miki

commit c85271fa741bf9c683f013d4eb3f64da37bb5c11
parent e26f5c8c2be83593545b3fe7752c0f79d1124ade
Author: weetat <wtenison@protonmail.com>
Date:   Thu, 27 Feb 2025 20:02:48 +0000

Strip directories from the subject file name

Run the ?s= parameter through filepath.Base so it can't be used to read
files outside the fmd data directory. Also switch the default
color-scheme to light.

Diffstat:
M
src/network/routes.go
 | 
1
+
M
web/global/styles.css
 | 
2
+-

2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/network/routes.go b/src/network/routes.go
@@ -107,6 +107,7 @@ func handlePageSubject(w http.ResponseWriter, r *http.Request) {
 	}
 
 	_fileName := _urlQuerySubject.Get("s")
+	_fileName = filepath.Base(_fileName)
 
 	var _templateDataContainer struct {
 		FileName string
diff --git a/web/global/styles.css b/web/global/styles.css
@@ -74,7 +74,7 @@
     body {
         margin: calc(var(--miki_header__height) + var(--miki_padding)) var(--miki_margin--double) var(--miki_margin--double);
 
-        color-scheme: dark;
+        color-scheme: light;
         color: var(--color__font-dark);
         background-color: var(--color__bg-light);