From 9b69de166fd539b66542518cda9dd170080c0ad6 Mon Sep 17 00:00:00 2001
From: Rob Loranger <dev@loranger.xyz>
Date: Mon, 11 Nov 2019 14:25:34 -0800
Subject: [PATCH 1/8] add silenced warning on invites page

---
 invites.go                 | 10 +++++++++-
 templates/user/invite.tmpl |  3 +++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/invites.go b/invites.go
index 1dba7bd..63216fa 100644
--- a/invites.go
+++ b/invites.go
@@ -56,12 +56,20 @@ func handleViewUserInvites(app *App, u *User, w http.ResponseWriter, r *http.Req
 
 	p := struct {
 		*UserPage
-		Invites *[]Invite
+		Invites   *[]Invite
+		Suspended bool
 	}{
 		UserPage: NewUserPage(app, r, u, "Invite People", f),
 	}
 
 	var err error
+
+	p.Suspended, err = app.db.IsUserSuspended(u.ID)
+	if err != nil {
+		log.Error("view invites: %v", err)
+		return ErrInternalGeneral
+	}
+
 	p.Invites, err = app.db.GetUserInvites(u.ID)
 	if err != nil {
 		return err
diff --git a/templates/user/invite.tmpl b/templates/user/invite.tmpl
index 1985bd5..edf7061 100644
--- a/templates/user/invite.tmpl
+++ b/templates/user/invite.tmpl
@@ -31,6 +31,9 @@ table td {
 </style>
 
 <div class="snug content-container">
+	{{if .Suspended}}
+		{{template "user-suspended"}}
+	{{end}}
 	<h1>Invite people</h1>
 	<p>Invite others to join <em>{{.SiteName}}</em> by generating and sharing invite links below.</p>
 

From 0766e6cb366a464327c8e20f2da987e71d5bcebc Mon Sep 17 00:00:00 2001
From: Rob Loranger <dev@loranger.xyz>
Date: Tue, 14 Jan 2020 10:44:56 -0800
Subject: [PATCH 2/8] fixes imported post times

changes the client side to round the unix time to avoid floats

alters the time to match the client time zone on the server side
---
 account_import.go          | 8 ++++++++
 templates/user/import.tmpl | 5 ++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/account_import.go b/account_import.go
index b34f3a7..1098798 100644
--- a/account_import.go
+++ b/account_import.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 
@@ -85,6 +86,7 @@ func handleImport(app *App, u *User, w http.ResponseWriter, r *http.Request) err
 		log.Error("invalid form data for file dates: %v", err)
 		return impart.HTTPError{http.StatusBadRequest, "form data for file dates was invalid"}
 	}
+	fileTZ := r.FormValue("tz")
 	files := r.MultipartForm.File["files"]
 	var fileErrs []error
 	filesSubmitted := len(files)
@@ -147,6 +149,12 @@ func handleImport(app *App, u *User, w http.ResponseWriter, r *http.Request) err
 			post.Collection = collAlias
 		}
 		dateTime := time.Unix(fileDates[formFile.Filename], 0)
+		offset, err := strconv.Atoi(fileTZ)
+		if err != nil {
+			log.Error("form time zone offset not a valid integer: %v", err)
+			continue
+		}
+		dateTime = dateTime.Add(time.Minute * time.Duration(offset))
 		post.Created = &dateTime
 		created := post.Created.Format("2006-01-02T15:04:05Z")
 		submittedPost := SubmittedPost{
diff --git a/templates/user/import.tmpl b/templates/user/import.tmpl
index 3400e2f..06ff8b7 100644
--- a/templates/user/import.tmpl
+++ b/templates/user/import.tmpl
@@ -32,6 +32,7 @@
 				<input id="fileInput" class="fileInput" name="files" type="file" multiple accept="text/markdown, text/plain"/>
 			</label>
 			<input id="fileDates" name="fileDates" hidden/>
+			<input id="tzInput" name="tz" hidden/>
 			<label>
 				Import these posts to:
 				<select name="collection">
@@ -42,13 +43,15 @@
 				</select>
 			</label>
 			<script>
+				const tzInput = document.getElementById('tzInput');
+				tzInput.value = new Date().getTimezoneOffset();
 				const fileInput = document.getElementById('fileInput');
 				const fileDates = document.getElementById('fileDates');
 				fileInput.addEventListener('change', (e) => {
 					const files = e.target.files;
 					let dateMap = {};
 					for (let file of files) {
-						dateMap[file.name] = file.lastModified / 1000;
+						dateMap[file.name] = Math.round(file.lastModified / 1000);
 					}
 					fileDates.value = JSON.stringify(dateMap);
 				})

From 571460f08d8b6b8db87670cd4f41984ddda90a6c Mon Sep 17 00:00:00 2001
From: Rob Loranger <dev@loranger.xyz>
Date: Wed, 15 Jan 2020 09:04:38 -0800
Subject: [PATCH 3/8] move timezone correction to client side

---
 account_import.go          | 8 --------
 templates/user/import.tmpl | 8 ++++----
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/account_import.go b/account_import.go
index 1098798..b34f3a7 100644
--- a/account_import.go
+++ b/account_import.go
@@ -9,7 +9,6 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"time"
 
@@ -86,7 +85,6 @@ func handleImport(app *App, u *User, w http.ResponseWriter, r *http.Request) err
 		log.Error("invalid form data for file dates: %v", err)
 		return impart.HTTPError{http.StatusBadRequest, "form data for file dates was invalid"}
 	}
-	fileTZ := r.FormValue("tz")
 	files := r.MultipartForm.File["files"]
 	var fileErrs []error
 	filesSubmitted := len(files)
@@ -149,12 +147,6 @@ func handleImport(app *App, u *User, w http.ResponseWriter, r *http.Request) err
 			post.Collection = collAlias
 		}
 		dateTime := time.Unix(fileDates[formFile.Filename], 0)
-		offset, err := strconv.Atoi(fileTZ)
-		if err != nil {
-			log.Error("form time zone offset not a valid integer: %v", err)
-			continue
-		}
-		dateTime = dateTime.Add(time.Minute * time.Duration(offset))
 		post.Created = &dateTime
 		created := post.Created.Format("2006-01-02T15:04:05Z")
 		submittedPost := SubmittedPost{
diff --git a/templates/user/import.tmpl b/templates/user/import.tmpl
index 06ff8b7..803a07c 100644
--- a/templates/user/import.tmpl
+++ b/templates/user/import.tmpl
@@ -32,7 +32,6 @@
 				<input id="fileInput" class="fileInput" name="files" type="file" multiple accept="text/markdown, text/plain"/>
 			</label>
 			<input id="fileDates" name="fileDates" hidden/>
-			<input id="tzInput" name="tz" hidden/>
 			<label>
 				Import these posts to:
 				<select name="collection">
@@ -43,15 +42,16 @@
 				</select>
 			</label>
 			<script>
-				const tzInput = document.getElementById('tzInput');
-				tzInput.value = new Date().getTimezoneOffset();
+				// timezone offset in seconds
+				const tzOffsetSec = new Date().getTimezoneOffset() * 60;
 				const fileInput = document.getElementById('fileInput');
 				const fileDates = document.getElementById('fileDates');
 				fileInput.addEventListener('change', (e) => {
 					const files = e.target.files;
 					let dateMap = {};
 					for (let file of files) {
-						dateMap[file.name] = Math.round(file.lastModified / 1000);
+						// convert from milliseconds to seconds and adjust for tz
+						dateMap[file.name] = Math.round(file.lastModified / 1000) + tzOffsetSec;
 					}
 					fileDates.value = JSON.stringify(dateMap);
 				})

From d6b7a5925f20ba7ca3d9f210188a3f1ceba07cf1 Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Wed, 29 Jan 2020 09:11:02 -0500
Subject: [PATCH 4/8] Restrict /invite/{code} route to valid chars
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, loading something like /invite/fFdblk😄 would return a 500,
due to a mix of collations in MySQL while SELECTing for an invite with
an ID of 'fFdblk😄'. This restricts the route to [a-zA-Z0-9] chars, to
prevent this.
---
 routes.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/routes.go b/routes.go
index ba531fb..023aca2 100644
--- a/routes.go
+++ b/routes.go
@@ -161,7 +161,7 @@ func InitRoutes(apper Apper, r *mux.Router) *mux.Router {
 	// Handle special pages first
 	write.HandleFunc("/login", handler.Web(viewLogin, UserLevelNoneRequired))
 	write.HandleFunc("/signup", handler.Web(handleViewLanding, UserLevelNoneRequired))
-	write.HandleFunc("/invite/{code}", handler.Web(handleViewInvite, UserLevelOptional)).Methods("GET")
+	write.HandleFunc("/invite/{code:[a-zA-Z0-9]+}", handler.Web(handleViewInvite, UserLevelOptional)).Methods("GET")
 	// TODO: show a reader-specific 404 page if the function is disabled
 	write.HandleFunc("/read", handler.Web(viewLocalTimeline, UserLevelReader))
 	RouteRead(handler, UserLevelReader, write.PathPrefix("/read").Subrouter())

From 51700cc7da47ad205187435ff8beaec2535b926f Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Thu, 30 Jan 2020 10:36:29 +0100
Subject: [PATCH 5/8] Ignore "mix of collations" error on invite SELECT

This adds the `isIgnorableError` method and calls it when error checking
in `GetUserInvite()`, returning "not found" if the rror comes up.
---
 database-no-sqlite.go | 14 +++++++++++++-
 database-sqlite.go    | 12 ++++++++++++
 database.go           |  5 +++--
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/database-no-sqlite.go b/database-no-sqlite.go
index a3d50fc..03d1a32 100644
--- a/database-no-sqlite.go
+++ b/database-no-sqlite.go
@@ -1,7 +1,7 @@
 // +build !sqlite,!wflib
 
 /*
- * Copyright © 2019 A Bunch Tell LLC.
+ * Copyright © 2019-2020 A Bunch Tell LLC.
  *
  * This file is part of WriteFreely.
  *
@@ -28,3 +28,15 @@ func (db *datastore) isDuplicateKeyErr(err error) bool {
 
 	return false
 }
+
+func (db *datastore) isIgnorableError(err error) bool {
+	if db.driverName == driverMySQL {
+		if mysqlErr, ok := err.(*mysql.MySQLError); ok {
+			return mysqlErr.Number == mySQLErrCollationMix
+		}
+	} else {
+		log.Error("isIgnorableError: failed check for unrecognized driver '%s'", db.driverName)
+	}
+
+	return false
+}
diff --git a/database-sqlite.go b/database-sqlite.go
index 3741169..bd77e6a 100644
--- a/database-sqlite.go
+++ b/database-sqlite.go
@@ -48,3 +48,15 @@ func (db *datastore) isDuplicateKeyErr(err error) bool {
 
 	return false
 }
+
+func (db *datastore) isIgnorableError(err error) bool {
+	if db.driverName == driverMySQL {
+		if mysqlErr, ok := err.(*mysql.MySQLError); ok {
+			return mysqlErr.Number == mySQLErrCollationMix
+		}
+	} else {
+		log.Error("isIgnorableError: failed check for unrecognized driver '%s'", db.driverName)
+	}
+
+	return false
+}
diff --git a/database.go b/database.go
index ef52d84..4948452 100644
--- a/database.go
+++ b/database.go
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2018 A Bunch Tell LLC.
+ * Copyright © 2018-2020 A Bunch Tell LLC.
  *
  * This file is part of WriteFreely.
  *
@@ -37,6 +37,7 @@ import (
 
 const (
 	mySQLErrDuplicateKey = 1062
+	mySQLErrCollationMix = 1267
 
 	driverMySQL  = "mysql"
 	driverSQLite = "sqlite3"
@@ -2281,7 +2282,7 @@ func (db *datastore) GetUserInvite(id string) (*Invite, error) {
 	var i Invite
 	err := db.QueryRow("SELECT id, max_uses, created, expires, inactive FROM userinvites WHERE id = ?", id).Scan(&i.ID, &i.MaxUses, &i.Created, &i.Expires, &i.Inactive)
 	switch {
-	case err == sql.ErrNoRows:
+	case err == sql.ErrNoRows, db.isIgnorableError(err):
 		return nil, impart.HTTPError{http.StatusNotFound, "Invite doesn't exist."}
 	case err != nil:
 		log.Error("Failed selecting invite: %v", err)

From 1b8f62d143ef90018674833c69f1e4bcb258132f Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Thu, 6 Feb 2020 17:44:02 -0500
Subject: [PATCH 6/8] Require authenticated user on draft edit routes

- /edit
- /meta
---
 routes.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/routes.go b/routes.go
index ba531fb..11c0389 100644
--- a/routes.go
+++ b/routes.go
@@ -175,8 +175,8 @@ func InitRoutes(apper Apper, r *mux.Router) *mux.Router {
 	}
 
 	// All the existing stuff
-	write.HandleFunc(draftEditPrefix+"/{action}/edit", handler.Web(handleViewPad, UserLevelOptional)).Methods("GET")
-	write.HandleFunc(draftEditPrefix+"/{action}/meta", handler.Web(handleViewMeta, UserLevelOptional)).Methods("GET")
+	write.HandleFunc(draftEditPrefix+"/{action}/edit", handler.Web(handleViewPad, UserLevelUser)).Methods("GET")
+	write.HandleFunc(draftEditPrefix+"/{action}/meta", handler.Web(handleViewMeta, UserLevelUser)).Methods("GET")
 	// Collections
 	if apper.App().cfg.App.SingleUser {
 		RouteCollections(handler, write.PathPrefix("/").Subrouter())

From 8cfffb56505318da1fc4253c59115be3cdc002bc Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Sun, 9 Feb 2020 10:51:34 -0500
Subject: [PATCH 7/8] Disable form items on Invite page when silenced

Ref T661
---
 templates/user/invite.tmpl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/templates/user/invite.tmpl b/templates/user/invite.tmpl
index edf7061..a853dc0 100644
--- a/templates/user/invite.tmpl
+++ b/templates/user/invite.tmpl
@@ -41,7 +41,7 @@ table td {
 		<div class="row">
 			<div class="half">
 				<label for="uses">Maximum number of uses:</label>
-				<select id="uses" name="uses">
+				<select id="uses" name="uses" {{if .Suspended}}disabled{{end}}>
 					<option value="0">No limit</option>
 					<option value="1">1 use</option>
 					<option value="5">5 uses</option>
@@ -53,7 +53,7 @@ table td {
 			</div>
 			<div class="half">
 				<label for="expires">Expire after:</label>
-				<select id="expires" name="expires">
+				<select id="expires" name="expires" {{if .Suspended}}disabled{{end}}>
 					<option value="0">Never</option>
 					<option value="30">30 minutes</option>
 					<option value="60">1 hour</option>
@@ -66,7 +66,7 @@ table td {
 			</div>
 		</div>
 		<div class="row">
-			<input type="submit" value="Generate" />
+			<input type="submit" value="Generate" {{if .Suspended}}disabled title="You cannot generate invites while your account is silenced."{{end}} />
 		</div>
 	</form>
 

From b78f64bad3d07f833e71e47270395196d792a6fd Mon Sep 17 00:00:00 2001
From: Matt Baer <matt@write.as>
Date: Sun, 9 Feb 2020 10:57:08 -0500
Subject: [PATCH 8/8] Don't fail Invite page rendering on IsUserSuspended check

---
 invites.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/invites.go b/invites.go
index 63216fa..e39ec3b 100644
--- a/invites.go
+++ b/invites.go
@@ -67,7 +67,6 @@ func handleViewUserInvites(app *App, u *User, w http.ResponseWriter, r *http.Req
 	p.Suspended, err = app.db.IsUserSuspended(u.ID)
 	if err != nil {
 		log.Error("view invites: %v", err)
-		return ErrInternalGeneral
 	}
 
 	p.Invites, err = app.db.GetUserInvites(u.ID)