From 34e39905f9e959e939e1a8638580a97c42aeee42 Mon Sep 17 00:00:00 2001 From: Lorenzo Yario Date: Wed, 29 Oct 2025 16:43:18 -0500 Subject: [PATCH 1/8] add simple sanity check for logins --- inc/mod/pages.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/inc/mod/pages.php b/inc/mod/pages.php index a3276702..97dc4711 100644 --- a/inc/mod/pages.php +++ b/inc/mod/pages.php @@ -57,6 +57,9 @@ function mod_login(Context $ctx, $redirect = false) { // Check if inputs are set and not empty if (!isset($_POST['username'], $_POST['password']) || $_POST['username'] == '' || $_POST['password'] == '') { $args['error'] = $config['error']['invalid']; + } + elseif (strlen($_POST['password']) > 128 || strlen($_POST['username']) > 128) { + $args['error'] = $config['error']['infotoolong']; } elseif (!login($_POST['username'], $_POST['password'])) { if ($config['syslog']) _syslog(LOG_WARNING, 'Unauthorized login attempt!'); From 44b9798c103b6fe5cae9a7ab04c3438167a9a9a0 Mon Sep 17 00:00:00 2001 From: Lorenzo Yario Date: Wed, 29 Oct 2025 16:44:55 -0500 Subject: [PATCH 2/8] Update config.php --- inc/config.php | 1 + 1 file changed, 1 insertion(+) diff --git a/inc/config.php b/inc/config.php index 458b9ee1..bdba69e8 100644 --- a/inc/config.php +++ b/inc/config.php @@ -1275,6 +1275,7 @@ // Moderator errors 'toomanyunban' => _('You are only allowed to unban %s users at a time. You tried to unban %u users.'), 'invalid' => _('Invalid username and/or password.'), + 'infotoolong' => _('Username and/or password contains too many characters.'), 'insecure' => _('Login on insecure connections is disabled.'), 'notamod' => _('You are not a mod…'), 'invalidafter' => _('Invalid username and/or password. Your user may have been deleted or changed.'), From f202fe93ec34ba66aa2fbbbe40515624bc41eef6 Mon Sep 17 00:00:00 2001 From: Lorenzo Yario Date: Wed, 29 Oct 2025 16:48:49 -0500 Subject: [PATCH 3/8] Update api.php --- inc/api.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inc/api.php b/inc/api.php index 4127576a..434c3439 100644 --- a/inc/api.php +++ b/inc/api.php @@ -209,7 +209,7 @@ class Api { return $apiCatalog; } - public function translateBoard(Board $board) { + public function translateBoard($board) { $apiBoard = []; foreach ($boards as $board) { From f71a001a02a81333bd8cde090ae3c22212249147 Mon Sep 17 00:00:00 2001 From: Lorenzo Yario Date: Wed, 29 Oct 2025 16:50:46 -0500 Subject: [PATCH 4/8] Delete static/banners/defaultbanner.png --- static/banners/defaultbanner.png | Bin 3675 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 static/banners/defaultbanner.png diff --git a/static/banners/defaultbanner.png b/static/banners/defaultbanner.png deleted file mode 100644 index 791457ad9426120069d4be5b1204d46e73154c92..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3675 zcmb7{_fr$h*2e<`o+PvoN0J<|h#=CGUQFmhkQyFZ5a|d~#n40V zC`eTZqJUBriHP83=Dzn2cz1So&d%BI=j@&z&dy0PH`Ql`T!H`q0A`GVjs*ZfBXMEh z0nuKpP44-*007HnjEgw}zsyDaK8&crvtNOOn0@js6Lipr(`;WpvkM}?R-ojlB z&)c{A*kcwJ7HVs2)6&vDeR5a$y1R?ootT&qJQiUJtP*Z+Ys-vX-B0J+l#~FY*4NjM zkB=q5(UYN!MtuYV&!4E!P@YSdE@P~%vr$A8alkAS`ntPY1blFQey-N0r?0;#q^{mo zQsV0Bs#*5o^XJcNYeH6FFc^hGSz1~?c<`W1SwmxgdwXPJVt}-`xX8^nxccL9XlQ#& zi@b=4h_LYU`uYoZlJDf?^fW0mQi9{NfB;tSp`YJF*_Mx&mM+zd zj*ebX@VONg72e+7`0LlNC$`_achB#^gZh^*-@bcSrFXW^7#bS-i-(=PsjDmPU9h`5 z-4uRfb5r|j2M(xDvq=8_^Jj2WlsX=}=X{yh>o7TtzplQX8coBBw70jP$uVWUB`?D& zLhHtR%`1~Z#S!mFCX;n_b#D(978GE)R{vktM+ogMv2f?ozb5;PCK*7?O?a(oZTiWyFA!$!hMvY2nkhWLAVKY1o^#2m`7+ zI9^+eDY_~DD$>Y^F>`txm5p_Jawrw^+r(K}K4Pv%s9^X>9k``@l|n%j>v~Z%N$u@C zd6*8K`MEiI6|jnm$_GX6svrdBml;|(cia>myghqhP4~oKqBI?=gb4M~Pof78bLC-5 zujptcGIO7e%*|O>Z*6tx`o@=nn8DYX28V|9_4HQmxFzO81BUXUzN|07ZqoNIXhE=2 z0J}V*`nKjEx?t)7{+AAhS?txSO`Ovy=Go%A>DN9tgdIu+H^h z1EEKJG-~Pi4>##95D+U{+fP!}lFr-)mDnE-@YB!m=X6IW5n^Iu-3uzw)^h~WdTNU%P(k{uUnV z%ey%$uPR!cAw@(9qxb9fv|uWjqz=QMVr%A-`BgjmP2%aw?#-Xcg9oOzQDA-?sb>bR z1mBAA!w+W8b_x<&cmN*33>L^ZAy{X-p-Ng4|(o(W?+C)A*B%sl@Tp?t8I8>N1FT z#TqSg*JLYwH-?-uN3cGoOoOH?Qd}vQ0s4w%o7&C)rt!cgQ{hb2$xv+y&hZXSqQ@ZO zJ<^!X52SikN3?AEN!E*DGw1c8=kY)iFSun>yWeDp8RJ==+3-0yT2sD7;~LAWD{iI! z+zLA4aW#ljV(XVLAb1BM{H-I}%_(ue$qSwWCit*h;?LNXtU>}z($5_Ym z?&Byl;bEdYm>tJEjE_39fv63WUth@a{WB21b=23rA17tBXT7OL;a#yZl1$#7hBcU+%!xbdm%>_@JQ!%Dc_5n z+zuL5@5g<1m4)1hpYhUxkBH2#Y$I2Cf-f%gKg9LD+q$s`#qQjneq7=gX(7oyaGtO2 zenmTD^>FtDIvUiE5Am>*LAs@ICrk3kVJ9z$e`_+M`n1LvCC@l;nbU`Yr$NR501yB$ z{;TAd%>n2KI3^$v1|S0vj20G$jll{bg#Mq~$8vZmh#e0_0+B#))$?*b`01B5)pl6_ zVfW|z%dNiuou_-A%dPJ#sda|dwyR$rE#9H-lJ|^%x~XImFmlB~X4DOr$_#L+R7Y=Uj1(&>R%-GJL`%G5KYn*8l;y~%aCp~*`soE|~ zl(y1G(TrG;w;|%qO%fq6rC9(m#yqR#u&HcF16dXvdt*KY(UB267zuh}7**2P=rpBV z$Bd>S+HswWpZ{rH!w_148W-W6F;~5N&f@Z!AbunCMP>PVdhsC}<3Ws-O{j;5nb2c964xi7lWCXq=%kuANYk{mwtRV$=kide43@goe+OAl zIHPSAJ@RESnp@WNV?|~-Y1E0uuR)3z@dj(yGo?t5ET>GL(Ez0Zk2W`T=P_j*^(ou=ujbD`2^I=Olh=u2@xTPP68&^;5EvEr?%b+c|kXL5Rc&Tn^E-~=hIqC?%|>ulorbRdE4Mx_&|SM`cw{SEn2 zLE2|5!a8s@x^I8|%&Jvt-@9yluw0~1bu7B!I8i9}iem)sy8B1`Da*G%GMkqo0sh?i1-QfCX`t1V7TwD`0_O7=cl66mL zr{Cd=oZ>y8;KvU;M&`<#nw4ECBW#g#D};u(0GzEE3}1NjI3 zqaNqxl%Q;0JN*DOO`nC&NXeQ_Sp{mkSjb8fRVrau&6-KC@EjATSS#T}uE9nitp3-#gqeX>~&-KRy zR6Y8^2Jb%B%h3vqLZzM(3`W_A{9bz&8SHWGqT3S+>~Gc(kWl{sF9Tiyj+2{5TFlrE z#_?c#_+A)uqK3C`uh%u951S5eZ)t8#&})JGsI6C|v>a0Z>hRwMg?_(h`&PU{ESW;w zJt3a=PHbS0Aon#5?GOo0D28!FP#t3({h?db$-gizFJ=Bmtm<(!ATX%2v%pBBM^JJ~ znEX5tf{@@W&cE~n8>B1(9BnOg64c0@Pq<6&QNk{f{BPHn2D=5Qg}DA0yTz&afrzeJ zXJF_swA$-vS(s?}(?w5=f%;tA5y{bhookH0jBUS~%&qU3I!z zjd>Ug8VaKRwEG$|Jv`E{KDF95Dc}*oARJDEDu^?~)pNK6j=G3)z5T~RVU3dx9%-^- ze4c@gnLcH#qdS?^Pqbjh{!&Qz=GG4dU_U%Adh{rKU2Y!KP6&RF7*0x$!8hCSE7EDG zK@i6b2J#dbovKVXB1(Yu){FvN&Pi2i1y$maCdM8XYJ(qge=U(JAUvnjXC5m{L(GN$ z(ufcPX|2G*EZ5VVO)z9>sblM= z#a%m%mz%Z-p`)a}r>qjJ3d+@3C~7Rrv_^@FKnkWevN`<*${&kj8^TA&Q^DUxsr7J2 zNN5Zk=E5b)-)GzLt4aX9Gx_QFfb6G8#)~R8xUjlG6HeyduJk_{GGlQVqcpkv;uw7)lK z>k$)B2uSzUf@IR~JSzQ^Ozc54^^&moD4seL;%|5s+H9T*gvXgIl(2~PrsJd=+Kr27 zU%;GxGtQZ>?xx<9-4RhftBF*;a?uXD0cJHS6WBVO@LK;If64goXG8 Date: Wed, 29 Oct 2025 16:51:53 -0500 Subject: [PATCH 5/8] Create .gitkeep --- static/banners/.gitkeep | 1 + 1 file changed, 1 insertion(+) create mode 100644 static/banners/.gitkeep diff --git a/static/banners/.gitkeep b/static/banners/.gitkeep new file mode 100644 index 00000000..8b137891 --- /dev/null +++ b/static/banners/.gitkeep @@ -0,0 +1 @@ + From 0b49efffa48c58f760c6f26064f8ad31efaf5ba5 Mon Sep 17 00:00:00 2001 From: Lorenzo Yario Date: Wed, 29 Oct 2025 16:52:17 -0500 Subject: [PATCH 6/8] Add files via upload --- static/banners/defaultbanner.png | Bin 0 -> 4719 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 static/banners/defaultbanner.png diff --git a/static/banners/defaultbanner.png b/static/banners/defaultbanner.png new file mode 100644 index 0000000000000000000000000000000000000000..b67a4b5b8a6e4d7ec75c8684551ea38272c0a4c7 GIT binary patch literal 4719 zcmbVQ*{LW=YAVyFpqyBm|a51nEv;kyeoI4v}twB_yPA>3H|K ze*eMyVdk21&8fNXIp@QP)zVPH$EC(aLqo$?QHDU#&;Z=1vn}u$YX5GNoq>i%BBBD3 z)%9OK%r%H1Ga-sv@c~<6X=}@ZZ34B3gHL69*!bh)aQLjdV`30eF#t9AOU^&Axa;j; za1oqRHi43#Z9Jy9GUw#@A#;=dPyX7`L6((YROfCeq|-M+J}p~{DN0y=TET(Pt6F!c4VP|fX|TjbxK2yBqg@oKj& z_g8MplupKrjm{Lp<^#>acbDT?g71+B!l92rioJ?9%2rYR7FpbcS!^1)l;Yldt1Vs~ zGVT6n&-U>dq}naILInKPy?rhGj#ul;Y6VIK>B@1kVArrgl4lYu@(Nz}H52tVLlO+9 z%tqK+fH!q0%*gv1oflq8hCa6IlxvVz_?@hw@@ZP-eE$COkT}ZWSAL`W`dTqmKDZ@u z>1U2;2X41o3N^_xZ{*T<2kcvz2sxkmxNljEMnUI9(z$o8P5MoD!jlJ?rRc0b`aR10 z#lc4!Q8)(=PafDReCay$;TCy!fMIS;}4gm^AoYbM7pu{K;*&iuFx(xd=CX#Y6X>ah=i_l!z}8<$Xz42xw+dz z9s-L=ScRGW3q510GmScfUVTKzg+?HzA?2DDcFL~e8u;JX#hoHmxW4gJRWm6is^v>8 zEqiF@iDRbSIsFK&6qG+lXCXGRx(&R)t~YHAxUjFdIopbMwECGXT(&e+c+XKA% zmWmagb6EO3NZ#I9{UMs--nr=7I4&6F-O1l`C zk5yd8%~Y=dd3`WnJr+k-N#qKR#Zvt7hC*DEewT}t65n6haBJ=So~`ViUO#mX0>(+7R`N;d^8DF zwy-m+8;)iy#`^jBd5n0B=3;}R&e>i%w^29+EIP^p7I>;0^lwj_4@2#_g!$$cv1s7+ zDX3PcqG+wFu>=PuY5ThmNBV(8R|s!335prw<3>B!b3FYep0QOZ>5q4_@Z4sz=T4kX zY=V*!l2F!gD1}x1d=$M%T3Gz{-@Xpl4@X9y7nor$v#1@5eE!bQ@62jhxIM2L_^|iZ zNq!o`&IZvNDe=y!cm@ShsYqU%--+taow1C(XnmyeGRdHIJ<6!sqN~$=z4PJjYQ5Qm ziDCX)ZxdBiFh+1Jcg+4wd4W`L>-($Yq~%6uzx`>id1^s>Jm15Exyr4Qp;@L2IH}LhSpkHM!7HZ7KXbejGi!EBc zIqbEF%~~hRx70M!dynJ^2(lu*e$vqj;FZG&2sCi$Xmd%##l*x|yx+Z3-P_nm(&PKf zLF1$-@EY#OVd@*p4PoJV(b>Ei33iXDcK*$U8;uvi2dEtAi3aG+Ybz=ai^}j>bZ#q` zQfT+DI{Ct_?}?TCL!|usNj|e|JROr}=K_PC*|WLT6|xphl1lD5aujEngRL2O_M&WDL zzuE9ontK8b4N|n=vGlVIWK(0j{C1;czpx2dMngFxYH(9yb{Upmyvj=AKSa9pe_ z0#j|FCos6fv8?r~`|+W`0vIFz6uP{F;Kt&6cmo+=5{qim(atu5{UU6|rqMDFy`~Jm}M^Q zfb1SU1?Ummk%B@NgAUTuN;zFj#ci)eMBI+cSxoM%Hd{K#q?nVNad(^6Yvp|L@0AB| z;VM4*QTcr^@A}y8XDQ}&m=$ZvR2ydX=bQEv)i1>f`}*l=pM)E&7`^!MX*kF1*#oT_ zjd{{k_r1jt(S{JG#_aE;JaKkgQF|2JIa-TCf#9Yu%22=9pW$M!9fha`!gd2zI1le0 zYtlX~s<~zko2vCiT~?Ol`29f!N}fggcZG10#|Lg!=yKi!nP+_XR}xa4L57PtHi%!J zt(E!SHgg5a+}H*?&RP58tsqNL@bC5@u!&dqZHs41F5<~t5_xc&QzK)jFLgW{6+1p4 zbW&s|NVedEEMIaFxrxpcedzU`7OWkFUZUmyh~oJ22CY362krMfT5C061Hmo>1Q5x6 zAbR!^h6chw335P`03$*PKoFW7kVp;HS!9JW<+l7h6@2@Z5Ec4;u$?9T{EZXx#E1@8!4 z9()H?YOeb9c0-$2v!$>8s13QlHbD-p-7nvquNV<~a0k%}Yf4N1Xz1LyciJ`mQ2ezQ zEy$neB`AD@(NPXJxx!IhL^9~bjq-)|kL23V<3VYv1MtW!{u_3lMn;Rbsj`c22D$r$ zbS4uN%+C$U$uUgn$87wpjC?y*ANMD6Z#)p++MEQ(a@~)`cJFsrw>tbz5Kq6Jo_39s zY97$DJ^y7aX4hSjE<0R9)*a=HIB^08r9Z37d01N0R@{8{{)KszmD-A7jS04)8TTor zQ46}m{`yuc&4uJLL?rTXi8#A?|5!3Qs^HY;;$$wRE;T*a><+sbbF*(|Al|U&G7gD> z*gq8h^7NgloxWXG?@}y4L%3`dNrgeY=CJJ@nw1eRnl_s=r{uJmWfL{^ejZjCXI^Nq zV(V7-D@;3ZydJR?im~=9Dz59B(&9IaY)D9X3 zXVK?gC(g6l{(XufJpwD;iLC?taBJJ@OFk}!pZ2rc1P|Ud-{S6gJg|~Nl0lzhpz{H6 zU{{tLsOlH6Vq1gLfbtx{W|=*iyl7NU{1n_#D!I@iOy2Zoe`j;KsJb(v3cr=6TxQD#`&I3 zp6^YF_{8C1JvRhlIoq@V8SdNHY%cQ$xH<{VZIxwyHt1JZZ4n8E+Oq=(*g!vizNKO? zYJKjl7E{`h^cn!$#LkELtNJYksPw3<;hrOn(swtp6-t6G&!CUG5|$N3F-^~7NH;y! z^mrZqz#|ZR$rA*IGL=TRc;Hsp`BbYs>l!2{9YZ1I*b(uMA${l_j0qT<@>rFvRF?|6GGbqabE(`hDs;_w8>yo`b<*EE%ZO1h;-W6Lyfdm_P>eG{ZV3tS}cV zatT0~dU%l$G}fyocYq(NwK-U|$*CUX0ZWZ}^snD;J$#CG(@deaM$Jc_N~clAYf9)kuTry_j3xodB0x~g%UX%U~Dt|T+=_QZESLy!(RWAokg%EK4TF?a2XIs-3E zTIGPpqUH-O`qed}bE_NYlBH`3L}z*?1xe9UTj~RhvLU7^cvnDl-=xIvKfCDKFL7jL zj`yeso@GW~L+t{#PPLL2yJ-azRcRbD(;kS-|AuO}42;eSCdv1bDOY_W-K5;A%|79w z6O=LT<39ry`Pbzu4SNn5ZDsZ(GM=F;ZI9v&=(+{?Nzb!hiY*^(-pK75?%;9{`AykQ zbB`CSZfVu&B)_t!eF4-RCp0C%q&Cl?xXzw4$u+f>mkJxeY55}KNnZLorRLNF$<&0u zh?=7SnBJM4iqP(Pu}+9W#9+OA*{PabqQqR?Y{vS?g~lnCc+LdX%Yb?s<;XA9?e| zRpIc09Iq1Wm#K$^38}|5_ACsl>=Xh_y`dyMHvr8JKJmSyqg@4VH%3U}fMk^wqqha9 zpEWWoJrR0GJl_8-5_CpzQJxm`vf^Ee*Z(pBQ@W@RTY?uS0fgW%&OA4005H literal 0 HcmV?d00001 From 83ae07baf823d1a0cfc14a5525b89d0f5a2f8dcb Mon Sep 17 00:00:00 2001 From: Lorenzo Yario Date: Wed, 29 Oct 2025 16:52:45 -0500 Subject: [PATCH 7/8] Update install.php --- install.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/install.php b/install.php index a2f6f3a5..d1b5cb43 100644 --- a/install.php +++ b/install.php @@ -1,7 +1,7 @@ Date: Wed, 29 Oct 2025 17:15:53 -0500 Subject: [PATCH 8/8] Update image.php --- inc/image.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/inc/image.php b/inc/image.php index 840c9004..cab5bb13 100644 --- a/inc/image.php +++ b/inc/image.php @@ -250,7 +250,7 @@ class ImageConvert extends ImageBase { if ($size = @getimagesize($src)) return $size; } - $size = shell_exec_error(($this->gm ? 'gm ' : '') . 'identify -format "%w %h" ' . escapeshellarg($src . '[0]')); + $size = shell_exec_error(($this->gm ? 'gm ' : 'magick ') . 'identify -format "%w %h" ' . escapeshellarg($src . '[0]')); if (preg_match('/^(\d+) (\d+)$/', $size, $m)) return array($m[1], $m[2]); return false; @@ -276,13 +276,13 @@ class ImageConvert extends ImageBase { if (!$this->temp) { if ($config['strip_exif']) { - if($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' . + if($error = shell_exec_error(($this->gm ? 'gm convert ' : 'magick ') . escapeshellarg($this->src) . ' -auto-orient -strip ' . escapeshellarg($src))) { $this->destroy(); error(_('Failed to redraw image!'), null, $error); } } else { - if($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' . + if($error = shell_exec_error(($this->gm ? 'gm convert ' : 'magick ') . escapeshellarg($this->src) . ' -auto-orient ' . escapeshellarg($src))) { $this->destroy(); error(_('Failed to redraw image!'), null, $error); @@ -329,7 +329,7 @@ class ImageConvert extends ImageBase { } else { $convert_args = &$config['convert_args']; - if (($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' . + if (($error = shell_exec_error(($this->gm ? 'gm convert ' : 'magick ') . sprintf($convert_args, $this->width, $this->height, @@ -348,7 +348,7 @@ class ImageConvert extends ImageBase { } else { $convert_args = &$config['convert_args']; - if (($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' . + if (($error = shell_exec_error(($this->gm ? 'gm convert ' : 'magick ') . sprintf($convert_args, $this->width, $this->height,