prevent potential admin cache leak

app/rest/api/rest.go

@@ -112,7 +112,7 @@ func (s *Rest) Run(port int) {
 	router.Get("/robots.txt", func(w http.ResponseWriter, r *http.Request) {
 		render.PlainText(w, r, "User-agent: *\nDisallow: /auth/\nDisallow: /api/\n")
 	})
-	s.addFileServer(router, "/web", http.Dir(filepath.Join(".", "web")))
+	addFileServer(router, "/web", http.Dir(filepath.Join(".", "web")))
 
 	s.httpServer = &http.Server{Addr: fmt.Sprintf(":%d", port), Handler: router}
 	err := s.httpServer.ListenAndServe()
@@ -134,22 +134,10 @@ func (s *Rest) createCommentCtrl(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// reset comment to initial state
-	func() {
-		comment.ID = ""                 // don't allow user to define ID, force auto-gen
-		comment.Timestamp = time.Time{} // reset time, force auto-gen
-		comment.Votes = make(map[string]bool)
-		comment.Score = 0
-		comment.Edit = nil
-		comment.Pin = false
-	}()
-
+	comment.Init()
 	comment.User = user
 	comment.User.IP = strings.Split(r.RemoteAddr, ":")[0]
-
-	// render markdown
-	comment.Text = string(blackfriday.Run([]byte(comment.Text), blackfriday.WithNoExtensions()))
-
+	comment.Text = string(blackfriday.Run([]byte(comment.Text), blackfriday.WithNoExtensions())) // render markdown
 	log.Printf("[DEBUG] create comment %+v", comment)
 
 	// check if user blocked
@@ -500,7 +488,7 @@ func (s *Rest) notifyStatusCtrl(w http.ResponseWriter, r *http.Request) {
 }
 
 // serves static files from /web
-func (s *Rest) addFileServer(r chi.Router, path string, root http.FileSystem) {
+func addFileServer(r chi.Router, path string, root http.FileSystem) {
 	log.Printf("[INFO] run file server for %s, path %s", root, path)
 	origPath := path
 	fs := http.StripPrefix(path, http.FileServer(root))

app/rest/cache.go

@@ -3,6 +3,7 @@ package rest
 import (
 	"log"
 	"net/http"
+	"strings"
 	"time"
 
 	cache "github.com/patrickmn/go-cache"
@@ -51,9 +52,10 @@ func (lc *loadingCache) Flush() {
 // URLKey gets url from request to use is as cache key
 // admins will have separate keys in order tp prevent leak of admin-only data to regular users
 func URLKey(r *http.Request) string {
-	key := r.URL.String()
+	adminPrefix := "admin!!"
+	key := strings.TrimPrefix(r.URL.String(), adminPrefix)     // prevents attach with fake url to get admin view
 	if user, err := GetUserInfo(r); err == nil && user.Admin { // make seprate cache key for admins
-		key = "admin!!" + key
+		key = adminPrefix + key
 	}
 	return key
 }

app/store/comment.go

@@ -58,6 +58,16 @@ type BlockedUser struct {
 	Timestamp time.Time `json:"time"`
 }
 
+// Init comment skeleton
+func (c *Comment) Init() {
+	c.ID = ""                 // don't allow user to define ID, force auto-gen
+	c.Timestamp = time.Time{} // reset time, force auto-gen
+	c.Votes = make(map[string]bool)
+	c.Score = 0
+	c.Edit = nil
+	c.Pin = false
+}
+
 // Sanitize clean dangerous html/js from the comment
 func (c *Comment) Sanitize() {
 	p := bluemonday.UGCPolicy()