Replace strings.Split(RemoteAddr, ":") with net.SplitHostPort for correct
IPv6 address extraction in vote deduplication and comment IP tracking.
Harden image proxy: add SSRF-safe transport blocking private/reserved IPs
at connection time with DNS rebinding protection, sanitize error messages
to prevent information leakage, add response size limit via io.LimitReader.
Fix shadowed error variables in BlockedUsers, SetTitle, and Delete methods.
Exclude gosec taint analysis false positives at linter config level.
Replace go-chi/render with go-pkgz/rest for JSON responses and custom
helpers for HTML/plain text responses.
Key changes:
- Replace render.JSON/render.Status with rest.RenderJSON and explicit
w.WriteHeader() calls
- Replace render.DecodeJSON with json.NewDecoder().Decode()
- Add SendErrorJSON helper that sets Content-Type header before
WriteHeader (required since rest.RenderJSON can't set headers after
WriteHeader is called)
- Add HTMLResponse and PlainTextResponse helpers
Fix export double-execution in migrator.go:
The original code called Export twice - once to io.Discard to check for
errors, then again to actually write. This was wasteful and had a race
condition risk. Now file mode buffers to memory first for atomic
success/failure, while stream mode writes directly with proper error
handling.
I haven't found a linter for these, so I had to catch these manually.
I found #757 to fix one of these, and I thought it would be good
to fix everything at once.
* implement (strings) user details storage
* add rpc user details implementation
* return error from getUserDetail, rewrite tests to table tests
* make UserDetails store UserDetailEntry instead of strings
* update comment about user_details
* fix confusing return
* add user details support for memory store
* add engine.UserDetailEntry to service.UserMetaData
* add ListDetails support to memory storage
* add user details support to native migrator, ListDetails func to storage
* go mod tidy for memory storage
* increase memory storage test coverage, fix tests naming
* add ListDetails tests to memory storage
* add engine.ListDetails and service.[Set]Metas tests
* change Fprintf to Fprint (triggered by explicitly ignoring error)
* remove Delete from engine.UserDetail, implement list via same method
* adjust service.Metas to new engine.UserDetails signature
* introduce engine.UserDetail("all") consonant
* fix Meta user detail retrieval
* extend store implementations Delete method with UserDetail deletion
* make UserDetail test answer order-independent
* fix flaky test check in TestMemData_FlagListBlocked
* delete user details alongside with comments on deleteme request
* add tests to UserDetail store.Delete implementations
* clarify engine module user details consonants names
* update comments to reflect current state of code
* check for value absence instead of it's length
* revert unneeded code change
* add extensive commentary on UserDetail return type
* remove unused check condition
* clarify UserDetail tests to be truly stateless
* add clarifying comment for pre-table test
* fresh vendor
* enforce vendor flag with env
* move tree to service package
* move controllers routing to rest.go, remove separate subrouters
* cleanup/formatting
* missing vendor packages
* move rss, img proxy, robots and getstarted to top-level routes
* simplify logger middleware usage
* randomize server test ports
* check for non-admin in admin tests
* lint: minor warns
* admin test to jwt admin
* remove cache, switch to go-pkgz/rest/cache
* remove mongo cache from server test
* remove old caching code
* test tricky disqus inputs
* fix migrator test
* stacktrace dump test
* support flags commands, move to cmd
* fix target name
* test for happy path importer
* add export cmd
* fix wrong import, lint warns
* increase test timeout
* add sellp to allow main test server to start
* implement all cmds
* handle backup/restore errors
* fix import status check, hide secret from logs
* backup cmd err tests
* randimize test port
* avoid dup code in Last controller
* add target to make all bin archives
* remove container in make
* add smiple scripts to simplify commands, update readme
* add docs on dockerless, enforce app user
* add restore info
* move last to lastCommentsScope const
* add siteID to cache Get
* indirect option setters
* add mongo cache with tests, add Key and Flusher
* lint: minor warns
* workaround for cache parallel test
* repeater in mongo cache
* missing repeater vendor
* fix nop cache
* add cache mongo benchmark
* wired mongo cache, single opts group for mongo
* disable goconst
* stop cache repeated on not found error
* use local mongo for tests in travis
* remove extra dmin check, add blocking check via jwt and auth middleware
* short jwt and refresh for expired
* lint: missing comment on UserFlager
* simplify user management in auth refresh
* allow custom max cookie age
* test blocked user
* reset cookie for blocked user
* move admin perm detection to data service
* customizable ttl with opts as a part of auth group
* add local auth provider dev
* main minimal test for dev auth mode
* add comments and update docs with current params
* add admin and auth_dev flags
* comments for dev compose
* lint: shadow err
Umputun
Dmitry VerkhoturovandGitHub