#255: widen history URL column with dedicated col-url class

A 250-char multipart filename was accepted and echoed verbatim in
Content-Disposition. SanitizeFilename already truncates; lower the cap
from 255 to 128 so DB rows and header echoes stay bounded (#248).

internal/store/attachment.go

@@ -26,7 +26,10 @@ type Attachment struct {
 	SizeHuman string `json:"-"` // template-only: human-readable size
 }
 
-const MaxFilenameLen = 255
+// MaxFilenameLen caps stored attachment filenames (bytes) to bound DB
+// rows and Content-Disposition echoes. 128 keeps names readable while
+// stopping filename-bloat abuse; longer names truncate.
+const MaxFilenameLen = 128
 
 // ErrFileTooLarge is returned when an attachment exceeds the per-file cap.
 var ErrFileTooLarge = errors.New("file too large")

internal/store/blob_test.go

@@ -105,4 +105,9 @@ func TestSanitizeFilename(t *testing.T) {
 	if got := SanitizeFilename(long); len(got) != MaxFilenameLen {
 		t.Errorf("long name len = %d want %d", len(got), MaxFilenameLen)
 	}
+	// issue #248: a 250-char multipart filename must truncate to the cap
+	repro := strings.Repeat("b", 246) + ".txt"
+	if got := SanitizeFilename(repro); len(got) != MaxFilenameLen {
+		t.Errorf("repro name len = %d want %d", len(got), MaxFilenameLen)
+	}
 }

internal/store/customslug.go

@@ -13,6 +13,7 @@ var reservedSlugs = map[string]bool{
 	"api": true, "raw": true, "can": true, "cans": true, "public": true,
 	"history": true, "static": true, "assets": true, "favicon.ico": true,
 	"new": true, "login": true, "logout": true, "admin": true, "settings": true,
+	"mine": true, "unlock": true, "guess": true, "f": true,
 }
 
 var ErrInvalidSlug = errors.New("custom slug must be 1-64 chars: letters, digits, dash, underscore; must start with letter or digit")

internal/web/static/app.css

@@ -869,6 +869,9 @@ button[type="submit"]:focus-visible,
 .col-a { width: 260px; } .col-b { width: 140px; } .col-c { width: 120px; }
 .col-d { width: 96px; } .col-d2 { width: 150px; } .col-e { width: 190px; }
 .col-f { width: 100px; } .col-g { width: 190px; }
+/* #255: history's URL column had its own narrow width (col-f doubles as
+   /mine's ID column); give it a dedicated class. */
+.col-url { width: 150px; }
 /* #210: /mine rows render a delete button cell that had no declared column,
    so under table-layout:fixed it overlapped the ID column. */
 .col-del { width: 64px; }

internal/web/templates/history.html

@@ -8,7 +8,7 @@
   <div class="search"><input id="filter" placeholder="Search…"><span class="search-spinner" id="search-spinner"></span></div>
   <div class="float">
     <table>
-      <colgroup><col class="col-a"><col class="col-b"><col class="col-c"><col class="col-d"><col class="col-e"><col class="col-f"><col class="col-g"></colgroup>
+      <colgroup><col class="col-a"><col class="col-b"><col class="col-c"><col class="col-d"><col class="col-e"><col class="col-url"><col class="col-g"></colgroup>
       <thead><tr>
         <th data-sort="title" class="sortable">Paste<span class="sort-ind"></span></th>
         <th data-sort="type" class="sortable">Type<span class="sort-ind"></span></th>

internal/web/templates/paste.html

@@ -50,7 +50,7 @@
     </div>
   </div>
   {{end}}
-  {{if not .AttachmentImage}}
+  {{if not .Attachment}}
   <div class="float">
     <div class="code" id="code"><div class="gutter" id="gutter">{{.Gutter}}</div><div class="codebody" id="codebody">{{.ContentHTML}}</div></div>
   </div>