fen
be3ff81e5c
base
2026-09-09 21:45:42 -05:00
fen
0ceeabc810
Merge dev: burn fix, version label, theme persistence, admin/settings UI, theme grid, CSP fix, docs
CI / test (push) Successful in 21s
CI / docker (push) Successful in 47s
2026-09-09 21:32:30 -05:00
fen
aca99bc6d4
Merge pull request 'Fix #116 : allow inline styles in CSP (style-src)' ( #117 ) from fix-116-csp-inline-styles into dev
CI / test (push) Successful in 22s
CI / docker (push) Successful in 36s
2026-09-10 02:20:53 +00:00
fen
073d39ccba
Fix #116 : allow inline styles in CSP (style-src 'self' 'unsafe-inline')
CI / test (pull_request) Successful in 24s
CI / docker (pull_request) Skipped
2026-09-09 21:18:53 -05:00
fen
9ec7d5152e
Merge pull request 'Fix #114 : theme grid empty (t.colors undefined)' ( #115 ) from fix-114-theme-grid-empty into dev
CI / test (push) Successful in 21s
CI / docker (push) Successful in 42s
2026-09-10 02:01:38 +00:00
fen
a677e627a8
Fix #114 : use presetColors(t.id) for theme card swatches
...
CI / test (pull_request) Successful in 24s
CI / docker (pull_request) Skipped
t.colors was removed by #113 ; rendering threw on first iteration and
the theme grid rendered empty. Use the colors returned by
presetColors(t.id) instead. Verified in headless chromium: 5
theme-card elements render on /settings.
2026-09-09 20:55:13 -05:00
fen
7a2fa00f4a
Merge pull request 'Fix admin lock-on-load, settings hint, theme swatches ( #112 )' ( #113 ) from fix-112-admin-settings-ui into dev
CI / test (push) Successful in 21s
CI / docker (push) Successful in 34s
2026-09-10 00:54:43 +00:00
fen
6b95994c53
Admin lock on every load, drop settings hint, derive theme swatches from CSS vars ( #112 )
CI / test (pull_request) Successful in 24s
CI / docker (pull_request) Skipped
2026-09-09 19:52:32 -05:00
fen
7fde147500
Merge pull request 'Fix theme persistence on reload' ( #109 ) from fix-100-theme-persist into dev
CI / test (push) Successful in 23s
CI / docker (push) Successful in 38s
2026-09-10 00:22:04 +00:00
fen
cf8674b898
Merge pull request 'Fix wiki docs accuracy ( #110 )' ( #111 ) from fix-110-docs-accuracy into dev
CI / test (push) Successful in 21s
CI / docker (push) Successful in 32s
2026-09-10 00:20:17 +00:00
fen
f6e81de2a3
Fix README: build path ./cmd/palette, Go 1.27+, design-doc wiki link ( #110 )
CI / test (pull_request) Successful in 21s
CI / docker (pull_request) Skipped
2026-09-09 19:15:44 -05:00
fen
e17ea4f8c2
Move docs to Gitea wiki; point README links at wiki
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-09 18:52:41 -05:00
fen
5afe81f34c
README: AI-built disclaimer before feature list
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-09 18:46:15 -05:00
poslop
097ffb7971
Update README.md
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-09 23:44:37 +00:00
poslop
815635a973
Update README.md
CI / test (push) Successful in 28s
CI / docker (push) Skipped
2026-09-09 23:42:06 +00:00
fen
df73d56e32
Merge remote-tracking branch 'origin/fix-93-version-label' into dev
CI / test (push) Successful in 28s
CI / docker (push) Successful in 49s
2026-09-09 18:41:26 -05:00
fen
9d89995c91
Merge pull request 'store: burn_after_reads>0 implies burn-after-read ( #82 )' ( #107 ) from fix-82-burn-implies-budget into dev
CI / test (push) Successful in 24s
CI / docker (push) Successful in 37s
2026-09-09 23:40:22 +00:00
fen
805cc3ff2b
web: restore persisted theme on page load ( #100 )
CI / test (pull_request) Successful in 24s
CI / docker (pull_request) Skipped
2026-09-09 18:40:09 -05:00
poslop
f37cc932c4
store: burn_after_reads>0 implies burn-after-read mode ( #82 )
CI / test (pull_request) Successful in 24s
CI / docker (pull_request) Skipped
2026-09-09 18:28:00 -05:00
agent
65ed0c7043
Show actual version in topbar instead of hardcoded beta ( Fixes #93 )
CI / test (pull_request) Successful in 26s
CI / docker (pull_request) Skipped
2026-09-09 18:27:57 -05:00
poslop
8ecf5338d5
CI: build dev image on dev branch pushes (palette-dev deploy)
CI / test (push) Successful in 25s
CI / docker (push) Successful in 42s
2026-09-09 18:22:31 -05:00
poslop
69da340224
Settings page: theme switcher with live preview ( #100 )
CI / test (push) Successful in 23s
CI / docker (push) Skipped
2026-09-09 18:21:45 -05:00
poslop
b1af398bea
Update README.md
CI / test (push) Successful in 20s
CI / docker (push) Skipped
2026-09-09 22:56:50 +00:00
poslop
15f199b2fe
README: trim to brief front page + retake themed screenshots ( #106 )
...
CI / test (push) Successful in 20s
CI / docker (push) Skipped
- Cut Admin walkthrough and API curl block to one-liners pointing at docs
- Keep Configuration table, features, Get Started, doc links
- Retake all screenshots against current UI, one theme each:
/new midnight, /history pastel-lavender, paste view pastel-peach,
/mine pastel-cloud; remove superseded stale previews
2026-09-09 17:30:54 -05:00
poslop
9df6224a27
Result box: color-code by status + friendly error messages from error codes ( #105 )
...
CI / test (push) Successful in 23s
CI / docker (push) Skipped
- Backend create/can validation paths emit machine-readable error codes
(slug_taken, slug_invalid, content_empty, content_too_large,
expiry_invalid, rate_limited, ...) alongside the human message
- new.html JS maps codes to plain-language guidance with generic fallback
- Result card colored via --ok/--err/--warn left border (result-ok/err/warn)
- docs/API.md error section documents the code field
- Tests assert the code on every validation path
2026-09-09 17:28:25 -05:00
poslop
c35531e03e
Settings page: small muted Admin link ( #102 )
CI / test (push) Successful in 22s
CI / docker (push) Skipped
2026-09-09 17:17:00 -05:00
poslop
be2b4fb47f
Sort arrows: left of label, further spaced, vertically centered, no label shift ( #101 )
...
Arrow is absolutely positioned at left:8px in the th, label padding-left
24px; translateY(-50%) keeps it centered regardless of row height, and
being out of flow the label never moves between sorted/unsorted states.
2026-09-09 17:17:00 -05:00
poslop
064f05536a
Admin page: validate key before persisting to sessionStorage ( #99 )
...
Panel was already display:none-gated until auth; tightened so a wrong
submitted key is never stored in sessionStorage — the typed key is
validated via the settings API first, and only persisted on 200.
2026-09-09 17:17:00 -05:00
poslop
4175ffef3e
CSS: inline sort arrow with uniform 8px gap ( #103 ), full-pill slug roundness ( #104 )
CI / test (push) Successful in 22s
CI / docker (push) Skipped
2026-09-09 17:10:24 -05:00
poslop
ea9edc211a
UI: consistent sort arrow gap, uniform pill roundness (slug -> radius-sm)
CI / test (push) Successful in 22s
CI / docker (push) Skipped
2026-09-09 16:50:06 -05:00
poslop
6d467312af
Merge minor fixes: #92-#98, #100 theme switcher + cans work
CI / test (push) Successful in 22s
CI / docker (push) Skipped
2026-09-09 16:40:53 -05:00
poslop
b21be29daa
minor fixes: version label ( #93 ), view dedupe tests ( #95 )
2026-09-09 16:40:53 -05:00
poslop
cd70dd0b0e
Merge origin/main (license, compose, #65 leak guard) into cans work
CI / test (push) Failing after 6s
CI / docker (push) Skipped
2026-09-09 16:39:14 -05:00
poslop
5b9be808ed
Merge origin/main: keep can listing rows with #65 password-metadata leak guard
2026-09-09 16:36:55 -05:00
poslop
19804d47a3
Cans UI + parity: unlock-cookie flow, /can page, listings badge, custom slug, delete, sweeper; #32 perf notes ( #4 , #32 )
2026-09-09 16:34:51 -05:00
poslop
ffc10c2b86
README: link to docker-compose example
CI / test (push) Successful in 19s
CI / docker (push) Skipped
2026-09-09 16:16:28 +00:00
poslop
bf5a79878f
add example docker-compose.yml documenting all env vars
CI / test (push) Successful in 19s
CI / docker (push) Skipped
2026-09-09 16:16:15 +00:00
poslop
60200ac14b
README: license section with as-is / no-liability disclaimer
CI / test (push) Successful in 19s
CI / docker (push) Skipped
2026-09-09 16:12:41 +00:00
poslop
49f7b6e7a4
add AGPLv3 license with copyright and warranty disclaimer notice
CI / test (push) Successful in 19s
CI / docker (push) Skipped
2026-09-09 16:12:19 +00:00
poslop
959a83be1e
Merge pull request 'Bound title and language at create time ( #86 )' ( #91 ) from fix-86-field-bounds into main
CI / test (push) Successful in 24s
CI / docker (push) Successful in 42s
2026-09-09 15:59:32 +00:00
poslop
5b068faf8f
Merge pull request 'ratelimit: rightmost untrusted-hop-safe client IP ( fixes #85 )' ( #89 ) from fix-85-xff into main
CI / test (push) Successful in 27s
CI / docker (push) Skipped
2026-09-09 15:59:29 +00:00
poslop
b0360af79c
Merge pull request 'Fix #83 : create API ignores boolean public field' ( #88 ) from fix-83-public-false into main
CI / test (push) Successful in 26s
CI / docker (push) Skipped
2026-09-09 15:59:26 +00:00
poslop
806798fae6
Merge pull request 'Rate-limit all password verification attempts ( #81 )' ( #90 ) from fix-81-password-ratelimit into main
CI / test (push) Successful in 26s
CI / docker (push) Skipped
2026-09-09 15:59:24 +00:00
poslop
8977c05cda
Merge pull request 'fix #84 : security headers were silently dropped (set pre-handler)' ( #87 ) from fix-84-headers-prewrite into main
CI / test (push) Successful in 21s
CI / docker (push) Skipped
2026-09-09 15:59:21 +00:00
fen
389e4d333f
Bound title and language at create time ( #86 )
...
CI / test (pull_request) Successful in 21s
CI / docker (pull_request) Skipped
Titles are trimmed and truncated to 200 characters; language must be
blank or match ^[a-zA-Z0-9+#-]{1,40}$ (max 40 chars) or the create is
rejected with a clear 400. Regression tests cover truncation, malformed
and oversized language values, valid identifiers, and blank metadata.
2026-09-09 10:58:34 -05:00
fen
99a044e8a2
Rate-limit all password verification attempts ( #81 )
...
CI / test (pull_request) Successful in 22s
CI / docker (pull_request) Skipped
GET ?password= and X-Paste-Password header checks in handleGetPaste were
unlimited (pentest2: 8 wrong = 8x401, no 429). Gate every password
verification on the same per-IP+paste unlock limiter (5/min, 429 with
Retry-After) already used by the POST unlock form path.
Regression tests: repeated wrong passwords via GET ?password= and via
header must eventually 429; correct password within burst still 200.
Fixes #81
2026-09-09 10:58:21 -05:00
agent
3d1d5ee1fd
ratelimit: key on rightmost X-Forwarded-For entry ( fixes #85 )
CI / test (pull_request) Successful in 21s
CI / docker (pull_request) Skipped
2026-09-09 10:57:59 -05:00
Hermes Agent
ccb22a2d28
#83 : accept boolean public field in create API (false->unlisted, true->public)
CI / test (pull_request) Successful in 23s
CI / docker (pull_request) Skipped
2026-09-09 10:57:56 -05:00
fen
3d415edbdc
fix #84 : security headers dropped because they were set post-flush; set pre-handler
CI / test (pull_request) Successful in 21s
CI / docker (pull_request) Skipped
2026-09-09 10:54:16 -05:00
poslop
7ca1b58362
Merge pull request 'docs: attachments & storage backend design ( #38 , #31 )' ( #69 ) from issue-38-31-storage-design into main
CI / test (push) Successful in 19s
CI / docker (push) Successful in 34s
2026-09-09 14:27:50 +00:00
fen
fen
poslop
agent