Merge branch 'about'

Application.hs

@@ -69,6 +69,7 @@ import Handler.AdminComments
 import Handler.Tag
 import Handler.RootFeed
 -- import Handler.Search
+import Handler.About
 
 -- This line actually creates our YesodDispatch instance. It is the second half
 -- of the call to mkYesodData which occurs in Foundation.hs. Please see the

Foundation.hs

@@ -98,9 +98,6 @@ renderLayout widget = do
     -- value passed to hamletToRepHtml cannot be a widget, this allows
     -- you to use normal widget features in default-layout.
 
-    copyrightWidget <- widgetToPageContent $
-        $(widgetFile "copyrightFooter")
-
     -- searchWidget <- widgetToPageContent $ [whamlet|
     --   <form action=@{SearchR} method=GET>
     --     <input type="hidden" name="_hasdata">

Handler/About.hs

@@ -0,0 +1,30 @@
+--  eidolon -- A simple gallery in Haskell and Yesod
+--  Copyright (C) 2015  Amedeo Molnár
+--
+--  This program is free software: you can redistribute it and/or modify
+--  it under the terms of the GNU Affero General Public License as published
+--  by the Free Software Foundation, either version 3 of the License, or
+--  (at your option) any later version.
+--
+--  This program is distributed in the hope that it will be useful,
+--  but WITHOUT ANY WARRANTY; without even the implied warranty of
+--  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+--  GNU Affero General Public License for more details.
+--
+--  You should have received a copy of the GNU Affero General Public License
+--  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+module Handler.About where
+
+import Import
+
+getAboutR :: Handler Html
+getAboutR = do
+  master <- getYesod
+  defaultLayout $
+    $(widgetFile "about")
+
+getThreatR :: Handler Html
+getThreatR =
+  defaultLayout $
+    $(widgetFile "threat")

Import.hs

@@ -50,3 +50,9 @@ infixr 5 <>
 (<>) :: Monoid m => m -> m -> m
 (<>) = mappend
 #endif
+
+import Data.Version
+import qualified Paths_eidolon as P
+
+version :: String
+version = showVersion $ P.version

README.md

@@ -81,7 +81,9 @@ want. The executable needs to be accompanied by the folders `config` and
 `static` and their contents. It's best to copy them to your desired destination.
 
 Also check `config/settings.yml` and set the values there accrding to your
-configuration. Especially the settings for elasticsearch are vital.
+configuration. The field `contactEmail` is optional, you can comment it out, but
+be aware. In certain jurisdictions you are required to give some contact
+information.
 
 It may also be necessery to create a reverse proxy to your gallery. I would
 recommend using [nginx](http://nginx.org/).

Settings.hs

@@ -64,10 +64,8 @@ data AppSettings = AppSettings
     -- ^ Perform no stylesheet/script combining
 
     -- Example app-specific configuration values.
-    , appCopyright              :: Text
+    , appAfferoLink             :: Text
-    -- ^ Copyright text to appear in the footer of the page
+    -- ^ Link to source code
-    , appCopyrightLink          :: Text
-    -- ^ Link to Copyright
     , appAnalytics              :: Maybe Text
     -- ^ Google Analytics code
     , appSignupBlocked          :: Bool
@@ -75,10 +73,7 @@ data AppSettings = AppSettings
     , appTos1                   :: Text
     , appTos2                   :: Text
     -- ^ Terms of Service
-    , appSearchHost             :: Text
+    , appContactEmail           :: Maybe Text
-    , appShards                 :: Int
-    , appReplicas               :: Int
-    -- ^ Settings for Elasticsearch
     }
 
 instance FromJSON AppSettings where
@@ -102,17 +97,14 @@ instance FromJSON AppSettings where
         appMutableStatic          <- o .:? "mutable-static"   .!= defaultDev
         appSkipCombining          <- o .:? "skip-combining"   .!= defaultDev
 
-        appCopyright              <- o .: "copyright"
+        appAfferoLink             <- o .: "afferoLink"
-        appCopyrightLink          <- o .: "copyrightLink"
         appAnalytics              <- o .:? "analytics"
 
         appSignupBlocked          <- o .: "signupBlocked"
         appTos1                   <- o .: "tos1"
         appTos2                   <- o .: "tos2"
 
-        appSearchHost             <- o .: "searchhost"
+        appContactEmail           <- o .:? "contactEmail"
-        appShards                 <- o .: "shards"
-        appReplicas               <- o .: "replicas"
 
         return AppSettings {..}
 

config/routes

@@ -73,3 +73,6 @@
 !/feed/user/#T.Text/rss.xml	NameFeedRssR		GET
 
 -- /search				SearchR			GET
+
+/about				AboutR			GET
+/about/threat			ThreatR			GET

config/settings.yml

@@ -41,10 +41,11 @@ database:
   database: "_env:PGDATABASE:eidolon"
   poolsize: "_env:PGPOOLSIZE:10"
 
-copyright: Powered by Eidolon
+afferoLink: https://github.com/nek0/eidolon
-copyrightLink: https://github.com/nek0/eidolon
 #analytics: UA-YOURCODE
 
+contactEmail: your@email.here
+
 # block signup process
 signupBlocked:  "_env:SIGNUP_BLOCK:false"
 

eidolon.cabal

@@ -1,5 +1,5 @@
 name:                eidolon
-version:             0.1.1.1
+version:             0.1.2.0
 synopsis:            Image gallery in Yesod
 homepage:            https://eidolon.nek0.eu
 license:             AGPL-3
@@ -20,6 +20,7 @@ Flag library-only
     Default:       False
 
 library
+    other-modules:   Paths_eidolon
     exposed-modules: Application
                      Foundation
                      Helper
@@ -51,6 +52,7 @@ library
                      Handler.RootFeed
                      Handler.Commons
                      -- Handler.Search
+                     Handler.About
 
     if flag(dev) || flag(library-only)
         cpp-options:   -DDEVELOPMENT

static/css/main.css

@@ -193,6 +193,10 @@ footer {
 	float: right;
 }
 
+ul, ol {
+	text-align: left;
+}
+
 @media (max-width: 755px) {
 	#main {
 		margin-top: 120px;

templates/about.hamlet

@@ -0,0 +1,20 @@
+$newline always
+
+<div .medium>
+  <h1>About this Eidolon
+  <p> Build version: #{version}
+  <p>
+    This software is licenced under the
+    <a href="http://www.gnu.org/licenses/agpl-3.0">
+      GNU Affero General Public License 3.0
+  <p>
+    The source code for this instance can be found at
+    <a href="#{appAfferoLink $ appSettings master}" target=_blank>
+      #{appAfferoLink $ appSettings master}
+  $maybe contact <- appContactEmail $ appSettings master
+    <p>
+      if you wish to contact the maintaner of this Eidolon, you can do it by
+      <a href="mailto:#{contact}">
+        email
+  <a href=@{ThreatR}>
+    Data and threat analysis

templates/copyrightFooter.hamlet

@@ -1 +0,0 @@
-<a href=#{appCopyrightLink $ appSettings master} target=_blank>#{appCopyright $ appSettings master}

templates/default-layout-wrapper.hamlet

@@ -18,7 +18,8 @@ $doctype 5
         ^{pageBody pc}
       <footer>
         <div class="left">
-          ^{pageBody copyrightWidget}
+          <a href=@{AboutR} target="_blank">
+            About Eidolon
         <div class="right">
           $case route
             $of Just HomeR

templates/threat.hamlet

@@ -0,0 +1,39 @@
+$newline always
+<div .medium>
+  <h1>
+    Data and threat analysis
+  <h2>
+    Eidolon stores the following data:
+  <ul>
+    <li>Usernames
+    <li>Email addresses
+    <li>Salted password hashes (SHA1) and the respective salt
+    <li>Images
+    <li>Upload time of images
+    <li>Image titles
+    <li>Image descriptions
+    <li>Image tags
+    <li>EXIF data of images are preserved
+    <li>Comment texts
+    <li>Time when comment was posted
+    <li>Comment author
+    <li>Album titles
+    <li>Album owner
+    <li>With whom the album is shared
+  <h2>
+    Database exposure
+  <p>
+    If an attacker were to gain access to the eidolon database they would have
+    access to the above information.
+  <p>
+    An attacker that gained access to the eidolon database could delete or
+    otherwise corrupt user data, potentially disrupting the service.
+  <h3>
+    Mitigation
+  <p>
+    Any discovery of a user's real identity can be mitigated by using an
+    anonymous email account.
+  <p>
+    Passwords are stored salted and hashed in the database rendering them
+    useless to an attacker.<br>Additionally the authentication mechanism does not
+    need the password to be transmitted in clear text to the server.