G-tix
/
rDrama
forked from rDrama/rDrama
1
0
Fork 0
Code Pull Requests Activity
21,819 Commits
1 Branch
0 Tags
2.1 GiB
Commit Graph

2624 Commits (e8f9d39bcf59fd324e949c329bbbe93961e0bbd5)

Author SHA1 Message Date
Aevann1 1a4600bd95 imagemagick is really cringe 2022-12-07 10:42:23 +02:00
Aevann1 5d2dbee95e increase MAX_IMAGE_CONVERSION_TIMEOUT from 15 to 30 2022-12-07 10:30:11 +02:00
Aevann1 ab51e97e09 better error message 2022-12-07 10:28:01 +02:00
Aevann1 a3f1b85e16 fix this https://stupidpol.site/h/programming/post/129189/advent-of-code-day-6/3195992?context=8#context 2022-12-07 09:58:46 +02:00
Aevann1 14aaed820c boost scrd.app 2022-12-07 09:36:56 +02:00
Aevann1 5e87e53335 make poll limit 20 on rdrama and 30 on wpd 2022-12-07 07:30:03 +02:00
justcool393 6dbad04f08 band-aid fix for frozen session issue on signup (#50) 
through some reason or another, people are somehow getting cookies that aren't prepended with a dot.

this is a problem because both sessions at, as best as I can tell, mix so it tries to read from a different cookie than we write to. this essentially "freezes" the session in place. users are unable to login, logout, signup, toggle poor mode, toggle NSFW, etc.

~~this attempts to delete bad session cookies (i.e. cookies with a domain that don't start with a dot).~~

~~we don't do this on "dotless" domains (and by extension localhost) because browser support for setting cookies on FQDNs that only have one dot has tenuous support among browsers anyway).~~

~~this *may* log some people out, but... their days of being able to do stuff on the site were numbered anyway.~~

**edit: as amazing as this thought was, browsers just wipe the entire cookies completely and there's no way to specifically target dotless cookies. for an issue that affects a few users, better to just tell them to clear their cookies. if *this* doesn't work, delete service-worker.js and be done with the whole service worker crap. forever. permanently. this PR also includes some QOL improvements.**

Co-authored-by: justcool393 <justcool393@gmail.com>
Reviewed-on: rDrama/rDrama#50
Co-authored-by: justcool393 <justcool393@noreply.fsdfsd.net>
Co-committed-by: justcool393 <justcool393@noreply.fsdfsd.net>
 2022-12-06 22:07:12 +00:00
justcool393 c12bf5105f WPD: remove poll limit (#51) 
by request of the wpd mops

Co-authored-by: justcool393 <justcool393@gmail.com>
Reviewed-on: rDrama/rDrama#51
Co-authored-by: justcool393 <justcool393@noreply.fsdfsd.net>
Co-committed-by: justcool393 <justcool393@noreply.fsdfsd.net>
 2022-12-06 18:24:41 +00:00
Snakes 9160a853ec
Remove !YOU!. 
Security mess and stale joke.
 2022-12-05 20:06:04 -05:00
Snakes fe5ffd1bcf
security: sanitize !YOU! in <a href="">. 
Unlike the recent auto-embed exploits which have been patched, this
requires active user action. However our userbase, like all userbases,
contains quite a few retards and phoneposters who don't check links
before clicking.

Example exploit:

    <a href="https://example.com/log?username=!YOU!">Bardfinn Dox</a>
 2022-12-05 19:05:02 -05:00
Snakes 616634158c
Narrow approved_embed_hosts for security. 
Probably will break some peoples' profilecss and irritate the
newsposters, but in light of recent live proven exploits to disclose
user IP & username pairs to remote servers, the broad list of embed
hosts was unsustainable and impossible to prove safe.

We extend is_safe_url to allow whitelisting subdomains, specifically
to solve the s.lain.la open redirect exploit. Also, open media proxies
like external-content.duckduckgo.com were concerning enough, despite
likely being safe, to warrant removal. Anything infrequently used and
difficult to review, or has a reasonable alternative, was also removed.

In general: we want people to be rehosting, and if we want to allow
more external content, we need to run a media proxy. The central issue
is that any user-configurable 302 is a potential disclosure risk, and
Lord knows how many ways there were to get <arbitrarynewssite>.com to
do so. Maybe zero, but the problem is we just don't know.
 2022-12-05 18:57:35 -05:00
float-trip bca9aff068 Disallow !YOU! in URLs. (#49) 
!YOU! + an escape for `approved_embed_hosts` could let you grab the IP and username of everyone who views your comment

https://rdrama.net/post/129053/you-callout-thread/3191218?context=8#context

lain.la has a URL shortener that also works to get around embed hosts, fwiw

Co-authored-by: float trip <float-trip@rdrama.net>
Reviewed-on: rDrama/rDrama#49
Co-authored-by: float-trip <float-trip@noreply.fsdfsd.net>
Co-committed-by: float-trip <float-trip@noreply.fsdfsd.net>
 2022-12-05 21:20:59 +00:00
Aevann1 159cb52e46 add looksmax.org to BOOSTED_SITES 2022-12-05 15:59:01 +02:00
Aevann1 9dacb7c307 add teamblind.com to boosted sites 2022-12-05 08:13:11 +02:00
Aevann 18df70caab allow JL3 to edit rules (#39) 
Co-authored-by: Aevann1 <randomname42029@gmail.com>
Reviewed-on: rDrama/rDrama#39
Co-authored-by: Aevann <aevann@noreply.fsdfsd.net>
Co-committed-by: Aevann <aevann@noreply.fsdfsd.net>
 2022-12-05 05:22:08 +00:00
Aevann1 5473cb3084 add snus mentions 2022-12-05 04:01:55 +02:00
Aevann1 f2c4dc429a fix for MIMW_ID 2022-12-05 04:01:01 +02:00
Aevann1 66aeb82823 add pings for MIMW 2022-12-05 03:57:24 +02:00
Aevann1 468fd5f5f4 add (((heymoon))) notifs 2022-12-05 03:40:51 +02:00
Snakes be2b210df4
Remove superfluous #disablepoll command. 
Already resolved by 29070c78a9.
 2022-12-04 17:15:52 -05:00
justcool393 ed0981cbdb add functionality to disable poll formatting (#35) 
Co-authored-by: justcool393 <justcool393@gmail.com>
Reviewed-on: rDrama/rDrama#35
Co-authored-by: justcool393 <justcool393@noreply.fsdfsd.net>
Co-committed-by: justcool393 <justcool393@noreply.fsdfsd.net>
 2022-12-04 21:46:27 +00:00
Aevann1 892e35b1c3 splash mountain for PCM 2022-12-04 23:28:39 +02:00
Aevann1 e66234eb6a fix offsitementions 2022-12-04 21:48:28 +02:00
Aevann1 da643ea88b sneed 2022-12-04 21:30:33 +02:00
Aevann e105035272 remove country club system and replace it with a 3 tier thing: (#41) 
- /h/masterbaiters: 1 TS - for gayops

- /h/countryclub: 1000 TS - for anything requiring secrecy and doesnt need critical mass - have to make it a rule that u cant post gayops in /h/countryclub

- /h/chudrama: 5000 TS - for chad+stud posts

EDIT: i removed the /h/masterbaiters gate, but u can bring it back if u want
Co-authored-by: Aevann1 <randomname42029@gmail.com>
Co-authored-by: Snakes <duolsm@outlook.com>
Reviewed-on: rDrama/rDrama#41
Co-authored-by: Aevann <aevann@noreply.fsdfsd.net>
Co-committed-by: Aevann <aevann@noreply.fsdfsd.net>
 2022-12-04 18:39:06 +00:00
Aevann1 29070c78a9 fix this and related stuff https://stupidpol.site/h/programming/post/128394/advent-of-code-day-3-i/3182179?context=8#context 2022-12-04 17:53:41 +02:00
Aevann1 30405e1841 slur fix 2022-12-04 16:44:59 +02:00
Aevann1 1f675c61e5 minor regex fix for emojis 2022-12-04 00:26:05 +02:00
Aevann1 a92737b85c re-add kylie slur filter 2022-12-04 00:01:24 +02:00
Aevann1 8d218c28e2 fix this https://stupidpol.site/h/programming/post/128511/nostalgia-post-heres-a-shitty-tictactoe/3179456?context=8#context 2022-12-03 22:09:12 +02:00
Aevann1 0046e63bc7 boost /h/programming temporarily - revert at will 2022-12-03 21:56:27 +02:00
Aevann1 a13311d72e sneed 2022-12-03 21:10:59 +02:00
Aevann1 a193952c5e fix this https://stupidpol.site/h/slackernews/post/128394/advent-of-code-day-3-i/3177263?context=8#context 2022-12-03 10:02:26 +02:00
Aevann1 3907a2f25f make the gevent sequential 2022-12-03 01:25:48 +02:00
Snakes 9b09181e28
Dispatch push notifications using greenlets. 2022-12-02 18:15:58 -05:00
Snakes d79465517d
Rename siege log filename. 2022-12-02 17:50:48 -05:00
Aevann1 9947e635ab make supportjews.webp an image instead 2022-12-03 00:32:51 +02:00
Aevann1 6248042e46 add supportjews emoji and use it in chud message 2022-12-03 00:22:18 +02:00
Aevann 5c2dab73c7 stop using pusher (#37) 
Co-authored-by: Aevann1 <randomname42029@gmail.com>
Co-authored-by: Snakes <duolsm@outlook.com>
Reviewed-on: rDrama/rDrama#37
Co-authored-by: Aevann <aevann@noreply.fsdfsd.net>
Co-committed-by: Aevann <aevann@noreply.fsdfsd.net>
 2022-12-02 22:21:18 +00:00
Aevann1 3542703ced Revert "make it so only the post author can declare winner and not all admins" 
This reverts commit 9e1425d93e.
 2022-12-03 00:08:46 +02:00
Aevann1 9e1425d93e make it so only the post author can declare winner and not all admins 2022-12-03 00:06:57 +02:00
Aevann1 25be392e3b add soyjak.party to BOOSTED SITES 2022-12-03 00:02:04 +02:00
Aevann1 064b5878f9 add "media" tld 2022-12-02 12:38:07 +02:00
Aevann1 acd4a61232 add dramarama to boosted users 2022-12-01 18:22:00 +02:00
Aevann1 238c92b703 make PAGE_SIZES ordered 2022-12-01 14:28:00 +02:00
Aevann1 845e13b4ae minor bug fix 2022-12-01 14:27:15 +02:00
Snakes 1bc086ad1b
PCM: adjust perms, add christmas banner. 2022-11-30 23:38:25 -05:00
Snakes 4585323275
Fix monthly jannie patron badge granting. 2022-11-30 23:38:25 -05:00
Snakes 885601e0ab
Fix offsitementions on localhost testing. 2022-11-30 19:24:45 -05:00
Aevann1 e1ed46fa36 rework reddit notifs - testing on pcm lol 2022-12-01 00:29:13 +02:00