jeffrey-deng/imcoder-blog

Java博客

imcoder-blog's Issues

Change file name style

keep different file names the same length of characters,
Split an album folder into multiple albums for upload a lot of images in one album without degrading performance.

Make page style same in zoom 100% and 125%

file size is to small in zoom 100%,
so use 'em' to implement style same in different zoom.

Develop the same photo to display in multiple albums

Sometimes I want to put the same photo warrior in a different album, but I just want to upload a source file to develop this requirement.
Also supports user-defined local configuration for some page layouts.

Add a popup modal for playing videos

Video page should add a popup modal for playing videos

Should add archives page and tags page

Add archive pages and tab pages to help users find targeted articles

Detecting the risk of sql injection in query data

When querying articles and photos, I found that there are risks of SQL injection when querying some fields that support regular matching, resulting in user data being leaked.

add server config push to user's browser

Manager could push a Specific configuration to user,and let user's browser cache refresh when code is updated

Should support file recycle bin for data recovery

A file recycle bin should be set up to prevent accidental deletion of files

Login invalidation when opening the login page

As long as the login page is opened (not the login box), the login will be invalid, and it will be useless even if it is refreshed,
the "remember password" function will also be invalid, re-opening the browser will not automatically log in.

Album should support upload videos.

Album should support upload videos.

add support for uploading file to a oss file system.

add remote file system interface and implement for aliyun oss.

The filter rules displayed in the url should be more user friendly when searching.

should modify encode regex expr implement from js to java

encode implement on backstage is more elegant and make the url be more friendly.

because writing the database rules in the url will make the url very long.
It should show the rules that the user can understand.
also should add help document for user.

add image file compression parameter config

make image file is compressed when photo is listing, and support manager change config in backend at any time.

Update photo source file and remember passwords in multiple terminals simultaneously

If someone uploads a photo, there is a small error in the direction photo to replace the uploaded photo file, because he does not want to change the display position of the photo, then you need a function to update the image source file.

The switch that has been added to the strict login mode has been turned off by default. Although the user who is not the same IP is logged in, the token that the user remembered before will not be deleted. However, if the user uses the mobile phone to access the computer at the same time, the user wants both terminals to remember passwords, which require different terminals to remember the same token.

Develop these features~

Sensitive cookie without the `HttpOnly` flag set

Hi @Jeffrey-deng,

Thanks for sharing the repository and it's a nice one.

I noticed one issue - the program src/main/java/site/imcoder/blog/Interceptor/LoginRequiredInterceptor.java has the following code:

                            Cookie identifier_cookie = new Cookie("identifier", longUid);
                            identifier_cookie.setPath(cookie_path);
                            identifier_cookie.setSecure(cookie_secure);
                            identifier_cookie.setMaxAge(max_age); // max_age
                            Cookie credential_cookie = new Cookie("credential", token);
                            credential_cookie.setPath(cookie_path);
                            credential_cookie.setSecure(cookie_secure);
                            credential_cookie.setMaxAge(max_age); // max_age
                            response.addCookie(identifier_cookie);
                            response.addCookie(credential_cookie);

I think for a sensitive cookie like credentials, both the Secure flag and the HttpOnly flag shall be set to avoid XSS attacks through client side JavaScripts. Please consider to make the change.

Thanks,
@luchua-bc