Merge 0709d739df into 376f687c38

The minimum version requirements are rough guesses, in practice any decently modern docker installation should work.

README.md

@@ -8,7 +8,7 @@ scrubbing](https://sjp.pwn.pl/sjp/;2527372). It is pronounced as *shoorubooru*.
 ## Features
 
 - Post content: images (JPG, PNG, GIF, animated GIF), videos (MP4, WEBM), Flash animations
-- Ability to retrieve web video content using [youtube-dl](https://github.com/ytdl-org/youtube-dl)
+- Ability to retrieve web video content using [yt-dlp](https://github.com/yt-dlp/yt-dlp)
 - Post comments
 - Post notes / annotations, including arbitrary polygons
 - Rich JSON REST API ([see documentation](doc/API.md))

client/css/comment-control.styl

@@ -127,6 +127,10 @@ $comment-border-color = #DDD
             color: mix($main-color, $inactive-link-color-darktheme)
 
 .comment-content
+    p
+        word-wrap: normal
+        word-break: break-word
+
     ul, ol
         list-style-position: inside
         margin: 1em 0

client/css/core-general.styl

@@ -300,10 +300,10 @@ a .access-key
         background-size: 20px 20px
     img
         opacity: 0
-        width: auto
+        width: 100%
         height: 100%
     video
-        width: auto
+        width: 100%
         height: 100%
 
 .flexbox-dummy

client/css/post-list-view.styl

@@ -187,6 +187,9 @@
             vertical-align: top
         @media (max-width: 1000px)
             display: block
+            &.bulk-edit-tags:not(.opened), &.bulk-edit-safety:not(.opened)
+                float: left
+                margin-right: 1em
     input
         margin-bottom: 0.25em
         margin-right: 0.25em

client/css/post-main-view.styl

@@ -15,38 +15,42 @@
             border: 0
             outline: 0
 
-        nav.buttons
-            margin-top: 0
-            display: flex
-            flex-wrap: wrap
-            article
-                flex: 1 0 33%
-                a
-                    display: inline-block
-                    width: 100%
-                    padding: 0.3em 0
-                    text-align: center
-                    vertical-align: middle
-                    transition: background 0.2s linear, box-shadow 0.2s linear
-                    &:not(.inactive):hover
-                        background: lighten($main-color, 90%)
-                i
-                    font-size: 140%
+    >.sidebar>nav.buttons, >.content nav.buttons
+        margin-top: 0
+        display: flex
+        flex-wrap: wrap
+        article
+            flex: 1 0 33%
+            a
+                display: inline-block
+                width: 100%
+                padding: 0.3em 0
                 text-align: center
-            @media (max-width: 800px)
-                margin-top: 2em
+                vertical-align: middle
+                transition: background 0.2s linear, box-shadow 0.2s linear
+                &:not(.inactive):hover
+                    background: lighten($main-color, 90%)
+            i
+                font-size: 140%
+            text-align: center
+        @media (max-width: 800px)
+            margin-top: 0.6em
+            margin-bottom: 0.6em
 
     >.content
         width: 100%
 
     .post-container
-        margin-bottom: 2em
+        margin-bottom: 0.6em
 
         .post-content
             margin: 0
 
+    .after-mobile-controls
+        width: 100%
+
 .darktheme .post-view
-    >.sidebar
+    >.sidebar, >.content
         nav.buttons
             article
                 a:not(.inactive):hover
@@ -56,6 +60,8 @@
 @media (max-width: 800px)
     .post-view
         flex-wrap: wrap
+        >.after-mobile-controls
+            order: 3
         >.sidebar
             order: 2
             min-width: 100%
@@ -113,7 +119,6 @@
         h1
             margin-bottom: 0.5em
         .thumbnail
-            background-position: 50% 30%
             width: 4em
             height: 3em
         li

client/css/user-list-view.styl

@@ -21,10 +21,11 @@
     .details
         font-size: 90%
         line-height: 130%
+    .image
+        margin: 0.25em 0.6em 0.25em 0
     .thumbnail
         width: 3em
         height: 3em
-        margin: 0.25em 0.6em 0 0
 
 .darktheme .user-list
     ul li

client/html/index.htm

@@ -2,7 +2,7 @@
 <html>
 <head>
     <meta charset='utf-8'/>
-    <meta name='viewport' content='width=device-width, initial-scale=1, maximum-scale=1'/>
+    <meta name='viewport' content='width=device-width, initial-scale=1.0'>
     <meta name='theme-color' content='#24aadd'/>
     <meta name='apple-mobile-web-app-capable' content='yes'/>
     <meta name='apple-mobile-web-app-status-bar-style' content='black'/>

client/html/post_main.tpl

@@ -29,6 +29,7 @@
                     <span class='vim-nav-hint'>Next post &gt;</span>
                 </a>
             </article>
+            <% if (ctx.canEditPosts || ctx.canDeletePosts || ctx.canFeaturePosts) { %>
             <article class='edit-post'>
                 <% if (ctx.editMode) { %>
                     <a href='<%= ctx.getPostUrl(ctx.post.id, ctx.parameters) %>'>
@@ -36,16 +37,13 @@
                         <span class='vim-nav-hint'>Back to view mode</span>
                     </a>
                 <% } else { %>
-                    <% if (ctx.canEditPosts || ctx.canDeletePosts || ctx.canFeaturePosts) { %>
-                        <a href='<%= ctx.getPostEditUrl(ctx.post.id, ctx.parameters) %>'>
-                    <% } else { %>
-                        <a class='inactive'>
-                    <% } %>
-                        <i class='fa fa-pencil'></i>
-                        <span class='vim-nav-hint'>Edit post</span>
+                    <a href='<%= ctx.getPostEditUrl(ctx.post.id, ctx.parameters) %>'>
+                    <i class='fa fa-pencil'></i>
+                    <span class='vim-nav-hint'>Edit post</span>
                     </a>
                 <% } %>
             </article>
+            <% } %>
         </nav>
 
         <div class='sidebar-container'></div>
@@ -54,13 +52,15 @@
     <div class='content'>
         <div class='post-container'></div>
 
-        <% if (ctx.canListComments) { %>
-            <div class='comments-container'></div>
-        <% } %>
+        <div class='after-mobile-controls'>
+            <% if (ctx.canCreateComments) { %>
+                <h2>Add comment</h2>
+                <div class='comment-form-container'></div>
+            <% } %>
 
-        <% if (ctx.canCreateComments) { %>
-            <h2>Add comment</h2>
-            <div class='comment-form-container'></div>
-        <% } %>
+            <% if (ctx.canListComments) { %>
+                <div class='comments-container'></div>
+            <% } %>
+        </div>
     </div>
 </div>

client/html/post_readonly_sidebar.tpl

@@ -17,8 +17,8 @@
                     'video/mp4': 'MPEG-4',
                     'video/quicktime': 'MOV',
                     'application/x-shockwave-flash': 'SWF',
-                }[ctx.post.mimeType] %>
-            </a>
+                }[ctx.post.mimeType] %><!--
+            --></a>
             (<%- ctx.post.canvasWidth %>x<%- ctx.post.canvasHeight %>)
             <% if (ctx.post.flags.length) { %><!--
                 --><% if (ctx.post.flags.includes('loop')) { %><i class='fa fa-repeat'></i><% } %><!--
@@ -58,7 +58,7 @@
             Search on
             <a href='http://iqdb.org/?url=<%- encodeURIComponent(ctx.post.fullContentUrl) %>'>IQDB</a> &middot;
             <a href='https://danbooru.donmai.us/posts?tags=md5:<%- ctx.post.checksumMD5 %>'>Danbooru</a> &middot;
-            <a href='https://www.google.com/searchbyimage?&image_url=<%- encodeURIComponent(ctx.post.fullContentUrl) %>'>Google Images</a>
+            <a href='https://lens.google.com/uploadbyurl?url=<%- encodeURIComponent(ctx.post.fullContentUrl) %>'>Google Images</a>
         </section>
 
         <section class='social'>
@@ -99,10 +99,10 @@
                         --><% if (ctx.canListPosts) { %><!--
                             --><a href='<%- ctx.formatClientLink('posts', {query: ctx.escapeTagName(tag.names[0])}) %>' class='<%= ctx.makeCssName(tag.category, 'tag') %>'><!--
                         --><% } %><!--
-                            --><%- ctx.getPrettyName(tag.names[0]) %>&#32;<!--
+                            --><%- ctx.getPrettyName(tag.names[0]) %><!--
                         --><% if (ctx.canListPosts) { %><!--
                             --></a><!--
-                        --><% } %><!--
+                        --><% } %>&#32;<!--
                         --><span class='tag-usages' data-pseudo-content='<%- tag.postCount %>'></span><!--
                     --></li><!--
                 --><% } %><!--

client/html/posts_header.tpl

@@ -16,7 +16,6 @@
         %><form class='horizontal bulk-edit bulk-edit-tags'><%
             %><span class='append hint'>Tagging with:</span><%
             %><a href class='mousetrap button append open'>Mass tag</a><%
-            %><wbr/><%
             %><%= ctx.makeTextInput({name: 'tag', value: ctx.parameters.tag}) %><%
             %><input class='mousetrap start' type='submit' value='Start tagging'/><%
             %><a href class='mousetrap button append close'>Stop tagging</a><%

client/js/api.js

@@ -100,6 +100,10 @@ class Api extends events.EventTarget {
         return remoteConfig.contactEmail;
     }
 
+    getAllowedExtensions() {
+    	return remoteConfig.allowedExtensions;
+    }
+
     canSendMails() {
         return !!remoteConfig.canSendMails;
     }

client/js/controllers/pool_controller.js

@@ -91,16 +91,16 @@ class PoolController {
     _evtUpdate(e) {
         this._view.clearMessages();
         this._view.disableForm();
-        if (e.detail.names !== undefined) {
+        if (e.detail.names !== undefined && e.detail.names !== null) {
             e.detail.pool.names = e.detail.names;
         }
-        if (e.detail.category !== undefined) {
+        if (e.detail.category !== undefined && e.detail.category !== null) {
             e.detail.pool.category = e.detail.category;
         }
-        if (e.detail.description !== undefined) {
+        if (e.detail.description !== undefined && e.detail.description !== null) {
             e.detail.pool.description = e.detail.description;
         }
-        if (e.detail.posts !== undefined) {
+        if (e.detail.posts !== undefined && e.detail.posts !== null) {
             e.detail.pool.posts.clear();
             for (let postId of e.detail.posts) {
                 e.detail.pool.posts.add(

client/js/controllers/pool_list_controller.js

@@ -43,6 +43,8 @@ class PoolListController {
         this._headerView.addEventListener(
             "submit",
             (e) => this._evtSubmit(e),
+        );
+        this._headerView.addEventListener(
             "navigate",
             (e) => this._evtNavigate(e)
         );

client/js/controllers/post_main_controller.js

@@ -169,22 +169,22 @@ class PostMainController extends BasePostController {
         this._view.sidebarControl.disableForm();
         this._view.sidebarControl.clearMessages();
         const post = e.detail.post;
-        if (e.detail.safety !== undefined) {
+        if (e.detail.safety !== undefined && e.detail.safety !== null) {
             post.safety = e.detail.safety;
         }
-        if (e.detail.flags !== undefined) {
+        if (e.detail.flags !== undefined && e.detail.flags !== null) {
             post.flags = e.detail.flags;
         }
-        if (e.detail.relations !== undefined) {
+        if (e.detail.relations !== undefined && e.detail.relations !== null) {
             post.relations = e.detail.relations;
         }
-        if (e.detail.content !== undefined) {
+        if (e.detail.content !== undefined && e.detail.content !== null) {
             post.newContent = e.detail.content;
         }
-        if (e.detail.thumbnail !== undefined) {
+        if (e.detail.thumbnail !== undefined && e.detail.thumbnail !== null) {
             post.newThumbnail = e.detail.thumbnail;
         }
-        if (e.detail.source !== undefined) {
+        if (e.detail.source !== undefined && e.detail.source !== null) {
             post.source = e.detail.source;
         }
         post.save().then(

client/js/controllers/tag_controller.js

@@ -95,13 +95,13 @@ class TagController {
     _evtUpdate(e) {
         this._view.clearMessages();
         this._view.disableForm();
-        if (e.detail.names !== undefined) {
+        if (e.detail.names !== undefined && e.detail.names !== null) {
             e.detail.tag.names = e.detail.names;
         }
-        if (e.detail.category !== undefined) {
+        if (e.detail.category !== undefined && e.detail.category !== null) {
             e.detail.tag.category = e.detail.category;
         }
-        if (e.detail.description !== undefined) {
+        if (e.detail.description !== undefined && e.detail.description !== null) {
             e.detail.tag.description = e.detail.description;
         }
         e.detail.tag.save().then(

client/js/controllers/user_controller.js

@@ -175,21 +175,21 @@ class UserController {
         const isLoggedIn = api.isLoggedIn(e.detail.user);
         const infix = isLoggedIn ? "self" : "any";
 
-        if (e.detail.name !== undefined) {
+        if (e.detail.name !== undefined && e.detail.name !== null) {
             e.detail.user.name = e.detail.name;
         }
-        if (e.detail.email !== undefined) {
+        if (e.detail.email !== undefined && e.detail.email !== null) {
             e.detail.user.email = e.detail.email;
         }
-        if (e.detail.rank !== undefined) {
+        if (e.detail.rank !== undefined && e.detail.rank !== null) {
             e.detail.user.rank = e.detail.rank;
         }
 
-        if (e.detail.password !== undefined) {
+        if (e.detail.password !== undefined && e.detail.password !== null) {
             e.detail.user.password = e.detail.password;
         }
 
-        if (e.detail.avatarStyle !== undefined) {
+        if (e.detail.avatarStyle !== undefined && e.detail.avatarStyle !== null) {
             e.detail.user.avatarStyle = e.detail.avatarStyle;
             if (e.detail.avatarContent) {
                 e.detail.user.avatarContent = e.detail.avatarContent;
@@ -302,7 +302,7 @@ class UserController {
         this._view.clearMessages();
         this._view.disableForm();
 
-        if (e.detail.note !== undefined) {
+        if (e.detail.note !== undefined && e.detail.note !== null) {
             e.detail.userToken.note = e.detail.note;
         }
 

client/js/controls/file_dropper_control.js

@@ -48,6 +48,12 @@ class FileDropperControl extends events.EventTarget {
             this._urlInputNode.addEventListener("keydown", (e) =>
                 this._evtUrlInputKeyDown(e)
             );
+            this._urlInputNode.addEventListener("paste", (e) => {
+                // document.onpaste is used on the post-upload page.
+                // And this event is used on the post edit page.
+                if (document.getElementById("post-upload")) return;
+                this._evtPaste(e)
+            });
         }
         if (this._urlConfirmButtonNode) {
             this._urlConfirmButtonNode.addEventListener("click", (e) =>
@@ -55,6 +61,11 @@ class FileDropperControl extends events.EventTarget {
             );
         }
 
+        document.onpaste = (e) => {
+            if (!document.getElementById("post-upload")) return;
+            this._evtPaste(e)
+        }
+
         this._originalHtml = this._dropperNode.innerHTML;
         views.replaceContent(target, source);
     }
@@ -129,6 +140,17 @@ class FileDropperControl extends events.EventTarget {
         this._emitFiles(e.dataTransfer.files);
     }
 
+    _evtPaste(e) {
+        const items = (e.clipboardData || e.originalEvent.clipboardData).items;
+        const fileList = Array.from(items).map((x) => x.getAsFile()).filter(f => f);
+
+        if (!this._options.allowMultiple && fileList.length > 1) {
+            window.alert("Cannot select multiple files.");
+        } else if (fileList.length > 0) {
+            this._emitFiles(fileList);
+        }
+    }
+
     _evtUrlInputKeyDown(e) {
         if (e.which !== KEY_RETURN) {
             return;

client/js/controls/post_content_control.js

@@ -103,6 +103,30 @@ class PostContentControl {
     }
 
     _refreshSize() {
+        if (window.innerWidth <= 800) {
+            const buttons = document.querySelector(".sidebar > .buttons");
+            if (buttons) {
+                const content = document.querySelector(".content");
+                content.insertBefore(buttons, content.querySelector(".post-container + *"));
+
+                const afterControls = document.querySelector(".content > .after-mobile-controls");
+                if (afterControls) {
+                    afterControls.parentElement.parentElement.appendChild(afterControls);
+                }
+            }
+        } else {
+            const buttons = document.querySelector(".content > .buttons");
+            if (buttons) {
+                const sidebar = document.querySelector(".sidebar");
+                sidebar.insertBefore(buttons, sidebar.firstElementChild);
+            }
+
+            const afterControls = document.querySelector(".content + .after-mobile-controls");
+            if (afterControls) {
+                document.querySelector(".content").appendChild(afterControls);
+            }
+        }
+
         this._currentFitFunction();
     }
 

client/js/controls/post_edit_sidebar_control.js

@@ -427,7 +427,7 @@ class PostEditSidebarControl extends events.EventTarget {
                         : undefined,
 
                     thumbnail:
-                        this._newPostThumbnail !== undefined
+                        this._newPostThumbnail !== undefined && this._newPostThumbnail !== null
                             ? this._newPostThumbnail
                             : undefined,
 

client/js/models/post.js

@@ -271,7 +271,7 @@ class Post extends events.EventTarget {
         if (this._newContent) {
             files.content = this._newContent;
         }
-        if (this._newThumbnail !== undefined) {
+        if (this._newThumbnail !== undefined && this._newThumbnail !== null) {
             files.thumbnail = this._newThumbnail;
         }
         if (this._source !== this._orig._source) {

client/js/util/views.js

@@ -209,13 +209,13 @@ function makePostLink(id, includeHash) {
 }
 
 function makeTagLink(name, includeHash, includeCount, tag) {
-    const category = tag ? tag.category : "unknown";
+    const category = tag && tag.category ? tag.category : "unknown";
     let text = misc.getPrettyName(name);
     if (includeHash === true) {
         text = "#" + text;
     }
     if (includeCount === true) {
-        text += " (" + (tag ? tag.postCount : 0) + ")";
+        text += " (" + (tag && tag.postCount ? tag.postCount : 0) + ")";
     }
     return api.hasPrivilege("tags:view")
         ? makeElement(
@@ -234,15 +234,15 @@ function makeTagLink(name, includeHash, includeCount, tag) {
 }
 
 function makePoolLink(id, includeHash, includeCount, pool, name) {
-    const category = pool ? pool.category : "unknown";
+    const category = pool && pool.category ? pool.category : "unknown";
     let text = misc.getPrettyName(
-        name ? name : pool ? pool.names[0] : "unknown"
+        name ? name : pool && pool.names ? pool.names[0] : "pool " + id
     );
     if (includeHash === true) {
         text = "#" + text;
     }
     if (includeCount === true) {
-        text += " (" + (pool ? pool.postCount : 0) + ")";
+        text += " (" + (pool && pool.postCount ? pool.postCount : 0) + ")";
     }
     return api.hasPrivilege("pools:view")
         ? makeElement(
@@ -264,7 +264,7 @@ function makeUserLink(user) {
     let text = makeThumbnail(user ? user.avatarUrl : null);
     text += user && user.name ? misc.escapeHtml(user.name) : "Anonymous";
     const link =
-        user && api.hasPrivilege("users:view")
+        user && user.name && api.hasPrivilege("users:view")
             ? makeElement(
                   "a",
                   { href: uri.formatClientLink("user", user.name) },

client/js/views/post_upload_view.js

@@ -161,11 +161,14 @@ class PostUploadView extends events.EventTarget {
             return this._uploadables.findIndex((u2) => u.key === u2.key);
         };
 
+				let allowedExtensions = api.getAllowedExtensions().map(
+					function(e) {return "." + e}
+				);
         this._contentFileDropper = new FileDropperControl(
             this._contentInputNode,
             {
                 extraText:
-                    "Allowed extensions: .jpg, .png, .gif, .webm, .mp4, .swf, .avif, .heif, .heic",
+                    "Allowed extensions: " + allowedExtensions.join(", "),
                 allowUrls: true,
                 allowMultiple: true,
                 lock: false,

doc/API.md

@@ -54,7 +54,7 @@
         - [Deleting pool category](#deleting-pool-category)
         - [Setting default pool category](#setting-default-pool-category)
     - Pools
-        - [Listing pools](#listing-pool)
+        - [Listing pools](#listing-pools)
         - [Creating pool](#creating-pool)
         - [Updating pool](#updating-pool)
         - [Getting pool](#getting-pool)
@@ -165,9 +165,9 @@ way. The files, however, should be passed as regular fields appended with a
 accepts a file named `content`, the client should pass
 `{"contentUrl":"http://example.com/file.jpg"}` as a part of the JSON message
 body. When creating or updating post content using this method, the server can
-also be configured to employ [youtube-dl](https://github.com/ytdl-org/youtube-dl)
-to download content from popular sites such as youtube, gfycat, etc. Access to
-youtube-dl can be configured with the `'uploads:use_downloader'` permission
+also be configured to employ [yt-dlp](https://github.com/yt-dlp/yt-dlp) to
+download content from popular sites such as youtube, gfycat, etc. Access to
+yt-dlp can be configured with the `'uploads:use_downloader'` permission
 
 Finally, in some cases the user might want to reuse one file between the
 requests to save the bandwidth (for example, reverse search + consecutive
@@ -789,7 +789,7 @@ data.
     | `fav-time`           | alias of `fav-date`                                                                                                                     |
     | `feature-date`       | featured at given date                                                                                                                  |
     | `feature-time`       | alias of `feature-time`                                                                                                                 |
-    | `safety`             | having given safety. `<value>` can be either `safe`, `sketchy` (or `questionable`) or `unsafe`.                                         |
+    | `safety`             | having given safety. `<value>` can be either `safe`, `sketchy` or `unsafe`.                                         |
     | `rating`             | alias of `safety`                                                                                                                       |
 
     **Sort style tokens**
@@ -1389,7 +1389,7 @@ data.
 ## Creating pool
 - **Request**
 
-    `POST /pools/create`
+    `POST /pool`
 
 - **Input**
 

doc/INSTALL.md

@@ -1,5 +1,5 @@
-This assumes that you have Docker (version 17.05 or greater)
-and Docker Compose (version 1.6.0 or greater) already installed.
+This assumes that you have Docker (version 19.03 or greater)
+and the Docker Compose CLI (version 1.27.0 or greater) already installed.
 
 ### Prepare things
 
@@ -38,7 +38,7 @@ and Docker Compose (version 1.6.0 or greater) already installed.
 
     This pulls the latest containers from docker.io:
     ```console
-    user@host:szuru$ docker-compose pull
+    user@host:szuru$ docker compose pull
     ```
 
     If you have modified the application's source and would like to manually
@@ -49,17 +49,17 @@ and Docker Compose (version 1.6.0 or greater) already installed.
 
     For first run, it is recommended to start the database separately:
     ```console
-    user@host:szuru$ docker-compose up -d sql
+    user@host:szuru$ docker compose up -d sql
     ```
 
     To start all containers:
     ```console
-    user@host:szuru$ docker-compose up -d
+    user@host:szuru$ docker compose up -d
     ```
 
     To view/monitor the application logs:
     ```console
-    user@host:szuru$ docker-compose logs -f
+    user@host:szuru$ docker compose logs -f
     # (CTRL+C to exit)
     ```
 
@@ -84,13 +84,13 @@ and Docker Compose (version 1.6.0 or greater) already installed.
 2. Build the containers:
 
     ```console
-    user@host:szuru$ docker-compose build
+    user@host:szuru$ docker compose build
     ```
 
     That will attempt to build both containers, but you can specify `client`
     or `server` to make it build only one.
 
-    If `docker-compose build` spits out:
+    If `docker compose build` spits out:
 
     ```
     ERROR: Service 'server' failed to build: failed to parse platform : "" is an invalid component of "": platform specifier component must match "^[A-Za-z0-9_-]+$": invalid argument
@@ -102,7 +102,7 @@ and Docker Compose (version 1.6.0 or greater) already installed.
     user@host:szuru$ export DOCKER_BUILDKIT=1; export COMPOSE_DOCKER_CLI_BUILD=1
     ```
 
-    ...and run `docker-compose build` again.
+    ...and run `docker compose build` again.
 
 *Note: If your changes are not taking effect in your builds, consider building
 with `--no-cache`.*
@@ -117,7 +117,7 @@ with `--no-cache`.*
     run from docker:
 
     ```console
-    user@host:szuru$ docker-compose run server ./szuru-admin --help
+    user@host:szuru$ docker compose run server ./szuru-admin --help
     ```
 
     will give you a breakdown on all available commands.

docker-compose.yml

@@ -1,9 +1,7 @@
 ## Example Docker Compose configuration
 ##
-## Use this as a template to set up docker-compose, or as guide to set up other
+## Use this as a template to set up docker compose, or as guide to set up other
 ## orchestration services
-version: '2'
-
 services:
 
   server:

server/Dockerfile

@@ -23,15 +23,15 @@ RUN apk --no-cache add \
         py3-pillow \
         py3-pynacl \
         py3-tz \
-        py3-pyrfc3339 \
- && pip3 install --no-cache-dir --disable-pip-version-check \
+        py3-pyrfc3339
+RUN pip3 install --no-cache-dir --disable-pip-version-check \
         "alembic>=0.8.5" \
         "coloredlogs==5.0" \
         "pyheif==0.6.1" \
         "heif-image-plugin>=0.3.2" \
-        youtube_dl \
-        "pillow-avif-plugin>=1.1.0" \
- && apk --no-cache del py3-pip
+        yt-dlp \
+        "pillow-avif-plugin~=1.1.0"
+RUN apk --no-cache del py3-pip
 
 COPY ./ /opt/app/
 RUN rm -rf /opt/app/szurubooru/tests

server/config.yaml.dist

@@ -29,6 +29,18 @@ convert:
      to_webm: false
      to_mp4: false
 
+# specify which MIME types are allowed
+allowed_mime_types:
+   - image/jpeg
+   - image/png
+   - image/gif
+   - video/webm
+   - video/mp4
+   - application/x-shockwave-flash
+   - image/avif
+   - image/heif
+   - image/heic
+
 # allow posts to be uploaded even if some image processing errors occur
 allow_broken_uploads: false
 

server/requirements.txt

@@ -3,7 +3,7 @@ certifi>=2017.11.5
 coloredlogs==5.0
 heif-image-plugin==0.3.2
 numpy>=1.8.2
-pillow-avif-plugin>=1.1.0
+pillow-avif-plugin~=1.1.0
 pillow>=4.3.0
 psycopg2-binary>=2.6.1
 pyheif==0.6.1
@@ -12,4 +12,4 @@ pyRFC3339>=1.0
 pytz>=2018.3
 pyyaml>=3.11
 SQLAlchemy>=1.0.12, <1.4
-youtube_dl
+yt-dlp

server/szurubooru/api/info_api.py

@@ -3,7 +3,7 @@ from datetime import datetime, timedelta
 from typing import Dict, Optional
 
 from szurubooru import config, rest
-from szurubooru.func import auth, posts, users, util
+from szurubooru.func import auth, mime, posts, users, util
 
 _cache_time = None  # type: Optional[datetime]
 _cache_result = None  # type: Optional[int]
@@ -49,6 +49,11 @@ def get_info(ctx: rest.Context, _params: Dict[str, str] = {}) -> rest.Response:
             "privileges": util.snake_case_to_lower_camel_case_keys(
                 config.config["privileges"]
             ),
+            "allowedExtensions": [
+                mime.MIME_EXTENSIONS_MAP[i]
+                for i in config.config["allowed_mime_types"]
+                if i in mime.MIME_EXTENSIONS_MAP
+            ],
         },
     }
     if auth.has_privilege(ctx.user, "posts:view:featured"):

server/szurubooru/config.py

@@ -21,7 +21,7 @@ def _merge(left: Dict, right: Dict) -> Dict:
     return left
 
 
-def _docker_config() -> Dict:
+def _container_config() -> Dict:
     if "TEST_ENVIRONMENT" not in os.environ:
         for key in ["POSTGRES_USER", "POSTGRES_PASSWORD", "POSTGRES_HOST"]:
             if key not in os.environ:
@@ -49,6 +49,15 @@ def _file_config(filename: str) -> Dict:
         return yaml.load(handle.read(), Loader=yaml.SafeLoader) or {}
 
 
+def _running_inside_container() -> bool:
+    env = os.environ.keys()
+    return (
+        os.path.exists("/.dockerenv")
+        or "KUBERNETES_SERVICE_HOST" in env
+        or "container" in env  # set by lxc/podman
+    )
+
+
 def _read_config() -> Dict:
     ret = _file_config("config.yaml.dist")
     if os.path.isfile("config.yaml"):
@@ -57,8 +66,8 @@ def _read_config() -> Dict:
         logger.warning(
             "'config.yaml' should be a file, not a directory, skipping"
         )
-    if os.path.exists("/.dockerenv"):
-        ret = _merge(ret, _docker_config())
+    if _running_inside_container():
+        ret = _merge(ret, _container_config())
     return ret
 
 

server/szurubooru/func/mime.py

@@ -1,6 +1,33 @@
 import re
+from collections import ChainMap
 from typing import Optional
 
+MIME_TYPES_MAP = {
+    "image": {
+        "image/gif": "gif",
+        "image/jpeg": "jpg",
+        "image/png": "png",
+        "image/webp": "webp",
+        "image/bmp": "bmp",
+        "image/avif": "avif",
+        "image/heif": "heif",
+        "image/heic": "heic",
+    },
+    "video": {
+        "application/ogg": None,
+        "video/mp4": "mp4",
+        "video/quicktime": "mov",
+        "video/webm": "webm",
+    },
+    "flash": {
+        "application/x-shockwave-flash": "swf"
+    },
+    "other": {
+        "application/octet-stream": "dat",
+    },
+}
+MIME_EXTENSIONS_MAP = ChainMap(*MIME_TYPES_MAP.values())
+
 
 def get_mime_type(content: bytes) -> str:
     if not content:
@@ -46,48 +73,19 @@ def get_mime_type(content: bytes) -> str:
 
 
 def get_extension(mime_type: str) -> Optional[str]:
-    extension_map = {
-        "application/x-shockwave-flash": "swf",
-        "image/gif": "gif",
-        "image/jpeg": "jpg",
-        "image/png": "png",
-        "image/webp": "webp",
-        "image/bmp": "bmp",
-        "image/avif": "avif",
-        "image/heif": "heif",
-        "image/heic": "heic",
-        "video/mp4": "mp4",
-        "video/quicktime": "mov",
-        "video/webm": "webm",
-        "application/octet-stream": "dat",
-    }
-    return extension_map.get((mime_type or "").strip().lower(), None)
+    return MIME_EXTENSIONS_MAP.get((mime_type or "").strip().lower(), None)
 
 
 def is_flash(mime_type: str) -> bool:
-    return mime_type.lower() == "application/x-shockwave-flash"
+    return mime_type.lower() in MIME_TYPES_MAP["flash"]
 
 
 def is_video(mime_type: str) -> bool:
-    return mime_type.lower() in (
-        "application/ogg",
-        "video/mp4",
-        "video/quicktime",
-        "video/webm",
-    )
+    return mime_type.lower() in MIME_TYPES_MAP["video"]
 
 
 def is_image(mime_type: str) -> bool:
-    return mime_type.lower() in (
-        "image/jpeg",
-        "image/png",
-        "image/gif",
-        "image/webp",
-        "image/bmp",
-        "image/avif",
-        "image/heif",
-        "image/heic",
-    )
+    return mime_type.lower() in MIME_TYPES_MAP["image"]
 
 
 def is_animated_gif(content: bytes) -> bool:

server/szurubooru/func/net.py

@@ -64,7 +64,7 @@ def download(url: str, use_video_downloader: bool = False) -> bytes:
 
 
 def _get_youtube_dl_content_url(url: str) -> str:
-    cmd = ["youtube-dl", "--format", "best", "--no-playlist"]
+    cmd = ["yt-dlp", "--format", "best", "--no-playlist"]
     if config.config["user_agent"]:
         cmd.extend(["--user-agent", config.config["user_agent"]])
     cmd.extend(["--get-url", url])

server/szurubooru/func/posts.py

@@ -611,7 +611,11 @@ def update_post_content(post: model.Post, content: Optional[bytes]) -> None:
 
     update_signature = False
     post.mime_type = mime.get_mime_type(content)
-    if mime.is_flash(post.mime_type):
+    if post.mime_type not in config.config["allowed_mime_types"]:
+        raise InvalidPostContentError(
+            "File type not allowed: %r" % post.mime_type
+        )
+    elif mime.is_flash(post.mime_type):
         post.type = model.Post.TYPE_FLASH
     elif mime.is_image(post.mime_type):
         update_signature = True

server/szurubooru/tests/api/test_info.py

@@ -34,6 +34,7 @@ def test_info_api(
             "smtp": {
                 "host": "example.com",
             },
+            "allowed_mime_types": ["application/octet-stream"],
         }
     )
     db.session.add_all([post_factory(), post_factory()])
@@ -54,6 +55,7 @@ def test_info_api(
             "posts:view:featured": "regular",
         },
         "canSendMails": True,
+        "allowedExtensions": ["dat"],
     }
 
     with fake_datetime("2016-01-01 13:00"):

server/szurubooru/tests/api/test_post_creating.py

@@ -343,6 +343,10 @@ def test_errors_not_spending_ids(
                 "uploads:use_downloader": model.User.RANK_POWER,
             },
             "secret": "test",
+            "allowed_mime_types": [
+                "image/png",
+                "image/jpeg",
+            ],
         }
     )
     auth_user = user_factory(rank=model.User.RANK_REGULAR)

server/szurubooru/tests/func/test_posts.py

@@ -489,6 +489,18 @@ def test_update_post_content_for_new_post(
                 },
                 "secret": "test",
                 "allow_broken_uploads": False,
+                "allowed_mime_types": [
+                    "image/png",
+                    "image/jpeg",
+                    "image/gif",
+                    "image/bmp",
+                    "image/avif",
+                    "image/heic",
+                    "image/heif",
+                    "video/webm",
+                    "video/mp4",
+                    "application/x-shockwave-flash",
+                ],
             }
         )
         output_file_path = "{}/data/posts/{}".format(tmpdir, output_file_name)
@@ -526,6 +538,7 @@ def test_update_post_content_to_existing_content(
             },
             "secret": "test",
             "allow_broken_uploads": False,
+            "allowed_mime_types": ["image/png"],
         }
     )
     post = post_factory()
@@ -553,6 +566,7 @@ def test_update_post_content_with_broken_content(
             },
             "secret": "test",
             "allow_broken_uploads": allow_broken_uploads,
+            "allowed_mime_types": ["image/png"],
         }
     )
     post = post_factory()
@@ -576,6 +590,7 @@ def test_update_post_content_with_invalid_content(
     config_injector(
         {
             "allow_broken_uploads": True,
+            "allowed_mime_types": ["application/octet-stream"],
         }
     )
     post = model.Post()
@@ -583,6 +598,29 @@ def test_update_post_content_with_invalid_content(
         posts.update_post_content(post, input_content)
 
 
+def test_update_post_content_with_unallowed_mime_type(
+        tmpdir, config_injector, post_factory, read_asset
+):
+    config_injector(
+        {
+            "data_dir": str(tmpdir.mkdir("data")),
+            "thumbnails": {
+                "post_width": 300,
+                "post_height": 300,
+            },
+            "secret": "test",
+            "allow_broken_uploads": False,
+            "allowed_mime_types": [],
+        }
+    )
+    post = post_factory()
+    db.session.add(post)
+    db.session.flush()
+    content = read_asset("png.png")
+    with pytest.raises(posts.InvalidPostContentError):
+        posts.update_post_content(post, content)
+
+
 @pytest.mark.parametrize("is_existing", (True, False))
 def test_update_post_thumbnail_to_new_one(
     tmpdir, config_injector, read_asset, post_factory, is_existing
@@ -596,6 +634,7 @@ def test_update_post_thumbnail_to_new_one(
             },
             "secret": "test",
             "allow_broken_uploads": False,
+            "allowed_mime_types": ["image/png"],
         }
     )
     post = post_factory(id=1)
@@ -637,6 +676,7 @@ def test_update_post_thumbnail_to_default(
             },
             "secret": "test",
             "allow_broken_uploads": False,
+            "allowed_mime_types": ["image/png"],
         }
     )
     post = post_factory(id=1)
@@ -677,6 +717,7 @@ def test_update_post_thumbnail_with_broken_thumbnail(
             },
             "secret": "test",
             "allow_broken_uploads": False,
+            "allowed_mime_types": ["image/png"],
         }
     )
     post = post_factory(id=1)
@@ -721,6 +762,7 @@ def test_update_post_content_leaving_custom_thumbnail(
             },
             "secret": "test",
             "allow_broken_uploads": False,
+            "allowed_mime_types": ["image/png"],
         }
     )
     post = post_factory(id=1)
@@ -754,6 +796,11 @@ def test_update_post_content_convert_heif_to_png_when_processing(
             },
             "secret": "test",
             "allow_broken_uploads": False,
+            "allowed_mime_types": [
+                "image/avif",
+                "image/heic",
+                "image/heif",
+            ],
         }
     )
     post = post_factory(id=1)
@@ -1176,6 +1223,7 @@ def test_merge_posts_replaces_content(
                 "post_height": 300,
             },
             "secret": "test",
+            "allowed_mime_types": ["image/png"],
         }
     )
     source_post = post_factory(id=1)