From edca73723a4f6d76552537fe53645c6d0695887d Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Thu, 9 Dec 2021 23:21:52 +0200
Subject: [PATCH 01/11] sfdsfd

---
 files/mail/__init__.py                |  1 +
 files/routes/admin.py                 | 12 +++++
 files/routes/awards.py                |  3 ++
 files/routes/front.py                 | 17 ++++---
 files/routes/oauth.py                 |  2 +
 files/routes/reporting.py             |  2 +
 files/routes/settings.py              |  8 ++-
 files/routes/static.py                |  1 +
 files/routes/users.py                 | 11 ++++
 files/routes/votes.py                 |  1 +
 files/templates/changelog.html        |  2 +-
 files/templates/comments.html         |  2 +-
 files/templates/default.html          |  2 +-
 files/templates/header.html           |  2 +-
 files/templates/settings_blocks.html  |  6 ++-
 files/templates/settings_profile.html |  4 ++
 files/templates/submission.html       |  4 +-
 files/templates/userpage.html         | 73 ++++-----------------------
 files/templates/userpage_private.html |  1 -
 19 files changed, 75 insertions(+), 79 deletions(-)

diff --git a/files/mail/__init__.py b/files/mail/__init__.py
index 1bc255a4e..36d753da8 100644
--- a/files/mail/__init__.py
+++ b/files/mail/__init__.py
@@ -43,6 +43,7 @@ def send_verification_email(user, email=None):
 @app.post("/verify_email")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def api_verify_email(v):
 
 	send_verification_email(v)
diff --git a/files/routes/admin.py b/files/routes/admin.py
index 10ec84ddb..653bc5c9c 100644
--- a/files/routes/admin.py
+++ b/files/routes/admin.py
@@ -36,6 +36,7 @@ def truescore(v):
 @app.post("/@<username>/revert_actions")
 @limiter.limit("1/second")
 @admin_level_required(2)
+@validate_formkey
 def revert_actions(v, username):
 	if 'pcm' in request.host or (SITE_NAME == 'Drama' and v.admin_level > 2) or ('rama' not in request.host and 'pcm' not in request.host):
 		user = get_user(username)
@@ -61,6 +62,7 @@ def revert_actions(v, username):
 @app.post("/@<username>/club_allow")
 @limiter.limit("1/second")
 @admin_level_required(2)
+@validate_formkey
 def club_allow(v, username):
 
 	u = get_user(username, v=v)
@@ -84,6 +86,7 @@ def club_allow(v, username):
 @app.post("/@<username>/club_ban")
 @limiter.limit("1/second")
 @admin_level_required(2)
+@validate_formkey
 def club_ban(v, username):
 
 	u = get_user(username, v=v)
@@ -107,6 +110,7 @@ def club_ban(v, username):
 @app.post("/@<username>/make_admin")
 @limiter.limit("1/second")
 @admin_level_required(2)
+@validate_formkey
 def make_admin(v, username):
 	if 'pcm' in request.host or (SITE_NAME == 'Drama' and v.admin_level > 2) or ('rama' not in request.host and 'pcm' not in request.host):
 		user = get_user(username)
@@ -120,6 +124,7 @@ def make_admin(v, username):
 @app.post("/@<username>/remove_admin")
 @limiter.limit("1/second")
 @admin_level_required(2)
+@validate_formkey
 def remove_admin(v, username):
 	if 'pcm' in request.host or (SITE_NAME == 'Drama' and v.admin_level > 2) or ('rama' not in request.host and 'pcm' not in request.host):
 		user = get_user(username)
@@ -133,6 +138,7 @@ def remove_admin(v, username):
 @app.post("/@<username>/make_meme_admin")
 @limiter.limit("1/second")
 @admin_level_required(2)
+@validate_formkey
 def make_meme_admin(v, username):
 	if 'pcm' in request.host or (SITE_NAME == 'Drama' and v.admin_level > 2) or ('rama' not in request.host and 'pcm' not in request.host):
 		user = get_user(username)
@@ -146,6 +152,7 @@ def make_meme_admin(v, username):
 @app.post("/@<username>/remove_meme_admin")
 @limiter.limit("1/second")
 @admin_level_required(2)
+@validate_formkey
 def remove_meme_admin(v, username):
 	if 'pcm' in request.host or (SITE_NAME == 'Drama' and v.admin_level > 2) or ('rama' not in request.host and 'pcm' not in request.host):
 		user = get_user(username)
@@ -159,6 +166,7 @@ def remove_meme_admin(v, username):
 @app.post("/admin/monthly")
 @limiter.limit("1/day")
 @admin_level_required(2)
+@validate_formkey
 def monthly(v):
 	if 'pcm' in request.host or (SITE_NAME == 'Drama' and v.admin_level > 2) or ('rama' not in request.host and 'pcm' not in request.host):
 		thing = g.db.query(AwardRelationship).order_by(AwardRelationship.id.desc()).first().id
@@ -930,6 +938,7 @@ def api_distinguish_post(post_id, v):
 
 @app.post("/sticky/<post_id>")
 @admin_level_required(2)
+@validate_formkey
 def api_sticky_post(post_id, v):
 
 	post = g.db.query(Submission).filter_by(id=post_id).first()
@@ -965,6 +974,7 @@ def api_sticky_post(post_id, v):
 @app.post("/ban_comment/<c_id>")
 @limiter.limit("1/second")
 @admin_level_required(1)
+@validate_formkey
 def api_ban_comment(c_id, v):
 
 	comment = g.db.query(Comment).filter_by(id=c_id).first()
@@ -989,6 +999,7 @@ def api_ban_comment(c_id, v):
 @app.post("/unban_comment/<c_id>")
 @limiter.limit("1/second")
 @admin_level_required(1)
+@validate_formkey
 def api_unban_comment(c_id, v):
 
 	comment = g.db.query(Comment).filter_by(id=c_id).first()
@@ -1013,6 +1024,7 @@ def api_unban_comment(c_id, v):
 
 @app.post("/distinguish_comment/<c_id>")
 @admin_level_required(1)
+@validate_formkey
 def admin_distinguish_comment(c_id, v):
 	
 	
diff --git a/files/routes/awards.py b/files/routes/awards.py
index 5d9bf980e..f0fbae702 100644
--- a/files/routes/awards.py
+++ b/files/routes/awards.py
@@ -234,6 +234,7 @@ def shop(v):
 
 @app.post("/buy/<award>")
 @auth_required
+@validate_formkey
 def buy(v, award):
 	AWARDS = {
 		"shit": {
@@ -446,6 +447,7 @@ def buy(v, award):
 @app.post("/post/<pid>/awards")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def award_post(pid, v):
 
 	if v.shadowbanned: return render_template('errors/500.html', v=v), 500
@@ -603,6 +605,7 @@ def award_post(pid, v):
 @app.post("/comment/<cid>/awards")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def award_comment(cid, v):
 
 	if v.shadowbanned: return render_template('errors/500.html', v=v), 500
diff --git a/files/routes/front.py b/files/routes/front.py
index 2bd50296e..25e0a812b 100644
--- a/files/routes/front.py
+++ b/files/routes/front.py
@@ -13,6 +13,7 @@ def slash_post():
 
 @app.post("/clear")
 @auth_required
+@validate_formkey
 def clear(v):
 	for n in v.notifications.filter_by(read=False).all():
 		n.read = True
@@ -210,7 +211,8 @@ def frontlist(v=None, sort="hot", page=1, t="all", ids_only=True, filter_words='
 		posts = posts.filter(Submission.created_utc >= cutoff)
 	else: cutoff = 0
 
-	posts = posts.filter_by(is_banned=False, stickied=None, private=False, deleted_utc = 0)
+	if sort == "new": posts = posts.filter_by(is_banned=False, private=False, deleted_utc = 0)
+	else: posts = posts.filter_by(is_banned=False, stickied=None, private=False, deleted_utc = 0)
 
 	if v and v.admin_level == 0:
 		blocking = [x[0] for x in g.db.query(
@@ -263,13 +265,14 @@ def frontlist(v=None, sort="hot", page=1, t="all", ids_only=True, filter_words='
 
 	posts = posts[:size]
 
-	pins = g.db.query(Submission).filter(Submission.stickied != None, Submission.is_banned == False)
-	if v and v.admin_level == 0:
-		blocking = [x[0] for x in g.db.query(UserBlock.target_id).filter_by(user_id=v.id).all()]
-		blocked = [x[0] for x in g.db.query(UserBlock.user_id).filter_by(target_id=v.id).all()]
-		pins = pins.filter(Submission.author_id.notin_(blocking), Submission.author_id.notin_(blocked))
+	if sort != "new":
+		pins = g.db.query(Submission).filter(Submission.stickied != None, Submission.is_banned == False)
+		if v and v.admin_level == 0:
+			blocking = [x[0] for x in g.db.query(UserBlock.target_id).filter_by(user_id=v.id).all()]
+			blocked = [x[0] for x in g.db.query(UserBlock.user_id).filter_by(target_id=v.id).all()]
+			pins = pins.filter(Submission.author_id.notin_(blocking), Submission.author_id.notin_(blocked))
 
-	if page == 1 and not gt and not lt: posts = pins.all() + posts
+	if sort != "new" and page == 1 and not gt and not lt: posts = pins.all() + posts
 
 	if ids_only: posts = [x.id for x in posts]
 
diff --git a/files/routes/oauth.py b/files/routes/oauth.py
index fae4ecb0a..ef7edb4d1 100644
--- a/files/routes/oauth.py
+++ b/files/routes/oauth.py
@@ -38,6 +38,7 @@ def authorize(v):
 @app.post("/api_keys")
 @limiter.limit("1/second")
 @is_not_banned
+@validate_formkey
 def request_api_keys(v):
 
 	new_app = OauthApp(
@@ -253,6 +254,7 @@ def admin_apps_list(v):
 @app.post("/oauth/reroll/<aid>")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def reroll_oauth_tokens(aid, v):
 
 	aid = aid
diff --git a/files/routes/reporting.py b/files/routes/reporting.py
index 2cc2b3763..37b39bb5a 100644
--- a/files/routes/reporting.py
+++ b/files/routes/reporting.py
@@ -8,6 +8,7 @@ from files.helpers.sanitize import filter_emojis_only
 @app.post("/report/post/<pid>")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def api_flag_post(pid, v):
 
 	post = get_post(pid)
@@ -38,6 +39,7 @@ def api_flag_post(pid, v):
 @app.post("/report/comment/<cid>")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def api_flag_comment(cid, v):
 
 	comment = get_comment(cid)
diff --git a/files/routes/settings.py b/files/routes/settings.py
index 06c6a9ae9..0d01fbfe8 100644
--- a/files/routes/settings.py
+++ b/files/routes/settings.py
@@ -34,6 +34,7 @@ tiers={
 @app.post("/settings/removebackground")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def removebackground(v):
 	v.background = None
 	g.db.add(v)
@@ -439,6 +440,7 @@ def settings_profile_post(v):
 
 @app.post("/settings/filters")
 @auth_required
+@validate_formkey
 def filters(v):
 	filters=request.values.get("filters")[:1000].strip()
 
@@ -810,6 +812,7 @@ def settings_css_get(v):
 @app.post("/settings/css")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def settings_css(v):
 	css = request.values.get("css").strip().replace('\\', '').strip()[:4000]
 
@@ -826,14 +829,15 @@ def settings_css(v):
 @auth_required
 def settings_profilecss_get(v):
 
-	if v.truecoins < 1000 and not v.patron and v.admin_level == 0 : return f"You must have +1000 {COINS_NAME} or be a patron to set profile css."
+	if v.truecoins < 1000 and not v.patron and v.admin_level == 0 : return f"You must have +1000 {COINS_NAME} or be a paypig to set profile css."
 	return render_template("settings_profilecss.html", v=v)
 
 @app.post("/settings/profilecss")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def settings_profilecss(v):
-	if v.truecoins < 1000 and not v.patron: return f"You must have +1000 {COINS_NAME} or be a patron to set profile css."
+	if v.truecoins < 1000 and not v.patron: return f"You must have +1000 {COINS_NAME} or be a paypig to set profile css."
 	profilecss = request.values.get("profilecss").strip().replace('\\', '').strip()[:4000]
 	v.profilecss = profilecss
 	g.db.add(v)
diff --git a/files/routes/static.py b/files/routes/static.py
index 6b5f2f4de..58b13a41f 100644
--- a/files/routes/static.py
+++ b/files/routes/static.py
@@ -230,6 +230,7 @@ def contact(v):
 @app.post("/contact")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def submit_contact(v):
 	message = f'This message has been sent automatically to all admins via https://{site}/contact, user email is "{v.email}"\n\nMessage:\n\n' + request.values.get("message", "")
 	send_admin(v.id, message)
diff --git a/files/routes/users.py b/files/routes/users.py
index 46e5e9a68..16be0d6d4 100644
--- a/files/routes/users.py
+++ b/files/routes/users.py
@@ -97,6 +97,7 @@ def downvoting(v, username):
 @app.post("/pay_rent")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def pay_rent(v):
 	if v.coins < 500: return "You must have more than 500 coins."
 	v.coins -= 500
@@ -113,6 +114,7 @@ def pay_rent(v):
 @app.post("/steal")
 @limiter.limit("1/second")
 @is_not_banned
+@validate_formkey
 def steal(v):
 	if int(time.time()) - v.created_utc < 604800:
 		return "You must have an account older than 1 week in order to attempt stealing."
@@ -167,6 +169,7 @@ def thiefs(v):
 @app.post("/@<username>/suicide")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def suicide(v, username):
 	t = int(time.time())
 	if v.admin_level == 0 and t - v.suicide_utc < 86400: return {"message": "You're on 1-day cooldown!"}
@@ -312,6 +315,7 @@ def song(song):
 @app.post("/subscribe/<post_id>")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def subscribe(v, post_id):
 	new_sub = Subscription(user_id=v.id, submission_id=post_id)
 	g.db.add(new_sub)
@@ -321,6 +325,7 @@ def subscribe(v, post_id):
 @app.post("/unsubscribe/<post_id>")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def unsubscribe(v, post_id):
 	sub=g.db.query(Subscription).filter_by(user_id=v.id, submission_id=post_id).first()
 	if sub:
@@ -337,6 +342,7 @@ def reportbugs(v):
 @limiter.limit("1/second")
 @limiter.limit("10/hour")
 @auth_required
+@validate_formkey
 def message2(v, username):
 
 	user = get_user(username, v=v)
@@ -400,6 +406,7 @@ def message2(v, username):
 @limiter.limit("1/second")
 @limiter.limit("6/minute")
 @auth_required
+@validate_formkey
 def messagereply(v):
 
 	message = request.values.get("body", "").strip()[:1000].strip()
@@ -727,6 +734,7 @@ def u_username_info(username, v=None):
 @app.post("/follow/<username>")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def follow_user(username, v):
 
 	target = get_user(username)
@@ -752,6 +760,7 @@ def follow_user(username, v):
 @app.post("/unfollow/<username>")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def unfollow_user(username, v):
 
 	target = get_user(username)
@@ -778,6 +787,7 @@ def unfollow_user(username, v):
 @app.post("/remove_follow/<username>")
 @limiter.limit("1/second")
 @auth_required
+@validate_formkey
 def remove_follow(username, v):
 	target = get_user(username)
 
@@ -869,6 +879,7 @@ def saved_comments(v, username):
 
 @app.post("/fp/<fp>")
 @auth_required
+@validate_formkey
 def fp(v, fp):
 	if v.username != fp:
 		v.fp = fp
diff --git a/files/routes/votes.py b/files/routes/votes.py
index a03e16ca0..32201e980 100644
--- a/files/routes/votes.py
+++ b/files/routes/votes.py
@@ -196,6 +196,7 @@ def api_vote_comment(comment_id, new, v):
 
 @app.post("/vote/poll/<comment_id>")
 @auth_required
+@validate_formkey
 def api_vote_poll(comment_id, v):
 	
 	vote = request.values.get("vote")
diff --git a/files/templates/changelog.html b/files/templates/changelog.html
index 0e711b6db..6884eeb6d 100644
--- a/files/templates/changelog.html
+++ b/files/templates/changelog.html
@@ -102,6 +102,6 @@
 </nav>
 {% endif %}
 
-<script src="/assets/js/changelog.js?v=54"></script>
+<script src="/assets/js/changelog.js?v=55"></script>
 
 {% endblock %}
\ No newline at end of file
diff --git a/files/templates/comments.html b/files/templates/comments.html
index edfb51e1b..28b296911 100644
--- a/files/templates/comments.html
+++ b/files/templates/comments.html
@@ -749,7 +749,7 @@
 
 {% if v %}
 	<script src="/assets/js/marked.js?v=1"></script>
-	<script src="/assets/js/comments_v.js?v=85"></script>
+	<script src="/assets/js/comments_v.js?v=86"></script>
 {% endif %}
 
 <script src="/assets/js/clipboard.js?v=3"></script>
diff --git a/files/templates/default.html b/files/templates/default.html
index e9177d005..50ffa701d 100644
--- a/files/templates/default.html
+++ b/files/templates/default.html
@@ -287,7 +287,7 @@
 <script src="/assets/js/lozad.js?v=54"></script>
 
 {% if v %}
-	<script src="/assets/js/default.js?v=59"></script>
+	<script src="/assets/js/default.js?v=60"></script>
 {% endif %}
 
 <link rel="stylesheet" href="/assets/css/lite-youtube.css?v=3">
diff --git a/files/templates/header.html b/files/templates/header.html
index 912e2ed70..0fb96a491 100644
--- a/files/templates/header.html
+++ b/files/templates/header.html
@@ -213,7 +213,7 @@
 	</div>
 </nav>
 
-<script src="/assets/js/header.js?v=54"></script>
+<script src="/assets/js/header.js?v=56"></script>
 
 <style>
 	.notif-count {
diff --git a/files/templates/settings_blocks.html b/files/templates/settings_blocks.html
index 3768dff8b..7b19cccaf 100644
--- a/files/templates/settings_blocks.html
+++ b/files/templates/settings_blocks.html
@@ -4,7 +4,7 @@
 
 {% block content %}
 
-<script src="/assets/js/settings_block.js?v=2"></script>
+<script src="/assets/js/settings_blocks.js?v=2"></script>
 
 <div class="row">
 
@@ -121,4 +121,8 @@
 	</div>
 </div>
 
+{% if v %}
+	<div id="formkey" class="d-none">{{v.formkey}}</div>
+{% endif %}
+
 {% endblock %}
\ No newline at end of file
diff --git a/files/templates/settings_profile.html b/files/templates/settings_profile.html
index fb926c6d0..00a820ffb 100644
--- a/files/templates/settings_profile.html
+++ b/files/templates/settings_profile.html
@@ -687,4 +687,8 @@
 {% include "emoji_modal.html" %}
 {% include "gif_modal.html" %}
 
+{% if v %}
+	<div id="formkey" class="d-none">{{v.formkey}}</div>
+{% endif %}
+
 {% endblock %}
diff --git a/files/templates/submission.html b/files/templates/submission.html
index 8cddfa366..09cb432c8 100644
--- a/files/templates/submission.html
+++ b/files/templates/submission.html
@@ -805,7 +805,7 @@
  </div>
  
 {% if offset %}
-	<script src="/assets/js/viewmore.js?v=1"></script>
+	<script src="/assets/js/viewmore.js?v=2"></script>
 {% endif %}
 
 {% elif not p.replies and p.deleted_utc == 0 %}
@@ -865,7 +865,7 @@
 
 {% if not p.comment_count %}
 	{% if v %}
-		<script src="/assets/js/comments_v.js?v=85"></script>
+		<script src="/assets/js/comments_v.js?v=86"></script>
 		{% include "award_modal.html" %}
 		{% include "emoji_modal.html" %}
 		{% include "gif_modal.html" %}
diff --git a/files/templates/userpage.html b/files/templates/userpage.html
index af99d8a41..6447cf717 100644
--- a/files/templates/userpage.html
+++ b/files/templates/userpage.html
@@ -35,67 +35,6 @@
 
 {% if v %}
 	<script>
-		const TRANSFER_TAX = {% if v.patron or u.patron %}0{% else %}0.03{% endif %};
-
-		function updateTax(mobile=false) {
-			let suf = mobile ? "-mobile" : "";
-			let amount = parseInt(document.getElementById("coins-transfer-amount" + suf).value);
-			if(isNaN(amount) || amount < 0) {
-			amount = 0;
-			}
-			document.getElementById("coins-transfer-taxed" + suf).innerText = amount - Math.ceil(amount*TRANSFER_TAX);
-		}
-
-		function transferCoins(mobile=false) {
-			let t = event.target;
-			t.disabled = true;
-
-			let amount = parseInt(document.getElementById("coins-transfer-amount").value);
-			let transferred = amount - Math.ceil(amount*TRANSFER_TAX);
-
-			post_toast_callback("/@{{u.username}}/transfer_coins",
-				{"amount": document.getElementById(mobile ? "coins-transfer-amount-mobile" : "coins-transfer-amount").value},
-				(xhr) => {
-				if(xhr.status == 200) {
-					document.getElementById("user-coins-amount").innerText = parseInt(document.getElementById("user-coins-amount").innerText) - amount;
-					document.getElementById("profile-coins-amount-mobile").innerText = parseInt(document.getElementById("profile-coins-amount-mobile").innerText) + transferred;
-					document.getElementById("profile-coins-amount").innerText = parseInt(document.getElementById("profile-coins-amount").innerText) + transferred;
-				}
-				}
-			);
-
-			setTimeout(_ => t.disabled = false, 2000);
-		}
-	</script>
-{% endif %}
-
-{% if u.song %}
-	<script>
-		var audio = new Audio('/songs/{{u.id}}');
-		audio.loop=true;
-		
-		{% if not u.unmutable %}
-			function pause() {
-				audio.pause();
-				document.getElementById("pause1").classList.toggle("d-none");
-				document.getElementById("play1").classList.toggle("d-none");
-				document.getElementById("pause2").classList.toggle("d-none");
-				document.getElementById("play2").classList.toggle("d-none");
-			}
-
-			function play() {
-				audio.play();
-				document.getElementById("pause1").classList.toggle("d-none");
-				document.getElementById("play1").classList.toggle("d-none");
-				document.getElementById("pause2").classList.toggle("d-none");
-				document.getElementById("play2").classList.toggle("d-none");
-			}
-		{% endif %}
-
-		audio.play();
-		document.getElementById('userpage').addEventListener('click', () => {
-			if (audio.paused) audio.play(); 
-		}, {once : true});
 	</script>
 {% endif %}
 
@@ -780,8 +719,18 @@
 	{% include "emoji_modal.html" %}
 {% endif %}
 
-<script src="/assets/js/userpage.js?v=72"></script>
 {% endblock %}
 
 {% block GIFpicker %}
+	{% if u.song %}
+		<div id="uid" class="d-none">{{u.id}}</div>
+	{% endif %}
+
+	{% if v}
+		<script src="/assets/js/userpage_v.js?v=75"></script>
+		<div id="tax" class="d-none">{% if v.patron or u.patron %}0{% else %}0.03{% endif %}</div>
+		<div id="username" class="d-none">{{u.username}}</div>
+	{% endif %}
+
+	<script src="/assets/js/userpage.js?v=75"></script>
 {% endblock %}
\ No newline at end of file
diff --git a/files/templates/userpage_private.html b/files/templates/userpage_private.html
index 66f561273..383164796 100644
--- a/files/templates/userpage_private.html
+++ b/files/templates/userpage_private.html
@@ -33,5 +33,4 @@
 {% endblock %}
 
 {% block pagenav %}
-<script src="/assets/js/userpage.js?v=72"></script>
 {% endblock %}
\ No newline at end of file

From c6bbf4b7e010d8bdf1134fec638b93383ddb633a Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Thu, 9 Dec 2021 23:25:00 +0200
Subject: [PATCH 02/11] fsdfds

---
 files/templates/submission_listing.html | 1 -
 files/templates/userpage.html           | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/files/templates/submission_listing.html b/files/templates/submission_listing.html
index 1a11b4c85..62cd0547a 100644
--- a/files/templates/submission_listing.html
+++ b/files/templates/submission_listing.html
@@ -560,7 +560,6 @@
 				<i class="fas text-gray-500 fa-ghost fa-stack-1x text-lg"></i>
 			</span>
 			<h2 class="h5">There are no posts here.</h2>
-			<p class="text-muted">But the magic gnomes tell us there will be (eventually).</p>
 		</div>			
 	</div>	
 </div>
diff --git a/files/templates/userpage.html b/files/templates/userpage.html
index 6447cf717..4f9fcce8b 100644
--- a/files/templates/userpage.html
+++ b/files/templates/userpage.html
@@ -726,7 +726,7 @@
 		<div id="uid" class="d-none">{{u.id}}</div>
 	{% endif %}
 
-	{% if v}
+	{% if v %}
 		<script src="/assets/js/userpage_v.js?v=75"></script>
 		<div id="tax" class="d-none">{% if v.patron or u.patron %}0{% else %}0.03{% endif %}</div>
 		<div id="username" class="d-none">{{u.username}}</div>

From 1209b55a801c6673f2488655254d2210baa67c90 Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Thu, 9 Dec 2021 23:31:18 +0200
Subject: [PATCH 03/11] fdsfds

---
 files/templates/userpage.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/templates/userpage.html b/files/templates/userpage.html
index 4f9fcce8b..f754df40d 100644
--- a/files/templates/userpage.html
+++ b/files/templates/userpage.html
@@ -727,10 +727,10 @@
 	{% endif %}
 
 	{% if v %}
-		<script src="/assets/js/userpage_v.js?v=75"></script>
+		<script src="/assets/js/userpage_v.js?v=76"></script>
 		<div id="tax" class="d-none">{% if v.patron or u.patron %}0{% else %}0.03{% endif %}</div>
 		<div id="username" class="d-none">{{u.username}}</div>
 	{% endif %}
 
-	<script src="/assets/js/userpage.js?v=75"></script>
+	<script src="/assets/js/userpage.js?v=76"></script>
 {% endblock %}
\ No newline at end of file

From df1a2316335da6f19f37dcddd29caff4fe12da0a Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Thu, 9 Dec 2021 23:31:57 +0200
Subject: [PATCH 04/11] sfdfds

---
 files/templates/userpage.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/templates/userpage.html b/files/templates/userpage.html
index f754df40d..7abc871db 100644
--- a/files/templates/userpage.html
+++ b/files/templates/userpage.html
@@ -727,7 +727,7 @@
 	{% endif %}
 
 	{% if v %}
-		<script src="/assets/js/userpage_v.js?v=76"></script>
+		<script src="/assets/js/userpage_v.js?v=77"></script>
 		<div id="tax" class="d-none">{% if v.patron or u.patron %}0{% else %}0.03{% endif %}</div>
 		<div id="username" class="d-none">{{u.username}}</div>
 	{% endif %}

From e13de39475ad83ee724b0dd4370d75a33549152f Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Thu, 9 Dec 2021 23:33:06 +0200
Subject: [PATCH 05/11] fdsfsd

---
 files/templates/userpage.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/files/templates/userpage.html b/files/templates/userpage.html
index 7abc871db..ed239ffaa 100644
--- a/files/templates/userpage.html
+++ b/files/templates/userpage.html
@@ -727,10 +727,10 @@
 	{% endif %}
 
 	{% if v %}
-		<script src="/assets/js/userpage_v.js?v=77"></script>
+		<script src="/assets/js/userpage_v.js?v=78"></script>
 		<div id="tax" class="d-none">{% if v.patron or u.patron %}0{% else %}0.03{% endif %}</div>
 		<div id="username" class="d-none">{{u.username}}</div>
 	{% endif %}
 
-	<script src="/assets/js/userpage.js?v=76"></script>
+	<script src="/assets/js/userpage.js?v=77"></script>
 {% endblock %}
\ No newline at end of file

From 1931cd09c7f3198a2dcadec234c1d10b56327a7e Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Thu, 9 Dec 2021 23:37:31 +0200
Subject: [PATCH 06/11] fdsfds

---
 files/templates/userpage.html | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/files/templates/userpage.html b/files/templates/userpage.html
index ed239ffaa..9e298a92a 100644
--- a/files/templates/userpage.html
+++ b/files/templates/userpage.html
@@ -33,11 +33,6 @@
 
 {% block desktopUserBanner %}
 
-{% if v %}
-	<script>
-	</script>
-{% endif %}
-
 <div class="row d-none d-md-block">
 	<div class="col px-0">
 		<div class="jumbotron jumbotron-fluid jumbotron-guild d-none d-md-block" style="background-image: url({{u.banner_url}})">
@@ -727,7 +722,7 @@
 	{% endif %}
 
 	{% if v %}
-		<script src="/assets/js/userpage_v.js?v=78"></script>
+		<script src="/assets/js/userpage_v.js?v=79"></script>
 		<div id="tax" class="d-none">{% if v.patron or u.patron %}0{% else %}0.03{% endif %}</div>
 		<div id="username" class="d-none">{{u.username}}</div>
 	{% endif %}

From afd312654212ce2958d40c34121b94fc336c17a6 Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Thu, 9 Dec 2021 23:39:13 +0200
Subject: [PATCH 07/11] fdsfds

---
 files/templates/userpage.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/templates/userpage.html b/files/templates/userpage.html
index 9e298a92a..b196ec8d1 100644
--- a/files/templates/userpage.html
+++ b/files/templates/userpage.html
@@ -722,7 +722,7 @@
 	{% endif %}
 
 	{% if v %}
-		<script src="/assets/js/userpage_v.js?v=79"></script>
+		<script src="/assets/js/userpage_v.js?v=80"></script>
 		<div id="tax" class="d-none">{% if v.patron or u.patron %}0{% else %}0.03{% endif %}</div>
 		<div id="username" class="d-none">{{u.username}}</div>
 	{% endif %}

From ed258d4dfcee714052989096be347b112dff0a5e Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Fri, 10 Dec 2021 00:11:19 +0200
Subject: [PATCH 08/11] dfsdsf

---
 files/__main__.py                       |  2 +-
 files/templates/comments.html           | 37 ++++---------------------
 files/templates/submission.html         | 36 ++++++------------------
 files/templates/submission_listing.html | 27 ++++++------------
 4 files changed, 24 insertions(+), 78 deletions(-)

diff --git a/files/__main__.py b/files/__main__.py
index de8ff43f9..4dce46db0 100644
--- a/files/__main__.py
+++ b/files/__main__.py
@@ -125,7 +125,7 @@ def after_request(response):
 
 	response.headers.add("Strict-Transport-Security", "max-age=31536000")
 	response.headers.add("X-Frame-Options", "deny")
-	response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io 02ddcc80-b8db-42be-9022-44c546b4dce6.pushnotifications.pusher.com; object-src 'none';")
+	response.headers.add("Content-Security-Policy", "script-src 'self'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io 02ddcc80-b8db-42be-9022-44c546b4dce6.pushnotifications.pusher.com; object-src 'none';")
 	return response
 
 from files.routes import *
\ No newline at end of file
diff --git a/files/templates/comments.html b/files/templates/comments.html
index 28b296911..39da7efe5 100644
--- a/files/templates/comments.html
+++ b/files/templates/comments.html
@@ -198,7 +198,11 @@
 				{% if c.active_flags %}<a class="btn btn-primary" style="padding:1px 5px; font-size:10px;" href="javascript:void(0)" onclick="document.getElementById('flaggers-{{c.id}}').classList.toggle('d-none')">{{c.active_flags}} Reports</a>{% endif %}
 				{% if c.over_18 %}<span class="badge badge-danger text-small-extra mr-1">+18</span>{% endif %}
 				{% if v and v.admin_level > 1 and c.author.shadowbanned %}<i class="fas fa-user-times text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Shadowbanned by @{{c.author.shadowbanned}}"></i>{% endif %}
-				{% if c.is_pinned %}<i id='pinned-{{c.id}}' class="fas fa-thumbtack fa-rotate--45 text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Pinned {% if c.is_pinned.startswith('t:') %}until {{c.is_pinned[2:]}}{% else %}by @{{c.is_pinned}}{%endif%}"></i>{% endif %}
+				{% if c.is_pinned and c.is_pinned.startswith('t:') %}
+					<i id='pinned-{{c.id}}' onmouseover="pinned_tooltip('pinned-{{c.id}}')" class="fas fa-thumbtack fa-rotate--45 text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-timestamp={{c.is_pinned[2:]}}*1000></i>
+				{% elif c.is_pinned %}
+					<i id='pinned-{{c.id}}' class="fas fa-thumbtack fa-rotate--45 text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Pinned by @{{c.is_pinned}}"></i>
+				{% endif %}
 				{% if c.distinguish_level %}<i class="fas fa-broom text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="{{'SITE_NAME' | app_config}} Admin, speaking officially"></i>{% endif %}
 				{% if c.is_op %}<i class="fas fa-microphone-stand text-info" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="OP"></i>{% endif %}
 				{% if c.is_bot %}<i class="fad fa-robot text-info" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Bot"></i>{% endif %}
@@ -761,36 +765,7 @@
 {% include "expanded_image_modal.html" %}
 
 <script src="/assets/js/popover.js?v=10"></script>
-<script src="/assets/js/comments.js?v=9"></script>
-
-<script>
-	{% if p and (not v or v.highlightcomments) %}
-		comments = JSON.parse(localStorage.getItem("comment-counts")) || {}
-		lastCount = comments['{{p.id}}']
-		redhtml = '<i style="color:red !important" class="text-admin fas fa-circle" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Unread"></i>'
-		if (lastCount)
-		{
-			{% for c in comments %}
-				{% if not (v and v.id==c.author_id) %}
-					if ({{c.created_utc*1000}} > lastCount.t) document.getElementById("reddot-{{c.id}}").innerHTML = redhtml
-				{% endif %}
-			{% endfor %}
-		}
-	{% endif %}
-
-	(() => {
-		{% for c in comments %}
-			{% if c.is_pinned %}
-				const pinned_info = document.getElementById('pinned-{{c.id}}')
-				{% if c.is_pinned.startswith('t:') %}
-					pinned_info.setAttribute("data-bs-original-title", `Pinned until ${new Date({{c.is_pinned[2:]}} * 1000).toString()}`)
-				{% else %}
-					pinned_info.setAttribute("data-bs-original-title", "Pinned by @{{c.is_pinned}}")
-				{%endif%}
-			{%endif%}
-		{% endfor %}
-	})()
-</script>
+<script src="/assets/js/comments.js?v=10"></script>
 
 {% if offset %}
 	{% if p %}
diff --git a/files/templates/submission.html b/files/templates/submission.html
index 09cb432c8..ebef13191 100644
--- a/files/templates/submission.html
+++ b/files/templates/submission.html
@@ -14,7 +14,7 @@
 {% block title %}
 
 {% if v and (v.id == p.author_id or v.admin_level > 1 and v.admin_level > 2) %}
-	<script src="/assets/js/submission.js?v=2"></script>
+	<script src="/assets/js/submission.js?v=3"></script>
 {% endif %}
 
 <script src="/assets/js/new_comments_count.js?v=53"></script>
@@ -357,7 +357,13 @@
 							{% endfor %}
 						{% endif %}
 						{% if v and v.admin_level > 1 and p.author.shadowbanned %}<i class="fas fa-user-times text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Shadowbanned by @{{p.author.shadowbanned}}"></i>{% endif %}
-						{% if p.stickied %}<i id="pinned-{{p.id}}" class="fas fa-thumbtack fa-rotate--45 fa-fw text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Pinned {% if p.stickied.startswith('t:') %}until {{p.stickied[2:]}}{% else %}by @{{p.stickied}}{%endif%}"></i>{% endif %}
+
+						{% if p.stickied and p.stickied.startswith('t:') %}
+							<i id='pinned-{{p.id}}' onmouseover="pinned_tooltip('pinned-{{p.id}}')" class="fas fa-thumbtack fa-rotate--45 text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-timestamp={{p.stickied[2:]}}*1000></i>
+						{% elif p.stickied %}
+							<i id='pinned-{{p.id}}' class="fas fa-thumbtack fa-rotate--45 text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Pinned by @{{p.stickied}}"></i>
+						{% endif %}
+
 						{% if p.is_pinned %}<i class="fas fa-thumbtack fa-rotate--45 fa-fw text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Pinned to profile"></i>{% endif %}
 						{% if p.distinguish_level %} <i class="fas fa-broom text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="{{'SITE_NAME' | app_config}} Admin, speaking officially"></i>{% endif %}
 						{% if p.is_bot %} <i class="fad fa-robot text-info" data-bs-toggle="tooltip" data-bs-placement="bottom"	data-bs-original-title="Bot"></i>{% endif %}
@@ -827,30 +833,6 @@
 
 </div>
 
-<script>
-	(() => {
-		{% if (not v or v.highlightcomments) %}
-			showNewCommentCounts('{{p.id}}', {{p.comment_count}})
-		{% endif %}
-
-		{% if "?context" not in request.full_path %}
-			const comments = JSON.parse(localStorage.getItem("comment-counts")) || {}
-			const newTotal = {{p.comment_count}} || ((comments['{{p.id}}'] || { c: 0 }).c + 1)
-			comments['{{p.id}}'] = { c: newTotal, t: Date.now() }
-			window.localStorage.setItem("comment-counts", JSON.stringify(comments))
-		{% endif %}
-
-		{% if p.stickied %}
-		const pinned_info = document.getElementById('pinned-{{p.id}}')
-		{% if p.stickied.startswith('t:') %}
-			pinned_info.setAttribute("data-bs-original-title", `Pinned until ${new Date({{p.stickied[2:]}} * 1000).toString()}`)
-		{% else %}
-			pinned_info.setAttribute("data-bs-original-title", "Pinned by @{{p.stickied}}")
-		{%endif%}
-		{%endif%}
-	})()
-</script>
-
 {% if v and v.id==p.author_id %}
 	{% include "delete_post_modal.html" %}
 {% endif %}
@@ -873,7 +855,7 @@
 			{% include "ban_modal.html" %}
 		{% endif %}
 	{% endif %}
-	<script src="/assets/js/comments.js?v=9"></script>
+	<script src="/assets/js/comments.js?v=10"></script>
 	{% include "expanded_image_modal.html" %}
 {% endif %}
 
diff --git a/files/templates/submission_listing.html b/files/templates/submission_listing.html
index 62cd0547a..41789c54b 100644
--- a/files/templates/submission_listing.html
+++ b/files/templates/submission_listing.html
@@ -57,23 +57,6 @@
 	</div>
 </div>
 
-<script>
-	(() => {
-		{% if (not v or v.highlightcomments) %}
-			showNewCommentCounts('{{p.id}}', {{p.comment_count}})
-		{% endif %}
-
-		{% if p.stickied %}
-		const pinned_info = document.getElementById('pinned-{{p.id}}')
-		{% if p.stickied.startswith('t:') %}
-			pinned_info.setAttribute("data-bs-original-title", `Pinned until ${new Date({{p.stickied[2:]}} * 1000).toString()}`)
-		{% else %}
-			pinned_info.setAttribute("data-bs-original-title", "Pinned by @{{p.stickied}}")
-		{%endif%}
-		{%endif%}
-	})()
-</script>
-
 {% set ups=p.upvotes %}
 {% set downs=p.downvotes %}
 {% set score=ups-downs %}
@@ -176,7 +159,13 @@
 					{% endfor %}
 				{% endif %}
 				{% if v and v.admin_level > 1 and p.author.shadowbanned %}<i class="fas fa-user-times text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Shadowbanned by @{{p.author.shadowbanned}}"></i>{% endif %}
-				{% if p.stickied %}<i id='pinned-{{p.id}}' class="fas fa-thumbtack fa-rotate--45 text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Pinned {% if p.stickied.startswith('t:') %}until {{p.stickied[2:]}}{% else %}by @{{p.stickied}}{%endif%}"></i>{% endif %}
+
+				{% if p.stickied and p.stickied.startswith('t:') %}
+					<i id='pinned-{{p.id}}' onmouseover="pinned_tooltip('pinned-{{p.id}}')" class="fas fa-thumbtack fa-rotate--45 text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-timestamp={{p.stickied[2:]}}*1000></i>
+				{% elif p.stickied %}
+					<i id='pinned-{{p.id}}' class="fas fa-thumbtack fa-rotate--45 text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Pinned by @{{p.stickied}}"></i>
+				{% endif %}
+
 				{% if p.distinguish_level %}<i class="fas fa-broom text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="{{'SITE_NAME' | app_config}} Admin, speaking officially"></i>{% endif %}
 				{% if p.is_pinned and request.path.startswith('/@') %}<i class="fas fa-thumbtack fa-rotate--45 text-admin" data-bs-toggle="tooltip" data-bs-placement="bottom" data-bs-original-title="Pinned to profile"></i>{% endif %}
 				{% if p.over_18 %}<span class="badge badge-danger text-small-extra mr-1">+18</span>{% endif %}
@@ -662,4 +651,4 @@
 <script src="/assets/js/clipboard.js?v=3"></script>
 
 <script src="/assets/js/popover.js?v=10"></script>
-<script src="/assets/js/submission_listing.js?v=5"></script>
\ No newline at end of file
+<script src="/assets/js/submission_listing.js?v=6"></script>
\ No newline at end of file

From ba6001d45d8b2a979f2bd4fe4dc6eb5a46110e6f Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Fri, 10 Dec 2021 00:23:46 +0200
Subject: [PATCH 09/11] dfsdfs

---
 files/__main__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/__main__.py b/files/__main__.py
index 4dce46db0..b51f7157d 100644
--- a/files/__main__.py
+++ b/files/__main__.py
@@ -125,7 +125,7 @@ def after_request(response):
 
 	response.headers.add("Strict-Transport-Security", "max-age=31536000")
 	response.headers.add("X-Frame-Options", "deny")
-	response.headers.add("Content-Security-Policy", "script-src 'self'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io 02ddcc80-b8db-42be-9022-44c546b4dce6.pushnotifications.pusher.com; object-src 'none';")
+	response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io 02ddcc80-b8db-42be-9022-44c546b4dce6.pushnotifications.pusher.com; object-src 'none';")
 	return response
 
 from files.routes import *
\ No newline at end of file

From 561aa6d8eb05b98e883d8229e99a082200004da1 Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Fri, 10 Dec 2021 00:26:29 +0200
Subject: [PATCH 10/11] fsddfs

---
 files/__main__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/__main__.py b/files/__main__.py
index b51f7157d..de8ff43f9 100644
--- a/files/__main__.py
+++ b/files/__main__.py
@@ -125,7 +125,7 @@ def after_request(response):
 
 	response.headers.add("Strict-Transport-Security", "max-age=31536000")
 	response.headers.add("X-Frame-Options", "deny")
-	response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io 02ddcc80-b8db-42be-9022-44c546b4dce6.pushnotifications.pusher.com; object-src 'none';")
+	response.headers.add("Content-Security-Policy", "script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' tls-use1.fpapi.io api.fpjs.io 02ddcc80-b8db-42be-9022-44c546b4dce6.pushnotifications.pusher.com; object-src 'none';")
 	return response
 
 from files.routes import *
\ No newline at end of file

From 5d5af18d222d671cafbc7287edaa087cd13bba7e Mon Sep 17 00:00:00 2001
From: Aevann1 <randomname42029@gmail.com>
Date: Fri, 10 Dec 2021 00:36:33 +0200
Subject: [PATCH 11/11] sfdsdf

---
 files/templates/default.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/templates/default.html b/files/templates/default.html
index 50ffa701d..95503fa9f 100644
--- a/files/templates/default.html
+++ b/files/templates/default.html
@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
 	<script src="/assets/js/bootstrap.js?v=1"></script>
-
+	<script src="/assets/js/mirage.js?v=1"></script>		
 	{% if v %}
 		<style>:root{--primary:#{{v.themecolor}}}</style>
 		<link rel="stylesheet" href="/assets/css/main.css?v=139">