From 57d43801062844c27da75f48c184a684aaa74d75 Mon Sep 17 00:00:00 2001 From: Martin Zimmermann Date: Wed, 16 Jul 2014 13:55:49 +0200 Subject: [PATCH 01/12] fix french 'date-now' --- isso/js/app/i18n/fr.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/isso/js/app/i18n/fr.js b/isso/js/app/i18n/fr.js index cb0c006..e29d024 100644 --- a/isso/js/app/i18n/fr.js +++ b/isso/js/app/i18n/fr.js @@ -17,7 +17,7 @@ define({ "comment-queued": "Commentaire en attente de modération.", "comment-anonymous": "Anonyme", "comment-hidden": "1 caché\n{{ n }} cachés", - "date-now": "À l'instant'", + "date-now": "À l'instant", "date-minute": "Il y a une minute\nIl y a {{ n }} minutes", "date-hour": "Il y a une heure\nIl y a {{ n }} heures ", "date-day": "Hier\nIl y a {{ n }} jours", From 4aaa5bbdd2a051bd5905dda63c0427d4b8ac5556 Mon Sep 17 00:00:00 2001 From: Martin Zimmermann Date: Mon, 21 Jul 2014 17:00:46 +0200 Subject: [PATCH 02/12] fix #106 --- docs/docs/configuration/client.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/docs/configuration/client.rst b/docs/docs/configuration/client.rst index 9870df4..b67622f 100644 --- a/docs/docs/configuration/client.rst +++ b/docs/docs/configuration/client.rst @@ -14,8 +14,8 @@ preferably in the script tag which embeds the JS: data-isso-max-comments-nested="5" data-isso-reveal-on-click="5" data-isso-avatar="true" - data-avatar-bg="#f0f0f0" - data-avatar-fg="#9abf88 #5698c4 #e279a3 #9163b6 ..." + data-isso-avatar-bg="#f0f0f0" + data-isso-avatar-fg="#9abf88 #5698c4 #e279a3 #9163b6 ..." src="/prefix/js/embed.js"> Furthermore you can override the automatic title detection inside From 7701dafa136c0cbe5338b1a5546ab58afbbaadb0 Mon Sep 17 00:00:00 2001 From: Martin Zimmermann Date: Wed, 23 Jul 2014 19:06:41 +0200 Subject: [PATCH 03/12] remove old Markup.js module --- isso/js/app/markup.js | 50 ------------------------------------------- 1 file changed, 50 deletions(-) delete mode 100644 isso/js/app/markup.js diff --git a/isso/js/app/markup.js b/isso/js/app/markup.js deleted file mode 100644 index 98461a1..0000000 --- a/isso/js/app/markup.js +++ /dev/null @@ -1,50 +0,0 @@ -define(["vendor/markup", "app/config", "app/i18n", "app/text/svg"], function(Mark, config, i18n, svg) { - - "use strict"; - - - // circumvent https://github.com/adammark/Markup.js/issues/22 - function merge(obj) { - var result = {}; - for (var prefix in obj) { - for (var attrname in obj[prefix]) { - result[prefix + "-" + attrname] = obj[prefix][attrname]; - } - } - return result; - } - - Mark.delimiter = ":"; - Mark.includes = merge({ - conf: config, - i18n: i18n[i18n.lang], - svg: svg - }); - - Mark.pipes.datetime = function(date) { - if (typeof date !== "object") { - date = new Date(parseInt(date, 10) * 1000); - } - - return [date.getUTCFullYear(), pad(date.getUTCMonth(), 2), pad(date.getUTCDay(), 2)].join("-"); - }; - - Mark.pipes.substract = function(a, b) { - return parseInt(a, 10) - parseInt(b, 10); - }; - - var strip = function(string) { - // allow whitespace between Markup.js delimiters such as - // {{ var | pipe : arg }} instead of {{var|pipe:arg}} - return string.replace(/\{\{\s*(.+?)\s*\}\}/g, function(match, val) { - return ("{{" + val + "}}").replace(/\s*\|\s*/g, "|") - .replace(/\s*\:\s*/g, ":"); - }); - }; - - return { - up: function(template, context) { - return Mark.up(strip(template), context); - } - }; -}); \ No newline at end of file From 7008e88314b6d86e640e7e96e4886bc0d6e8492f Mon Sep 17 00:00:00 2001 From: Martin Zimmermann Date: Sat, 9 Aug 2014 20:28:54 +0200 Subject: [PATCH 04/12] prevent   insertion, closes #112 --- isso/js/app/utils.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/isso/js/app/utils.js b/isso/js/app/utils.js index f5f4992..2e3943a 100644 --- a/isso/js/app/utils.js +++ b/isso/js/app/utils.js @@ -57,7 +57,8 @@ define(["app/i18n"], function(i18n) { var _ = document.createElement("div"); _.innerHTML = html.replace(/

<\/div>/gi, '
') .replace(/
/gi,'
') - .replace(/
/gi, '\n'); + .replace(/
/gi, '\n') + .replace(/ /gi, ' '); return _.textContent.trim(); }; From 4a8cbcd8f05c2e6e2eac403651bdce1787036623 Mon Sep 17 00:00:00 2001 From: Martin Zimmermann Date: Sat, 9 Aug 2014 20:55:02 +0200 Subject: [PATCH 05/12] limit request size, closes #107 --- isso/utils/__init__.py | 4 +++- isso/views/comments.py | 3 +++ isso/wsgi.py | 9 +++++++++ 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/isso/utils/__init__.py b/isso/utils/__init__.py index 1dfb517..924e9a1 100644 --- a/isso/utils/__init__.py +++ b/isso/utils/__init__.py @@ -8,9 +8,11 @@ werkzeug = pkg_resources.get_distribution("werkzeug") import json import hashlib -from werkzeug.wrappers import Request, Response +from werkzeug.wrappers import Response from werkzeug.exceptions import BadRequest +from isso.wsgi import Request + try: import ipaddress except ImportError: diff --git a/isso/views/comments.py b/isso/views/comments.py index 04910b7..5008d27 100644 --- a/isso/views/comments.py +++ b/isso/views/comments.py @@ -142,6 +142,9 @@ class API(object): if len(comment["text"].rstrip()) < 3: return False, "text is too short (minimum length: 3)" + if len(comment["text"]) > 65535: + return False, "text is too long (maximum length: 65535)" + if len(comment.get("email") or "") > 254: return False, "http://tools.ietf.org/html/rfc5321#section-4.5.3" diff --git a/isso/wsgi.py b/isso/wsgi.py index a2753f9..50214f3 100644 --- a/isso/wsgi.py +++ b/isso/wsgi.py @@ -17,6 +17,7 @@ except ImportError: from BaseHTTPServer import HTTPServer from werkzeug.serving import WSGIRequestHandler +from werkzeug.wrappers import Request as _Request from werkzeug.datastructures import Headers from isso.compat import string_types @@ -148,6 +149,14 @@ class CORSMiddleware(object): return self.app(environ, add_cors_headers) +class Request(_Request): + + # Assuming UTF-8, comments with 65536 characters would consume + # 128 kb memory. The remaining 128 kb cover additional parameters + # and WSGI headers. + max_content_length = 256 * 1024 + + class SocketWSGIRequestHandler(WSGIRequestHandler): def run_wsgi(self): From 8a58afc8e6633008356259ff368862a273248f7e Mon Sep 17 00:00:00 2001 From: Martin Zimmermann Date: Sat, 9 Aug 2014 21:01:56 +0200 Subject: [PATCH 06/12] fix order of converting HTML back to text Fixes a regression introduced by ad9384e, which escapes wanted line breaks, such as
and
. --- isso/js/app/utils.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/isso/js/app/utils.js b/isso/js/app/utils.js index 2e3943a..d7bddf4 100644 --- a/isso/js/app/utils.js +++ b/isso/js/app/utils.js @@ -63,8 +63,9 @@ define(["app/i18n"], function(i18n) { }; var detext = function(text) { - return escape(text.replace(/\n\n/gi, '

') - .replace(/\n/gi, '
')); + text = escape(text); + return text.replace(/\n\n/gi, '

') + .replace(/\n/gi, '
'); }; return { From 0f1b95a1255f47ad9aafeb0d21bf9fadbd26a178 Mon Sep 17 00:00:00 2001 From: Martin Zimmermann Date: Sun, 10 Aug 2014 10:55:25 +0200 Subject: [PATCH 07/12] add log to file option, closes #103 --- docs/docs/configuration/server.rst | 4 ++++ isso/__init__.py | 11 ++++++++++- isso/core.py | 1 + 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/docs/configuration/server.rst b/docs/docs/configuration/server.rst index 16ba15c..6faf61f 100644 --- a/docs/docs/configuration/server.rst +++ b/docs/docs/configuration/server.rst @@ -44,6 +44,7 @@ session key and hostname. Here are the default values for this section: host = max-age = 15m notify = stdout + log-file = dbpath file location to the SQLite3 database, highly recommended to change this @@ -86,6 +87,9 @@ notify Send notifications via SMTP on new comments with activation (if moderated) and deletion links. +log-file + Log console messages to file instead of standard out. + .. _CORS: https://developer.mozilla.org/en/docs/HTTP/Access_control_CORS diff --git a/isso/__init__.py b/isso/__init__.py index f2745c6..527e480 100644 --- a/isso/__init__.py +++ b/isso/__init__.py @@ -70,7 +70,7 @@ from isso.views import comments from isso.ext.notifications import Stdout, SMTP -logging.getLogger('werkzeug').setLevel(logging.ERROR) +logging.getLogger('werkzeug').setLevel(logging.WARN) logging.basicConfig( level=logging.INFO, format="%(asctime)s %(levelname)s: %(message)s") @@ -232,6 +232,15 @@ def main(): sys.exit(0) + if conf.get("general", "log-file"): + handler = logging.FileHandler(conf.get("general", "log-file")) + + logger.addHandler(handler) + logging.getLogger("werkzeug").addHandler(handler) + + logger.propagate = False + logging.getLogger("werkzeug").propagate = False + if not any(conf.getiter("general", "host")): logger.error("No website(s) configured, Isso won't work.") sys.exit(1) diff --git a/isso/core.py b/isso/core.py index af85054..0672f54 100644 --- a/isso/core.py +++ b/isso/core.py @@ -96,6 +96,7 @@ class Config: "host = ", "max-age = 15m", "notify = stdout", + "log-file = ", "[moderation]", "enabled = false", "purge-after = 30d", From 881788a0496d96ac69873914872c1e985ad17e5e Mon Sep 17 00:00:00 2001 From: Martin Zimmermann Date: Sun, 10 Aug 2014 11:33:45 +0200 Subject: [PATCH 08/12] fix