vh/booth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(booth): the reveal button was inert; add kept-lane wipe and in-booth keep

Browse Source 
Three operator reports, one of them a real defect I had claimed was working.

THE REVEAL BUTTON DID NOTHING, for a day. Its handler sat after the content
block's closing tag, and a child template's out-of-block content is silently
DISCARDED by Jinja. The button rendered. The handler never reached the browser.
Two commits and a README paragraph said click-to-reveal worked, and the suite
passed the entire time because nothing asserted against the SERVED page -- the
template really did contain the code.

Two guards, both confirmed to FAIL when the defect is reintroduced rather than
merely added and assumed protective:
  * test_reveal_handler_actually_reaches_the_served_page greps the response
  * test_no_orphaned_markup_after_the_content_block guards the structure

While moving it, caught a second instance of the same class: the explanatory
comment I wrote for the fix contained a literal Jinja endblock tag, which Jinja
would have parsed as a real tag and used to close the block early.

KEPT-LANE ×. Wiping a kept booth required release-then-find-it-in-the-other-
lane. That protected nothing and cost a hunt -- the board you just released is
loose in a feed that turns over, and you have to go find it to finish a job you
had already decided on. Protection now lives in the confirmation, which names
the booth and says KEPT, instead of in the number of lanes you must traverse.
Release stays as the reversible option.

IN-BOOTH KEEP. `☆ keep` / `★ kept — release` beside "Wipe now", so promoting
does not mean navigating back to the index. The booth page did not previously
know its own kept state; it does now. Both post a `next` field to stay put --
and `next` is a form field, so it is attacker-controlled: only same-site
absolute paths are honoured, with `//host`, schemes and backslashes refused,
tested.

173 tests pass.
This commit is contained in:
vh
2026-09-21 08:40:26 -07:00
parent 59ba9f5c10
commit 21f4afc033
6 changed files with 194 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
booth/app.py
+16 -4
View File
@@ -704,6 +704,9 @@ def create_app(
**base_ctx,
"name": name,
"name_url": quote(name, safe=""),
# The page could not previously tell keep from release, so it
# offered neither and you had to go back to the index.
"kept": is_kept(booth),
# links.md is rendered AS the board below, so it must not also
# appear as a markdown doc tile — that would show the same
# content twice, once interactive and once not.
@@ -992,16 +995,25 @@ def create_app(
toggle_pin(resolve_booth(name), entry)
return RedirectResponse(url=f"/b/{quote(name, safe='')}/", status_code=303)
def _safe_next(nxt: str) -> str:
"""Where to land after keep/unkeep. Defaults to the index; a booth page
can ask to stay put. Only same-site absolute paths are honoured — `//`
and any scheme are refused, because a redirect target taken from a form
field is an open redirect if you do not check it."""
if nxt.startswith("/") and not nxt.startswith("//") and "\\" not in nxt:
return nxt
return "/"
@app.post("/b/{name}/keep")
def booth_keep(name: str):
def booth_keep(name: str, next: str = Form("/")):
(resolve_booth(name) / KEEP_MARKER).touch()
return RedirectResponse(url="/", status_code=303)
return RedirectResponse(url=_safe_next(next), status_code=303)
@app.post("/b/{name}/unkeep")
def booth_unkeep(name: str):
def booth_unkeep(name: str, next: str = Form("/")):
# missing_ok: releasing an already-released board is a no-op, not a 500.
(resolve_booth(name) / KEEP_MARKER).unlink(missing_ok=True)
return RedirectResponse(url="/", status_code=303)
return RedirectResponse(url=_safe_next(next), status_code=303)
@app.post("/b/{name}/blur")
def booth_blur(name: str, f: str = Form(...), on: str = Form("1")):
booth/templates/base.html
+14
View File
@@ -253,6 +253,20 @@
/* ★ keep, mirroring .wipe on the other shoulder of the card. Same
hover-to-reveal language as .release in the kept lane. */
.keepit{position:absolute;top:.5rem;left:.5rem;margin:0;opacity:0;transition:opacity .12s}
/* × on a KEPT card. Same shoulder as the ephemeral ×, deliberately tinted so
it does not read as the same weight of action. */
.wipe-kept{position:absolute;top:.5rem;right:.5rem;margin:0;opacity:0;transition:opacity .12s}
.card-kept:hover .wipe-kept,.wipe-kept:focus-within{opacity:1}
.wipe-kept button{font:inherit;line-height:1;cursor:pointer;border:1px solid var(--line);
border-radius:.3rem;padding:.02rem .3rem;background:var(--bg);color:var(--muted)}
.wipe-kept button:hover{background:var(--aus-red,#ff6b6b);color:var(--fg-on-accent,#fff);
border-color:var(--aus-red,#ff6b6b)}
/* keep / release from inside a booth, beside "Wipe now" */
.keep-lg{display:inline-block;margin:0 .4rem 0 0}
.keep-lg button{font:inherit;font-size:.8rem;line-height:1;padding:.32rem .6rem;
cursor:pointer;border:1px solid var(--line);border-radius:.3rem;
background:var(--bg);color:var(--fg)}
.keep-lg button:hover{background:var(--aus-blue);color:var(--fg-on-accent)}
.card:hover .keepit,.keepit:focus-within{opacity:1}
.keepit button{font:inherit;font-size:.9rem;line-height:1;padding:.1rem .34rem;
cursor:pointer;border:1px solid var(--line);border-radius:.3rem;
booth/templates/booth.html
+24 -6
View File
@@ -23,6 +23,19 @@
{# A durable multi-writer board gets no one-click wipe — same rule as the
kept lane on the index. Remove rows with the per-row ×, or release the
board from the index and wipe it from there. #}
{# Promote or release without going back to the index. `next` keeps you on
this page instead of bouncing you to /. #}
{% if kept %}
<form class="keep-lg" method="post" action="/b/{{ name_url }}/unkeep">
<input type="hidden" name="next" value="/b/{{ name_url }}/">
<button title="release — rejoins the TTL sweep">★ kept — release</button>
</form>
{% else %}
<form class="keep-lg" method="post" action="/b/{{ name_url }}/keep">
<input type="hidden" name="next" value="/b/{{ name_url }}/">
<button title="keep — exempt from the TTL sweep">☆ keep</button>
</form>
{% endif %}
{% if not board %}
<form class="wipe wipe-lg" method="post" action="/b/{{ name_url }}/delete"
onsubmit="return confirm('Wipe this booth now?')">
@@ -285,17 +298,22 @@
refresh();
})();
</script>
{% endblock %}
<script>
/* Progressive enhancement only: without JS a blurred item stays blurred.
Reveal is per-viewer and never persisted — reloading re-hides. */
/* Blur reveal. WARNING: this handler previously sat after the content
block's closing tag, which in a
child template Jinja DISCARDS — the button rendered and did nothing, and
two commits plus a README claimed click-to-reveal worked. Anything that
must reach the page belongs inside the content block. Verified now by
grepping the SERVED html for this function, not the template for the text.
Per-viewer and never persisted: a reload re-hides. */
document.querySelectorAll('.item.blurred .reveal').forEach(function (btn) {
btn.addEventListener('click', function () {
btn.addEventListener('click', function (ev) {
ev.preventDefault();
ev.stopPropagation();
var fig = btn.closest('.item');
var on = fig.classList.toggle('revealed');
btn.textContent = on ? '🙈 hide' : '👁 reveal';
});
});
</script>
{% endblock %}
booth/templates/index.html
+19 -10
View File
@@ -40,17 +40,26 @@
<a class="name" href="/b/{{ b.name_url }}/">{{ b.name }}</a>
<div class="sub">{{ b.count }} item{{ '' if b.count == 1 else 's' }} · kept · <a class="dl-link" href="/b/{{ b.name_url }}/?download=1" title="download this booth as a zip">⬇ zip</a></div>
</div>
{# Still no × here — a one-click wipe next to the durable stuff is a
footgun. But "deliberate" must not mean "impossible from the UI",
which is what it meant before: the only routes out were ssh or a
hand-written API call. Release drops the sentinel and the board moves
to the ephemeral lane, where the × already lives. Two deliberate
acts, both reachable, and the first one is reversible.
{# There IS a × here now (operator, 2026-09-21). The old rule was
release-then-find-it-in-the-other-lane, on the theory that two
deliberate acts protect durable boards. In practice it protects
nothing and costs a hunt: the board you just released is loose in a
feed that turns over, and you have to go find it to finish the job
you had already decided on.
The confirm says "wipe it from there" rather than "let it expire" on
purpose: releasing BUMPS the directory mtime, so the board's age
resets and it survives another full TTL. Unkeep-and-wait is a 24h
delay, not a delete. #}
The protection now lives in the CONFIRMATION, not in the number of
lanes you must traverse — this one names the booth and says the word
KEPT, where the ephemeral × just asks. A deliberate act, one click,
reachable.
Release still exists and is still the reversible option. Note it
BUMPS the directory mtime, so the board's age resets and it survives
another full TTL — unkeep-and-wait is a 24h delay, not a delete,
which is exactly why a direct × was worth adding. #}
<form class="wipe wipe-kept" method="post" action="/b/{{ b.name_url }}/delete"
onsubmit="return confirm('WIPE the KEPT booth \u201c{{ b.name }}\u201d?\n\nThis deletes it and its files immediately. Kept booths are the ones nothing else will clean up, so nobody else is going to do this for you — and nothing brings it back.')">
<button title="wipe this KEPT booth now" aria-label="wipe kept booth">×</button>
</form>
<form class="release" method="post" action="/b/{{ b.name_url }}/unkeep"
onsubmit="return confirm('Release \u201c{{ b.name }}\u201d?\n\nIt moves to the ephemeral lane so you can wipe it from there. Nothing is deleted by this step.')">
<button title="release this board so it can be wiped">release</button>