fen - Gitea: Git with a cup of tea

fen commented on issue poslop/palette#38

2026-09-10 04:23:27 +00:00

FUTURE: file/image attachments storage backend (S3?)

QA re-run passed (iteration 1, renderPaste fix verified).

Local: go vet + go test clean on 0073335; chip + img preview render on paste view (dump-dom verified), src -> /f/; html upload = chip…

fen closed issue poslop/palette#38

2026-09-10 04:23:27 +00:00

FUTURE: file/image attachments storage backend (S3?)

fen closed pull request poslop/palette#129

2026-09-10 04:23:27 +00:00

Fix #38 (iteration 1: 1 file per paste)

fen merged pull request poslop/palette#150

2026-09-10 04:23:27 +00:00

Secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

fen closed issue poslop/palette#137

2026-09-10 04:23:27 +00:00

[MEDIUM] Admin key accepted via ?key= query parameter leaks the secret into proxy access logs

fen closed issue poslop/palette#141

2026-09-10 04:23:27 +00:00

[MEDIUM] Paste password accepted via GET ?password= query string leaks it into logs and history

fen commented on issue poslop/palette#137

2026-09-10 04:23:27 +00:00

[MEDIUM] Admin key accepted via ?key= query parameter leaks the secret into proxy access logs

Fixed in PR #150: admin key is now accepted only via the X-Admin-Key header; the ?key= fallback is removed (repro now returns 401). Header path re-verified 200. Log: 20m.

fen commented on issue poslop/palette#141

2026-09-10 04:23:27 +00:00

[MEDIUM] Paste password accepted via GET ?password= query string leaks it into logs and history

Fixed in PR #150: ?password= is no longer accepted on paste/can reads (repro now returns 401); the X-Paste-Password header and POST unlock form still work, re-verified 200. Log: 30m.

fen created pull request poslop/palette#150

2026-09-10 04:23:12 +00:00

Secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

fen created branch fix-137-141-drop-query-secrets in poslop/palette

2026-09-10 04:23:11 +00:00

fen pushed to fix-137-141-drop-query-secrets at poslop/palette

2026-09-10 04:23:11 +00:00

d013f3965f Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)

fen pushed to dev at poslop/palette

2026-09-10 04:21:04 +00:00

22c66243d5 Merge fix-38-file-attachments into dev (PR #129)

0073335875 #38 QA fix: render GetAttachmentForPaste in paste view; dedupe dark-toggle CSS

4948ef9f1c #38 iteration 1: file attachments, 1 file per paste

821f49993f Theme pairs with dark mode toggle, gear active state, PALETTE_DEFAULT_DARK (#127)

Compare 4 commits »

fen deleted branch fix-133-paging from poslop/palette

2026-09-10 04:16:05 +00:00

fen commented on issue poslop/palette#133

2026-09-10 04:16:04 +00:00

History: pagination bar disappears when searching or sorting; pin it to page bottom

QA passed: pagination now operates over the filtered/sorted set (never cleared), page resets to 1 on sort change, pager sticky at bottom via .pager CSS. go vet/test clean, JS syntax validated.…

fen pushed to dev at poslop/palette

2026-09-10 04:14:22 +00:00

98222e762f Merge pull request 'History: pagination survives search/sort, pager pinned to page bottom' (#140) from fix-133-paging into dev

fa2e9b1bb5 History: keep pagination over filtered/sorted set, pin pager to page bottom (#133)

Compare 2 commits »

fen merged pull request poslop/palette#140

2026-09-10 04:14:20 +00:00

History: pagination survives search/sort, pager pinned to page bottom

fen closed issue poslop/palette#133

2026-09-10 04:14:20 +00:00

History: pagination bar disappears when searching or sorting; pin it to page bottom

fen commented on issue poslop/palette#147

2026-09-10 04:13:38 +00:00

New paste: split title input into its own component, separate from language select + refresh

QA passed: editor header split into .editor-head-title pill (title input) and .editor-head-settings pill (language select + re-detect + wrap toggle); all element ids intact; responsive wrap CSS…

fen closed issue poslop/palette#147

2026-09-10 04:13:38 +00:00

New paste: split title input into its own component, separate from language select + refresh

fen deleted branch fix-147-header-split from poslop/palette

2026-09-10 04:13:38 +00:00