ddcfa042a7
feat: timeline layout with dates on left grouped by day
2026-08-21 15:45:00 +00:00
e72d554a75
fix(ci): isolate e2e container name to prevent killing production
2026-08-21 15:45:00 +00:00
51d668fe3e
fix: remove stale container before e2e app start
2026-08-21 15:45:00 +00:00
dbdbbc73ed
feat: add Playwright E2E tests to CI
...
- 15 tests: home, listing, detail, nav, status, RSS/Atom, theme toggle
- CI e2e job seeds test DB (80 articles, 3 sources) in Docker container
- Tests run in mcr.microsoft.com/playwright:v1.51.0-jammy image
- Port 5000 published for health check from runner
- node_modules + test-results excluded from git
2026-08-21 15:45:00 +00:00
56bb633c68
fix: stable named volume for data persistence across deploys
2026-08-21 15:45:00 +00:00
c208bd99c5
fix: use pure shell instead of python3 for version parsing in runner
2026-08-21 15:45:00 +00:00
3848162f07
fix: use GITHUB_OUTPUT file in bump step too
2026-08-21 15:45:00 +00:00
0d77ba8505
fix: use python3 instead of jq for JSON parsing in runner
2026-08-21 15:45:00 +00:00
76727807a7
fix: add missing import os for environ access
2026-08-21 15:45:00 +00:00
11d2b44195
ci: use Gitea container registry instead of release branches
2026-08-21 15:45:00 +00:00
efc79a16e3
ci: add CODEOWNERS for official reviews
2026-08-21 15:45:00 +00:00
c3cdfe9adb
fix: lowercase docker image name for uppercase repo
2026-08-21 15:45:00 +00:00
d28b4b955c
ci: add PR check and release/deploy workflows with version.json
2026-08-21 15:45:00 +00:00
d19b174884
fix: fix docker build for CI
2026-08-21 15:45:00 +00:00
2bb690d3da
fix: add meta tags ( #30 ), favicon ( #31 ), aria-labels ( #29 )
2026-08-21 15:45:00 +00:00
6228589c14
fix: OPE hardening - logging, Docker, deps, scheduler, cleanup
...
- #12 : Remove duplicate logging.basicConfig() from 10 modules
- #15 : Remove redundant import re in rebuild_database.py
- #17 : rglob('*') → rglob('*.html/json/txt/xml/md') for speed
- #18 : Dockerfile individual COPY → glob COPY *.py/*.json + .dockerignore
- #19 : Remove deprecated docker-compose version field
- #20 : Pin requirements.txt versions (flask, requests, etc.)
- #22 : SIGALRM → threading.Timer for multi-threaded safety
- #23 : AP regex parsing → BeautifulSoup selectors
2026-08-21 15:45:00 +00:00
e5292bada7
fix: tests + URL-encoded path traversal fix + fix test files
...
- Add URL-decode in validate_archive_path to block ..%2F encoded traversal
- Rewrite test_storage_manager.py (was corrupted, #14 )
- Rewrite test_path_handling.py (remove hardcoded macOS path, #13 )
- Add test_web_interface.py (auth, CSRF, headers, XSS tests)
- All 11 tests pass
- Fixes : #1 path traversal, #2 XSS, #13 hardcoded path, #14 corrupted tests
2026-08-21 15:45:00 +00:00
73bf484a4c
CI: remove --no-cache for docker layer caching
2026-08-21 15:45:00 +00:00
31af35ec6d
CI: add generalized workflow
2026-08-21 15:45:00 +00:00
e2cbfa15b2
fix: security hardening - auth, CSRF, path traversal, XSS, secrets, headers
...
- #3 : Path traversal fix in /archive and /archive-file routes via resolve() check
- #4 : SSRF mitigation - env-based SERVER_URL, no hardcoded internal IPs
- #5 : Stored XSS fix - remove |safe filter from article.html template
- #6 : Missing import os in scheduler.py (crash on import)
- #7 : Flask auth (password via NEWSARCHIVER_PASSWORD) + CSRF tokens
- #8 : Same as #5 (template XSS via |safe)
- #9 : Motley Fool API key removed - use env var interpolation
- #10 : Hardcoded paths in setup_cron.sh, stop_services.sh - use BASH_SOURCE
- #11 : Hardcoded user paths in singlefile_archive.py - use Path.home()
- #16 : HTTP RSS feeds updated to HTTPS (Barchart, Guardian, BBC, MarketWatch)
- #24 : SSRF - replace hardcoded 192.168.8.150:5000 with NEWSARCHIVER_SERVER_URL
- #25 : Command execution details sanitized in error messages
- #26 : Security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, CSP)
- #27 : Auth guard on all routes except RSS/Atom feeds
- archive_engine.py: Add missing import os
2026-08-21 15:45:00 +00:00
21a59c0d34
most deletes
2026-08-21 15:45:00 +00:00
aa51dc766b
added docker support
2026-08-21 15:45:00 +00:00
49a657086e
fix singlefile archived links on the UI
2026-08-21 15:45:00 +00:00
4fce6c7528
Current state of NA
2026-08-21 15:45:00 +00:00
639f03fdb9
first commit
2026-03-31 09:37:06 -05:00
