No OneTemporary
Actions

Size

33 KB

Subscribers

None

View Options

	diff --git a/app.go b/app.go
	index 6b5fbb4..dd86700 100644
	--- a/app.go
	+++ b/app.go
	@@ -1,647 +1,647 @@
	/*
	* Copyright © 2018 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"database/sql"
	"flag"
	"fmt"
	"html/template"
	"net/http"
	"net/url"
	"os"
	"os/signal"
	"path/filepath"
	"regexp"
	"strings"
	"syscall"
	"time"

	_ "github.com/go-sql-driver/mysql"

	"github.com/gorilla/mux"
	"github.com/gorilla/schema"
	"github.com/gorilla/sessions"
	"github.com/manifoldco/promptui"
	"github.com/writeas/go-strip-markdown"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/converter"
	"github.com/writeas/web-core/log"
	"github.com/writeas/writefreely/author"
	"github.com/writeas/writefreely/config"
	"github.com/writeas/writefreely/migrations"
	"github.com/writeas/writefreely/page"
	)

	const (
	staticDir = "static"
	assumedTitleLen = 80
	postsPerPage = 10

	serverSoftware = "WriteFreely"
	softwareURL = "https://writefreely.org"
	)

	var (
	debugging bool

	// Software version can be set from git env using -ldflags
	- softwareVer = "0.8.0"
	+ softwareVer = "0.8.1"

	// DEPRECATED VARS
	// TODO: pass app.cfg into GetCollection* calls so we can get these values
	// from Collection methods and we no longer need these.
	hostName string
	isSingleUser bool
	)

	type app struct {
	router *mux.Router
	db *datastore
	cfg *config.Config
	cfgFile string
	keys *keychain
	sessionStore *sessions.CookieStore
	formDecoder *schema.Decoder

	timeline *localTimeline
	}

	// handleViewHome shows page at root path. Will be the Pad if logged in and the
	// catch-all landing page otherwise.
	func handleViewHome(app app, w http.ResponseWriter, r http.Request) error {
	if app.cfg.App.SingleUser {
	// Render blog index
	return handleViewCollection(app, w, r)
	}

	// Multi-user instance
	u := getUserSession(app, r)
	if u != nil {
	// User is logged in, so show the Pad
	return handleViewPad(app, w, r)
	}

	p := struct {
	page.StaticPage
	Flashes []template.HTML
	}{
	StaticPage: pageForReq(app, r),
	}

	// Get error messages
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// Ignore this
	log.Error("Unable to get session in handleViewHome; ignoring: %v", err)
	}
	flashes, _ := getSessionFlashes(app, w, r, session)
	for _, flash := range flashes {
	p.Flashes = append(p.Flashes, template.HTML(flash))
	}

	// Show landing page
	return renderPage(w, "landing.tmpl", p)
	}

	func handleTemplatedPage(app app, w http.ResponseWriter, r http.Request, t *template.Template) error {
	p := struct {
	page.StaticPage
	Content template.HTML
	PlainContent string
	Updated string

	AboutStats *InstanceStats
	}{
	StaticPage: pageForReq(app, r),
	}
	if r.URL.Path == "/about" \|\| r.URL.Path == "/privacy" {
	var c string
	var updated *time.Time
	var err error

	if r.URL.Path == "/about" {
	c, err = getAboutPage(app)

	// Fetch stats
	p.AboutStats = &InstanceStats{}
	p.AboutStats.NumPosts, _ = app.db.GetTotalPosts()
	p.AboutStats.NumBlogs, _ = app.db.GetTotalCollections()
	} else {
	c, updated, err = getPrivacyPage(app)
	}

	if err != nil {
	return err
	}
	p.Content = template.HTML(applyMarkdown([]byte(c)))
	p.PlainContent = shortPostDescription(stripmd.Strip(c))
	if updated != nil {
	p.Updated = updated.Format("January 2, 2006")
	}
	}

	// Serve templated page
	err := t.ExecuteTemplate(w, "base", p)
	if err != nil {
	log.Error("Unable to render page: %v", err)
	}
	return nil
	}

	func pageForReq(app app, r http.Request) page.StaticPage {
	p := page.StaticPage{
	AppCfg: app.cfg.App,
	Path: r.URL.Path,
	Version: "v" + softwareVer,
	}

	// Add user information, if given
	var u *User
	accessToken := r.FormValue("t")
	if accessToken != "" {
	userID := app.db.GetUserID(accessToken)
	if userID != -1 {
	var err error
	u, err = app.db.GetUserByID(userID)
	if err == nil {
	p.Username = u.Username
	}
	}
	} else {
	u = getUserSession(app, r)
	if u != nil {
	p.Username = u.Username
	}
	}

	return p
	}

	var shttp = http.NewServeMux()
	var fileRegex = regexp.MustCompile("/([^/]\\.[^/])$")

	func Serve() {
	// General options usable with other commands
	debugPtr := flag.Bool("debug", false, "Enables debug logging.")
	configFile := flag.String("c", "config.ini", "The configuration file to use")

	// Setup actions
	createConfig := flag.Bool("create-config", false, "Creates a basic configuration and exits")
	doConfig := flag.Bool("config", false, "Run the configuration process")
	genKeys := flag.Bool("gen-keys", false, "Generate encryption and authentication keys")
	createSchema := flag.Bool("init-db", false, "Initialize app database")
	migrate := flag.Bool("migrate", false, "Migrate the database")

	// Admin actions
	createAdmin := flag.String("create-admin", "", "Create an admin with the given username:password")
	createUser := flag.String("create-user", "", "Create a regular user with the given username:password")
	resetPassUser := flag.String("reset-pass", "", "Reset the given user's password")
	outputVersion := flag.Bool("v", false, "Output the current version")
	flag.Parse()

	debugging = *debugPtr

	app := &app{
	cfgFile: *configFile,
	}

	if *outputVersion {
	fmt.Println(serverSoftware + " " + softwareVer)
	os.Exit(0)
	} else if *createConfig {
	log.Info("Creating configuration...")
	c := config.New()
	log.Info("Saving configuration %s...", app.cfgFile)
	err := config.Save(c, app.cfgFile)
	if err != nil {
	log.Error("Unable to save configuration: %v", err)
	os.Exit(1)
	}
	os.Exit(0)
	} else if *doConfig {
	d, err := config.Configure(app.cfgFile)
	if err != nil {
	log.Error("Unable to configure: %v", err)
	os.Exit(1)
	}
	if d.User != nil {
	app.cfg = d.Config
	connectToDatabase(app)
	defer shutdown(app)

	if !app.db.DatabaseInitialized() {
	err = adminInitDatabase(app)
	if err != nil {
	log.Error(err.Error())
	os.Exit(1)
	}
	}

	u := &User{
	Username: d.User.Username,
	HashedPass: d.User.HashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	// Create blog
	log.Info("Creating user %s...\n", u.Username)
	err = app.db.CreateUser(u, app.cfg.App.SiteName)
	if err != nil {
	log.Error("Unable to create user: %s", err)
	os.Exit(1)
	}
	log.Info("Done!")
	}
	os.Exit(0)
	} else if *genKeys {
	errStatus := 0

	// Read keys path from config
	loadConfig(app)

	// Create keys dir if it doesn't exist yet
	fullKeysDir := filepath.Join(app.cfg.Server.KeysParentDir, keysDir)
	if _, err := os.Stat(fullKeysDir); os.IsNotExist(err) {
	err = os.Mkdir(fullKeysDir, 0700)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	}

	// Generate keys
	initKeyPaths(app)
	err := generateKey(emailKeyPath)
	if err != nil {
	errStatus = 1
	}
	err = generateKey(cookieAuthKeyPath)
	if err != nil {
	errStatus = 1
	}
	err = generateKey(cookieKeyPath)
	if err != nil {
	errStatus = 1
	}

	os.Exit(errStatus)
	} else if *createSchema {
	loadConfig(app)
	connectToDatabase(app)
	defer shutdown(app)
	err := adminInitDatabase(app)
	if err != nil {
	log.Error(err.Error())
	os.Exit(1)
	}
	os.Exit(0)
	} else if *createAdmin != "" {
	err := adminCreateUser(app, *createAdmin, true)
	if err != nil {
	log.Error(err.Error())
	os.Exit(1)
	}
	os.Exit(0)
	} else if *createUser != "" {
	err := adminCreateUser(app, *createUser, false)
	if err != nil {
	log.Error(err.Error())
	os.Exit(1)
	}
	os.Exit(0)
	} else if *resetPassUser != "" {
	// Connect to the database
	loadConfig(app)
	connectToDatabase(app)
	defer shutdown(app)

	// Fetch user
	u, err := app.db.GetUserForAuth(*resetPassUser)
	if err != nil {
	log.Error("Get user: %s", err)
	os.Exit(1)
	}

	// Prompt for new password
	prompt := promptui.Prompt{
	Templates: &promptui.PromptTemplates{
	Success: "{{ . \| bold \| faint }}: ",
	},
	Label: "New password",
	Mask: '*',
	}
	newPass, err := prompt.Run()
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}

	// Do the update
	log.Info("Updating...")
	err = adminResetPassword(app, u, newPass)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	os.Exit(0)
	} else if *migrate {
	loadConfig(app)
	connectToDatabase(app)
	defer shutdown(app)

	err := migrations.Migrate(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	log.Error("migrate: %s", err)
	os.Exit(1)
	}

	os.Exit(0)
	}

	log.Info("Initializing...")

	loadConfig(app)

	hostName = app.cfg.App.Host
	isSingleUser = app.cfg.App.SingleUser
	app.cfg.Server.Dev = *debugPtr

	err := initTemplates(app.cfg)
	if err != nil {
	log.Error("load templates: %s", err)
	os.Exit(1)
	}

	// Load keys
	log.Info("Loading encryption keys...")
	initKeyPaths(app)
	err = initKeys(app)
	if err != nil {
	log.Error("\n%s\n", err)
	}

	// Initialize modules
	app.sessionStore = initSession(app)
	app.formDecoder = schema.NewDecoder()
	app.formDecoder.RegisterConverter(converter.NullJSONString{}, converter.ConvertJSONNullString)
	app.formDecoder.RegisterConverter(converter.NullJSONBool{}, converter.ConvertJSONNullBool)
	app.formDecoder.RegisterConverter(sql.NullString{}, converter.ConvertSQLNullString)
	app.formDecoder.RegisterConverter(sql.NullBool{}, converter.ConvertSQLNullBool)
	app.formDecoder.RegisterConverter(sql.NullInt64{}, converter.ConvertSQLNullInt64)
	app.formDecoder.RegisterConverter(sql.NullFloat64{}, converter.ConvertSQLNullFloat64)

	// Check database configuration
	if app.cfg.Database.Type == driverMySQL && (app.cfg.Database.User == "" \|\| app.cfg.Database.Password == "") {
	log.Error("Database user or password not set.")
	os.Exit(1)
	}
	if app.cfg.Database.Host == "" {
	app.cfg.Database.Host = "localhost"
	}
	if app.cfg.Database.Database == "" {
	app.cfg.Database.Database = "writefreely"
	}

	connectToDatabase(app)
	defer shutdown(app)

	// Test database connection
	err = app.db.Ping()
	if err != nil {
	log.Error("Database ping failed: %s", err)
	}

	r := mux.NewRouter()
	handler := NewHandler(app)
	handler.SetErrorPages(&ErrorPages{
	NotFound: pages["404-general.tmpl"],
	Gone: pages["410.tmpl"],
	InternalServerError: pages["500.tmpl"],
	Blank: pages["blank.tmpl"],
	})

	// Handle app routes
	initRoutes(handler, r, app.cfg, app.db)

	// Handle local timeline, if enabled
	if app.cfg.App.LocalTimeline {
	log.Info("Initializing local timeline...")
	initLocalTimeline(app)
	}

	// Handle static files
	fs := http.FileServer(http.Dir(filepath.Join(app.cfg.Server.StaticParentDir, staticDir)))
	shttp.Handle("/", fs)
	r.PathPrefix("/").Handler(fs)

	// Handle shutdown
	c := make(chan os.Signal, 2)
	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
	go func() {
	<-c
	log.Info("Shutting down...")
	shutdown(app)
	log.Info("Done.")
	os.Exit(0)
	}()

	http.Handle("/", r)

	// Start web application server
	var bindAddress = app.cfg.Server.Bind
	if bindAddress == "" {
	bindAddress = "localhost"
	}
	if app.cfg.IsSecureStandalone() {
	log.Info("Serving redirects on http://%s:80", bindAddress)
	go func() {
	err = http.ListenAndServe(
	fmt.Sprintf("%s:80", bindAddress), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	http.Redirect(w, r, app.cfg.App.Host, http.StatusMovedPermanently)
	}))
	log.Error("Unable to start redirect server: %v", err)
	}()

	log.Info("Serving on https://%s:443", bindAddress)
	log.Info("---")
	err = http.ListenAndServeTLS(
	fmt.Sprintf("%s:443", bindAddress), app.cfg.Server.TLSCertPath, app.cfg.Server.TLSKeyPath, nil)
	} else {
	log.Info("Serving on http://%s:%d\n", bindAddress, app.cfg.Server.Port)
	log.Info("---")
	err = http.ListenAndServe(fmt.Sprintf("%s:%d", bindAddress, app.cfg.Server.Port), nil)
	}
	if err != nil {
	log.Error("Unable to start: %v", err)
	os.Exit(1)
	}
	}

	func loadConfig(app *app) {
	log.Info("Loading %s configuration...", app.cfgFile)
	cfg, err := config.Load(app.cfgFile)
	if err != nil {
	log.Error("Unable to load configuration: %v", err)
	os.Exit(1)
	}
	app.cfg = cfg
	}

	func connectToDatabase(app *app) {
	log.Info("Connecting to %s database...", app.cfg.Database.Type)

	var db *sql.DB
	var err error
	if app.cfg.Database.Type == driverMySQL {
	db, err = sql.Open(app.cfg.Database.Type, fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=true&loc=%s", app.cfg.Database.User, app.cfg.Database.Password, app.cfg.Database.Host, app.cfg.Database.Port, app.cfg.Database.Database, url.QueryEscape(time.Local.String())))
	db.SetMaxOpenConns(50)
	} else if app.cfg.Database.Type == driverSQLite {
	if !SQLiteEnabled {
	log.Error("Invalid database type '%s'. Binary wasn't compiled with SQLite3 support.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if app.cfg.Database.FileName == "" {
	log.Error("SQLite database filename value in config.ini is empty.")
	os.Exit(1)
	}
	db, err = sql.Open("sqlite3_with_regex", app.cfg.Database.FileName+"?parseTime=true&cached=shared")
	db.SetMaxOpenConns(1)
	} else {
	log.Error("Invalid database type '%s'. Only 'mysql' and 'sqlite3' are supported right now.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	app.db = &datastore{db, app.cfg.Database.Type}
	}

	func shutdown(app *app) {
	log.Info("Closing database connection...")
	app.db.Close()
	}

	func adminCreateUser(app *app, credStr string, isAdmin bool) error {
	// Create an admin user with --create-admin
	creds := strings.Split(credStr, ":")
	if len(creds) != 2 {
	c := "user"
	if isAdmin {
	c = "admin"
	}
	return fmt.Errorf("usage: writefreely --create-%s username:password", c)
	}

	loadConfig(app)
	connectToDatabase(app)
	defer shutdown(app)

	// Ensure an admin / first user doesn't already exist
	firstUser, _ := app.db.GetUserByID(1)
	if isAdmin {
	// Abort if trying to create admin user, but one already exists
	if firstUser != nil {
	return fmt.Errorf("Admin user already exists (%s). Create a regular user with: writefreely --create-user", firstUser.Username)
	}
	} else {
	// Abort if trying to create regular user, but no admin exists yet
	if firstUser == nil {
	return fmt.Errorf("No admin user exists yet. Create an admin first with: writefreely --create-admin")
	}
	}

	// Create the user
	username := creds[0]
	password := creds[1]

	// Normalize and validate username
	desiredUsername := username
	username = getSlug(username, "")

	usernameDesc := username
	if username != desiredUsername {
	usernameDesc += " (originally: " + desiredUsername + ")"
	}

	if !author.IsValidUsername(app.cfg, username) {
	return fmt.Errorf("Username %s is invalid, reserved, or shorter than configured minimum length (%d characters).", usernameDesc, app.cfg.App.MinUsernameLen)
	}

	// Hash the password
	hashedPass, err := auth.HashPass([]byte(password))
	if err != nil {
	return fmt.Errorf("Unable to hash password: %v", err)
	}

	u := &User{
	Username: username,
	HashedPass: hashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	userType := "user"
	if isAdmin {
	userType = "admin"
	}
	log.Info("Creating %s %s...", userType, usernameDesc)
	err = app.db.CreateUser(u, desiredUsername)
	if err != nil {
	return fmt.Errorf("Unable to create user: %s", err)
	}
	log.Info("Done!")
	return nil
	}

	func adminInitDatabase(app *app) error {
	schemaFileName := "schema.sql"
	if app.cfg.Database.Type == driverSQLite {
	schemaFileName = "sqlite.sql"
	}

	schema, err := Asset(schemaFileName)
	if err != nil {
	return fmt.Errorf("Unable to load schema file: %v", err)
	}

	tblReg := regexp.MustCompile("CREATE TABLE (IF NOT EXISTS )?`([a-z_]+)`")

	queries := strings.Split(string(schema), ";\n")
	for _, q := range queries {
	if strings.TrimSpace(q) == "" {
	continue
	}
	parts := tblReg.FindStringSubmatch(q)
	if len(parts) >= 3 {
	log.Info("Creating table %s...", parts[2])
	} else {
	log.Info("Creating table ??? (Weird query) No match in: %v", parts)
	}
	_, err = app.db.Exec(q)
	if err != nil {
	log.Error("%s", err)
	} else {
	log.Info("Created.")
	}
	}

	// Set up migrations table
	log.Info("Updating appmigrations table...")
	err = migrations.SetInitialMigrations(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("Unable to set initial migrations: %v", err)
	}

	log.Info("Done.")
	return nil
	}
	diff --git a/postrender.go b/postrender.go
	index 2cc6730..06b74a1 100644
	--- a/postrender.go
	+++ b/postrender.go
	@@ -1,231 +1,231 @@
	/*
	* Copyright © 2018 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"bytes"
	"fmt"
	"github.com/microcosm-cc/bluemonday"
	stripmd "github.com/writeas/go-strip-markdown"
	"github.com/writeas/saturday"
	"github.com/writeas/web-core/stringmanip"
	"github.com/writeas/writefreely/parse"
	"html"
	"html/template"
	"regexp"
	"strings"
	"unicode"
	"unicode/utf8"
	)

	var (
	blockReg = regexp.MustCompile("<(ul\|ol\|blockquote)>\n")
	endBlockReg = regexp.MustCompile("</([a-z]+)>\n</(ul\|ol\|blockquote)>")
	youtubeReg = regexp.MustCompile("(https?://www.youtube.com/embed/[a-zA-Z0-9\\-_]+)(\\?[^\t\n\f\r \"']+)?")
	titleElementReg = regexp.MustCompile("</?h[1-6]>")
	- hashtagReg = regexp.MustCompile(`#([\p{L}\p{M}\d]+)`)
	+ hashtagReg = regexp.MustCompile(`(?m)(^\| )#([\p{L}\p{M}\d]+)`)
	markeddownReg = regexp.MustCompile("<p>(.+)</p>")
	)

	func (p Post) formatContent(c Collection, isOwner bool) {
	baseURL := c.CanonicalURL()
	if !isSingleUser {
	baseURL = "/" + c.Alias + "/"
	}
	newCon := hashtagReg.ReplaceAllFunc([]byte(p.Content), func(b []byte) []byte {
	// Ensure we only replace "hashtags" that have already been extracted.
	// `hashtagReg` catches everything, including any hash on the end of a
	// URL, so we rely on p.Tags as the final word on whether or not to link
	// a tag.
	for _, t := range p.Tags {
	- if string(b) == "#"+t {
	+ if strings.TrimSpace(string(b)) == "#"+t {
	return bytes.Replace(b, []byte("#"+t), []byte("<a href=\""+baseURL+"tag:"+t+"\" class=\"hashtag\"><span>#</span><span class=\"p-category\">"+t+"</span></a>"), -1)
	}
	}
	return b
	})
	p.HTMLTitle = template.HTML(applyBasicMarkdown([]byte(p.Title.String)))
	p.HTMLContent = template.HTML(applyMarkdown([]byte(newCon)))
	if exc := strings.Index(string(newCon), "<!--more-->"); exc > -1 {
	p.HTMLExcerpt = template.HTML(applyMarkdown([]byte(newCon[:exc])))
	}
	}

	func (p *PublicPost) formatContent(isOwner bool) {
	p.Post.formatContent(&p.Collection.Collection, isOwner)
	}

	func applyMarkdown(data []byte) string {
	return applyMarkdownSpecial(data, false)
	}

	func applyMarkdownSpecial(data []byte, skipNoFollow bool) string {
	mdExtensions := 0 \|
	blackfriday.EXTENSION_TABLES \|
	blackfriday.EXTENSION_FENCED_CODE \|
	blackfriday.EXTENSION_AUTOLINK \|
	blackfriday.EXTENSION_STRIKETHROUGH \|
	blackfriday.EXTENSION_SPACE_HEADERS \|
	blackfriday.EXTENSION_AUTO_HEADER_IDS
	htmlFlags := 0 \|
	blackfriday.HTML_USE_SMARTYPANTS \|
	blackfriday.HTML_SMARTYPANTS_DASHES

	// Generate Markdown
	md := blackfriday.Markdown([]byte(data), blackfriday.HtmlRenderer(htmlFlags, "", ""), mdExtensions)
	// Strip out bad HTML
	policy := getSanitizationPolicy()
	policy.RequireNoFollowOnLinks(!skipNoFollow)
	outHTML := string(policy.SanitizeBytes(md))
	// Strip newlines on certain block elements that render with them
	outHTML = blockReg.ReplaceAllString(outHTML, "<$1>")
	outHTML = endBlockReg.ReplaceAllString(outHTML, "</$1></$2>")
	// Remove all query parameters on YouTube embed links
	// TODO: make this more specific. Taking the nuclear approach here to strip ?autoplay=1
	outHTML = youtubeReg.ReplaceAllString(outHTML, "$1")

	return outHTML
	}

	func applyBasicMarkdown(data []byte) string {
	mdExtensions := 0 \|
	blackfriday.EXTENSION_STRIKETHROUGH \|
	blackfriday.EXTENSION_SPACE_HEADERS \|
	blackfriday.EXTENSION_HEADER_IDS
	htmlFlags := 0 \|
	blackfriday.HTML_SKIP_HTML \|
	blackfriday.HTML_USE_SMARTYPANTS \|
	blackfriday.HTML_SMARTYPANTS_DASHES

	// Generate Markdown
	md := blackfriday.Markdown([]byte(data), blackfriday.HtmlRenderer(htmlFlags, "", ""), mdExtensions)
	// Strip out bad HTML
	policy := bluemonday.UGCPolicy()
	policy.AllowAttrs("class", "id").Globally()
	outHTML := string(policy.SanitizeBytes(md))
	outHTML = markeddownReg.ReplaceAllString(outHTML, "$1")
	outHTML = strings.TrimRightFunc(outHTML, unicode.IsSpace)

	return outHTML
	}

	func postTitle(content, friendlyId string) string {
	const maxTitleLen = 80

	// Strip HTML tags with bluemonday's StrictPolicy, then unescape the HTML
	// entities added in by sanitizing the content.
	content = html.UnescapeString(bluemonday.StrictPolicy().Sanitize(content))

	content = strings.TrimLeftFunc(stripmd.Strip(content), unicode.IsSpace)
	eol := strings.IndexRune(content, '\n')
	blankLine := strings.Index(content, "\n\n")
	if blankLine != -1 && blankLine <= eol && blankLine <= assumedTitleLen {
	return strings.TrimSpace(content[:blankLine])
	} else if utf8.RuneCountInString(content) <= maxTitleLen {
	return content
	}
	return friendlyId
	}

	// TODO: fix duplicated code from postTitle. postTitle is a widely used func we
	// don't have time to investigate right now.
	func friendlyPostTitle(content, friendlyId string) string {
	const maxTitleLen = 80

	// Strip HTML tags with bluemonday's StrictPolicy, then unescape the HTML
	// entities added in by sanitizing the content.
	content = html.UnescapeString(bluemonday.StrictPolicy().Sanitize(content))

	content = strings.TrimLeftFunc(stripmd.Strip(content), unicode.IsSpace)
	eol := strings.IndexRune(content, '\n')
	blankLine := strings.Index(content, "\n\n")
	if blankLine != -1 && blankLine <= eol && blankLine <= assumedTitleLen {
	return strings.TrimSpace(content[:blankLine])
	} else if eol == -1 && utf8.RuneCountInString(content) <= maxTitleLen {
	return content
	}
	title, truncd := parse.TruncToWord(parse.PostLede(content, true), maxTitleLen)
	if truncd {
	title += "..."
	}
	return title
	}

	func getSanitizationPolicy() *bluemonday.Policy {
	policy := bluemonday.UGCPolicy()
	policy.AllowAttrs("src", "style").OnElements("iframe", "video")
	policy.AllowAttrs("frameborder", "width", "height").Matching(bluemonday.Integer).OnElements("iframe")
	policy.AllowAttrs("allowfullscreen").OnElements("iframe")
	policy.AllowAttrs("controls", "loop", "muted", "autoplay").OnElements("video")
	policy.AllowAttrs("target").OnElements("a")
	policy.AllowAttrs("style", "class", "id").Globally()
	policy.AllowURLSchemes("http", "https", "mailto", "xmpp")
	return policy
	}

	func sanitizePost(content string) string {
	return strings.Replace(content, "<", "<", -1)
	}

	// postDescription generates a description based on the given post content,
	// title, and post ID. This doesn't consider a V2 post field, `title` when
	// choosing what to generate. In case a post has a title, this function will
	// fail, and logic should instead be implemented to skip this when there's no
	// title, like so:
	// var desc string
	// if title == "" {
	// desc = postDescription(content, title, friendlyId)
	// } else {
	// desc = shortPostDescription(content)
	// }
	func postDescription(content, title, friendlyId string) string {
	maxLen := 140

	if content == "" {
	content = "Write Freely is a painless, simple, federated blogging platform."
	} else {
	fmtStr := "%s"
	truncation := 0
	if utf8.RuneCountInString(content) > maxLen {
	// Post is longer than the max description, so let's show a better description
	fmtStr = "%s..."
	truncation = 3
	}

	if title == friendlyId {
	// No specific title was found; simply truncate the post, starting at the beginning
	content = fmt.Sprintf(fmtStr, strings.Replace(stringmanip.Substring(content, 0, maxLen-truncation), "\n", " ", -1))
	} else {
	// There was a title, so return a real description
	blankLine := strings.Index(content, "\n\n")
	if blankLine < 0 {
	blankLine = 0
	}
	truncd := stringmanip.Substring(content, blankLine, blankLine+maxLen-truncation)
	contentNoNL := strings.Replace(truncd, "\n", " ", -1)
	content = strings.TrimSpace(fmt.Sprintf(fmtStr, contentNoNL))
	}
	}

	return content
	}

	func shortPostDescription(content string) string {
	maxLen := 140
	fmtStr := "%s"
	truncation := 0
	if utf8.RuneCountInString(content) > maxLen {
	// Post is longer than the max description, so let's show a better description
	fmtStr = "%s..."
	truncation = 3
	}
	return strings.TrimSpace(fmt.Sprintf(fmtStr, strings.Replace(stringmanip.Substring(content, 0, maxLen-truncation), "\n", " ", -1)))
	}
	diff --git a/templates/collection-tags.tmpl b/templates/collection-tags.tmpl
	index fd37eed..8ef4816 100644
	--- a/templates/collection-tags.tmpl
	+++ b/templates/collection-tags.tmpl
	@@ -1,194 +1,194 @@
	{{define "collection-tags"}}<!DOCTYPE HTML>
	<html>
	<head prefix="og: http://ogp.me/ns# article: http://ogp.me/ns/article#">
	<meta charset="utf-8">

	<title>{{.Tag}} — {{.Collection.DisplayTitle}}</title>

	- <link rel="stylesheet" type="text/css" href="{{if .IsCustomDomain}}https://files.writeas.org{{end}}/css/write.css" />
	- <link rel="shortcut icon" href="{{ if .Collection.ShowFooterBranding }}{{if .IsCustomDomain}}https://files.writeas.org{{end}}/favicon.ico{{ else }}/none.ico{{ end }}" />
	+ <link rel="stylesheet" type="text/css" href="/css/write.css" />
	+ <link rel="shortcut icon" href="/favicon.ico" />
	{{if not .Collection.IsPrivate}}<link rel="alternate" type="application/rss+xml" title="{{.Tag}} posts on {{.DisplayTitle}}" href="{{.CanonicalURL}}tag:{{.Tag}}/feed/" />{{end}}
	<meta name="viewport" content="width=device-width, initial-scale=1.0" />
	<link rel="canonical" href="{{.CanonicalURL}}tag:{{.Tag \| tolower}}" />
	<meta name="generator" content="Write.as">
	<meta name="title" content="{{.Tag}} — {{.Collection.DisplayTitle}}">
	<meta name="description" content="{{.Tag}} posts on {{.Collection.DisplayTitle}}">
	<meta name="application-name" content="Write.as">
	<meta name="application-url" content="https://write.as">
	{{if gt .Views 1}}<meta name="twitter:label1" value="Views">
	<meta name="twitter:data1" value="{{largeNumFmt .Views}}">{{end}}
	<meta itemprop="name" content="{{.Collection.DisplayTitle}}">
	<meta itemprop="description" content="{{.Tag}} posts on {{.Collection.DisplayTitle}}">
	<meta name="twitter:card" content="summary">
	<meta name="twitter:site" content="@writeas__">
	<meta name="twitter:description" content="{{.Tag}} posts on {{.Collection.DisplayTitle}}">
	<meta name="twitter:title" content="{{.Tag}} — {{.Collection.DisplayTitle}}">
	<meta name="twitter:image" content="{{.Collection.AvatarURL}}">
	<meta property="og:title" content="{{.Tag}} — {{.Collection.DisplayTitle}}" />
	<meta property="og:site_name" content="{{.DisplayTitle}}" />
	<meta property="og:type" content="article" />
	<meta property="og:url" content="{{.CanonicalURL}}tag:{{.Tag}}" />
	<meta property="og:image" content="{{.Collection.AvatarURL}}">
	{{if .Collection.StyleSheet}}<style type="text/css">{{.Collection.StyleSheetDisplay}}</style>{{end}}

	{{if .Collection.RenderMathJax}}
	<!-- Add mathjax logic -->
	{{template "mathjax" .}}
	{{end}}

	<!-- Add highlighting logic -->
	{{template "highlighting" . }}

	</head>
	<body id="subpage">

	<div id="overlay"></div>

	<header>
	<h1 dir="{{.Direction}}" id="blog-title"><a href="{{if .IsTopLevel}}/{{else}}/{{.Collection.Alias}}/{{end}}" class="h-card p-author">{{.Collection.DisplayTitle}}</a></h1>
	<nav>
	{{if .PinnedPosts}}
	{{range .PinnedPosts}}<a class="pinned" href="{{if not $.SingleUser}}/{{$.Collection.Alias}}/{{.Slug.String}}{{else}}{{.CanonicalURL}}{{end}}">{{.DisplayTitle}}</a>{{end}}
	{{end}}
	</nav>
	</header>

	{{if .Posts}}<section id="wrapper" itemscope itemtype="http://schema.org/Blog">{{else}}<div id="wrapper">{{end}}
	<h1>{{.Tag}}</h1>
	{{template "posts" .}}
	{{if .Posts}}</section>{{else}}</div>{{end}}

	{{ if .Collection.ShowFooterBranding }}
	<footer dir="ltr">
	<hr>
	<nav>
	<p style="font-size: 0.9em"><a class="home pubd" href="/">{{.SiteName}}</a> · powered by <a style="margin-left:0" href="https://writefreely.org">write freely</a></p>
	</nav>
	</footer>
	{{ end }}
	</body>

	{{if .CanShowScript}}
	{{range .ExternalScripts}}<script type="text/javascript" src="{{.}}" async></script>{{end}}
	{{if .Collection.Script}}<script type="text/javascript">{{.ScriptDisplay}}</script>{{end}}
	{{end}}
	{{if .IsOwner}}
	<script src="/js/h.js"></script>
	<script src="/js/postactions.js"></script>
	{{end}}
	<script type="text/javascript">
	{{if .IsOwner}}
	var deleting = false;
	function delPost(e, id, owned) {
	e.preventDefault();
	if (deleting) {
	return;
	}

	// TODO: UNDO!
	if (window.confirm('Are you sure you want to delete this post?')) {
	// AJAX
	deletePost(id, "", function() {
	// Remove post from list
	var $postEl = document.getElementById('post-' + id);
	$postEl.parentNode.removeChild($postEl);
	// TODO: add next post from this collection at the bottom
	});
	}
	}

	var deletePost = function(postID, token, callback) {
	deleting = true;

	var $delBtn = document.getElementById('post-' + postID).getElementsByClassName('delete action')[0];
	$delBtn.innerHTML = '...';

	var http = new XMLHttpRequest();
	var url = "/api/posts/" + postID;
	http.open("DELETE", url, true);
	http.onreadystatechange = function() {
	if (http.readyState == 4) {
	deleting = false;
	if (http.status == 204) {
	callback();
	} else if (http.status == 409) {
	$delBtn.innerHTML = 'delete';
	alert("Post is synced to another account. Delete the post from that account instead.");
	// TODO: show "remove" button instead of "delete" now
	// Persist that state.
	// Have it remove the post locally only.
	} else {
	$delBtn.innerHTML = 'delete';
	alert("Failed to delete." + (http.status>=500?" Please try again.":""));
	}
	}
	}
	http.send();
	};

	var pinning = false;
	function pinPost(e, postID, slug, title) {
	e.preventDefault();
	if (pinning) {
	return;
	}
	pinning = true;

	var callback = function() {
	// Visibly remove post from collection
	var $postEl = document.getElementById('post-' + postID);
	$postEl.parentNode.removeChild($postEl);
	var $header = document.getElementsByTagName('header')[0];
	var $pinnedNavs = $header.getElementsByTagName('nav');
	// Add link to nav
	var link = '<a class="pinned" href="/{{.Alias}}/'+slug+'">'+title+'</a>';
	if ($pinnedNavs.length == 0) {
	$header.insertAdjacentHTML("beforeend", '<nav>'+link+'</nav>');
	} else {
	$pinnedNavs[0].insertAdjacentHTML("beforeend", link);
	}
	};

	var $pinBtn = document.getElementById('post-' + postID).getElementsByClassName('pin action')[0];
	$pinBtn.innerHTML = '...';

	var http = new XMLHttpRequest();
	var url = "/api/collections/{{.Alias}}/pin";
	var params = [ { "id": postID } ];
	http.open("POST", url, true);
	http.setRequestHeader("Content-type", "application/json");
	http.onreadystatechange = function() {
	if (http.readyState == 4) {
	pinning = false;
	if (http.status == 200) {
	callback();
	} else if (http.status == 409) {
	$pinBtn.innerHTML = 'pin';
	alert("Post is synced to another account. Delete the post from that account instead.");
	// TODO: show "remove" button instead of "delete" now
	// Persist that state.
	// Have it remove the post locally only.
	} else {
	$pinBtn.innerHTML = 'pin';
	alert("Failed to pin." + (http.status>=500?" Please try again.":""));
	}
	}
	}
	http.send(JSON.stringify(params));
	};
	{{end}}
	try { // Fonts
	WebFontConfig = {
	- custom: { families: [ 'Lora:400,700:latin', 'Open+Sans:400,700:latin' ], urls: [ '{{if .IsCustomDomain}}https://files.writeas.org{{end}}/css/fonts.css' ] }
	+ custom: { families: [ 'Lora:400,700:latin', 'Open+Sans:400,700:latin' ], urls: [ '/css/fonts.css' ] }
	};
	(function() {
	var wf = document.createElement('script');
	- wf.src = '{{if .IsCustomDomain}}https://files.writeas.org{{end}}/js/webfont.js';
	+ wf.src = '/js/webfont.js';
	wf.type = 'text/javascript';
	wf.async = 'true';
	var s = document.getElementsByTagName('script')[0];
	s.parentNode.insertBefore(wf, s);
	})();
	} catch (e) { /* ¯\_(ツ)_/¯ */ }
	</script>
	</html>{{end}}

File Metadata

Mime Type: text/x-diff
Expires: Sat, Nov 15, 7:33 AM (2 h, 32 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3491740

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions