- Remove restriction that prevented setting display_name to empty
- Users can now clear display name to fall back to username display
- Trim whitespace from display_name input
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Show display name (or username as fallback) next to avatar
- Improve UI readability and user experience
- Avatar and name together act as dropdown trigger
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add AdminRequired middleware to all /admin routes for proper authorization
- Restrict admin panel, comments, users, settings to admin role only
- Create separate /my/articles routes for regular users to manage their own articles
- Add MyArticlesPage handler for users to view/edit/delete their own content
- Update navigation menus with role-based visibility
- Admin dropdown shows only 'Admin Panel' link, other features in dashboard
- Regular users see 'My Articles' link in profile dropdown
- Add i18n translations for 'my_articles' and 'comment_manage' keys
- Fix permission boundary issues where author role could access admin settings
Security improvements:
- Platform settings now require admin role
- Comment moderation requires admin role
- User management requires admin role
- Regular users can only manage their own articles
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add AdminRequired middleware for admin-role routes
- Add login status check to reject disabled/locked accounts
- Add CRUD handlers (list, create, edit, delete) for users
- Add user_list and user_form templates with role/status badges
- Add nav entry and dashboard button for user management
- Add dynamic user count on admin dashboard
- Fix userIDFromSession to handle all numeric session types
- Self-protection: cannot delete/disable self or demote last admin
- Add EN/ZH i18n keys for all user management strings
- Comment model with nested replies (ParentID), dual authorship
(logged-in UserID / anonymous GuestToken cookie), email hash for
Gravatar, private flag, and moderation status
- CommentConfig singleton (enabled / allow guest / guest-require-approval
/ use Gravatar) cached like the other platform config
- Markdown comments with built-in emoji picker, preview, and markdown
help; rendered client-side via marked + DOMPurify, with server-side
HTML/dangerous-scheme stripping as a first XSS defense
- Private comments visible only to admin and the author; pending
comments visible only to admin and the author
- Admin moderation list (pending/approved/rejected/all tabs) with
approve/reject/delete and a pending-count badge
- Comment settings page with the four toggles
- One-time session flash notice (auto-dismissed after 4s) so the
"comment posted" banner no longer persists across refreshes
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The slug regex stripped everything that is not a-z0-9, so Chinese or
punctuation-only titles produced an empty slug (stored as ""), which
broke the unique index and article URLs.
generateSlug now keeps ASCII word characters and returns "" when the
title yields no URL-safe ASCII (e.g. CJK or punctuation only). Both the
create and update handlers fall back to a "post-<id>" slug in that case;
on create a temporary token-based placeholder is refined to post-<id>
once the row exists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add an attachments table and AJAX upload/management on the article
create and edit pages.
- Attachment model with article_id (0 while pending on create),
session_token ownership, and SHA-256 content-addressed stored_name
- Upload validates via the platform policy (switch/type/size) and
deduplicates on disk by content hash
- Plan-A binding: attachments uploaded before an article exists are
owned by a session token and bound to the new article on save
- Delete soft-removes the record and drops the disk file only when no
remaining rows reference it (reference counting for deduped files)
- Edit page loads existing attachments via JSON list endpoint
- Row actions: insert into body (markdown image/link), set as cover
(image only), and delete
- Download URLs use the configured default download base URL when set,
else the local /uploads path
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add home_welcome and home_subtitle fields (zh/en) to site_settings so
the home page heading and subtitle are editable from the admin panel,
falling back to the i18n defaults when empty. Wire them through the
config cache, SetUserContext, DefaultData, and home.html.
Fix the /admin/settings/site page rendering blank: Go templates cannot
invoke methods on an interface{}-wrapped struct, so pre-compute
SiteLogoIsURL in the handler instead of calling .Site.LogoIsURL() in
the template.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add four DB-backed configuration tables for site-wide settings:
site_settings (logo, top-left title, header/footer text with zh/en
variants), upload_configs (master switch, default size, storage dir),
upload_file_types (per-extension whitelist with per-type size limits),
and download_baseurls (multiple download sources with priority/default).
- Models, AutoMigrate, and first-run seed (18 common file types)
- Process-level config cache warmed at startup, refreshed on admin save
- SetUserContext injects cached site settings into templates
- base.html renders logo (local upload or external URL), title, header
banner, and footer with i18n fallback
- Upload validator drives avatar uploads (form + AJAX) through the
configured switch/type/size policy
- Admin pages for site/upload/download settings with i18n keys
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add admin article list page at /admin/articles with status badges,
pin marker, publish time, and edit/delete actions
- Share the create/edit form: dynamic action URL, prefilled fields,
is_top checkbox state, and create-vs-edit heading
- Add ArticleUpdate/ArticleDelete handlers (soft-delete via DeletedAt);
stamp PublishedAt on first publish
- Add "Manage Articles" entry on the dashboard
- Hide home page sign-in/dashboard buttons
- Add EN/ZH i18n keys for the management UI
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Gin + GORM + Tailwind CSS blog engine
- OS-aware config (Linux /etc/blog_go/, Windows ./win/etc/blog_go/)
- SQLite by default, MySQL support via config
- Auto-migrate database + seed admin user on first run
- Session-based auth (login/logout)
- i18n: Chinese/English with auto-detect + manual switch
- Avatar dropdown nav with click-to-toggle menu
- Profile page: avatar upload, edit info, change password
- Role system: admin (full access) and author (profile only)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kevinandClaude Fable 5