Apply go fix ./... analysers (Go 1.26) across backend and examples:
- interface{} → any (type alias, no behaviour change)
- for i := 0; i < N; i++ → for range N / for i := range N
- slices.Contains / slices.ContainsFunc replacing manual loops
- strings.SplitSeq replacing strings.Split in range (avoids allocation)
- strings.CutPrefix replacing HasPrefix+TrimPrefix
- min() replacing manual if/else
- fmt.Appendf replacing []byte(fmt.Sprintf(...))
- strings.Builder replacing string += concatenation
- wg.Go(func(){}) replacing wg.Add(1)/go/wg.Done() pattern
- removed redundant ii := i loop variable copies (unnecessary since Go 1.22)
omitempty on struct-typed JSON fields: go fix removed omitempty from
struct-typed fields (time.Time, PostInfo, UserDetailEntry) because
encoding/json's omitempty never applied to struct types — it was always
a no-op. Kept as bare tags (no omitzero replacement) to preserve the
existing serialisation behaviour.
Replace strings.Split(RemoteAddr, ":") with net.SplitHostPort for correct
IPv6 address extraction in vote deduplication and comment IP tracking.
Harden image proxy: add SSRF-safe transport blocking private/reserved IPs
at connection time with DNS rebinding protection, sanitize error messages
to prevent information leakage, add response size limit via io.LimitReader.
Fix shadowed error variables in BlockedUsers, SetTitle, and Delete methods.
Exclude gosec taint analysis false positives at linter config level.
`format=tree` pagination provides top-level comments with all replies
and returns the last top-level comment as `last_comment` to be used
as `offset` for the next page. If comments and replies overflow
the limit, the one stepping out of the limit will not be returned.
If the first comment and its replies after the given offset overflow
the limit, it will be returned with all the replies.
`format=plain` pagination works by providing all comments and returning
the last comment as `last_comment` to be used as `offset`
for the next page.
Previously, only the first one was returned for site-wide requests,
and now all returned information will be correctly aggregated,
and the PostInfo.URL and PostInfo.ReadOnly parameters will be dropped.
Previously, we stripped unsafe HTML tags but left some,
but it's not expected to have a link in a title or username,
so the new behaviour is stripping everything.
1) Current implementation simply removes the last word, without truncating up to limit length.
2) In case if even the first word (magnet link or some base64?) is too long don't add extra space.
(url) is a text inserted by default and never an intended URL.
That additional validation will ensure that users won't post relative
links because they are rarely intended.
Previously it was sanitised using the HTML sanitiser,
but it had proven troublesome and unnecessary.
Remark42 rendered the markdown into proper HTML, but then some pieces
of it (like cited HTML code inside the code block, marked by backticks)
were cut out, which then showed the incorrect markdown to a user when
they were editing the comment.
For example, the comment "`foo<bar>`" became "foo" after sanitising,
and despite the proper render user saw only "foo" when editing
the comment.
After this change, the initial comment markdown is preserved unaltered.
It could contain dangerous HTML with JS, which I assume shouldn't
be a problem as it's never rendered as HTML but instead supposed
to be converted to HTML by the interpreter. In Remark42, it's stored
in a comment.Text field and sanitised and thus safe.
I've left information about the potential danger of rendering
the original markdown as-is without an interpreter in
all relevant places I could find.
* change vote params to request
* limit voting for the same ip
* limit same ip vote duration
* add same ip vote check for directions
* wire RestrictVoteIP and duration
* add votes-ip and votes-ip-time description
* embed assets for web with separate dockerfile
* add artifact dockerfile
* add artifacts upload to github release
* fix statik params and add make for local builds
* fix docker image name to match compose
* fix typos
* WIP: start mongo engine
* WIP: mongo accessor and admin
* integrate mongo store to main
* disable mongo tests by default, only in CI
* connection with constructor
* add mongo buffered writer
* buffered mongo writer
* fix nil responses on an empty list from mongo
* missing mongo index for scores
* cancelable store
* add gridfs implementation of avatar store
* fix race on mongo session copy
* gridfs avatars without tmp files
* move avatar store
* minor comments and refactoring for avatar store
* merged from current master
* simplify gridfs reader
* lint: fix minor warns
* test mongo against env defined url
* pass MONGO_REMARK_TEST to docker and travis
* set dockerfile env for mongo test url
* increase connect timeout in mongo tests
* pass MONGO_REMARK_TEST to drone build
* add MONGO_REMARK_TEST to branch stage of drone
* mass mongo test url via build_args_from_env
* populate mongo IP to docker build hosts
* test env
* pass mongo ip via .mongo
* remove .mongo temp from git
* add .mongo -> env to linter step
* allow more time to autoflush writer test
* default mongo tests to "mongo" if not in env
* merge fresh master into
* add test for mongo cleanup
* msg for a failed test
* lazy fix for failed test
* add an ability to skip all mongo tests
* add backend dev instructions
* remove unused code from mongo server
* move mongo testing to connection_test
* restore testing.go
* lint: minor warns for testing code
* remove extra dmin check, add blocking check via jwt and auth middleware
* short jwt and refresh for expired
* lint: missing comment on UserFlager
* simplify user management in auth refresh
* allow custom max cookie age
* test blocked user
* reset cookie for blocked user
* move admin perm detection to data service
* customizable ttl with opts as a part of auth group
* add local auth provider dev
* main minimal test for dev auth mode
* add comments and update docs with current params
* add admin and auth_dev flags
* comments for dev compose
* lint: shadow err
Dmitry VerkhoturovandGitHub
Umputun
Yury KotovandUmputun
vdimirandUmputun