- #3: Path traversal fix in /archive and /archive-file routes via resolve() check - #4: SSRF mitigation - env-based SERVER_URL, no hardcoded internal IPs - #5: Stored XSS fix - remove |safe filter from article.html template - #6: Missing import os in scheduler.py (crash on import) - #7: Flask auth (password via NEWSARCHIVER_PASSWORD) + CSRF tokens - #8: Same as #5 (template XSS via |safe) - #9: Motley Fool API key removed - use env var interpolation - #10: Hardcoded paths in setup_cron.sh, stop_services.sh - use BASH_SOURCE - #11: Hardcoded user paths in singlefile_archive.py - use Path.home() - #16: HTTP RSS feeds updated to HTTPS (Barchart, Guardian, BBC, MarketWatch) - #24: SSRF - replace hardcoded 192.168.8.150:5000 with NEWSARCHIVER_SERVER_URL - #25: Command execution details sanitized in error messages - #26: Security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, CSP) - #27: Auth guard on all routes except RSS/Atom feeds - archive_engine.py: Add missing import os
46 lines
1.6 KiB
HTML
46 lines
1.6 KiB
HTML
{% extends "base.html" %}
|
|
|
|
{% block content %}
|
|
<article class="article-view">
|
|
<div class="article-header">
|
|
<div class="article-source">
|
|
<span class="source-label">From</span>
|
|
<span class="source-name">{{ source_name }}</span>
|
|
</div>
|
|
<h1>{{ article.title }}</h1>
|
|
|
|
<div class="article-meta">
|
|
<div class="article-meta-row">
|
|
{% if article.publish_date %}
|
|
<time class="article-date" datetime="{{ article.publish_date }}">{{ article.publish_date }}</time>
|
|
{% endif %}
|
|
{% if article.author %}
|
|
<span class="article-author">By <strong>{{ article.author }}</strong></span>
|
|
{% endif %}
|
|
</div>
|
|
<p class="article-url"><a href="{{ article.url }}" target="_blank">{{ article.url }}</a></p>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="article-content">
|
|
{% if article.content_text %}
|
|
<div class="article-text">
|
|
{% set lines = article.content_text.split('\n') -%}
|
|
{%- for line in lines %}
|
|
{%- if line|trim %}
|
|
<p>{{ line }}</p>
|
|
{%- endif %}
|
|
{%- endfor %}
|
|
</div>
|
|
{%- endif %}
|
|
</div>
|
|
|
|
<div class="article-actions">
|
|
<a href="/source/{{ source_slug }}" class="back-link">← Back to articles</a>
|
|
{% if article.archive_file_path %}
|
|
|
|
|
<a href="/archive-file/{{ article.archive_file_path|urlencode }}" target="_blank" title="View archived copy">Archived HTML</a>
|
|
{% endif %}
|
|
</div>
|
|
</article>
|
|
{% endblock %} |