inabahare / lewd2 Goto Github PK

In case a user fucks up big time there should be a way to reset user token, generating a new one for them and discarding the old one.

Accessible from the user control panel like so (or something):

The whole panel could probably use some redesign but that's for another day.

I would like suggest a feature request for a bulk delete option for the view uploads page.

• What is the current behavior?
  View uploads lists the bulk of all our uploads ever posted. In the column delete there is a button for every line for us to be able to undo that bad accident of an upload.

• What change would you have see to the current feature?
  The option to purge my entire upload history and/or be able with for example check boxes to select which uploads I want to remove by hand and additionally maybe multi selecting the uploads you want to remove with Shift + Click?

• What is the motivation / use case for changing the behavior?
  To easier manage your most recent uploads, be able to purge your upload list quick and easy.

Basically it works like uguu.se.

Random filename is basically all it did was get rid of the filename part of the upload and only kept the random string. While custom filename let's user decide the filename part.

Can we add a timer for a schedueled scan every X hours, that will scan every file under a certain filesize?
For example: Scan every file under 512MiB every 24 hour.

Adjustable in config ofc :3

Show amount of files user has uploaded in /user/admin/view-users and /user/view-uploads, cuz that's neat! (and especially useful on the admin page)

What it says in the title

excuse me but what the fuck

You can quite easily crash the server by accessing /user/view-uploads, or by attempting to switch password at /user, all while not logged in.

2018-12-31 20:37 +01:00: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:37 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:37 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:37 +01:00: (node:3124) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:37 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:37 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:37 +01:00: (node:3124) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 2)
2018-12-31 20:37 +01:00: (node:3124) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

And then spamming it some more...

2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:38 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:38 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 3)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:38 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:38 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 4)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:38 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:38 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 5)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:38 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:38 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 6)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:38 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:38 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 7)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:38 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:38 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 8)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:38 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:38 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 9)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: TypeError: Cannot read property 'id' of undefined
2018-12-31 20:38 +01:00:     at get (/var/www/lewd2/dist/app.js:1052:80)
2018-12-31 20:38 +01:00:     at process._tickCallback (internal/process/next_tick.js:68:7)
2018-12-31 20:38 +01:00: (node:3124) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 10)

And then the server crashes! :)

Tell users how large files they can upload on their user page, like so:

What:
If you visit the View uploads tab the generated table is fixed to the page and with lower screen size won't enable side-scrolling disabling the actual intended use for the page.
Where:
https://lewd.se/view-uploads

Expected:
The generated table of content should enable side-scrolling on smaller screen sizes.

Actual:
If using a smaller screen size, the generated table drops below the navigation menu and doesn't enable side-scrolling.

System: Google Pixel 2
Browser: Firefox 65.0b7

Steps to reproduce:

1. Be logged in as user.
2. Navigate to https://lewd.se/view-uploads.
3. Observe the generated table being fixed unable to be accessed with side-scrolling and also below the menu items.

Image:

• What's happening?
  When the hard link count of a file reaches 65000, the server starts throwing errors and presents the user with a 504 Gateway Time-Out.

2019-01-18 18:24:21.2121+00:00: You have triggered an unhandledRejection, you may have forgotten to catch a Promise rejection:
2019-01-18 18:24:21.2121+00:00: Error: EMLINK: too many links, link '/var/www/lewd2/Public/uploads/cc0ab30ede7e_0.png' -> '/var/www/lewd2/Public/uploads/c4891de873b5_0.png'
2019-01-18 18:25:21.2121+00:00: (node:531) UnhandledPromiseRejectionWarning: Error: EMLINK: too many links, link '/var/www/lewd2/Public/uploads/cc0ab30ede7e_0.png' -> '/var/www/lewd2/Public/uploads/bb2e9d1566df_0.png'
2019-01-18 18:25:21.2121+00:00: (node:531) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 2)
2019-01-18 18:25:21.2121+00:00: (node:531) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.
2019-01-18 18:26:22.2222+00:00: (node:531) UnhandledPromiseRejectionWarning: Error: EMLINK: too many links, link '/var/www/lewd2/Public/uploads/cc0ab30ede7e_0.png' -> '/var/www/lewd2/Public/uploads/93d90566f30e_0.png'

and so on.

• What should be happening?
  Throw a 500 error instead and perhaps tell them there are too many (65000) duplicates of the same file.
  Also keep quiet in the error log, because it's handled and fine aye? 8-)

• But why?
  Because some thundercunt is going to try crash lewd.se one day and errors are annoying.

Add a way to remove files by the member page, also give a deletion link (like imgur does) when uploading a file.

Why? So you can delete files you didnt intend to upload, like your nudes or loli stash.

Shows on all admin pages if accessed by someone not logged in, non-admin user not tested.

.../user/admin/view-users
.../user/admin/token
.../user/admin/reset-password
.../user/admin/remove-files

TypeError: Cannot read property 'isadmin' of undefined
    at router.use (/var/www/lewd2/dist/app.js:2045:23)
    at Layer.handle [as handle_request] (/var/www/lewd2/node_modules/express/lib/router/layer.js:95:5)
    at trim_prefix (/var/www/lewd2/node_modules/express/lib/router/index.js:317:13)
    at /var/www/lewd2/node_modules/express/lib/router/index.js:284:7
    at Function.process_params (/var/www/lewd2/node_modules/express/lib/router/index.js:335:12)
    at next (/var/www/lewd2/node_modules/express/lib/router/index.js:275:10)
    at Function.handle (/var/www/lewd2/node_modules/express/lib/router/index.js:174:3)
    at router (/var/www/lewd2/node_modules/express/lib/router/index.js:47:12)
    at Layer.handle [as handle_request] (/var/www/lewd2/node_modules/express/lib/router/layer.js:95:5)
    at trim_prefix (/var/www/lewd2/node_modules/express/lib/router/index.js:317:13)

Feature: Link duplicate to original file in DB and reset original files deletion counter
Other Details: Not exactly sure how to deal with user deletions, remove that file-ID and replace with the one next in line?

Allow for inputting full URLs into an admin page which does the following:

• Removes file from hard disk + any duplicate of it
• Marks file(s) as "removed by google" in database
• List this action in a public list for transparency

Possibly also look into figuring out if Google provides an API for removing "Malicious or unwanted software" via their Search Console, and fully automate this (while still providing manual input)

Trying to generate password reset link at /user/admin/reset-password results in

2019-01-13 21:36:19.1919+01:00: (node:17701) UnhandledPromiseRejectionWarning: error: column "token" of relation "UpdatePasswordKeys" does not exist
2019-01-13 21:36:19.1919+01:00:     at Connection.parseE (/var/www/lewd2/node_modules/pg/lib/connection.js:554:11)
2019-01-13 21:36:19.1919+01:00:     at Connection.parseMessage (/var/www/lewd2/node_modules/pg/lib/connection.js:379:19)
2019-01-13 21:36:19.1919+01:00:     at Socket.<anonymous> (/var/www/lewd2/node_modules/pg/lib/connection.js:119:22)
2019-01-13 21:36:19.1919+01:00:     at Socket.emit (events.js:182:13)
2019-01-13 21:36:19.1919+01:00:     at addChunk (_stream_readable.js:283:12)
2019-01-13 21:36:19.1919+01:00:     at readableAddChunk (_stream_readable.js:264:11)
2019-01-13 21:36:19.1919+01:00:     at Socket.Readable.push (_stream_readable.js:219:10)
2019-01-13 21:36:19.1919+01:00:     at TCP.onStreamRead [as onread] (internal/stream_base_commons.js:94:17)
2019-01-13 21:36:19.1919+01:00: (node:17701) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 2)
2019-01-13 21:36:19.1919+01:00: (node:17701) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

When accessing /lewd.sxcu while not logged in, the response code is still HTTP/1.1 200 OK, even though it tells the user to log in. This should probably be changed to 401 (https://tools.ietf.org/html/rfc7235#section-3.1) or similar

this makes me a sad lad

Add waifus to the bottom of the page, loading random files from a folder

Absolutely not optional

Like if it's a million bytes it will return

{
    number: 1,
    unit: "MB"
}

The SQL connection fails (or something) after about 17 hours or someting like that, causing uploading to not work, you cannot log in and neither can /transparency be accessed as it reads from db

so you don't accidently show this in screenshots/streams or whatever

If cutting the heads off of catgirls is your goal then you've certainly made it, however this is not what I want :(

Accounts only given out by me or an admin by generating a link that expires after a certain time, user sets their own username and password.

File upload limit to be set while creating the link by admin (default value being the normal limit)
A way of deactivating of accounts would be neato too

When deleting files and refreshing the page, all the boxes stay ticked (in the same order as you ticked them earlier), which could lead to accidently deleting the wrong files. Perhaps tie the boxes to the specific ID of the file?

What:
If you click the [Change password] without any input the errors display the password lengths advised to be different for the two fields meant to be similar.

Where:
https://lewd.se/user

Expected:
The notification fields advising the user should have the same password length suggested for the two fields where the same put is advised.

Actual:
The notification fields advise the user different lengths minimum for the different identical fields.

Steps to reproduce:

1. Be logged in as user.
2. Navigate to https://lewd.se/user or user landing page.
3. Without any input in the Change password fields press the [Change password] button.
4. Observe notification fields two and three.

Image:

Say someone uploads illegal content, we'd then want to know who uploaded that, add a search box or something to the admin panel?

When an user deletes a file the site should ask user for confirmation, like "Are you sure you want to delete filename?".

Should also apply to multi-select mode.

2019-05-01 00:59:00.000+02:00: Finding files to scan
2019-05-01 00:59:00.000+02:00: Deleting 1514 files
2019-05-01 00:59:00.000+02:00: You have triggered an unhandledRejection, you may have forgotten to catch a Promise rejection:
2019-05-01 00:59:00.000+02:00: TypeError: (0 , _deleteFiles.default) is not a function
2019-05-01 00:59:00.000+02:00:     at Task.fileDeletion [as execution] (/var/www/lewd2/dist/cronactions.js:226:28)
2019-05-01 00:59:00.000+02:00:     at <anonymous>
2019-05-01 00:59:00.000+02:00:     at process._tickCallback (internal/process/next_tick.js:188:7)
2019-05-01 00:59:00.000+02:00: cronactions.js Promise: [object Promise] Reason: TypeError: (0 , _deleteFiles.default) is not a function
2019-05-01 00:59:00.000+02:00: Scanners:
2019-05-01 00:59:00.000+02:00: 	 VirusTotal
2019-05-01 00:59:00.000+02:00: Starting cronjob for VirusTotal
2019-05-01 00:59:00.000+02:00: Now doing cron operations :3

The log is full of this, not gonna paste all of that because that'd be ridiculous.

Allow multiple files be uploaded at once, drag and drop a bunch of files onto the upload button and itjustwerks.jpg

This button does absolutely nothing while it should.

• What are you doing
  Uploading lewd_doesn't_like_this.jpg

• What is happening
  https://too.lewd.se/0062115d1b4f_lewd_doesn't_like_this.jpg is returned which is 404
  File on disk is called 0062115d1b4f_lewd_doesn't_like_this.jpg

• What should be happening
  https://too.lewd.se/0062115d1b4f_lewd_doesn%27t_like_this.jpg should be returned
  file should still be lewd_doesn't_like_this.jpg once uploaded to lewd.

• Worth mentioning
  It shows up correctly on /user/view-uploads (clicking it still is 404 of course)
  

<a href="https://too.lewd.se/0062115d1b4f_lewd_doesn&#039;t_like_this.jpg">lewd_doesn't_like_this.jpg</a>

Yeah so the way AV scanning is handled is a bit shit, so if I could refactor the cronactions it would be swell

We are currently using soft links instead of hard links, while at least to my knowledge hard links are superior in this instance as we're on the same drive (and even same folder!).
This also doesn't totally fucking rape nginx, so that's good. :)

We're already shoving a login prompt in the users face when they're not logged in so the button is now useless

On the old lewd we showed "Currently storing X files (Y / day on average, Z today), totaling GiB in filesize."

What needs to be done:

• count files in database
• divide filecount by storage time in days (like 90)
• count files that are made today, as in after 00:00:00.000
• combined filesize of all files in DB

show this on info page :3

When uploading a file with spaces they are not replaced with %20, resulting in broken links like below.

$ curl -X POST -F "file=@file with spaces.svg" -H "token: <redacted>" https://lewd.se/upload
{"status":200,"data":{"link":"https://u.lewd.se/833980f7a82e_file with spaces.svg","deleteionURL":"https://lewd.se/delete/<redacted>"}}

Expected output would be https://u.lewd.se/833980f7a82e_file%20with%20spaces.svg

List newest uploads first instead of last, having a large amount of uploads makes the current layout a huge pain

Instead of redirecting to it's own page (like it does when you delete from directly accessing link), show a popup box with the message and delete item in background.

How I envision this feature:

Just a quality of life thing.

2019-02-08 08:25:35.3535+01:00: Something went wrong on the info page TypeError: uploadUnit.value.toFixed is not a function
2019-02-08 08:25:35.3535+01:00:     at getStatistics (/var/www/lewd2/dist/app.js:365:40)
2019-02-08 08:25:35.3535+01:00:     at <anonymous>
2019-02-08 08:25:35.3535+01:00:     at process._tickCallback (internal/process/next_tick.js:188:7)

when accessing /info

Because people are very good at jamming their entire first into the keyboard while typing, it seems.

Run a scanner from shell with specified arguments from a config file upon file upload (while still giving the end user his or her file)
If file turns out to be fine, schedule a second scan at a later date specified in config file.

When I log in, I get prompted as the title claims even though my password is exactly 72 characters long. Although this doesn't prevent you from logging in, it was pretty damn confusing at first because I thought I couldn't.

Ticking the box "Delete files" and pressing Save results in 504 Gateway Time-out, but I can see that it is removing the files in the background.

However, it also occured to me that it appears to be removing one file every 2 seconds or so, and deleting 65000 files (which is the case in this instance) will take literally over 36 hours!!
This clearly needs to be improved.

In conclusion: Don't throw 504 when deleting user along with files, and please for the love of god improve performance :D

Display files under the upload button, like pomf clones do. (it's cool aight?)
Filename to the left and the url to the right, neato~

Example:

Show some information while uploading files via webpage, like a progress bar with % and speed

Either put this inside the upload button or under it, idk which

Instead of crashing, either limit the input or just give a warning to contain themselves

What:
On desktop certain screen sizes specifically, between width 1023 -1087 px, the navbar goes white in sections but is still functional before transforming into the hamburger type menu

Where:
https://lewd.se/login

Expected:
The navbar consistently scales from a big window into the hamburger menu.

Actual:
Between certain window widths the navbar turns white in certain sections before transforming into the hamburger menu at the lowest width value of the issue.

Browsers:
Firefox Quantum 64.0 (64-bit)
Chrome Version 71.0.3578.98 (Official Build) (64-bit)

Steps to reproduce:

1. Navigate to https://lewd.se/login.
2. Reduce the width of your browser window by scaling it's side horizontally.
3. Between pixel width 1023 - 1087 you should observe the navbar turning white in certain sections rendering it unreadable.

Image: