}
	} else {
	log.Info("Serving on http://%s:%d\n", bindAddress, app.cfg.Server.Port)
	log.Info("---")
	err = http.ListenAndServe(fmt.Sprintf("%s:%d", bindAddress, app.cfg.Server.Port), r)
	}
	if err != nil {
	log.Error("Unable to start: %v", err)
	os.Exit(1)
	}
	}

	func (app *App) InitDecoder() {
	// TODO: do this at the package level, instead of the App level
	// Initialize modules
	app.formDecoder = schema.NewDecoder()
	app.formDecoder.RegisterConverter(converter.NullJSONString{}, converter.ConvertJSONNullString)
	app.formDecoder.RegisterConverter(converter.NullJSONBool{}, converter.ConvertJSONNullBool)
	app.formDecoder.RegisterConverter(sql.NullString{}, converter.ConvertSQLNullString)
	app.formDecoder.RegisterConverter(sql.NullBool{}, converter.ConvertSQLNullBool)
	app.formDecoder.RegisterConverter(sql.NullInt64{}, converter.ConvertSQLNullInt64)
	app.formDecoder.RegisterConverter(sql.NullFloat64{}, converter.ConvertSQLNullFloat64)
	}

	// ConnectToDatabase validates and connects to the configured database, then
	// tests the connection.
	func ConnectToDatabase(app *App) error {
	// Check database configuration
	if app.cfg.Database.Type == driverMySQL && (app.cfg.Database.User == "" \|\| app.cfg.Database.Password == "") {
	return fmt.Errorf("Database user or password not set.")
	}
	if app.cfg.Database.Host == "" {
	app.cfg.Database.Host = "localhost"
	}
	if app.cfg.Database.Database == "" {
	app.cfg.Database.Database = "writefreely"
	}

	// TODO: check err
	connectToDatabase(app)

	// Test database connection
	err := app.db.Ping()
	if err != nil {
	return fmt.Errorf("Database ping failed: %s", err)
	}

	return nil
	}

	// FormatVersion constructs the version string for the application
	func FormatVersion() string {
	return serverSoftware + " " + softwareVer
	}

	// OutputVersion prints out the version of the application.
	func OutputVersion() {
	fmt.Println(FormatVersion())
	}

	// NewApp creates a new app instance.
	func NewApp(cfgFile string) *App {
	return &App{
	cfgFile: cfgFile,
	}
	}

	// CreateConfig creates a default configuration and saves it to the app's cfgFile.
	func CreateConfig(app *App) error {
	log.Info("Creating configuration...")
	c := config.New()
	log.Info("Saving configuration %s...", app.cfgFile)
	err := config.Save(c, app.cfgFile)
	if err != nil {
	return fmt.Errorf("Unable to save configuration: %v", err)
	}
	return nil
	}

	// DoConfig runs the interactive configuration process.
	func DoConfig(app *App, configSections string) {
	if configSections == "" {
	configSections = "server db app"
	}
	// let's check there aren't any garbage in the list
	configSectionsArray := strings.Split(configSections, " ")
	for _, element := range configSectionsArray {
	if element != "server" && element != "db" && element != "app" {
	log.Error("Invalid argument to --sections. Valid arguments are only \"server\", \"db\" and \"app\"")
	os.Exit(1)
	}
	}
	d, err := config.Configure(app.cfgFile, configSections)
	if err != nil {
	log.Error("Unable to configure: %v", err)
	os.Exit(1)
	}
	app.cfg = d.Config
	connectToDatabase(app)
	defer shutdown(app)

	if !app.db.DatabaseInitialized() {
	err = adminInitDatabase(app)
	if err != nil {
	log.Error(err.Error())
	os.Exit(1)
	}
	} else {
	log.Info("Database already initialized.")
	}

	if d.User != nil {
	u := &User{
	Username: d.User.Username,
	HashedPass: d.User.HashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	// Create blog
	log.Info("Creating user %s...\n", u.Username)
	err = app.db.CreateUser(app.cfg, u, app.cfg.App.SiteName)
	if err != nil {
	log.Error("Unable to create user: %s", err)
	os.Exit(1)
	}
	log.Info("Done!")
	}
	os.Exit(0)
	}

	// GenerateKeyFiles creates app encryption keys and saves them into the configured KeysParentDir.
	func GenerateKeyFiles(app *App) error {
	// Read keys path from config
	app.LoadConfig()

	// Create keys dir if it doesn't exist yet
	fullKeysDir := filepath.Join(app.cfg.Server.KeysParentDir, keysDir)
	if _, err := os.Stat(fullKeysDir); os.IsNotExist(err) {
	err = os.Mkdir(fullKeysDir, 0700)
	if err != nil {
	return err
	}
	}

	// Generate keys
	initKeyPaths(app)
	// TODO: use something like https://github.com/hashicorp/go-multierror to return errors
	var keyErrs error
	err := generateKey(emailKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(cookieAuthKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(cookieKeyPath)
	if err != nil {
	keyErrs = err
	}

	return keyErrs
	}

	// CreateSchema creates all database tables needed for the application.
	func CreateSchema(apper Apper) error {
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())
	err := adminInitDatabase(apper.App())
	if err != nil {
	return err
	}
	return nil
	}

	// Migrate runs all necessary database migrations.
	func Migrate(apper Apper) error {
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	err := migrations.Migrate(migrations.NewDatastore(apper.App().db.DB, apper.App().db.driverName))
	if err != nil {
	return fmt.Errorf("migrate: %s", err)
	}
	return nil
	}

	// ResetPassword runs the interactive password reset process.
	func ResetPassword(apper Apper, username string) error {
	// Connect to the database
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// Fetch user
	u, err := apper.App().db.GetUserForAuth(username)
	if err != nil {
	log.Error("Get user: %s", err)
	os.Exit(1)
	}

	// Prompt for new password
	prompt := promptui.Prompt{
	Templates: &promptui.PromptTemplates{
	Success: "{{ . \| bold \| faint }}: ",
	},
	Label: "New password",
	Mask: '*',
	}
	newPass, err := prompt.Run()
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}

	// Do the update
	log.Info("Updating...")
	err = adminResetPassword(apper.App(), u, newPass)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	return nil
	}

	// DoDeleteAccount runs the confirmation and account delete process.
	func DoDeleteAccount(apper Apper, username string) error {
	// Connect to the database
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// check user exists
	u, err := apper.App().db.GetUserForAuth(username)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	userID := u.ID

	// do not delete the admin account
	// TODO: check for other admins and skip?
	if u.IsAdmin() {
	log.Error("Can not delete admin account")
	os.Exit(1)
	}

	// confirm deletion, w/ w/out posts
	prompt := promptui.Prompt{
	Templates: &promptui.PromptTemplates{
	Success: "{{ . \| bold \| faint }}: ",
	},
	Label: fmt.Sprintf("Really delete user : %s", username),
	IsConfirm: true,
	}
	_, err = prompt.Run()
	if err != nil {
	log.Info("Aborted...")
	os.Exit(0)
	}

	log.Info("Deleting...")
	err = apper.App().db.DeleteAccount(userID)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	return nil
	}

	func connectToDatabase(app *App) {
	log.Info("Connecting to %s database...", app.cfg.Database.Type)

	var db *sql.DB
	var err error
	if app.cfg.Database.Type == driverMySQL {
	db, err = sql.Open(app.cfg.Database.Type, fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=true&loc=%s", app.cfg.Database.User, app.cfg.Database.Password, app.cfg.Database.Host, app.cfg.Database.Port, app.cfg.Database.Database, url.QueryEscape(time.Local.String())))
	db.SetMaxOpenConns(50)
	} else if app.cfg.Database.Type == driverSQLite {
	if !SQLiteEnabled {
	log.Error("Invalid database type '%s'. Binary wasn't compiled with SQLite3 support.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if app.cfg.Database.FileName == "" {
	log.Error("SQLite database filename value in config.ini is empty.")
	os.Exit(1)
	}
	db, err = sql.Open("sqlite3_with_regex", app.cfg.Database.FileName+"?parseTime=true&cached=shared")
	db.SetMaxOpenConns(1)
	} else {
	log.Error("Invalid database type '%s'. Only 'mysql' and 'sqlite3' are supported right now.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	app.db = &datastore{db, app.cfg.Database.Type}
	}

	func shutdown(app *App) {
	log.Info("Closing database connection...")
	app.db.Close()
	}

	// CreateUser creates a new admin or normal user from the given credentials.
	func CreateUser(apper Apper, username, password string, isAdmin bool) error {
	// Create an admin user with --create-admin
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// Ensure an admin / first user doesn't already exist
	firstUser, _ := apper.App().db.GetUserByID(1)
	if isAdmin {
	// Abort if trying to create admin user, but one already exists
	if firstUser != nil {
	return fmt.Errorf("Admin user already exists (%s). Create a regular user with: writefreely --create-user", firstUser.Username)
	}
	} else {
	// Abort if trying to create regular user, but no admin exists yet
	if firstUser == nil {
	return fmt.Errorf("No admin user exists yet. Create an admin first with: writefreely --create-admin")
	}
	}

	// Create the user
	// Normalize and validate username
	desiredUsername := username
	username = getSlug(username, "")

	usernameDesc := username
	if username != desiredUsername {
	usernameDesc += " (originally: " + desiredUsername + ")"
	}

	if !author.IsValidUsername(apper.App().cfg, username) {
	return fmt.Errorf("Username %s is invalid, reserved, or shorter than configured minimum length (%d characters).", usernameDesc, apper.App().cfg.App.MinUsernameLen)
	}

	// Hash the password
	hashedPass, err := auth.HashPass([]byte(password))
	if err != nil {
	return fmt.Errorf("Unable to hash password: %v", err)
	}

	u := &User{
	Username: username,
	HashedPass: hashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	userType := "user"
	if isAdmin {
	userType = "admin"
	}
	log.Info("Creating %s %s...", userType, usernameDesc)
	err = apper.App().db.CreateUser(apper.App().Config(), u, desiredUsername)
	if err != nil {
	return fmt.Errorf("Unable to create user: %s", err)
	}
	log.Info("Done!")
	return nil
	}

	func adminInitDatabase(app *App) error {
	schemaFileName := "schema.sql"
	if app.cfg.Database.Type == driverSQLite {
	schemaFileName = "sqlite.sql"
	}

	schema, err := Asset(schemaFileName)
	if err != nil {
	return fmt.Errorf("Unable to load schema file: %v", err)
	}

	tblReg := regexp.MustCompile("CREATE TABLE (IF NOT EXISTS )?`([a-z_]+)`")

	queries := strings.Split(string(schema), ";\n")
	for _, q := range queries {
	if strings.TrimSpace(q) == "" {
	continue
	}
	parts := tblReg.FindStringSubmatch(q)
	if len(parts) >= 3 {
	log.Info("Creating table %s...", parts[2])
	} else {
	log.Info("Creating table ??? (Weird query) No match in: %v", parts)
	}
	_, err = app.db.Exec(q)
	if err != nil {
	log.Error("%s", err)
	} else {
	log.Info("Created.")
	}
	}

	// Set up migrations table
	log.Info("Initializing appmigrations table...")
	err = migrations.SetInitialMigrations(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("Unable to set initial migrations: %v", err)
	}

	log.Info("Running migrations...")
	err = migrations.Migrate(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("migrate: %s", err)
	}

	log.Info("Done.")
	return nil
	}
	diff --git a/config.ini.example b/config.ini.example
	index dcbd6ee..7ac944e 100644
	--- a/config.ini.example
	+++ b/config.ini.example
	@@ -1,26 +1,27 @@
	[server]
	hidden_host =
	port = 8080

	[database]
	type = mysql
	username = root
	password = changeme
	database = writefreely
	host = db
	port = 3306

	[app]
	site_name = WriteFreely Example Blog!
	host = http://localhost:8080
	theme = write
	disable_js = false
	webfonts = true
	single_user = true
	open_registration = false
	min_username_len = 3
	max_blogs = 1
	federation = true
	public_stats = true
	private = false
	+update_checks = true

	diff --git a/config/config.go b/config/config.go
	index 2616e9e..31f62f0 100644
	--- a/config/config.go
	+++ b/config/config.go
	@@ -1,212 +1,216 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	// Package config holds and assists in the configuration of a writefreely instance.
	package config

	import (
	- "gopkg.in/ini.v1"
	"strings"
	+
	+ "gopkg.in/ini.v1"
	)

	const (
	// FileName is the default configuration file name
	FileName = "config.ini"

	UserNormal UserType = "user"
	UserAdmin = "admin"
	)

	type (
	UserType string

	// ServerCfg holds values that affect how the HTTP server runs
	ServerCfg struct {
	HiddenHost string `ini:"hidden_host"`
	Port int `ini:"port"`
	Bind string `ini:"bind"`

	TLSCertPath string `ini:"tls_cert_path"`
	TLSKeyPath string `ini:"tls_key_path"`
	Autocert bool `ini:"autocert"`

	TemplatesParentDir string `ini:"templates_parent_dir"`
	StaticParentDir string `ini:"static_parent_dir"`
	PagesParentDir string `ini:"pages_parent_dir"`
	KeysParentDir string `ini:"keys_parent_dir"`

	HashSeed string `ini:"hash_seed"`

	Dev bool `ini:"-"`
	}

	// DatabaseCfg holds values that determine how the application connects to a datastore
	DatabaseCfg struct {
	Type string `ini:"type"`
	FileName string `ini:"filename"`
	User string `ini:"username"`
	Password string `ini:"password"`
	Database string `ini:"database"`
	Host string `ini:"host"`
	Port int `ini:"port"`
	}

	WriteAsOauthCfg struct {
	ClientID string `ini:"client_id"`
	ClientSecret string `ini:"client_secret"`
	AuthLocation string `ini:"auth_location"`
	TokenLocation string `ini:"token_location"`
	InspectLocation string `ini:"inspect_location"`
	CallbackProxy string `ini:"callback_proxy"`
	CallbackProxyAPI string `ini:"callback_proxy_api"`
	}

	SlackOauthCfg struct {
	ClientID string `ini:"client_id"`
	ClientSecret string `ini:"client_secret"`
	TeamID string `ini:"team_id"`
	CallbackProxy string `ini:"callback_proxy"`
	CallbackProxyAPI string `ini:"callback_proxy_api"`
	}

	// AppCfg holds values that affect how the application functions
	AppCfg struct {
	SiteName string `ini:"site_name"`
	SiteDesc string `ini:"site_description"`
	Host string `ini:"host"`

	// Site appearance
	Theme string `ini:"theme"`
	Editor string `ini:"editor"`
	JSDisabled bool `ini:"disable_js"`
	WebFonts bool `ini:"webfonts"`
	Landing string `ini:"landing"`
	SimpleNav bool `ini:"simple_nav"`
	WFModesty bool `ini:"wf_modesty"`

	// Site functionality
	Chorus bool `ini:"chorus"`
	DisableDrafts bool `ini:"disable_drafts"`

	// Users
	SingleUser bool `ini:"single_user"`
	OpenRegistration bool `ini:"open_registration"`
	MinUsernameLen int `ini:"min_username_len"`
	MaxBlogs int `ini:"max_blogs"`

	// Federation
	Federation bool `ini:"federation"`
	PublicStats bool `ini:"public_stats"`

	// Access
	Private bool `ini:"private"`

	// Additional functions
	LocalTimeline bool `ini:"local_timeline"`
	UserInvites string `ini:"user_invites"`

	// Defaults
	DefaultVisibility string `ini:"default_visibility"`
	+
	+ // Check for Updates
	+ UpdateChecks bool `ini:"update_checks"`
	}

	// Config holds the complete configuration for running a writefreely instance
	Config struct {
	Server ServerCfg `ini:"server"`
	Database DatabaseCfg `ini:"database"`
	App AppCfg `ini:"app"`
	SlackOauth SlackOauthCfg `ini:"oauth.slack"`
	WriteAsOauth WriteAsOauthCfg `ini:"oauth.writeas"`
	}
	)

	// New creates a new Config with sane defaults
	func New() *Config {
	c := &Config{
	Server: ServerCfg{
	Port: 8080,
	Bind: "localhost", /* IPV6 support when not using localhost? */
	},
	App: AppCfg{
	Host: "http://localhost:8080",
	Theme: "write",
	WebFonts: true,
	SingleUser: true,
	MinUsernameLen: 3,
	MaxBlogs: 1,
	Federation: true,
	PublicStats: true,
	},
	}
	c.UseMySQL(true)
	return c
	}

	// UseMySQL resets the Config's Database to use default values for a MySQL setup.
	func (cfg *Config) UseMySQL(fresh bool) {
	cfg.Database.Type = "mysql"
	if fresh {
	cfg.Database.Host = "localhost"
	cfg.Database.Port = 3306
	}
	}

	// UseSQLite resets the Config's Database to use default values for a SQLite setup.
	func (cfg *Config) UseSQLite(fresh bool) {
	cfg.Database.Type = "sqlite3"
	if fresh {
	cfg.Database.FileName = "writefreely.db"
	}
	}

	// IsSecureStandalone returns whether or not the application is running as a
	// standalone server with TLS enabled.
	func (cfg *Config) IsSecureStandalone() bool {
	return cfg.Server.Port == 443 && cfg.Server.TLSCertPath != "" && cfg.Server.TLSKeyPath != ""
	}

	func (ac *AppCfg) LandingPath() string {
	if !strings.HasPrefix(ac.Landing, "/") {
	return "/" + ac.Landing
	}
	return ac.Landing
	}

	// Load reads the given configuration file, then parses and returns it as a Config.
	func Load(fname string) (*Config, error) {
	if fname == "" {
	fname = FileName
	}
	cfg, err := ini.Load(fname)
	if err != nil {
	return nil, err
	}

	// Parse INI file
	uc := &Config{}
	err = cfg.MapTo(uc)
	if err != nil {
	return nil, err
	}
	return uc, nil
	}

	// Save writes the given Config to the given file.
	func Save(uc *Config, fname string) error {
	cfg := ini.Empty()
	err := ini.ReflectFrom(cfg, uc)
	if err != nil {
	return err
	}

	if fname == "" {
	fname = FileName
	}
	return cfg.SaveTo(fname)
	}
	diff --git a/routes.go b/routes.go
	index fcd00ec..3ab820a 100644
	--- a/routes.go
	+++ b/routes.go
	@@ -1,219 +1,220 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"net/http"
	"path/filepath"
	"strings"

	"github.com/gorilla/mux"
	"github.com/writeas/go-webfinger"
	"github.com/writeas/web-core/log"
	"github.com/writefreely/go-nodeinfo"
	)

	// InitStaticRoutes adds routes for serving static files.
	// TODO: this should just be a func, not method
	func (app App) InitStaticRoutes(r mux.Router) {
	// Handle static files
	fs := http.FileServer(http.Dir(filepath.Join(app.cfg.Server.StaticParentDir, staticDir)))
	app.shttp = http.NewServeMux()
	app.shttp.Handle("/", fs)
	r.PathPrefix("/").Handler(fs)
	}

	// InitRoutes adds dynamic routes for the given mux.Router.
	func InitRoutes(apper Apper, r mux.Router) mux.Router {
	// Create handler
	handler := NewWFHandler(apper)

	// Set up routes
	hostSubroute := apper.App().cfg.App.Host[strings.Index(apper.App().cfg.App.Host, "://")+3:]
	if apper.App().cfg.App.SingleUser {
	hostSubroute = "{domain}"
	} else {
	if strings.HasPrefix(hostSubroute, "localhost") {
	hostSubroute = "localhost"
	}
	}

	if apper.App().cfg.App.SingleUser {
	log.Info("Adding %s routes (single user)...", hostSubroute)
	} else {
	log.Info("Adding %s routes (multi-user)...", hostSubroute)
	}

	// Primary app routes
	write := r.PathPrefix("/").Subrouter()

	// Federation endpoint configurations
	wf := webfinger.Default(wfResolver{apper.App().db, apper.App().cfg})
	wf.NoTLSHandler = nil

	// Federation endpoints
	// host-meta
	write.HandleFunc("/.well-known/host-meta", handler.Web(handleViewHostMeta, UserLevelReader))
	// webfinger
	write.HandleFunc(webfinger.WebFingerPath, handler.LogHandlerFunc(http.HandlerFunc(wf.Webfinger)))
	// nodeinfo
	niCfg := nodeInfoConfig(apper.App().db, apper.App().cfg)
	ni := nodeinfo.NewService(*niCfg, nodeInfoResolver{apper.App().cfg, apper.App().db})
	write.HandleFunc(nodeinfo.NodeInfoPath, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfoDiscover)))
	write.HandleFunc(niCfg.InfoURL, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfo)))

	// handle mentions
	write.HandleFunc("/@/{handle}", handler.Web(handleViewMention, UserLevelReader))

	configureSlackOauth(handler, write, apper.App())
	configureWriteAsOauth(handler, write, apper.App())

	// Set up dyamic page handlers
	// Handle auth
	auth := write.PathPrefix("/api/auth/").Subrouter()
	if apper.App().cfg.App.OpenRegistration {
	auth.HandleFunc("/signup", handler.All(apiSignup)).Methods("POST")
	}
	auth.HandleFunc("/login", handler.All(login)).Methods("POST")
	auth.HandleFunc("/read", handler.WebErrors(handleWebCollectionUnlock, UserLevelNone)).Methods("POST")
	auth.HandleFunc("/me", handler.All(handleAPILogout)).Methods("DELETE")

	// Handle logged in user sections
	me := write.PathPrefix("/me").Subrouter()
	me.HandleFunc("/", handler.Redirect("/me", UserLevelUser))
	me.HandleFunc("/c", handler.Redirect("/me/c/", UserLevelUser)).Methods("GET")
	me.HandleFunc("/c/", handler.User(viewCollections)).Methods("GET")
	me.HandleFunc("/c/{collection}", handler.User(viewEditCollection)).Methods("GET")
	me.HandleFunc("/c/{collection}/stats", handler.User(viewStats)).Methods("GET")
	me.HandleFunc("/posts", handler.Redirect("/me/posts/", UserLevelUser)).Methods("GET")
	me.HandleFunc("/posts/", handler.User(viewArticles)).Methods("GET")
	me.HandleFunc("/posts/export.csv", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
	me.HandleFunc("/posts/export.zip", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
	me.HandleFunc("/posts/export.json", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
	me.HandleFunc("/export", handler.User(viewExportOptions)).Methods("GET")
	me.HandleFunc("/export.json", handler.Download(viewExportFull, UserLevelUser)).Methods("GET")
	me.HandleFunc("/import", handler.User(viewImport)).Methods("GET")
	me.HandleFunc("/settings", handler.User(viewSettings)).Methods("GET")
	me.HandleFunc("/invites", handler.User(handleViewUserInvites)).Methods("GET")
	me.HandleFunc("/logout", handler.Web(viewLogout, UserLevelNone)).Methods("GET")

	write.HandleFunc("/api/me", handler.All(viewMeAPI)).Methods("GET")
	apiMe := write.PathPrefix("/api/me/").Subrouter()
	apiMe.HandleFunc("/", handler.All(viewMeAPI)).Methods("GET")
	apiMe.HandleFunc("/posts", handler.UserAPI(viewMyPostsAPI)).Methods("GET")
	apiMe.HandleFunc("/collections", handler.UserAPI(viewMyCollectionsAPI)).Methods("GET")
	apiMe.HandleFunc("/password", handler.All(updatePassphrase)).Methods("POST")
	apiMe.HandleFunc("/self", handler.All(updateSettings)).Methods("POST")
	apiMe.HandleFunc("/invites", handler.User(handleCreateUserInvite)).Methods("POST")
	apiMe.HandleFunc("/import", handler.User(handleImport)).Methods("POST")

	// Sign up validation
	write.HandleFunc("/api/alias", handler.All(handleUsernameCheck)).Methods("POST")

	write.HandleFunc("/api/markdown", handler.All(handleRenderMarkdown)).Methods("POST")

	// Handle collections
	write.HandleFunc("/api/collections", handler.All(newCollection)).Methods("POST")
	apiColls := write.PathPrefix("/api/collections/").Subrouter()
	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.AllReader(fetchCollection)).Methods("GET")
	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.All(existingCollection)).Methods("POST", "DELETE")
	apiColls.HandleFunc("/{alias}/posts", handler.AllReader(fetchCollectionPosts)).Methods("GET")
	apiColls.HandleFunc("/{alias}/posts", handler.All(newPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/posts/{post}", handler.AllReader(fetchPost)).Methods("GET")
	apiColls.HandleFunc("/{alias}/posts/{post:[a-zA-Z0-9]{10}}", handler.All(existingPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/posts/{post}/{property}", handler.AllReader(fetchPostProperty)).Methods("GET")
	apiColls.HandleFunc("/{alias}/collect", handler.All(addPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/pin", handler.All(pinPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/unpin", handler.All(pinPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/inbox", handler.All(handleFetchCollectionInbox)).Methods("POST")
	apiColls.HandleFunc("/{alias}/outbox", handler.AllReader(handleFetchCollectionOutbox)).Methods("GET")
	apiColls.HandleFunc("/{alias}/following", handler.AllReader(handleFetchCollectionFollowing)).Methods("GET")
	apiColls.HandleFunc("/{alias}/followers", handler.AllReader(handleFetchCollectionFollowers)).Methods("GET")

	// Handle posts
	write.HandleFunc("/api/posts", handler.All(newPost)).Methods("POST")
	posts := write.PathPrefix("/api/posts/").Subrouter()
	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}", handler.AllReader(fetchPost)).Methods("GET")
	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}", handler.All(existingPost)).Methods("POST", "PUT")
	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}", handler.All(deletePost)).Methods("DELETE")
	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}/{property}", handler.AllReader(fetchPostProperty)).Methods("GET")
	posts.HandleFunc("/claim", handler.All(addPost)).Methods("POST")
	posts.HandleFunc("/disperse", handler.All(dispersePost)).Methods("POST")

	write.HandleFunc("/auth/signup", handler.Web(handleWebSignup, UserLevelNoneRequired)).Methods("POST")
	write.HandleFunc("/auth/login", handler.Web(webLogin, UserLevelNoneRequired)).Methods("POST")

	write.HandleFunc("/admin", handler.Admin(handleViewAdminDash)).Methods("GET")
	write.HandleFunc("/admin/users", handler.Admin(handleViewAdminUsers)).Methods("GET")
	write.HandleFunc("/admin/user/{username}", handler.Admin(handleViewAdminUser)).Methods("GET")
	write.HandleFunc("/admin/user/{username}/status", handler.Admin(handleAdminToggleUserStatus)).Methods("POST")
	write.HandleFunc("/admin/user/{username}/passphrase", handler.Admin(handleAdminResetUserPass)).Methods("POST")
	write.HandleFunc("/admin/pages", handler.Admin(handleViewAdminPages)).Methods("GET")
	write.HandleFunc("/admin/page/{slug}", handler.Admin(handleViewAdminPage)).Methods("GET")
	write.HandleFunc("/admin/update/config", handler.AdminApper(handleAdminUpdateConfig)).Methods("POST")
	write.HandleFunc("/admin/update/{page}", handler.Admin(handleAdminUpdateSite)).Methods("POST")
	+ write.HandleFunc("/admin/updates", handler.Admin(handleViewAdminUpdates)).Methods("GET")

	// Handle special pages first
	write.HandleFunc("/login", handler.Web(viewLogin, UserLevelNoneRequired))
	write.HandleFunc("/signup", handler.Web(handleViewLanding, UserLevelNoneRequired))
	write.HandleFunc("/invite/{code:[a-zA-Z0-9]+}", handler.Web(handleViewInvite, UserLevelOptional)).Methods("GET")
	// TODO: show a reader-specific 404 page if the function is disabled
	write.HandleFunc("/read", handler.Web(viewLocalTimeline, UserLevelReader))
	RouteRead(handler, UserLevelReader, write.PathPrefix("/read").Subrouter())

	draftEditPrefix := ""
	if apper.App().cfg.App.SingleUser {
	draftEditPrefix = "/d"
	write.HandleFunc("/me/new", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
	} else {
	write.HandleFunc("/new", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
	}

	// All the existing stuff
	write.HandleFunc(draftEditPrefix+"/{action}/edit", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
	write.HandleFunc(draftEditPrefix+"/{action}/meta", handler.Web(handleViewMeta, UserLevelUser)).Methods("GET")
	// Collections
	if apper.App().cfg.App.SingleUser {
	RouteCollections(handler, write.PathPrefix("/").Subrouter())
	} else {
	write.HandleFunc("/{prefix:[@~$!\\-+]}{collection}", handler.Web(handleViewCollection, UserLevelReader))
	write.HandleFunc("/{collection}/", handler.Web(handleViewCollection, UserLevelReader))
	RouteCollections(handler, write.PathPrefix("/{prefix:[@~$!\\-+]?}{collection}").Subrouter())
	// Posts
	}
	write.HandleFunc(draftEditPrefix+"/{post}", handler.Web(handleViewPost, UserLevelOptional))
	write.HandleFunc("/", handler.Web(handleViewHome, UserLevelOptional))

	return r
	}

	func RouteCollections(handler Handler, r mux.Router) {
	r.HandleFunc("/page/{page:[0-9]+}", handler.Web(handleViewCollection, UserLevelReader))
	r.HandleFunc("/tag:{tag}", handler.Web(handleViewCollectionTag, UserLevelReader))
	r.HandleFunc("/tag:{tag}/feed/", handler.Web(ViewFeed, UserLevelReader))
	r.HandleFunc("/tags/{tag}", handler.Web(handleViewCollectionTag, UserLevelReader))
	r.HandleFunc("/sitemap.xml", handler.AllReader(handleViewSitemap))
	r.HandleFunc("/feed/", handler.AllReader(ViewFeed))
	r.HandleFunc("/{slug}", handler.CollectionPostOrStatic)
	r.HandleFunc("/{slug}/edit", handler.Web(handleViewPad, UserLevelUser))
	r.HandleFunc("/{slug}/edit/meta", handler.Web(handleViewMeta, UserLevelUser))
	r.HandleFunc("/{slug}/", handler.Web(handleCollectionPostRedirect, UserLevelReader)).Methods("GET")
	}

	func RouteRead(handler Handler, readPerm UserLevelFunc, r mux.Router) {
	r.HandleFunc("/api/posts", handler.Web(viewLocalTimelineAPI, readPerm))
	r.HandleFunc("/p/{page}", handler.Web(viewLocalTimeline, readPerm))
	r.HandleFunc("/feed/", handler.Web(viewLocalTimelineFeed, readPerm))
	r.HandleFunc("/t/{tag}", handler.Web(viewLocalTimeline, readPerm))
	r.HandleFunc("/a/{post}", handler.Web(handlePostIDRedirect, readPerm))
	r.HandleFunc("/{author}", handler.Web(viewLocalTimeline, readPerm))
	r.HandleFunc("/", handler.Web(viewLocalTimeline, readPerm))
	}
	diff --git a/semver.go b/semver.go
	new file mode 100644
	index 0000000..18fb276
	--- /dev/null
	+++ b/semver.go
	@@ -0,0 +1,315 @@
	+// Copyright 2018 The Go Authors. All rights reserved.
	+// Use of this source code is governed by a BSD-style
	+// license that can be found in the LICENSE file.
	+
	+// Package semver implements comparison of semantic version strings.
	+// In this package, semantic version strings must begin with a leading "v",
	+// as in "v1.0.0".
	+//
	+// The general form of a semantic version string accepted by this package is
	+//
	+// vMAJOR[.MINOR[.PATCH[-PRERELEASE][+BUILD]]]
	+//
	+// where square brackets indicate optional parts of the syntax;
	+// MAJOR, MINOR, and PATCH are decimal integers without extra leading zeros;
	+// PRERELEASE and BUILD are each a series of non-empty dot-separated identifiers
	+// using only alphanumeric characters and hyphens; and
	+// all-numeric PRERELEASE identifiers must not have leading zeros.
	+//
	+// This package follows Semantic Versioning 2.0.0 (see semver.org)
	+// with two exceptions. First, it requires the "v" prefix. Second, it recognizes
	+// vMAJOR and vMAJOR.MINOR (with no prerelease or build suffixes)
	+// as shorthands for vMAJOR.0.0 and vMAJOR.MINOR.0.
	+
	+// Package writefreely
	+// copied from
	+// https://github.com/golang/tools/blob/master/internal/semver/semver.go
	+// slight modifications made
	+package writefreely
	+
	+// parsed returns the parsed form of a semantic version string.
	+type parsed struct {
	+ major string
	+ minor string
	+ patch string
	+ short string
	+ prerelease string
	+ build string
	+ err string
	+}
	+
	+// IsValid reports whether v is a valid semantic version string.
	+func IsValid(v string) bool {
	+ _, ok := semParse(v)
	+ return ok
	+}
	+
	+// CompareSemver returns an integer comparing two versions according to
	+// according to semantic version precedence.
	+// The result will be 0 if v == w, -1 if v < w, or +1 if v > w.
	+//
	+// An invalid semantic version string is considered less than a valid one.
	+// All invalid semantic version strings compare equal to each other.
	+func CompareSemver(v, w string) int {
	+ pv, ok1 := semParse(v)
	+ pw, ok2 := semParse(w)
	+ if !ok1 && !ok2 {
	+ return 0
	+ }
	+ if !ok1 {
	+ return -1
	+ }
	+ if !ok2 {
	+ return +1
	+ }
	+ if c := compareInt(pv.major, pw.major); c != 0 {
	+ return c
	+ }
	+ if c := compareInt(pv.minor, pw.minor); c != 0 {
	+ return c
	+ }
	+ if c := compareInt(pv.patch, pw.patch); c != 0 {
	+ return c
	+ }
	+ return comparePrerelease(pv.prerelease, pw.prerelease)
	+}
	+
	+func semParse(v string) (p parsed, ok bool) {
	+ if v == "" \|\| v[0] != 'v' {
	+ p.err = "missing v prefix"
	+ return
	+ }
	+ p.major, v, ok = parseInt(v[1:])
	+ if !ok {
	+ p.err = "bad major version"
	+ return
	+ }
	+ if v == "" {
	+ p.minor = "0"
	+ p.patch = "0"
	+ p.short = ".0.0"
	+ return
	+ }
	+ if v[0] != '.' {
	+ p.err = "bad minor prefix"
	+ ok = false
	+ return
	+ }
	+ p.minor, v, ok = parseInt(v[1:])
	+ if !ok {
	+ p.err = "bad minor version"
	+ return
	+ }
	+ if v == "" {
	+ p.patch = "0"
	+ p.short = ".0"
	+ return
	+ }
	+ if v[0] != '.' {
	+ p.err = "bad patch prefix"
	+ ok = false
	+ return
	+ }
	+ p.patch, v, ok = parseInt(v[1:])
	+ if !ok {
	+ p.err = "bad patch version"
	+ return
	+ }
	+ if len(v) > 0 && v[0] == '-' {
	+ p.prerelease, v, ok = parsePrerelease(v)
	+ if !ok {
	+ p.err = "bad prerelease"
	+ return
	+ }
	+ }
	+ if len(v) > 0 && v[0] == '+' {
	+ p.build, v, ok = parseBuild(v)
	+ if !ok {
	+ p.err = "bad build"
	+ return
	+ }
	+ }
	+ if v != "" {
	+ p.err = "junk on end"
	+ ok = false
	+ return
	+ }
	+ ok = true
	+ return
	+}
	+
	+func parseInt(v string) (t, rest string, ok bool) {
	+ if v == "" {
	+ return
	+ }
	+ if v[0] < '0' \|\| '9' < v[0] {
	+ return
	+ }
	+ i := 1
	+ for i < len(v) && '0' <= v[i] && v[i] <= '9' {
	+ i++
	+ }
	+ if v[0] == '0' && i != 1 {
	+ return
	+ }
	+ return v[:i], v[i:], true
	+}
	+
	+func parsePrerelease(v string) (t, rest string, ok bool) {
	+ // "A pre-release version MAY be denoted by appending a hyphen and
	+ // a series of dot separated identifiers immediately following the patch version.
	+ // Identifiers MUST comprise only ASCII alphanumerics and hyphen [0-9A-Za-z-].
	+ // Identifiers MUST NOT be empty. Numeric identifiers MUST NOT include leading zeroes."
	+ if v == "" \|\| v[0] != '-' {
	+ return
	+ }
	+ i := 1
	+ start := 1
	+ for i < len(v) && v[i] != '+' {
	+ if !isIdentChar(v[i]) && v[i] != '.' {
	+ return
	+ }
	+ if v[i] == '.' {
	+ if start == i \|\| isBadNum(v[start:i]) {
	+ return
	+ }
	+ start = i + 1
	+ }
	+ i++
	+ }
	+ if start == i \|\| isBadNum(v[start:i]) {
	+ return
	+ }
	+ return v[:i], v[i:], true
	+}
	+
	+func parseBuild(v string) (t, rest string, ok bool) {
	+ if v == "" \|\| v[0] != '+' {
	+ return
	+ }
	+ i := 1
	+ start := 1
	+ for i < len(v) {
	+ if !isIdentChar(v[i]) {
	+ return
	+ }
	+ if v[i] == '.' {
	+ if start == i {
	+ return
	+ }
	+ start = i + 1
	+ }
	+ i++
	+ }
	+ if start == i {
	+ return
	+ }
	+ return v[:i], v[i:], true
	+}
	+
	+func isIdentChar(c byte) bool {
	+ return 'A' <= c && c <= 'Z' \|\| 'a' <= c && c <= 'z' \|\| '0' <= c && c <= '9' \|\| c == '-'
	+}
	+
	+func isBadNum(v string) bool {
	+ i := 0
	+ for i < len(v) && '0' <= v[i] && v[i] <= '9' {
	+ i++
	+ }
	+ return i == len(v) && i > 1 && v[0] == '0'
	+}
	+
	+func isNum(v string) bool {
	+ i := 0
	+ for i < len(v) && '0' <= v[i] && v[i] <= '9' {
	+ i++
	+ }
	+ return i == len(v)
	+}
	+
	+func compareInt(x, y string) int {
	+ if x == y {
	+ return 0
	+ }
	+ if len(x) < len(y) {
	+ return -1
	+ }
	+ if len(x) > len(y) {
	+ return +1
	+ }
	+ if x < y {
	+ return -1
	+ } else {
	+ return +1
	+ }
	+}
	+
	+func comparePrerelease(x, y string) int {
	+ // "When major, minor, and patch are equal, a pre-release version has
	+ // lower precedence than a normal version.
	+ // Example: 1.0.0-alpha < 1.0.0.
	+ // Precedence for two pre-release versions with the same major, minor,
	+ // and patch version MUST be determined by comparing each dot separated
	+ // identifier from left to right until a difference is found as follows:
	+ // identifiers consisting of only digits are compared numerically and
	+ // identifiers with letters or hyphens are compared lexically in ASCII
	+ // sort order. Numeric identifiers always have lower precedence than
	+ // non-numeric identifiers. A larger set of pre-release fields has a
	+ // higher precedence than a smaller set, if all of the preceding
	+ // identifiers are equal.
	+ // Example: 1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta <
	+ // 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0."
	+ if x == y {
	+ return 0
	+ }
	+ if x == "" {
	+ return +1
	+ }
	+ if y == "" {
	+ return -1
	+ }
	+ for x != "" && y != "" {
	+ x = x[1:] // skip - or .
	+ y = y[1:] // skip - or .
	+ var dx, dy string
	+ dx, x = nextIdent(x)
	+ dy, y = nextIdent(y)
	+ if dx != dy {
	+ ix := isNum(dx)
	+ iy := isNum(dy)
	+ if ix != iy {
	+ if ix {
	+ return -1
	+ } else {
	+ return +1
	+ }
	+ }
	+ if ix {
	+ if len(dx) < len(dy) {
	+ return -1
	+ }
	+ if len(dx) > len(dy) {
	+ return +1
	+ }
	+ }
	+ if dx < dy {
	+ return -1
	+ } else {
	+ return +1
	+ }
	+ }
	+ }
	+ if x == "" {
	+ return -1
	+ } else {
	+ return +1
	+ }
	+}
	+
	+func nextIdent(x string) (dx, rest string) {
	+ i := 0
	+ for i < len(x) && x[i] != '.' {
	+ i++
	+ }
	+ return x[:i], x[i:]
	+}
	diff --git a/templates/user/admin/app-updates.tmpl b/templates/user/admin/app-updates.tmpl
	new file mode 100644
	index 0000000..540fb7c
	--- /dev/null
	+++ b/templates/user/admin/app-updates.tmpl
	@@ -0,0 +1,23 @@
	+{{define "app-updates"}}
	+{{template "header" .}}
	+
	+<style type="text/css">
	+</style>
	+
	+<div class="content-container snug">
	+ {{template "admin-header" .}}
	+
	+ {{if not .UpdateAvailable}}
	+ <p class="alert info">WriteFreely is up to date.</p>
	+ {{else}}
	+ <p class="alert info">WriteFreely {{.LatestVersion}} is available.</p>
	+ <section class="changelog">
	+ For details on features, bug fixes or notes on upgrading, <a href="{{.LatestReleaseURL}}">read the release notes</a>.
	+ </section>
	+ {{end}}
	+ <p>Last checked at: {{.LastChecked}}. <a href="/admin/updates?check=now">Check now</a>.</p>
	+
	+{{template "footer" .}}
	+
	+{{template "body-end" .}}
	+{{end}}
	diff --git a/templates/user/include/header.tmpl b/templates/user/include/header.tmpl
	index 0704854..8b39480 100644
	--- a/templates/user/include/header.tmpl
	+++ b/templates/user/include/header.tmpl
	@@ -1,108 +1,109 @@
	{{define "user-navigation"}}
	<header class="{{if .SingleUser}}singleuser{{else}}multiuser{{end}}">
	{{if .SingleUser}}
	<nav id="user-nav">
	<nav class="dropdown-nav">
	<ul><li><a href="/" title="View blog" class="title">{{.SiteName}}</a> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" />
	<ul>
	<li><a href="/me/c/{{.Username}}">Customize</a></li>
	<li><a href="/me/c/{{.Username}}/stats">Stats</a></li>
	<li class="separator"><hr /></li>
	{{if .IsAdmin}}<li><a href="/admin">Admin</a></li>{{end}}
	<li><a href="/me/settings">Settings</a></li>
	<li><a href="/me/import">Import posts</a></li>
	<li><a href="/me/export">Export</a></li>
	<li class="separator"><hr /></li>
	<li><a href="/me/logout">Log out</a></li>
	</ul></li>
	</ul>
	</nav>
	<nav class="tabs">
	<a href="/me/posts/"{{if eq .Path "/me/posts/"}} class="selected"{{end}}>Drafts</a>
	<a href="/me/new">New Post</a>
	</nav>
	</nav>
	{{else}}
	<nav id="full-nav">
	<div class="left-side">
	<h1><a href="/" title="Return to editor">{{.SiteName}}</a></h1>
	</div>
	<nav id="user-nav">
	{{if .Username}}
	<nav class="dropdown-nav">
	<ul><li><a>{{.Username}}</a> <img class="ic-18dp" src="/img/ic_down_arrow_dark@2x.png" /><ul>
	{{if .IsAdmin}}<li><a href="/admin">Admin dashboard</a></li>{{end}}
	<li><a href="/me/settings">Account settings</a></li>
	<li><a href="/me/import">Import posts</a></li>
	<li><a href="/me/export">Export</a></li>
	{{if .CanInvite}}<li><a href="/me/invites">Invite people</a></li>{{end}}
	<li class="separator"><hr /></li>
	<li><a href="/me/logout">Log out</a></li>
	</ul></li>
	</ul>
	</nav>
	{{end}}
	<nav class="tabs">
	{{if .SimpleNav}}
	{{ if not .SingleUser }}
	{{if and (and .LocalTimeline .CanViewReader) .Chorus}}<a href="/"{{if eq .Path "/"}} class="selected"{{end}}>Home</a>{{end}}
	{{ end }}
	<a href="/about">About</a>
	{{ if not .SingleUser }}
	{{ if .Username }}
	{{if gt .MaxBlogs 1}}<a href="/me/c/"{{if eq .Path "/me/c/"}} class="selected"{{end}}>Blogs</a>{{end}}
	{{if and .Chorus (eq .MaxBlogs 1)}}<a href="/{{.Username}}/"{{if eq .Path (printf "/%s/" .Username)}} class="selected"{{end}}>My Posts</a>{{end}}
	{{if not .DisableDrafts}}<a href="/me/posts/"{{if eq .Path "/me/posts/"}} class="selected"{{end}}>Drafts</a>{{end}}
	{{ end }}
	{{if and (and .LocalTimeline .CanViewReader) (not .Chorus)}}<a href="/read">Reader</a>{{end}}
	{{if and (and (and .Chorus .OpenRegistration) (not .Username)) (or (not .Private) (ne .Landing ""))}}<a href="/signup"{{if eq .Path "/signup"}} class="selected"{{end}}>Sign up</a>{{end}}
	{{if .Username}}<a href="/me/logout">Log out</a>{{else}}<a href="/login">Log in</a>{{end}}
	{{ end }}
	{{else}}
	<a href="/me/c/"{{if eq .Path "/me/c/"}} class="selected"{{end}}>Blogs</a>
	{{if not .DisableDrafts}}<a href="/me/posts/"{{if eq .Path "/me/posts/"}} class="selected"{{end}}>Drafts</a>{{end}}
	{{if and (and .LocalTimeline .CanViewReader) (not .Chorus)}}<a href="/read">Reader</a>{{end}}
	{{end}}
	</nav>
	</nav>
	{{if .Chorus}}{{if .Username}}<div class="right-side">
	<a class="simple-btn" href="/new">New Post</a>
	</div>{{end}}
	</nav>
	{{end}}
	{{end}}
	</header>
	{{end}}
	{{define "header"}}<!DOCTYPE HTML>
	<html>
	<head>
	<meta charset="utf-8">

	<title>{{.PageTitle}} {{if .Separator}}{{.Separator}}{{else}}—{{end}} {{.SiteName}}</title>

	<link rel="stylesheet" type="text/css" href="/css/write.css" />
	<link rel="shortcut icon" href="/favicon.ico" />
	<meta name="viewport" content="width=device-width, initial-scale=1.0" />
	<meta name="theme-color" content="#888888" />
	<meta name="apple-mobile-web-app-title" content="{{.SiteName}}">
	<link rel="apple-touch-icon" sizes="152x152" href="/img/touch-icon-152.png">
	<link rel="apple-touch-icon" sizes="167x167" href="/img/touch-icon-167.png">
	<link rel="apple-touch-icon" sizes="180x180" href="/img/touch-icon-180.png">
	</head>
	<body id="me">
	{{template "user-navigation" .}}
	<div id="official-writing">
	{{end}}

	{{define "admin-header"}}
	<header class="admin">
	<h1>Admin</h1>
	<nav id="admin">
	<a href="/admin" {{if eq .Path "/admin"}}class="selected"{{end}}>Dashboard</a>
	{{if not .SingleUser}}
	<a href="/admin/users" {{if eq .Path "/admin/users"}}class="selected"{{end}}>Users</a>
	<a href="/admin/pages" {{if eq .Path "/admin/pages"}}class="selected"{{end}}>Pages</a>
	+ {{if .UpdateChecks}}<a href="/admin/updates" {{if eq .Path "/admin/updates"}}class="selected"{{end}}>Updates</a>{{end}}
	{{end}}
	</nav>
	</header>
	{{end}}
	diff --git a/updates.go b/updates.go
	new file mode 100644
	index 0000000..c33247b
	--- /dev/null
	+++ b/updates.go
	@@ -0,0 +1,106 @@
	+/*
	+ * Copyright © 2018-2019 A Bunch Tell LLC.
	+ *
	+ * This file is part of WriteFreely.
	+ *
	+ * WriteFreely is free software: you can redistribute it and/or modify
	+ * it under the terms of the GNU Affero General Public License, included
	+ * in the LICENSE file in this source code package.
	+ */
	+
	+package writefreely
	+
	+import (
	+ "io/ioutil"
	+ "net/http"
	+ "strings"
	+ "sync"
	+ "time"
	+)
	+
	+// updatesCacheTime is the default interval between cache updates for new
	+// software versions
	+const defaultUpdatesCacheTime = 12 * time.Hour
	+
	+// updatesCache holds data about current and new releases of the writefreely
	+// software
	+type updatesCache struct {
	+ mu sync.Mutex
	+ frequency time.Duration
	+ lastCheck time.Time
	+ latestVersion string
	+ currentVersion string
	+}
	+
	+// CheckNow asks for the latest released version of writefreely and updates
	+// the cache last checked time. If the version postdates the current 'latest'
	+// the version value is replaced.
	+func (uc *updatesCache) CheckNow() error {
	+ uc.mu.Lock()
	+ defer uc.mu.Unlock()
	+ latestRemote, err := newVersionCheck()
	+ if err != nil {
	+ return err
	+ }
	+ uc.lastCheck = time.Now()
	+ if CompareSemver(latestRemote, uc.latestVersion) == 1 {
	+ uc.latestVersion = latestRemote
	+ }
	+ return nil
	+}
	+
	+// AreAvailable updates the cache if the frequency duration has passed
	+// then returns if the latest release is newer than the current running version.
	+func (uc updatesCache) AreAvailable() bool {
	+ if time.Since(uc.lastCheck) > uc.frequency {
	+ uc.CheckNow()
	+ }
	+ return CompareSemver(uc.latestVersion, uc.currentVersion) == 1
	+}
	+
	+// LatestVersion returns the latest stored version available.
	+func (uc updatesCache) LatestVersion() string {
	+ return uc.latestVersion
	+}
	+
	+// ReleaseURL returns the full URL to the blog.writefreely.org release notes
	+// for the latest version as stored in the cache.
	+func (uc updatesCache) ReleaseURL() string {
	+ ver := strings.TrimPrefix(uc.latestVersion, "v")
	+ ver = strings.TrimSuffix(ver, ".0")
	+ // hack until go 1.12 in build/travis
	+ seg := strings.Split(ver, ".")
	+ return "https://blog.writefreely.org/version-" + strings.Join(seg, "-")
	+}
	+
	+// newUpdatesCache returns an initialized updates cache
	+func newUpdatesCache(expiry time.Duration) *updatesCache {
	+ cache := updatesCache{
	+ frequency: expiry,
	+ currentVersion: "v" + softwareVer,
	+ }
	+ cache.CheckNow()
	+ return &cache
	+}
	+
	+// InitUpdates initializes the updates cache, if the config value is set
	+// It uses the defaultUpdatesCacheTime for the cache expiry
	+func (app *App) InitUpdates() {
	+ if app.cfg.App.UpdateChecks {
	+ app.updates = newUpdatesCache(defaultUpdatesCacheTime)
	+ }
	+}
	+
	+func newVersionCheck() (string, error) {
	+ res, err := http.Get("https://version.writefreely.org")
	+ if err == nil && res.StatusCode == http.StatusOK {
	+ defer res.Body.Close()
	+
	+ body, err := ioutil.ReadAll(res.Body)
	+ if err != nil {
	+ return "", err
	+ }
	+ return string(body), nil
	+ }
	+ return "", err
	+}
	diff --git a/updates_test.go b/updates_test.go
	new file mode 100644
	index 0000000..2cb9f92
	--- /dev/null
	+++ b/updates_test.go
	@@ -0,0 +1,82 @@
	+package writefreely
	+
	+import (
	+ "regexp"
	+ "testing"
	+ "time"
	+)
	+
	+func TestUpdatesRoundTrip(t *testing.T) {
	+ cache := newUpdatesCache(defaultUpdatesCacheTime)
	+ t.Run("New Updates Cache", func(t *testing.T) {
	+
	+ if cache == nil {
	+ t.Fatal("Returned nil cache")
	+ }
	+
	+ if cache.frequency != defaultUpdatesCacheTime {
	+ t.Fatalf("Got cache expiry frequency: %s but expected: %s", cache.frequency, defaultUpdatesCacheTime)
	+ }
	+
	+ if cache.currentVersion != "v"+softwareVer {
	+ t.Fatalf("Got current version: %s but expected: %s", cache.currentVersion, "v"+softwareVer)
	+ }
	+ })
	+
	+ t.Run("Release URL", func(t *testing.T) {
	+ url := cache.ReleaseURL()
	+
	+ reg, err := regexp.Compile(`^https:\/\/blog.writefreely.org\/version(-\d+){1,}$`)
	+ if err != nil {
	+ t.Fatalf("Test Case Error: Failed to compile regex: %v", err)
	+ }
	+ match := reg.MatchString(url)
	+
	+ if !match {
	+ t.Fatalf("Malformed Release URL: %s", url)
	+ }
	+ })
	+
	+ t.Run("Check Now", func(t *testing.T) {
	+ // ensure time between init and next check
	+ time.Sleep(1 * time.Second)
	+
	+ prevLastCheck := cache.lastCheck
	+
	+ // force to known older version for latest and current
	+ prevLatestVer := "v0.8.1"
	+ cache.latestVersion = prevLatestVer
	+ cache.currentVersion = "v0.8.0"
	+
	+ err := cache.CheckNow()
	+ if err != nil {
	+ t.Fatalf("Error should be nil, got: %v", err)
	+ }
	+
	+ if prevLastCheck == cache.lastCheck {
	+ t.Fatal("Expected lastCheck to update")
	+ }
	+
	+ if cache.lastCheck.Before(prevLastCheck) {
	+ t.Fatal("Last check should be newer than previous")
	+ }
	+
	+ if prevLatestVer == cache.latestVersion {
	+ t.Fatal("expected latestVersion to update")
	+ }
	+
	+ })
	+
	+ t.Run("Are Available", func(t *testing.T) {
	+ if !cache.AreAvailable() {
	+ t.Fatalf("Cache reports not updates but Current is %s and Latest is %s", cache.currentVersion, cache.latestVersion)
	+ }
	+ })
	+
	+ t.Run("Latest Version", func(t *testing.T) {
	+ gotLatest := cache.LatestVersion()
	+ if gotLatest != cache.latestVersion {
	+ t.Fatalf("Malformed latest version. Expected: %s but got: %s", cache.latestVersion, gotLatest)
	+ }
	+ })
	+}

File Metadata

Mime Type: text/x-diff
Expires: Sat, Nov 23, 3:44 PM (1 d, 4 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3104597

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions