From e89593b4fcd01835c0fb74cf65cd72ff50ed56d2 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Fri, 11 Aug 2023 20:51:12 +0200 Subject: [PATCH 01/32] comment fix, kudos @r4sas --- .github/ISSUE_TEMPLATE/feature_request.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index b12823f0..81eeb2d8 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -9,11 +9,11 @@ assignees: '' ## The problem -<-- Is your feature request related to a problem? Please describe. + ## The solution -<-- A clear and concise description of what you want to happen. Pitch your solution! What would happen, if we don't implement this? --> + ## Alternatives From 0e582e893493b9950fdceaa28f219660089d08c3 Mon Sep 17 00:00:00 2001 From: El RIDO Date: Fri, 11 Aug 2023 20:53:06 +0200 Subject: [PATCH 02/32] fix syntax, standardize form attributes radio buttons are not supported, checkboxes would allow selecting multiple things, so dropdown it is --- .github/DISCUSSION_TEMPLATE/q-a.yml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/.github/DISCUSSION_TEMPLATE/q-a.yml b/.github/DISCUSSION_TEMPLATE/q-a.yml index cf02916f..192081d3 100644 --- a/.github/DISCUSSION_TEMPLATE/q-a.yml +++ b/.github/DISCUSSION_TEMPLATE/q-a.yml @@ -3,17 +3,19 @@ labels: ["question/support"] body: - type: markdown attributes: - value: | - Describe the problem/question: A clear and concise description of what the problem/issue or question is. + label: Describe the problem/question + description: | + A clear and concise description of what the problem/issue or question is. - type: checkboxes attributes: label: Please tick this to confirm options: - label: Yes, I have read [the FAQ](https://github.com/PrivateBin/PrivateBin/wiki/FAQ) and I found no solution/answer there. - type: markdown + id: what_you_did attributes: - value: | - ## What you did + label: What you did + description: | Tell us how to reproduce the problem. 1. @@ -51,12 +53,12 @@ body: id: privatebin_version attributes: label: PrivateBin version - - type: radio + - type: dropdown id: reproduce_issue attributes: label: I can reproduce this issue on [https://privatebin.net](https://privatebin.net) options: - - label: Yes - value: Yes - label: No value: No + - label: Yes + value: Yes From 7f28e8cc0c4bf4066d346d9e49fac96ad7438abc Mon Sep 17 00:00:00 2001 From: R4SAS Date: Wed, 16 Aug 2023 23:21:46 +0300 Subject: [PATCH 03/32] Update discussion template Try to fix #1143. --- .github/DISCUSSION_TEMPLATE/q-a.yml | 35 +++++++++++++++++++---------- 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/.github/DISCUSSION_TEMPLATE/q-a.yml b/.github/DISCUSSION_TEMPLATE/q-a.yml index 192081d3..6e4b1e35 100644 --- a/.github/DISCUSSION_TEMPLATE/q-a.yml +++ b/.github/DISCUSSION_TEMPLATE/q-a.yml @@ -2,32 +2,42 @@ title: "[Question and support] " labels: ["question/support"] body: - type: markdown + attributes: + value: | + Thanks for taking the time to fill out this form! + - type: textarea + id: description attributes: label: Describe the problem/question - description: | - A clear and concise description of what the problem/issue or question is. + description: A clear and concise description of what the problem/issue or question is. + validations: + required: true - type: checkboxes + id: readed-faq attributes: label: Please tick this to confirm + description: Have you read [the FAQ](https://github.com/PrivateBin/PrivateBin/wiki/FAQ)? options: - - label: Yes, I have read [the FAQ](https://github.com/PrivateBin/PrivateBin/wiki/FAQ) and I found no solution/answer there. - - type: markdown + - label: Yes, I have read the FAQ and I found no solution/answer there. + required: true + - type: textarea id: what_you_did attributes: - label: What you did - description: | - Tell us how to reproduce the problem. - + label: What you did? + description: Tell us how to reproduce the problem. + value: | 1. 2. - type: textarea id: what_happens attributes: label: What happens + placeholder: Tell us what you see! - type: textarea id: what_should_happen attributes: label: What should happen + placeholder: Tell us what you want to see! - type: textarea id: additional_info attributes: @@ -58,7 +68,8 @@ body: attributes: label: I can reproduce this issue on [https://privatebin.net](https://privatebin.net) options: - - label: No - value: No - - label: Yes - value: Yes + - No + - Yes + default: 0 + validations: + required: true From ad35c30d45d18b0ff8c393dcf3711a9a0c5fd16d Mon Sep 17 00:00:00 2001 From: El RIDO Date: Wed, 16 Aug 2023 23:14:07 +0200 Subject: [PATCH 04/32] Update q-a.yml, one more try body[12]: options must not include booleans. Please wrap values such as 'yes', and 'true' in quotes. --- .github/DISCUSSION_TEMPLATE/q-a.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/DISCUSSION_TEMPLATE/q-a.yml b/.github/DISCUSSION_TEMPLATE/q-a.yml index 6e4b1e35..75b0ed04 100644 --- a/.github/DISCUSSION_TEMPLATE/q-a.yml +++ b/.github/DISCUSSION_TEMPLATE/q-a.yml @@ -68,8 +68,8 @@ body: attributes: label: I can reproduce this issue on [https://privatebin.net](https://privatebin.net) options: - - No - - Yes + - "No" + - "Yes" default: 0 validations: required: true From 81ae359dfcd3c45d792d434082577a07f526f09f Mon Sep 17 00:00:00 2001 From: El RIDO Date: Thu, 17 Aug 2023 00:00:30 +0200 Subject: [PATCH 05/32] Delete shiftleft-analysis.yml Development on this stopped in 2021 and apart from the (false positive) secret scan, dev suggests CodeQL replaces it, feature wise: https://github.com/ShiftLeftSecurity/sast-scan/issues/352 --- .github/workflows/shiftleft-analysis.yml | 35 ------------------------ 1 file changed, 35 deletions(-) delete mode 100644 .github/workflows/shiftleft-analysis.yml diff --git a/.github/workflows/shiftleft-analysis.yml b/.github/workflows/shiftleft-analysis.yml deleted file mode 100644 index 56d24520..00000000 --- a/.github/workflows/shiftleft-analysis.yml +++ /dev/null @@ -1,35 +0,0 @@ -# This workflow integrates Scan with GitHub's code scanning feature -# Scan is a free open-source security tool for modern DevOps teams from ShiftLeft -# Visit https://slscan.io/en/latest/integrations/code-scan for help -name: SL Scan - -on: - push: - branches: [ master ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ master ] - schedule: - - cron: '16 22 * * 4' - -jobs: - Scan-Build: - # Scan runs on ubuntu, mac and windows - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - # potentially add composer install steo here - - name: Perform Scan - uses: ShiftLeftSecurity/scan-action@master - env: - WORKSPACE: "" - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SCAN_AUTO_BUILD: true - with: - output: reports - # Scan auto-detects the languages. - - - name: Upload report - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: reports From 1c425765758027abd86b6bce722460905b96aa79 Mon Sep 17 00:00:00 2001 From: R4SAS Date: Thu, 17 Aug 2023 03:05:39 +0300 Subject: [PATCH 06/32] [GH] update discussion q-a template (#1143) --- .github/DISCUSSION_TEMPLATE/q-a.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/DISCUSSION_TEMPLATE/q-a.yml b/.github/DISCUSSION_TEMPLATE/q-a.yml index 75b0ed04..00c713a5 100644 --- a/.github/DISCUSSION_TEMPLATE/q-a.yml +++ b/.github/DISCUSSION_TEMPLATE/q-a.yml @@ -4,7 +4,7 @@ body: - type: markdown attributes: value: | - Thanks for taking the time to fill out this form! + ## Thanks for taking the time to fill out this form! - type: textarea id: description attributes: @@ -15,7 +15,7 @@ body: - type: checkboxes id: readed-faq attributes: - label: Please tick this to confirm + label: Did you use the FAQ section? description: Have you read [the FAQ](https://github.com/PrivateBin/PrivateBin/wiki/FAQ)? options: - label: Yes, I have read the FAQ and I found no solution/answer there. @@ -28,6 +28,7 @@ body: value: | 1. 2. + ... - type: textarea id: what_happens attributes: @@ -66,7 +67,8 @@ body: - type: dropdown id: reproduce_issue attributes: - label: I can reproduce this issue on [https://privatebin.net](https://privatebin.net) + label: Issue reproducibility + description: Can you reproduce this issue on [https://privatebin.net](https://privatebin.net)? options: - "No" - "Yes" From e14b55bd27a15269b535b37d8433ca79099b2122 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Aug 2023 11:06:57 +0000 Subject: [PATCH 07/32] Bump phpunit/phpunit from 9.6.10 to 9.6.11 Bumps [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit) from 9.6.10 to 9.6.11. - [Changelog](https://github.com/sebastianbergmann/phpunit/blob/9.6.11/ChangeLog-9.6.md) - [Commits](https://github.com/sebastianbergmann/phpunit/compare/9.6.10...9.6.11) --- updated-dependencies: - dependency-name: phpunit/phpunit dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- composer.lock | 49 +++++++++++++++++++++++++------------------------ 1 file changed, 25 insertions(+), 24 deletions(-) diff --git a/composer.lock b/composer.lock index 9ef854e6..e021d4fd 100644 --- a/composer.lock +++ b/composer.lock @@ -316,16 +316,16 @@ }, { "name": "nikic/php-parser", - "version": "v4.16.0", + "version": "v4.17.1", "source": { "type": "git", "url": "https://github.com/nikic/PHP-Parser.git", - "reference": "19526a33fb561ef417e822e85f08a00db4059c17" + "reference": "a6303e50c90c355c7eeee2c4a8b27fe8dc8fef1d" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/19526a33fb561ef417e822e85f08a00db4059c17", - "reference": "19526a33fb561ef417e822e85f08a00db4059c17", + "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/a6303e50c90c355c7eeee2c4a8b27fe8dc8fef1d", + "reference": "a6303e50c90c355c7eeee2c4a8b27fe8dc8fef1d", "shasum": "" }, "require": { @@ -366,9 +366,9 @@ ], "support": { "issues": "https://github.com/nikic/PHP-Parser/issues", - "source": "https://github.com/nikic/PHP-Parser/tree/v4.16.0" + "source": "https://github.com/nikic/PHP-Parser/tree/v4.17.1" }, - "time": "2023-06-25T14:52:30+00:00" + "time": "2023-08-13T19:53:39+00:00" }, { "name": "phar-io/manifest", @@ -483,16 +483,16 @@ }, { "name": "phpunit/php-code-coverage", - "version": "9.2.26", + "version": "9.2.27", "source": { "type": "git", "url": "https://github.com/sebastianbergmann/php-code-coverage.git", - "reference": "443bc6912c9bd5b409254a40f4b0f4ced7c80ea1" + "reference": "b0a88255cb70d52653d80c890bd7f38740ea50d1" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/443bc6912c9bd5b409254a40f4b0f4ced7c80ea1", - "reference": "443bc6912c9bd5b409254a40f4b0f4ced7c80ea1", + "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/b0a88255cb70d52653d80c890bd7f38740ea50d1", + "reference": "b0a88255cb70d52653d80c890bd7f38740ea50d1", "shasum": "" }, "require": { @@ -548,7 +548,8 @@ ], "support": { "issues": "https://github.com/sebastianbergmann/php-code-coverage/issues", - "source": "https://github.com/sebastianbergmann/php-code-coverage/tree/9.2.26" + "security": "https://github.com/sebastianbergmann/php-code-coverage/security/policy", + "source": "https://github.com/sebastianbergmann/php-code-coverage/tree/9.2.27" }, "funding": [ { @@ -556,7 +557,7 @@ "type": "github" } ], - "time": "2023-03-06T12:58:08+00:00" + "time": "2023-07-26T13:44:30+00:00" }, { "name": "phpunit/php-file-iterator", @@ -801,16 +802,16 @@ }, { "name": "phpunit/phpunit", - "version": "9.6.10", + "version": "9.6.11", "source": { "type": "git", "url": "https://github.com/sebastianbergmann/phpunit.git", - "reference": "a6d351645c3fe5a30f5e86be6577d946af65a328" + "reference": "810500e92855eba8a7a5319ae913be2da6f957b0" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/a6d351645c3fe5a30f5e86be6577d946af65a328", - "reference": "a6d351645c3fe5a30f5e86be6577d946af65a328", + "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/810500e92855eba8a7a5319ae913be2da6f957b0", + "reference": "810500e92855eba8a7a5319ae913be2da6f957b0", "shasum": "" }, "require": { @@ -884,7 +885,7 @@ "support": { "issues": "https://github.com/sebastianbergmann/phpunit/issues", "security": "https://github.com/sebastianbergmann/phpunit/security/policy", - "source": "https://github.com/sebastianbergmann/phpunit/tree/9.6.10" + "source": "https://github.com/sebastianbergmann/phpunit/tree/9.6.11" }, "funding": [ { @@ -900,7 +901,7 @@ "type": "tidelift" } ], - "time": "2023-07-10T04:04:23+00:00" + "time": "2023-08-19T07:10:56+00:00" }, { "name": "sebastian/cli-parser", @@ -1408,16 +1409,16 @@ }, { "name": "sebastian/global-state", - "version": "5.0.5", + "version": "5.0.6", "source": { "type": "git", "url": "https://github.com/sebastianbergmann/global-state.git", - "reference": "0ca8db5a5fc9c8646244e629625ac486fa286bf2" + "reference": "bde739e7565280bda77be70044ac1047bc007e34" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/sebastianbergmann/global-state/zipball/0ca8db5a5fc9c8646244e629625ac486fa286bf2", - "reference": "0ca8db5a5fc9c8646244e629625ac486fa286bf2", + "url": "https://api.github.com/repos/sebastianbergmann/global-state/zipball/bde739e7565280bda77be70044ac1047bc007e34", + "reference": "bde739e7565280bda77be70044ac1047bc007e34", "shasum": "" }, "require": { @@ -1460,7 +1461,7 @@ ], "support": { "issues": "https://github.com/sebastianbergmann/global-state/issues", - "source": "https://github.com/sebastianbergmann/global-state/tree/5.0.5" + "source": "https://github.com/sebastianbergmann/global-state/tree/5.0.6" }, "funding": [ { @@ -1468,7 +1469,7 @@ "type": "github" } ], - "time": "2022-02-14T08:28:10+00:00" + "time": "2023-08-02T09:26:13+00:00" }, { "name": "sebastian/lines-of-code", From 906c115a97f49a498bc45e167551c3ed14506982 Mon Sep 17 00:00:00 2001 From: rugk Date: Thu, 24 Aug 2023 21:30:25 +0200 Subject: [PATCH 08/32] Make QA template more strict and helpful 1. Require to fill out STRs. 2. Add more fields for client stuff, i.e. web browser and OS. 3. Add more placeholders and descriptions to guide users. 4. Adjust the reproducibility thing to be more clear. I.e. before the result was sth. like "Issue reproducibility: Yes" - this could be confused with "Is it always reproducible? Yes", and not "It is reproducible on our test instance." --- .github/DISCUSSION_TEMPLATE/q-a.yml | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/.github/DISCUSSION_TEMPLATE/q-a.yml b/.github/DISCUSSION_TEMPLATE/q-a.yml index 00c713a5..6d22b6b5 100644 --- a/.github/DISCUSSION_TEMPLATE/q-a.yml +++ b/.github/DISCUSSION_TEMPLATE/q-a.yml @@ -29,6 +29,8 @@ body: 1. 2. ... + validations: + required: true - type: textarea id: what_happens attributes: @@ -43,35 +45,47 @@ body: id: additional_info attributes: label: Additional information - description: If you have access to the server log files, copy them here. + description: E.g. if you have access to the server log files, copy them here. Or copy the browser console, if appropiate. - type: input id: server_address attributes: label: Server address + description: The instance of PrivateBin, where you experience the issue. + placeholder: e.g. https://privatebin.net - type: input id: server_os attributes: label: Server OS + placeholder: e.g. Ubuntu - type: input id: webserver attributes: label: Webserver - - type: input - id: browser - attributes: - label: Browser + placeholder: e.g. Apache - type: input id: privatebin_version attributes: label: PrivateBin version + description: The PrivateBin version, where you experience the issue. It is shown at the bottom left in the web interface e.g. + placeholder: e.g. v1.5.2 + - type: input + id: browser + attributes: + label: Browser and version + placeholder: e.g. Firefox v116.3.0 (desktop) + - type: input + id: client + attributes: + label: Local operating system and version + placeholder: e.g. Windows 10 - type: dropdown id: reproduce_issue attributes: label: Issue reproducibility description: Can you reproduce this issue on [https://privatebin.net](https://privatebin.net)? options: - - "No" - - "Yes" + - "No, I cannot reproduce it on https://privatebin.net"" + - "Yes, reproducible on https://privatebin.net" default: 0 validations: required: true From 11fd21f8a8786dcc843c3c4294cab8b494c2ba1e Mon Sep 17 00:00:00 2001 From: rugk Date: Thu, 24 Aug 2023 21:32:42 +0200 Subject: [PATCH 09/32] doc: improve wording/grammar --- .github/DISCUSSION_TEMPLATE/q-a.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/DISCUSSION_TEMPLATE/q-a.yml b/.github/DISCUSSION_TEMPLATE/q-a.yml index 6d22b6b5..053e1277 100644 --- a/.github/DISCUSSION_TEMPLATE/q-a.yml +++ b/.github/DISCUSSION_TEMPLATE/q-a.yml @@ -45,7 +45,7 @@ body: id: additional_info attributes: label: Additional information - description: E.g. if you have access to the server log files, copy them here. Or copy the browser console, if appropiate. + description: E.g. if you have access to the server log files, copy them here. Or copy the browser console content, if appropiate. - type: input id: server_address attributes: @@ -66,7 +66,7 @@ body: id: privatebin_version attributes: label: PrivateBin version - description: The PrivateBin version, where you experience the issue. It is shown at the bottom left in the web interface e.g. + description: The PrivateBin version, where you experience the issue. It is e.g. shown at the bottom left in the web interface. placeholder: e.g. v1.5.2 - type: input id: browser @@ -84,8 +84,8 @@ body: label: Issue reproducibility description: Can you reproduce this issue on [https://privatebin.net](https://privatebin.net)? options: - - "No, I cannot reproduce it on https://privatebin.net"" - - "Yes, reproducible on https://privatebin.net" + - "No, I cannot reproduce it on https://privatebin.net." + - "Yes, reproducible on https://privatebin.net." default: 0 validations: required: true From 61457c46c01091b2eab9a7a4ae93119d76798bac Mon Sep 17 00:00:00 2001 From: rugk Date: Thu, 24 Aug 2023 21:35:42 +0200 Subject: [PATCH 10/32] doc: link FAQ in option too The doc says MD is supported for that here, too. --- .github/DISCUSSION_TEMPLATE/q-a.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/DISCUSSION_TEMPLATE/q-a.yml b/.github/DISCUSSION_TEMPLATE/q-a.yml index 053e1277..bc0b06c7 100644 --- a/.github/DISCUSSION_TEMPLATE/q-a.yml +++ b/.github/DISCUSSION_TEMPLATE/q-a.yml @@ -18,7 +18,7 @@ body: label: Did you use the FAQ section? description: Have you read [the FAQ](https://github.com/PrivateBin/PrivateBin/wiki/FAQ)? options: - - label: Yes, I have read the FAQ and I found no solution/answer there. + - label: Yes, I have read [the FAQ](https://github.com/PrivateBin/PrivateBin/wiki/FAQ) and I found no solution/answer there. required: true - type: textarea id: what_you_did From 1470b0cb9cc4881173da903af2138a0e47878210 Mon Sep 17 00:00:00 2001 From: rugk Date: Thu, 24 Aug 2023 22:14:15 +0200 Subject: [PATCH 11/32] QA tenplate: remove prefilled title MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's remove that. 1. With label and A&A category we have more than enough options for filtering such requests. 2. Actually, as you can see in https://github.com/orgs/PrivateBin/discussions/1152, as it is a required field, but already filled out… we want them to write proper titles. --- .github/DISCUSSION_TEMPLATE/q-a.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/DISCUSSION_TEMPLATE/q-a.yml b/.github/DISCUSSION_TEMPLATE/q-a.yml index bc0b06c7..7dcb8c5c 100644 --- a/.github/DISCUSSION_TEMPLATE/q-a.yml +++ b/.github/DISCUSSION_TEMPLATE/q-a.yml @@ -1,4 +1,4 @@ -title: "[Question and support] " +title: "" labels: ["question/support"] body: - type: markdown From b2e4920aa2c92a6b8f84f443c47857b701fb7034 Mon Sep 17 00:00:00 2001 From: rugk Date: Thu, 24 Aug 2023 21:41:50 +0000 Subject: [PATCH 12/32] feat: add basic support for debugging and working with devcontainer For GitHub Codespaces e.g. --- .devcontainer/devcontainer.json | 46 +++++++++++++++++++++++++++++++++ .vscode/extensions.json | 7 +++++ .vscode/launch.json | 35 +++++++++++++++++++++++++ 3 files changed, 88 insertions(+) create mode 100644 .devcontainer/devcontainer.json create mode 100644 .vscode/extensions.json create mode 100644 .vscode/launch.json diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 00000000..16917098 --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,46 @@ +{ + "name": "PHP", + "image": "mcr.microsoft.com/devcontainers/php", + "customizations": { + "vscode": { + "extensions": [ + "github.codespaces", + // PHP from https://github.com/devcontainers/templates/tree/main/src/php + "xdebug.php-debug", + "bmewburn.vscode-intelephense-client", + "xdebug.php-pack", + // PHP + "DEVSENSE.phptools-vscode", + "DEVSENSE.composer-php-vscode", + // linting + "EditorConfig.EditorConfig", + "dbaeumer.vscode-eslint", + "raymondcamden.CSSLint", + // testing + "maty.vscode-mocha-sidebar" + ] + }, + "codespaces": { + "repositories": { + "PrivateBin/*": { + "permissions": { + "pull_requests": "write" + } + } + } + } + }, + "features": { + "ghcr.io/devcontainers-contrib/features/mocha:2": {} + }, + "forwardPorts": [ + 8080 + ], + "postCreateCommand": [ + "composer install --no-dev --optimize-autoloader", + "sudo chmod a+x \"$(pwd)\" && sudo rm -rf /var/www/html && sudo ln -s \"$(pwd)\" /var/www/html", + "npm install --global nyc" + ], + // alternatiuve: apache2ctl start (but requires root) + "postAttachCommand": "php -S 0.0.0.0:8080" +} diff --git a/.vscode/extensions.json b/.vscode/extensions.json new file mode 100644 index 00000000..eea5315d --- /dev/null +++ b/.vscode/extensions.json @@ -0,0 +1,7 @@ +{ + "recommendations": [ + "recca0120.vscode-phpunit", + "onecentlin.phpunit-snippets", + "devsense.profiler-php-vscode" + ] +} diff --git a/.vscode/launch.json b/.vscode/launch.json new file mode 100644 index 00000000..e62f41ff --- /dev/null +++ b/.vscode/launch.json @@ -0,0 +1,35 @@ +{ + "version": "0.2.0", + "configurations": [ + { + "name": "Launch built-in server and debug", + "type": "php", + "request": "launch", + "runtimeArgs": [ + "-S", + "localhost:8000", + "-t", + "." + ], + "port": 9003, + "serverReadyAction": { + "action": "openExternally" + } + }, + { + "name": "Debug current script in console", + "type": "php", + "request": "launch", + "program": "${file}", + "cwd": "${fileDirname}", + "externalConsole": false, + "port": 9003 + }, + { + "name": "Listen for Xdebug", + "type": "php", + "request": "launch", + "port": 9003 + } + ] +} From 664a8fff0868a60c75a9837dda1682256a9ae665 Mon Sep 17 00:00:00 2001 From: rugk Date: Thu, 24 Aug 2023 22:08:45 +0000 Subject: [PATCH 13/32] feat: also open doc readme by default --- .devcontainer/devcontainer.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 16917098..a0c531ee 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -21,6 +21,10 @@ ] }, "codespaces": { + "openFiles": [ + "README.md", + "doc/README.md" + ], "repositories": { "PrivateBin/*": { "permissions": { From 876a59cedc347074304df03e51bdfebd7b92d5e3 Mon Sep 17 00:00:00 2001 From: rugk Date: Mon, 28 Aug 2023 18:49:27 +0200 Subject: [PATCH 14/32] Apprently GitHub Apparently GitHub now adds a security policy button by default (this is new, is not it?)? Also they have a policy report form behind that button. So reports can apparently now be made online at GitHub? (IMHO that is fine, just need to be aware of that) As such, IMHO two buttons would be confusing, so let's remove our custom one here? --- .github/ISSUE_TEMPLATE/config.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 53c2d8ac..5e2d8d5a 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -6,7 +6,4 @@ contact_links: - name: Problem with the container image url: https://github.com/PrivateBin/docker-nginx-fpm-alpine/issues/new about: Please report all problems that apply only(!) to the official (Docker) image “docker-nginx-fpm-alpine” here. - - name: Security issue - url: https://github.com/PrivateBin/PrivateBin/security/policy - about: Please report security vulnerabilities and other security issues here. From 617b421d8f3c2c066acfd5cd822f49d231ae38ef Mon Sep 17 00:00:00 2001 From: R4SAS Date: Sun, 3 Sep 2023 19:30:32 +0300 Subject: [PATCH 15/32] Fix comment in bug report issue template --- .github/ISSUE_TEMPLATE/bug_report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index c43420c6..ea372925 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -10,7 +10,7 @@ assignees: '' -<-- Describe the bug: A clear and concise description of what the bug is. --> + ## Steps to reproduce From 5bd2eb97e6f222a13ea60a2c9fdd523c8539a336 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 5 Sep 2023 11:13:01 +0000 Subject: [PATCH 16/32] Bump actions/checkout from 3 to 4 Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql-analysis.yml | 2 +- .github/workflows/snyk-scan.yml | 2 +- .github/workflows/tests.yml | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 6dc09465..d0c0c63e 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/snyk-scan.yml b/.github/workflows/snyk-scan.yml index 42024705..7cba1864 100644 --- a/.github/workflows/snyk-scan.yml +++ b/.github/workflows/snyk-scan.yml @@ -13,7 +13,7 @@ jobs: snyk-php: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Install Google Cloud Storage run: composer require --no-update google/cloud-storage && composer update --no-dev - name: Run Snyk to check for vulnerabilities diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 9b5320b8..c023edfd 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Validate composer.json and composer.lock run: composer validate - name: Install dependencies @@ -29,7 +29,7 @@ jobs: # let's get started! - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 # cache PHP extensions - name: Setup cache environment @@ -99,7 +99,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Setup Node uses: actions/setup-node@v3 From 172efafb817926f74e86c534934b8719d761eac4 Mon Sep 17 00:00:00 2001 From: voidquark Date: Thu, 7 Sep 2023 20:49:10 +0200 Subject: [PATCH 17/32] modify ansible installation part --- doc/Installation.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/doc/Installation.md b/doc/Installation.md index 5319414d..717bc5cc 100644 --- a/doc/Installation.md +++ b/doc/Installation.md @@ -13,10 +13,12 @@ mostly safe default configuration, but we urge you to check the **NOTE:** See our [FAQ entry on securely downloading release files](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-can-i-securely-clonedownload-your-project) for more information. -**NOTE:** There is a [ansible](https://ansible.com) role by @e1mo available to -install and configure PrivateBin on your server. It's available on -[ansible galaxy](https://galaxy.ansible.com/e1mo/privatebin) -([source code](https://git.sr.ht/~e1mo/ansible-role-privatebin)). +**NOTE:** There are Ansible roles available for installing and configuring PrivateBin on your server. You can choose from the following options: + +- [Podman Rootless - PrivateBin by @voidquark](https://galaxy.ansible.com/voidquark/privatebin) ([Github source code](https://github.com/voidquark/privatebin)): +Simplifies the deployment and management of a secure PrivateBin service using a rootless Podman container. Key features include root-less deployment, ensuring security within a user namespace, idempotent deployment for consistent state, out-of-the-box setup for Red Hat systems, and the flexibility to customize PrivateBin configurations. It has been tested on EL9. + +- [Config Configuration - PrivateBin by @e1mo](https://galaxy.ansible.com/e1mo/privatebin) ([Github source code](https://git.sr.ht/~e1mo/ansible-role-privatebin)) Deploy PrivateBin configuration to disk with a customized configuration. ### Minimal Requirements From 42cf45542fe08526e0c4321960728d6374e22e27 Mon Sep 17 00:00:00 2001 From: voidquark Date: Thu, 7 Sep 2023 20:50:58 +0200 Subject: [PATCH 18/32] consistency --- doc/Installation.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/doc/Installation.md b/doc/Installation.md index 717bc5cc..e87c4c04 100644 --- a/doc/Installation.md +++ b/doc/Installation.md @@ -15,10 +15,9 @@ for more information. **NOTE:** There are Ansible roles available for installing and configuring PrivateBin on your server. You can choose from the following options: -- [Podman Rootless - PrivateBin by @voidquark](https://galaxy.ansible.com/voidquark/privatebin) ([Github source code](https://github.com/voidquark/privatebin)): -Simplifies the deployment and management of a secure PrivateBin service using a rootless Podman container. Key features include root-less deployment, ensuring security within a user namespace, idempotent deployment for consistent state, out-of-the-box setup for Red Hat systems, and the flexibility to customize PrivateBin configurations. It has been tested on EL9. +- [Podman Rootless - PrivateBin by @voidquark](https://galaxy.ansible.com/voidquark/privatebin) ([Github source code](https://github.com/voidquark/privatebin)): Simplifies the deployment and management of a secure PrivateBin service using a rootless Podman container. Key features include root-less deployment, ensuring security within a user namespace, idempotent deployment for consistent state, out-of-the-box setup for Red Hat systems, and the flexibility to customize PrivateBin configurations. It has been tested on EL9. -- [Config Configuration - PrivateBin by @e1mo](https://galaxy.ansible.com/e1mo/privatebin) ([Github source code](https://git.sr.ht/~e1mo/ansible-role-privatebin)) Deploy PrivateBin configuration to disk with a customized configuration. +- [Config Configuration - PrivateBin by @e1mo](https://galaxy.ansible.com/e1mo/privatebin) ([Github source code](https://git.sr.ht/~e1mo/ansible-role-privatebin)): Deploy PrivateBin configuration to disk with a customized configuration. ### Minimal Requirements From c665385ff6ed7a6924717fe6dfe97e1e0cc112aa Mon Sep 17 00:00:00 2001 From: Sergio Giraldo Date: Sat, 9 Sep 2023 22:26:11 +0200 Subject: [PATCH 19/32] feat: make the email button optional. Issue #1031 ::by sergio giraldo @ 20230909T2226CEST, gpg signed --- cfg/conf.sample.php | 10 ++++++++-- lib/Configuration.php | 1 + lib/Controller.php | 1 + tpl/bootstrap.php | 11 +++++++++++ tpl/page.php | 5 +++++ 5 files changed, 26 insertions(+), 2 deletions(-) diff --git a/cfg/conf.sample.php b/cfg/conf.sample.php index 09bb9e19..f65fbb35 100644 --- a/cfg/conf.sample.php +++ b/cfg/conf.sample.php @@ -1,4 +1,5 @@ -; '', 'urlshortener' => '', 'qrcode' => true, + 'email' => true, 'icon' => 'identicon', 'cspheader' => 'default-src \'none\'; base-uri \'self\'; form-action \'none\'; manifest-src \'self\'; connect-src * blob:; script-src \'self\' \'unsafe-eval\'; style-src \'self\'; font-src \'self\'; frame-ancestors \'none\'; img-src \'self\' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals allow-downloads', 'zerobincompatibility' => false, diff --git a/lib/Controller.php b/lib/Controller.php index bb5450ca..6a68a2e5 100644 --- a/lib/Controller.php +++ b/lib/Controller.php @@ -411,6 +411,7 @@ class Controller $page->assign('EXPIREDEFAULT', $this->_conf->getKey('default', 'expire')); $page->assign('URLSHORTENER', $this->_conf->getKey('urlshortener')); $page->assign('QRCODE', $this->_conf->getKey('qrcode')); + $page->assign('EMAIL', $this->_conf->getKey('email')); $page->assign('HTTPWARNING', $this->_conf->getKey('httpwarning')); $page->assign('HTTPSLINK', 'https://' . $this->_request->getHost() . $this->_request->getRequestUri()); $page->assign('COMPRESSION', $this->_conf->getKey('compression')); diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 7d1d1879..2190be2f 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -144,6 +144,7 @@ if ($QRCODE) : +