Merge branch 'about'

This commit is contained in:
nek0 2016-09-09 21:42:54 +02:00
commit 5c20170b06
14 changed files with 119 additions and 22 deletions

View file

@ -69,6 +69,7 @@ import Handler.AdminComments
import Handler.Tag
import Handler.RootFeed
-- import Handler.Search
import Handler.About
-- This line actually creates our YesodDispatch instance. It is the second half
-- of the call to mkYesodData which occurs in Foundation.hs. Please see the

View file

@ -98,9 +98,6 @@ renderLayout widget = do
-- value passed to hamletToRepHtml cannot be a widget, this allows
-- you to use normal widget features in default-layout.
copyrightWidget <- widgetToPageContent $
$(widgetFile "copyrightFooter")
-- searchWidget <- widgetToPageContent $ [whamlet|
-- <form action=@{SearchR} method=GET>
-- <input type="hidden" name="_hasdata">

30
Handler/About.hs Normal file
View file

@ -0,0 +1,30 @@
-- eidolon -- A simple gallery in Haskell and Yesod
-- Copyright (C) 2015 Amedeo Molnár
--
-- This program is free software: you can redistribute it and/or modify
-- it under the terms of the GNU Affero General Public License as published
-- by the Free Software Foundation, either version 3 of the License, or
-- (at your option) any later version.
--
-- This program is distributed in the hope that it will be useful,
-- but WITHOUT ANY WARRANTY; without even the implied warranty of
-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-- GNU Affero General Public License for more details.
--
-- You should have received a copy of the GNU Affero General Public License
-- along with this program. If not, see <http://www.gnu.org/licenses/>.
module Handler.About where
import Import
getAboutR :: Handler Html
getAboutR = do
master <- getYesod
defaultLayout $
$(widgetFile "about")
getThreatR :: Handler Html
getThreatR =
defaultLayout $
$(widgetFile "threat")

View file

@ -50,3 +50,9 @@ infixr 5 <>
(<>) :: Monoid m => m -> m -> m
(<>) = mappend
#endif
import Data.Version
import qualified Paths_eidolon as P
version :: String
version = showVersion $ P.version

View file

@ -81,7 +81,9 @@ want. The executable needs to be accompanied by the folders `config` and
`static` and their contents. It's best to copy them to your desired destination.
Also check `config/settings.yml` and set the values there accrding to your
configuration. Especially the settings for elasticsearch are vital.
configuration. The field `contactEmail` is optional, you can comment it out, but
be aware. In certain jurisdictions you are required to give some contact
information.
It may also be necessery to create a reverse proxy to your gallery. I would
recommend using [nginx](http://nginx.org/).

View file

@ -64,10 +64,8 @@ data AppSettings = AppSettings
-- ^ Perform no stylesheet/script combining
-- Example app-specific configuration values.
, appCopyright :: Text
-- ^ Copyright text to appear in the footer of the page
, appCopyrightLink :: Text
-- ^ Link to Copyright
, appAfferoLink :: Text
-- ^ Link to source code
, appAnalytics :: Maybe Text
-- ^ Google Analytics code
, appSignupBlocked :: Bool
@ -75,10 +73,7 @@ data AppSettings = AppSettings
, appTos1 :: Text
, appTos2 :: Text
-- ^ Terms of Service
, appSearchHost :: Text
, appShards :: Int
, appReplicas :: Int
-- ^ Settings for Elasticsearch
, appContactEmail :: Maybe Text
}
instance FromJSON AppSettings where
@ -102,17 +97,14 @@ instance FromJSON AppSettings where
appMutableStatic <- o .:? "mutable-static" .!= defaultDev
appSkipCombining <- o .:? "skip-combining" .!= defaultDev
appCopyright <- o .: "copyright"
appCopyrightLink <- o .: "copyrightLink"
appAfferoLink <- o .: "afferoLink"
appAnalytics <- o .:? "analytics"
appSignupBlocked <- o .: "signupBlocked"
appTos1 <- o .: "tos1"
appTos2 <- o .: "tos2"
appSearchHost <- o .: "searchhost"
appShards <- o .: "shards"
appReplicas <- o .: "replicas"
appContactEmail <- o .:? "contactEmail"
return AppSettings {..}

View file

@ -73,3 +73,6 @@
!/feed/user/#T.Text/rss.xml NameFeedRssR GET
-- /search SearchR GET
/about AboutR GET
/about/threat ThreatR GET

View file

@ -41,10 +41,11 @@ database:
database: "_env:PGDATABASE:eidolon"
poolsize: "_env:PGPOOLSIZE:10"
copyright: Powered by Eidolon
copyrightLink: https://github.com/nek0/eidolon
afferoLink: https://github.com/nek0/eidolon
#analytics: UA-YOURCODE
contactEmail: your@email.here
# block signup process
signupBlocked: "_env:SIGNUP_BLOCK:false"

View file

@ -1,5 +1,5 @@
name: eidolon
version: 0.1.1.1
version: 0.1.2.0
synopsis: Image gallery in Yesod
homepage: https://eidolon.nek0.eu
license: AGPL-3
@ -20,6 +20,7 @@ Flag library-only
Default: False
library
other-modules: Paths_eidolon
exposed-modules: Application
Foundation
Helper
@ -51,6 +52,7 @@ library
Handler.RootFeed
Handler.Commons
-- Handler.Search
Handler.About
if flag(dev) || flag(library-only)
cpp-options: -DDEVELOPMENT

View file

@ -193,6 +193,10 @@ footer {
float: right;
}
ul, ol {
text-align: left;
}
@media (max-width: 755px) {
#main {
margin-top: 120px;

20
templates/about.hamlet Normal file
View file

@ -0,0 +1,20 @@
$newline always
<div .medium>
<h1>About this Eidolon
<p> Build version: #{version}
<p>
This software is licenced under the
<a href="http://www.gnu.org/licenses/agpl-3.0">
GNU Affero General Public License 3.0
<p>
The source code for this instance can be found at
<a href="#{appAfferoLink $ appSettings master}" target=_blank>
#{appAfferoLink $ appSettings master}
$maybe contact <- appContactEmail $ appSettings master
<p>
if you wish to contact the maintaner of this Eidolon, you can do it by
<a href="mailto:#{contact}">
email
<a href=@{ThreatR}>
Data and threat analysis

View file

@ -1 +0,0 @@
<a href=#{appCopyrightLink $ appSettings master} target=_blank>#{appCopyright $ appSettings master}

View file

@ -18,7 +18,8 @@ $doctype 5
^{pageBody pc}
<footer>
<div class="left">
^{pageBody copyrightWidget}
<a href=@{AboutR} target="_blank">
About Eidolon
<div class="right">
$case route
$of Just HomeR

39
templates/threat.hamlet Normal file
View file

@ -0,0 +1,39 @@
$newline always
<div .medium>
<h1>
Data and threat analysis
<h2>
Eidolon stores the following data:
<ul>
<li>Usernames
<li>Email addresses
<li>Salted password hashes (SHA1) and the respective salt
<li>Images
<li>Upload time of images
<li>Image titles
<li>Image descriptions
<li>Image tags
<li>EXIF data of images are preserved
<li>Comment texts
<li>Time when comment was posted
<li>Comment author
<li>Album titles
<li>Album owner
<li>With whom the album is shared
<h2>
Database exposure
<p>
If an attacker were to gain access to the eidolon database they would have
access to the above information.
<p>
An attacker that gained access to the eidolon database could delete or
otherwise corrupt user data, potentially disrupting the service.
<h3>
Mitigation
<p>
Any discovery of a user's real identity can be mitigated by using an
anonymous email account.
<p>
Passwords are stored salted and hashed in the database rendering them
useless to an attacker.<br>Additionally the authentication mechanism does not
need the password to be transmitted in clear text to the server.