go_blog

77 Commits 12 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
kevin	6220de9c84	fix: 编辑/新建文章页 Font Awesome 改用本地 vendored 资源 easyMDE 会注入失效的 maxcdn.bootstrapcdn.com 样式链接导致工具栏图标加载失败。按 SECURITY_TODO #9 无外部 CDN 政策，本地化 Font Awesome 4.7.0（css+fonts），并在两处 EasyMDE 配置中禁用 autoDownloadFontAwesome。	2026-08-28 16:26:06 +08:00
kevin	c9f858b626	fix: 完成 P2 安全修复 #9-13 #22-25 - #9 CDN 本地化：marked/DOMPurify/highlight.js/cropperjs/easymde 入 static/vendor（go:embed），Tailwind 改静态构建（scripts/build_tailwind.sh），CSP 收紧为 default-src 'self' - #10 登录限速：IP+用户名维度 5 次失败锁 15 分钟，内存实现有界（handlers/login_ratelimit.go） - #25 计时侧信道：用户不存在时执行 dummy bcrypt 抹平时间差（随 #10 实施） - #11 配置文件权限 0640 - #12 首启随机一次性密码（弃用 admin/admin） - #13 unix socket 660 + 代理用户加组提示 - #22 storage_dir 路径穿越校验（单安全路径段） - #23 密码最小长度统一（改密/建号/重置），#24 邮箱格式统一校验 - 新增 13 个单元测试；go test ./... 含 -race 全绿	2026-08-27 18:10:22 +08:00
dsh	83866f6de2	feat: enhance frontend Markdown rendering - Add shared BlogMD renderer (static/js/markdown.js): marked + DOMPurify + highlight.js pipeline with GFM support, heading id slugger with CJK-aware anchors, syntax highlighting, per-block copy button and language badge, lazy images with lightbox, external links opened safely in new tabs, tables wrapped for small screens. - Add .md-body typography styles (static/css/markdown.css) so articles, comments and editor previews render with proper headings, tables, lists, blockquotes and code blocks (previously the prose classes had no effect because the Tailwind typography plugin is not loaded). - Fix marked options that were set after parsing and removed from marked v4+ (mangle/headerIds no-ops). - Pin CDN versions (marked 15.0.12, dompurify 3.4.13, highlight.js 11.12.0) instead of floating 'latest' URLs. - Wire EasyMDE preview/side-by-side to BlogMD in admin and user article editors; use BlogMD for comment bodies on the article page, admin comment list and comment preview. - Serve /static in main.go and deploy it in install_linux.sh.	2026-08-18 06:05:53 -04:00

Author

SHA1

Message

Date

kevin

6220de9c84

fix: 编辑/新建文章页 Font Awesome 改用本地 vendored 资源

easyMDE 会注入失效的 maxcdn.bootstrapcdn.com 样式链接导致工具栏图标加载失败。
按 SECURITY_TODO #9 无外部 CDN 政策，本地化 Font Awesome 4.7.0（css+fonts），
并在两处 EasyMDE 配置中禁用 autoDownloadFontAwesome。

2026-08-28 16:26:06 +08:00

kevin

c9f858b626

fix: 完成 P2 安全修复 #9-13 #22-25

- #9 CDN 本地化：marked/DOMPurify/highlight.js/cropperjs/easymde 入 static/vendor（go:embed），Tailwind 改静态构建（scripts/build_tailwind.sh），CSP 收紧为 default-src 'self'
- #10 登录限速：IP+用户名维度 5 次失败锁 15 分钟，内存实现有界（handlers/login_ratelimit.go）
- #25 计时侧信道：用户不存在时执行 dummy bcrypt 抹平时间差（随 #10 实施）
- #11 配置文件权限 0640
- #12 首启随机一次性密码（弃用 admin/admin）
- #13 unix socket 660 + 代理用户加组提示
- #22 storage_dir 路径穿越校验（单安全路径段）
- #23 密码最小长度统一（改密/建号/重置），#24 邮箱格式统一校验
- 新增 13 个单元测试；go test ./... 含 -race 全绿

2026-08-27 18:10:22 +08:00

dsh

83866f6de2

feat: enhance frontend Markdown rendering

- Add shared BlogMD renderer (static/js/markdown.js): marked + DOMPurify
  + highlight.js pipeline with GFM support, heading id slugger with
  CJK-aware anchors, syntax highlighting, per-block copy button and
  language badge, lazy images with lightbox, external links opened
  safely in new tabs, tables wrapped for small screens.
- Add .md-body typography styles (static/css/markdown.css) so articles,
  comments and editor previews render with proper headings, tables,
  lists, blockquotes and code blocks (previously the prose classes had
  no effect because the Tailwind typography plugin is not loaded).
- Fix marked options that were set after parsing and removed from
  marked v4+ (mangle/headerIds no-ops).
- Pin CDN versions (marked 15.0.12, dompurify 3.4.13, highlight.js
  11.12.0) instead of floating 'latest' URLs.
- Wire EasyMDE preview/side-by-side to BlogMD in admin and user
  article editors; use BlogMD for comment bodies on the article page,
  admin comment list and comment preview.
- Serve /static in main.go and deploy it in install_linux.sh.

2026-08-18 06:05:53 -04:00