Repository navigation
Bring the docs up to date and match platform hosts exactly - #16
Merged
Merged
Conversation
- **Platform hosts:** `platform_of` takes a host as Instagram or Facebook only when it is the domain itself or a real subdomain of it, no longer any host that merely ends with the name (`evilinstagram.com`). The host allowlist already kept such hosts out; this makes the check exact on its own. New tests in `tests/test_urls.py`, three of which fail with the old code. - **CHANGELOG:** a section "Unreleased" for everything on `main` since 0.1.1 (the browser extension, cookies per platform, the cookie state in the health check, packs from partial downloads, the Instagram pause and more). The release renames it. - **Security notes (README, SECURITY.md):** the login cookie (400 days, an HMAC of the token, the same on every device, revoked only by a new token), the bearer token, the public `/healthz` with the cookie state, and where platform cookies live: `secrets/`, `/data/cookies/` from the extension, and a copy per job that a stop in the middle of a download leaves until the job expires. - **Legal:** a sentence on passing posts on to other apps, and one on the single cookie Sharewerk sets. - **NOTICE:** PyAV and the FFmpeg libraries its wheels bring. - **`.env.example`:** every `SHAREWERK_*` setting the code reads, including host, port, data folder and the trusted proxies. - **README:** the development start listens on 127.0.0.1, the PWA update test is listed, a note on the proxy example's address, the error texts as the page shows them, and the image size and quality of a pack.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
platform_oftakes a host as Instagram or Facebook only when it is the domain itself or a real subdomain of it, no longer any host that merely ends with the name (evilinstagram.com). The host allowlist already kept such hosts out; this makes the check exact on its own. New tests intests/test_urls.py, three of which fail with the old code.mainsince 0.1.1 (the browser extension, cookies per platform, the cookie state in the health check, packs from partial downloads, the Instagram pause and more). The release renames it./healthzwith the cookie state, and where platform cookies live:secrets/,/data/cookies/from the extension, and a copy per job that a stop in the middle of a download leaves until the job expires..env.example: everySHAREWERK_*setting the code reads, including host, port, data folder and the trusted proxies.