mirror of
https://github.com/PrivateBin/PrivateBin.git
synced 2024-03-22 13:10:41 +08:00
Merge branch 'release-1.4'
This commit is contained in:
El RIDO
commit
7ce853001d
|
|
@ -1,7 +1,7 @@
|
|||
# PrivateBin version history
|
||||
|
||||
* **1.4 (not yet released)**
|
||||
* ADDED: Translations for Corsican, Estonian and Lojban
|
||||
* **1.4 (2022-04-09)**
|
||||
* ADDED: Translations for Corsican, Estonian, Finnish and Lojban
|
||||
* ADDED: new HTTP headers improving security (#765)
|
||||
* ADDED: Download button for paste text (#774)
|
||||
* ADDED: Opt-out of federated learning of cohorts (FLoC) (#776)
|
||||
|
|
|
|||
12
CREDITS.md
12
CREDITS.md
|
|
@ -2,18 +2,17 @@
|
|||
|
||||
## Active contributors
|
||||
|
||||
Simon Rupf - current developer and maintainer
|
||||
rugk - security review, doc improvment, JS refactoring & various other stuff
|
||||
R4SAS - python client, compression, blob URI to support larger attachments
|
||||
* Simon Rupf - current developer and maintainer
|
||||
* rugk - security review, doc improvment, JS refactoring & various other stuff
|
||||
* R4SAS - python client, compression, blob URI to support larger attachments
|
||||
|
||||
## Past contributions
|
||||
|
||||
Sébastien Sauvage - original idea and main developer
|
||||
|
||||
* Sébastien Sauvage - original idea and main developer
|
||||
* Alexey Gladkov - syntax highlighting
|
||||
* Greg Knaddison - robots.txt
|
||||
* MrKooky - HTML5 markup, CSS cleanup
|
||||
* Simon Rupf - WebCrypto, unit tests, containers images, database backend, MVC, configuration, i18n
|
||||
* Simon Rupf - WebCrypto, unit tests, container images, database backend, MVC, configuration, i18n
|
||||
* Hexalyse - Password protection
|
||||
* Viktor Stanchev - File upload support
|
||||
* azlux - Tab character input support
|
||||
|
|
@ -56,3 +55,4 @@ Sébastien Sauvage - original idea and main developer
|
|||
* sarnane - Estonian
|
||||
* foxsouns - Lojban
|
||||
* Patriccollu di Santa Maria è Sichè - Corsican
|
||||
* Markus Mikkonen - Finnish
|
||||
|
|
|
|||
126
INSTALL.md
126
INSTALL.md
|
|
@ -1,39 +1,47 @@
|
|||
# Installation
|
||||
|
||||
**TL;DR:** Download the
|
||||
[latest release archive](https://github.com/PrivateBin/PrivateBin/releases/latest) (with the link labelled as „Source code (…)“)
|
||||
and extract it in your web hosts folder where you want to install your PrivateBin
|
||||
instance. We try to provide a mostly safe default configuration, but we urge you to
|
||||
check the [security section](#hardening-and-security) below and the [configuration
|
||||
options](#configuration) to adjust as you see fit.
|
||||
[latest release archive](https://github.com/PrivateBin/PrivateBin/releases/latest)
|
||||
(with the link labelled as "Source code (…)") and extract it in your web hosts
|
||||
folder where you want to install your PrivateBin instance. We try to provide a
|
||||
mostly safe default configuration, but we urge you to check the
|
||||
[security section](#hardening-and-security) below and the
|
||||
[configuration options](#configuration) to adjust as you see fit.
|
||||
|
||||
**NOTE:** See [our FAQ](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-can-i-securely-clonedownload-your-project) for information how to securely download the PrivateBin release files.
|
||||
**NOTE:** See our [FAQ entry on securely downloading release files](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-can-i-securely-clonedownload-your-project)
|
||||
for more information.
|
||||
|
||||
**NOTE:** There is a [ansible](https://ansible.com) role by @e1mo available to install and configure PrivateBin on your server. It's available on [ansible galaxy](https://galaxy.ansible.com/e1mo/privatebin) ([source code](https://git.sr.ht/~e1mo/ansible-role-privatebin)).
|
||||
**NOTE:** There is a [ansible](https://ansible.com) role by @e1mo available to
|
||||
install and configure PrivateBin on your server. It's available on
|
||||
[ansible galaxy](https://galaxy.ansible.com/e1mo/privatebin)
|
||||
([source code](https://git.sr.ht/~e1mo/ansible-role-privatebin)).
|
||||
|
||||
### Minimal requirements
|
||||
### Minimal Requirements
|
||||
|
||||
- PHP version 7.0 or above
|
||||
- Or PHP version 5.6 AND _one_ of the following sources of cryptographically safe randomness:
|
||||
- [Libsodium](https://download.libsodium.org/libsodium/content/installation/) and it's [PHP extension](https://paragonie.com/book/pecl-libsodium/read/00-intro.md#installing-libsodium)
|
||||
- open_basedir access to `/dev/urandom`
|
||||
- mcrypt extension (mcrypt needs to be able to access `/dev/urandom`. This means if `open_basedir` is set, it must include this file.)
|
||||
- Or PHP version 5.6 AND _one_ of the following sources of cryptographically
|
||||
safe randomness:
|
||||
- [Libsodium](https://download.libsodium.org/libsodium/content/installation/)
|
||||
and it's [PHP extension](https://paragonie.com/book/pecl-libsodium/read/00-intro.md#installing-libsodium)
|
||||
- `open_basedir` access to `/dev/urandom`
|
||||
- mcrypt extension AND `open_basedir` access to `/dev/urandom`
|
||||
- com_dotnet extension
|
||||
- GD extension
|
||||
- zlib extension
|
||||
- some disk space or (optionally) a database supported by [PDO](https://php.net/manual/book.pdo.php)
|
||||
- ability to create files and folders in the installation directory and the PATH defined in index.php
|
||||
- A web browser with JavaScript support
|
||||
- some disk space or a database supported by [PDO](https://php.net/manual/book.pdo.php)
|
||||
- ability to create files and folders in the installation directory and the PATH
|
||||
defined in index.php
|
||||
- A web browser with JavaScript and (optional) WebAssembly support
|
||||
|
||||
## Hardening and security
|
||||
## Hardening and Security
|
||||
|
||||
### Changing the path
|
||||
### Changing the Path
|
||||
|
||||
In the index.php you can define a different `PATH`. This is useful to secure your
|
||||
installation. You can move the configuration, data files, templates and PHP
|
||||
In the index.php you can define a different `PATH`. This is useful to secure
|
||||
your installation. You can move the configuration, data files, templates and PHP
|
||||
libraries (directories cfg, doc, data, lib, tpl, tst and vendor) outside of your
|
||||
document root. This new location must still be accessible to your webserver / PHP
|
||||
process (see also
|
||||
document root. This new location must still be accessible to your webserver and
|
||||
PHP process (see also
|
||||
[open_basedir setting](https://secure.php.net/manual/en/ini.core.php#ini.open-basedir)).
|
||||
|
||||
> #### PATH Example
|
||||
|
|
@ -42,24 +50,25 @@ process (see also
|
|||
> http://example.com/paste/
|
||||
>
|
||||
> The full path of PrivateBin on your webserver is:
|
||||
> /home/example.com/htdocs/paste
|
||||
> /srv/example.com/htdocs/paste
|
||||
>
|
||||
> When setting the path like this:
|
||||
> define('PATH', '../../secret/privatebin/');
|
||||
>
|
||||
> PrivateBin will look for your includes / data here:
|
||||
> /home/example.com/secret/privatebin
|
||||
> PrivateBin will look for your includes and data here:
|
||||
> /srv/example.com/secret/privatebin
|
||||
|
||||
### Changing the config path only
|
||||
|
||||
In situations where you want to keep the PrivateBin static files separate from the
|
||||
rest of your data, or you want to reuse the installation files on multiple vhosts,
|
||||
you may only want to change the `conf.php`. In this instance, you can set the
|
||||
you may only want to change the `conf.php`. In this case, you can set the
|
||||
`CONFIG_PATH` environment variable to the absolute path to the `conf.php` file.
|
||||
This can be done in your web server's virtual host config, the PHP config, or in
|
||||
the index.php if you choose to customize it.
|
||||
the index.php, if you choose to customize it.
|
||||
|
||||
Note that your PHP process will need read access to the config wherever it may be.
|
||||
Note that your PHP process will need read access to the configuration file,
|
||||
wherever it may be.
|
||||
|
||||
> #### CONFIG_PATH example
|
||||
> Setting the value in an Apache Vhost:
|
||||
|
|
@ -73,23 +82,27 @@ Note that your PHP process will need read access to the config wherever it may b
|
|||
|
||||
### Transport security
|
||||
|
||||
When setting up PrivateBin, also set up HTTPS, if you haven't already. Without HTTPS
|
||||
PrivateBin is not secure, as the JavaScript files could be manipulated during transmission.
|
||||
For more information on this, see our [FAQ entry on HTTPS setup](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-should-i-setup-https).
|
||||
When setting up PrivateBin, also set up HTTPS, if you haven't already. Without
|
||||
HTTPS PrivateBin is not secure, as the JavaScript or WebAssembly files could be
|
||||
manipulated during transmission. For more information on this, see our
|
||||
[FAQ entry on HTTPS setup recommendations](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-should-i-setup-https).
|
||||
|
||||
### File-level permissions
|
||||
|
||||
After completing the installation, you should make sure, other users on the system cannot read the config file or the `data/` directory, as – depending on your configuration – potential secret information are saved there.
|
||||
After completing the installation, you should make sure, that other users on the
|
||||
system cannot read the config file or the `data/` directory, as – depending on
|
||||
your configuration – potentially sensitive information may be stored in there.
|
||||
|
||||
See [this FAQ item](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#what-are-the-recommended-file-and-folder-permissions-for-privatebin) for a detailed guide on how to "harden" the permissions of files and folders.
|
||||
See our [FAQ entry on permissions](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#what-are-the-recommended-file-and-folder-permissions-for-privatebin)
|
||||
for a detailed guide on how to "harden" access to files and folders.
|
||||
|
||||
## Configuration
|
||||
|
||||
In the file `cfg/conf.php` you can configure PrivateBin. A `cfg/conf.sample.php`
|
||||
is provided containing all options and default values. You can copy it to
|
||||
`cfg/conf.php` and adapt it as needed. Alternatively you can copy it anywhere and
|
||||
set the `CONFIG_PATH` environment variable (see above notes). The config file is
|
||||
divided into multiple sections, which are enclosed in square brackets.
|
||||
is provided containing all options and their default values. You can copy it to
|
||||
`cfg/conf.php` and change it as needed. Alternatively you can copy it anywhere
|
||||
and set the `CONFIG_PATH` environment variable (see above notes). The config
|
||||
file is divided into multiple sections, which are enclosed in square brackets.
|
||||
|
||||
In the `[main]` section you can enable or disable the discussion feature, set
|
||||
the limit of stored pastes and comments in bytes. The `[traffic]` section lets
|
||||
|
|
@ -107,28 +120,28 @@ A `robots.txt` file is provided in the root dir of PrivateBin. It disallows all
|
|||
robots from accessing your pastes. It is recommend to place it into the root of
|
||||
your web directory if you have installed PrivateBin in a subdirectory. Make sure
|
||||
to adjust it, so that the file paths match your installation. Of course also
|
||||
adjust the file if you already use a `robots.txt`.
|
||||
adjust the file, if you already use a `robots.txt`.
|
||||
|
||||
A `.htaccess.disabled` file is provided in the root dir of PrivateBin. It blocks
|
||||
some known robots and link-scanning bots. If you use Apache, you can rename the
|
||||
file to `.htaccess` to enable this feature. If you use another webserver, you
|
||||
have to configure it manually to do the same.
|
||||
|
||||
### When using Cloudflare
|
||||
### On using Cloudflare
|
||||
|
||||
If you want to use PrivateBin behind Cloudflare, make sure you have disabled the Rocket
|
||||
loader and unchecked "Javascript" for Auto Minify, found in your domain settings,
|
||||
under "Speed". (More information
|
||||
[in this FAQ entry](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#user-content-how-to-make-privatebin-work-when-using-cloudflare-for-ddos-protection))
|
||||
If you want to use PrivateBin behind Cloudflare, make sure you have disabled the
|
||||
Rocket loader and unchecked "Javascript" for Auto Minify, found in your domain
|
||||
settings, under "Speed". More information can be found in our
|
||||
[FAQ entry on Cloudflare related issues](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#user-content-how-to-make-privatebin-work-when-using-cloudflare-for-ddos-protection).
|
||||
|
||||
### Using a database instead of flat files
|
||||
### Using a Database Instead of Flat Files
|
||||
|
||||
In the configuration file the `[model]` and `[model_options]` sections let you
|
||||
configure your favourite way of storing the pastes and discussions on your
|
||||
server.
|
||||
|
||||
`Filesystem` is the default model, which stores everything in files in the
|
||||
data folder. This is the recommended setup for most sites.
|
||||
data folder. This is the recommended setup for most sites on single hosts.
|
||||
|
||||
Under high load, in distributed setups or if you are not allowed to store files
|
||||
locally, you might want to switch to the `Database` model. This lets you
|
||||
|
|
@ -142,21 +155,26 @@ to use a prefix for
|
|||
The table prefix option is called `tbl`.
|
||||
|
||||
> #### Note
|
||||
> The `Database` model has only been tested with SQLite, MySQL and PostgreSQL,
|
||||
> although it would not be recommended to use SQLite in a production environment.
|
||||
> If you gain any experience running PrivateBin on other RDBMS, please let us
|
||||
> know.
|
||||
> The `Database` model has only been tested with SQLite, MariaDB/MySQL and
|
||||
> PostgreSQL, although it would not be recommended to use SQLite in a production
|
||||
> environment. If you gain any experience running PrivateBin on other RDBMS,
|
||||
> please let us know.
|
||||
|
||||
The following GRANTs (privileges) are required for the PrivateBin user in **MySQL**. In normal operation:
|
||||
The following GRANTs (privileges) are required for the PrivateBin user in
|
||||
**MariaDB/MySQL**. In normal operation:
|
||||
- INSERT, SELECT, DELETE on the paste and comment tables
|
||||
- SELECT on the config table
|
||||
|
||||
If you want PrivateBin to handle table creation (when you create the first paste) and updates (after you update PrivateBin to a new release), you need to give the user these additional privileges:
|
||||
If you want PrivateBin to handle table creation (when you create the first paste)
|
||||
and updates (after you update PrivateBin to a new release), you need to give the
|
||||
user these additional privileges:
|
||||
- CREATE, INDEX and ALTER on the database
|
||||
- INSERT and UPDATE on the config table
|
||||
|
||||
For reference or if you want to create the table schema for yourself to avoid having to give PrivateBin too many permissions (replace
|
||||
`prefix_` with your own table prefix and create the table schema with your favourite MySQL console):
|
||||
For reference or if you want to create the table schema for yourself to avoid
|
||||
having to give PrivateBin too many permissions (replace `prefix_` with your own
|
||||
table prefix and create the table schema with your favourite MariaDB/MySQL
|
||||
client):
|
||||
|
||||
```sql
|
||||
CREATE TABLE prefix_paste (
|
||||
|
|
@ -187,7 +205,7 @@ CREATE INDEX parent ON prefix_comment(pasteid);
|
|||
CREATE TABLE prefix_config (
|
||||
id CHAR(16) NOT NULL, value TEXT, PRIMARY KEY (id)
|
||||
);
|
||||
INSERT INTO prefix_config VALUES('VERSION', '1.3.5');
|
||||
INSERT INTO prefix_config VALUES('VERSION', '1.4.0');
|
||||
```
|
||||
|
||||
In **PostgreSQL**, the `data`, `attachment`, `nickname` and `vizhash` columns
|
||||
|
|
@ -199,7 +217,7 @@ to be `CLOB` and not `BLOB` or `MEDIUMBLOB`, the `id` column in the `config`
|
|||
table needs to be `VARCHAR2(16)` and the `meta` column in the `paste` table
|
||||
and the `value` column in the `config` table need to be `VARCHAR2(4000)`.
|
||||
|
||||
### Using Google Cloud Storage
|
||||
#### Using Google Cloud Storage
|
||||
If you want to deploy PrivateBin in a serverless manner in the Google Cloud, you
|
||||
can choose the `GoogleCloudStorage` as backend. To use this backend, you create
|
||||
a GCS bucket and specify the name as the model option `bucket`. Alternatively,
|
||||
|
|
|
|||
9
Makefile
9
Makefile
|
|
@ -1,7 +1,7 @@
|
|||
.PHONY: all coverage coverage-js coverage-php doc doc-js doc-php increment sign test test-js test-php help
|
||||
|
||||
CURRENT_VERSION = 1.3.5
|
||||
VERSION ?= 1.3.6
|
||||
CURRENT_VERSION = 1.4.0
|
||||
VERSION ?= 1.4.1
|
||||
VERSION_FILES = index.php cfg/ *.md css/ i18n/ img/ js/package.json js/privatebin.js lib/ Makefile tpl/ tst/
|
||||
REGEX_CURRENT_VERSION := $(shell echo $(CURRENT_VERSION) | sed "s/\./\\\./g")
|
||||
REGEX_VERSION := $(shell echo $(VERSION) | sed "s/\./\\\./g")
|
||||
|
|
@ -33,12 +33,13 @@ increment: ## Increment and commit new version number, set target version using
|
|||
do \
|
||||
sed -i "s/$(REGEX_CURRENT_VERSION)/$(REGEX_VERSION)/g" $$F; \
|
||||
done
|
||||
git add $(VERSION_FILES)
|
||||
cd tst && phpunit --no-coverage && cd ..
|
||||
git add $(VERSION_FILES) tpl/
|
||||
git commit -m "incrementing version"
|
||||
|
||||
sign: ## Sign a release.
|
||||
git tag $(VERSION)
|
||||
git push --tags
|
||||
git push origin $(VERSION)
|
||||
signrelease.sh
|
||||
|
||||
test: test-js test-php ## Run all unit tests.
|
||||
|
|
|
|||
53
README.md
53
README.md
|
|
@ -1,25 +1,27 @@
|
|||
# [](https://privatebin.info/)
|
||||
|
||||
*Current version: 1.3.5*
|
||||
*Current version: 1.4.0*
|
||||
|
||||
**PrivateBin** is a minimalist, open source online [pastebin](https://en.wikipedia.org/wiki/Pastebin)
|
||||
**PrivateBin** is a minimalist, open source online
|
||||
[pastebin](https://en.wikipedia.org/wiki/Pastebin)
|
||||
where the server has zero knowledge of pasted data.
|
||||
|
||||
Data is encrypted and decrypted in the browser using 256bit AES in [Galois Counter mode](https://en.wikipedia.org/wiki/Galois/Counter_Mode).
|
||||
Data is encrypted and decrypted in the browser using 256bit AES in
|
||||
[Galois Counter mode](https://en.wikipedia.org/wiki/Galois/Counter_Mode).
|
||||
|
||||
This is a fork of ZeroBin, originally developed by
|
||||
[Sébastien Sauvage](https://github.com/sebsauvage/ZeroBin). ZeroBin was refactored
|
||||
to allow easier and cleaner extensions. PrivateBin has many more features than the
|
||||
original ZeroBin. It is, however, still fully compatible to the original ZeroBin 0.19
|
||||
[Sébastien Sauvage](https://github.com/sebsauvage/ZeroBin). PrivateBin was
|
||||
refactored to allow easier and cleaner extensions and has many additional
|
||||
features. It is, however, still fully compatible to the original ZeroBin 0.19
|
||||
data storage scheme. Therefore, such installations can be upgraded to PrivateBin
|
||||
without losing any data.
|
||||
|
||||
## What PrivateBin provides
|
||||
|
||||
+ As a server administrator you don't have to worry if your users post content
|
||||
that is considered illegal in your country. You have no knowledge of any
|
||||
of the pastes content. If requested or enforced, you can delete any paste from
|
||||
your system.
|
||||
that is considered illegal in your country. You have plausible deniability of
|
||||
any of the pastes content. If requested or enforced, you can delete any paste
|
||||
from your system.
|
||||
|
||||
+ Pastebin-like system to store text documents, code samples, etc.
|
||||
|
||||
|
|
@ -31,13 +33,13 @@ without losing any data.
|
|||
|
||||
## What it doesn't provide
|
||||
|
||||
- As a user you have to trust the server administrator not to inject any malicious
|
||||
javascript code.
|
||||
For basic security, the PrivateBin installation *has to provide HTTPS*!
|
||||
Otherwise you would also have to trust your internet provider, and any country
|
||||
the traffic passes through.
|
||||
Additionally the instance should be secured by
|
||||
[HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security). It can use traditional certificate authorities and/or use
|
||||
- As a user you have to trust the server administrator not to inject any
|
||||
malicious code. For security, a PrivateBin installation *has to be used over*
|
||||
*HTTPS*! Otherwise you would also have to trust your internet provider, and
|
||||
any jurisdiction the traffic passes through. Additionally the instance should
|
||||
be secured by
|
||||
[HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security). It can
|
||||
use traditional certificate authorities and/or use a
|
||||
[DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions)
|
||||
protected
|
||||
[DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities)
|
||||
|
|
@ -45,18 +47,17 @@ without losing any data.
|
|||
|
||||
- The "key" used to encrypt the paste is part of the URL. If you publicly post
|
||||
the URL of a paste that is not password-protected, anyone can read it.
|
||||
Use a password if you want your paste to be private. In this case, make sure to
|
||||
use a strong password and only share it privately and end-to-end-encrypted.
|
||||
Use a password if you want your paste to remain private. In that case, make
|
||||
sure to use a strong password and share it privately and end-to-end-encrypted.
|
||||
|
||||
- A server admin might be forced to hand over access logs to the authorities.
|
||||
- A server admin can be forced to hand over access logs to the authorities.
|
||||
PrivateBin encrypts your text and the discussion contents, but who accessed a
|
||||
paste (first) might still be disclosed via access logs.
|
||||
|
||||
- In case of a server breach your data is secure as it is only stored encrypted
|
||||
on the server. However, the server could be misused or the server admin could
|
||||
be legally forced into sending malicious JavaScript to all web users, which
|
||||
grabs the decryption key and sends it to the server when a user accesses a
|
||||
PrivateBin.
|
||||
on the server. However, the server could be absused or the server admin could
|
||||
be legally forced into sending malicious code to their users, which logs
|
||||
the decryption key and sends it to a server when a user accesses a paste.
|
||||
Therefore, do not access any PrivateBin instance if you think it has been
|
||||
compromised. As long as no user accesses this instance with a previously
|
||||
generated URL, the content can't be decrypted.
|
||||
|
|
@ -77,8 +78,8 @@ file](https://github.com/PrivateBin/PrivateBin/wiki/Configuration):
|
|||
* Syntax highlighting for source code using prettify.js, including 4 prettify
|
||||
themes
|
||||
|
||||
* File upload support, images get displayed (disabled by default, possibility
|
||||
to adjust size limit)
|
||||
* File upload support, image, media and PDF preview (disabled by default, size
|
||||
limit adjustable)
|
||||
|
||||
* Templates: By default there are bootstrap CSS, darkstrap and "classic ZeroBin"
|
||||
to choose from and it is easy to adapt these to your own websites layout or
|
||||
|
|
@ -89,7 +90,7 @@ file](https://github.com/PrivateBin/PrivateBin/wiki/Configuration):
|
|||
|
||||
* Language selection (disabled by default, as it uses a session cookie)
|
||||
|
||||
* QR code generation of URL, to easily transfer pastes over to a mobile device
|
||||
* QR code for paste URLs, to easily transfer them over to mobile devices
|
||||
|
||||
## Further resources
|
||||
|
||||
|
|
|
|||
|
|
@ -4,8 +4,8 @@
|
|||
|
||||
| Version | Supported |
|
||||
| ------- | ------------------ |
|
||||
| 1.3.5 | :heavy_check_mark: |
|
||||
| < 1.3.5 | :x: |
|
||||
| 1.4.0 | :heavy_check_mark: |
|
||||
| < 1.4.0 | :x: |
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
body {
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
/* When there is no script at all other */
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
/* CSS Reset from YUI 3.4.1 (build 4118) - Copyright 2011 Yahoo! Inc. All rights reserved.
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
// change this, if your php files and data is outside of your webservers document root
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "privatebin",
|
||||
"version": "1.3.5",
|
||||
"version": "1.4.0",
|
||||
"description": "PrivateBin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bit AES in Galois Counter mode (GCM).",
|
||||
"main": "privatebin.js",
|
||||
"directories": {
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
* @see {@link https://github.com/PrivateBin/PrivateBin}
|
||||
* @copyright 2012 Sébastien SAUVAGE ({@link http://sebsauvage.net})
|
||||
* @license {@link https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License}
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
* @name PrivateBin
|
||||
* @namespace
|
||||
*/
|
||||
|
|
@ -627,7 +627,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
|
|||
* @prop {string[]}
|
||||
* @readonly
|
||||
*/
|
||||
const supportedLanguages = ['bg', 'ca', 'co', 'cs', 'de', 'es', 'et', 'fr', 'he', 'hu', 'id', 'it', 'jbo', 'lt', 'no', 'nl', 'pl', 'pt', 'oc', 'ru', 'sl', 'uk', 'zh'];
|
||||
const supportedLanguages = ['bg', 'ca', 'co', 'cs', 'de', 'es', 'et', 'fi', 'fr', 'he', 'hu', 'id', 'it', 'jbo', 'lt', 'no', 'nl', 'pl', 'pt', 'oc', 'ru', 'sl', 'uk', 'zh'];
|
||||
|
||||
/**
|
||||
* built in language
|
||||
|
|
@ -793,7 +793,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
|
|||
/**
|
||||
* per language functions to use to determine the plural form
|
||||
*
|
||||
* @see {@link https://localization-guide.readthedocs.org/en/latest/l10n/pluralforms.html}
|
||||
* @see {@link https://docs.translatehouse.org/projects/localization-guide/en/latest/l10n/pluralforms.html}
|
||||
* @name I18n.getPluralForm
|
||||
* @function
|
||||
* @param {int} n
|
||||
|
|
@ -823,7 +823,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
|
|||
return n % 10 === 1 && n % 100 !== 11 ? 0 : (n % 10 >= 2 && n % 10 <= 4 && (n % 100 < 10 || n % 100 >= 20) ? 1 : 2);
|
||||
case 'sl':
|
||||
return n % 100 === 1 ? 1 : (n % 100 === 2 ? 2 : (n % 100 === 3 || n % 100 === 4 ? 3 : 0));
|
||||
// bg, ca, de, en, es, et, hu, it, nl, no, pt
|
||||
// bg, ca, de, en, es, et, fi, hu, it, nl, no, pt
|
||||
default:
|
||||
return n !== 1 ? 1 : 0;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
@ -28,7 +28,7 @@ class Controller
|
|||
*
|
||||
* @const string
|
||||
*/
|
||||
const VERSION = '1.3.5';
|
||||
const VERSION = '1.4.0';
|
||||
|
||||
/**
|
||||
* minimal required PHP version
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Data;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Data;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Data;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
@ -305,7 +305,7 @@ class I18n
|
|||
/**
|
||||
* determines the plural form to use based on current language and given number
|
||||
*
|
||||
* From: https://localization-guide.readthedocs.org/en/latest/l10n/pluralforms.html
|
||||
* From: https://docs.translatehouse.org/projects/localization-guide/en/latest/l10n/pluralforms.html
|
||||
*
|
||||
* @access protected
|
||||
* @static
|
||||
|
|
@ -336,7 +336,7 @@ class I18n
|
|||
return $n % 10 == 1 && $n % 100 != 11 ? 0 : ($n % 10 >= 2 && $n % 10 <= 4 && ($n % 100 < 10 || $n % 100 >= 20) ? 1 : 2);
|
||||
case 'sl':
|
||||
return $n % 100 == 1 ? 1 : ($n % 100 == 2 ? 2 : ($n % 100 == 3 || $n % 100 == 4 ? 3 : 0));
|
||||
// bg, ca, de, en, es, et, hu, it, nl, no, pt
|
||||
// bg, ca, de, en, es, et, fi, hu, it, nl, no, pt
|
||||
default:
|
||||
return $n != 1 ? 1 : 0;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Model;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Model;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Model;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Persistence;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Persistence;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Persistence;
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin\Persistence;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
* @link https://github.com/PrivateBin/PrivateBin
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license http://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 1.3.5
|
||||
* @version 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@
|
|||
* @link http://sebsauvage.net/wiki/doku.php?id=php:vizhash_gd
|
||||
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
||||
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
||||
* @version 0.0.5 beta PrivateBin 1.3.5
|
||||
* @version 0.0.5 beta PrivateBin 1.4.0
|
||||
*/
|
||||
|
||||
namespace PrivateBin;
|
||||
|
|
|
|||
|
|
@ -73,7 +73,7 @@ endif;
|
|||
?>
|
||||
<script type="text/javascript" data-cfasync="false" src="js/purify-2.3.6.js" integrity="sha512-N1GGPjbqLbwK821ZN7C925WuTwU4aDxz2CEEOXQ6/s6m6MBwVj8fh5fugiE2hzsm0xud3q7jpjZQ4ILnpMREYQ==" crossorigin="anonymous"></script>
|
||||
<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
|
||||
<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-kFUoM3Qg6VzRTJGau3wWP2IRZQF2WToL7Dgvazxqp0jgYIKA5cCK9xFy9Zes208XX0nYP64scW2nJIYNk9pL6Q==" crossorigin="anonymous"></script>
|
||||
<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-/F0+9bIbFUC8mKQzrcAjIs2Jg92w1DMcczT2Y/KqHVkFEXH1ZSrqtUX7QjLH6RgVR0YhTxhmWkZ2c8scGCwpkQ==" crossorigin="anonymous"></script>
|
||||
<!-- icon -->
|
||||
<link rel="apple-touch-icon" href="<?php echo I18n::encode($BASEPATH); ?>img/apple-touch-icon.png" sizes="180x180" />
|
||||
<link rel="icon" type="image/png" href="img/favicon-32x32.png" sizes="32x32" />
|
||||
|
|
|
|||
|
|
@ -51,7 +51,7 @@ endif;
|
|||
?>
|
||||
<script type="text/javascript" data-cfasync="false" src="js/purify-2.3.6.js" integrity="sha512-N1GGPjbqLbwK821ZN7C925WuTwU4aDxz2CEEOXQ6/s6m6MBwVj8fh5fugiE2hzsm0xud3q7jpjZQ4ILnpMREYQ==" crossorigin="anonymous"></script>
|
||||
<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
|
||||
<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-kFUoM3Qg6VzRTJGau3wWP2IRZQF2WToL7Dgvazxqp0jgYIKA5cCK9xFy9Zes208XX0nYP64scW2nJIYNk9pL6Q==" crossorigin="anonymous"></script>
|
||||
<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-/F0+9bIbFUC8mKQzrcAjIs2Jg92w1DMcczT2Y/KqHVkFEXH1ZSrqtUX7QjLH6RgVR0YhTxhmWkZ2c8scGCwpkQ==" crossorigin="anonymous"></script>
|
||||
<!-- icon -->
|
||||
<link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" />
|
||||
<link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" />
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user