dsh/go_blog
1
0 Fork 0
forked from kevin/go_blog
Code Pull Requests Activity
61 Commits 12 Branches 0 Tags
443eccb8a6dcbfe0091432bcfdf0dbbd5a243231
Commit Graph
4 Commits
Author SHA1 Message Date
kevin a0061b14e3 feat: 评论接口 JSON 化——/api/article/:slug/comments 与 admin 审核操作 
- comment.go：commentForm 加 json tag；PostComment 校验分支改 APIError
  （404 article_not_found、403 comments_disabled/comments_guests_disabled、
  400 校验码、500 article_error），保留 guest 令牌与 flash 机制，成功返回
  {ok,redirect:/article/:slug#comment-N,comment_id}
- api.go：新增 APIErrorf（支持 %d/%s 占位符键如 comments_too_long）
- admin_comment.go：approve/reject/delete 改 JSON（parseUintParam 拒绝非
  数值 id 400），成功带原 ?saved=1&msg= 查询串 redirect
- main.go：PostComment 迁入 /api；评论审核三操作迁入 /api/admin/comments
- article.html：评论表单改 blogAPI 提交，错误内联 commentError div
- comment_list.html：审核操作改 to commentAct() 委托（confirm 在函数内，
  取消不发请求），成功 reload 保持筛选状态
- 测试：security_test env 路由同步 /api；session_upload 评论用例改 JSON
- main_test 冒烟补评论 API 路由断言；go build/vet/test 全绿
 2026-08-27 19:36:09 +08:00
kevin f307781f58 docs: 全部 Go 代码注释汉化 
- 48 个 Go 文件所有注释（行注释/块注释/行尾注释，含 _test.go）翻译为中文
- 保留技术标识符：SECURITY_TODO(n)、unsafe-inline、sqlite/mysql、路由参数等
- 代码、字符串字面量、日志消息保持英文原文，零逻辑改动
- go build/vet 通过，go test -count=1 ./... 全绿
 2026-08-27 19:03:03 +08:00
kevin 46d6f3cd94 fix: 完成 P3 安全修复 #14-17（文件类型校验/默认关闭 Gravatar/RSS 固定 URL/bcrypt 成本） 2026-08-27 18:34:17 +08:00
kevinandClaude Fable 5 6139b3ef2c feat: add article comment system with moderation 
- Comment model with nested replies (ParentID), dual authorship
  (logged-in UserID / anonymous GuestToken cookie), email hash for
  Gravatar, private flag, and moderation status
- CommentConfig singleton (enabled / allow guest / guest-require-approval
  / use Gravatar) cached like the other platform config
- Markdown comments with built-in emoji picker, preview, and markdown
  help; rendered client-side via marked + DOMPurify, with server-side
  HTML/dangerous-scheme stripping as a first XSS defense
- Private comments visible only to admin and the author; pending
  comments visible only to admin and the author
- Admin moderation list (pending/approved/rejected/all tabs) with
  approve/reject/delete and a pending-count badge
- Comment settings page with the four toggles
- One-time session flash notice (auto-dismissed after 4s) so the
  "comment posted" banner no longer persists across refreshes

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-06-22 17:21:54 +08:00