- Comment model with nested replies (ParentID), dual authorship
(logged-in UserID / anonymous GuestToken cookie), email hash for
Gravatar, private flag, and moderation status
- CommentConfig singleton (enabled / allow guest / guest-require-approval
/ use Gravatar) cached like the other platform config
- Markdown comments with built-in emoji picker, preview, and markdown
help; rendered client-side via marked + DOMPurify, with server-side
HTML/dangerous-scheme stripping as a first XSS defense
- Private comments visible only to admin and the author; pending
comments visible only to admin and the author
- Admin moderation list (pending/approved/rejected/all tabs) with
approve/reject/delete and a pending-count badge
- Comment settings page with the four toggles
- One-time session flash notice (auto-dismissed after 4s) so the
"comment posted" banner no longer persists across refreshes
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add four DB-backed configuration tables for site-wide settings:
site_settings (logo, top-left title, header/footer text with zh/en
variants), upload_configs (master switch, default size, storage dir),
upload_file_types (per-extension whitelist with per-type size limits),
and download_baseurls (multiple download sources with priority/default).
- Models, AutoMigrate, and first-run seed (18 common file types)
- Process-level config cache warmed at startup, refreshed on admin save
- SetUserContext injects cached site settings into templates
- base.html renders logo (local upload or external URL), title, header
banner, and footer with i18n fallback
- Upload validator drives avatar uploads (form + AJAX) through the
configured switch/type/size policy
- Admin pages for site/upload/download settings with i18n keys
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
kevinandClaude Fable 5