Privatebin: 1.3.4 post release features and bugfixes

[Haocen]

As I move my own distro of PrivateBin to version 1.3.4 I've retrospectively applied all the changes that are not included in upstream.

Meanwhile I've spent some time fixing bugs I found in this release.

Some features I found useful had also been included.

To avoid polluting this repo with load of issues and merge conflicts caused by regenerating SRI in every PR, I would like to ask everyone for suggestion regarding what should be included in my PR.

I'll make a total of 2 PRs, one for bugfixes and one for features & enhancements to help reduce the effort required, meanwhile separating each changes into its own commit so we can have a clean history.

Here is a list of everything that can be included:

Bugfixes:

• [x] Add resource: to script-src cspheader to fix pdf display in Firefox
• [x] Cannot paste text into password input dialog
• [x] Avoid DOMPurify mess with forward slash in expirationDateString
• [x] Fix broken Helper.durationToSeconds, as it doesn't handle weeks
• [x] Reload page when back button in browser pressed, avoid reading burn after read paste from cache
• [x] Fix TopNav.isAttachmentReadonly logic so dropzone won't show when shouldn't
• [x] Fix attachment preview logic on editor preview and after paste successfully created (multiple commits)
• [x] Fix file attachment handling UI, hide file select input and delegate click to custom filename display, fix incorrect function call to clear drag and drop filename (visual change maybe undesired, also fix attachment cloning and incorrect filename display under multiple edge cases)
• [x] Remove AttachmentViewer.readFileData unreachable logic path and remove call to me.handleAttachmentPreview as it no longer exist
• [x] Change order of execution to detect delete token properly
• [x] Sanitize output from Helper.urls2links
• [x] Avoid recreation of existing pasteurl element when calling URL shortener

Features & Enhancements:

• [ ] rawText button now open a new browser tab to display content without styles applied
• [ ] Avoid layout shifting caused by unwanted newline and space in bootstrap.php (visual change maybe undesired)
• [ ] Implement bootstrap-auto theme which will automatically switch to dark theme based on css preferred-color-scheme, works seemlessly with devices running browsers support system level dark theme
• [x] Open all links in new window
• [ ] Add icons to buttons and dropdowns, hide hint-text on medium width devices(tablets)
• [x] Disable autoplay for attachment preview, avoid mix use of vanilla JS and jQuery syntax in AttachmentViewer.handleBlobAttachmentPreview
• [x] Avoid page scale on iOS devices when input focused(iOS zoom in onto textarea)
• [ ] Automatically expand TopNav to show status message on mobile, avoid TopNav height change on mobile by toggle TopNav intelligently
• [ ] Expand TopNav for easy retry on mobile when decrypt failed
• [ ] Reset expiration and paste format to default upon creation of new paste
• [ ] Move no paste text placeholder below attachment preview to stay consistent with the layout when there is paste text
• [ ] Copy new paste link when click on copyhint, change copyhint content, avoid warping copyhint
• [ ] Replace jQuery .attr call with .prop call wherever possible
• [x] Display file name and file size on preview and paste reading page
  
• [ ] Remaining time now update in real time, e.g. it will show This document will expire in 4 minutes. upon open and 1 minute later it will become This document will expire in 3 minutes. and another 3 minutes later it will become This document has expired.
• [ ] Set editor textarea and comment reply nickname/message to readonly upon send

Exclude from upstream:

• [ ] Disable text copy and select, remove rawText button when paste type is burn after read (cannot really stop user from copying content if they know how to open dev tools)
• [ ] Marquee project description in footer

Here is a preview of all changes that can be included, please notice this is just a draft and changes are squashed so they are in one single commit:

https://github.com/Haocen/PrivateBin-Contribute/pull/3

Cheers for keeping such a valuable project healthy and vivid.

[Haocen]

A demo contain all changes is now available:
https://privatebin-staging.herokuapp.com/

[rugk]

First of all: Wow, thanks for all that work! :tada:

Of course, I guess, we are very glad to accept any bug fixes.

The only other things I'd have objections too are:

Disable text copy and select, remove rawText button when paste type is burn after read (cannot really stop user from copying content if they know how to open dev tools)

This has been discussed in https://github.com/PrivateBin/PrivateBin/issues/498 and declined.

Other notes:

Implement bootstrap-auto theme which will automatically switch to dark theme based on css preferred-color-scheme, works seemlessly with devices running browsers support system level dark theme

Awesome! This fixes https://github.com/PrivateBin/PrivateBin/issues/433

Open all links in new window

Fixes #61

Copy new paste link when click on copyhint, change copyhint content, avoid warping copyhint

Fixes #12

Generally, please: If you introduce/fix a feature and there is an open issue, please do mention this in your PR(s) when fixing them. You can (automatically) let issues close when a PR is merged by adding some "magic" text to your PR _body_.
Of course, in general, if we have open issues that are not discussed/declined or so, you are always free to submit pull requests. We'd gladly appreciate them. One PR per issue is ideal.
And as I saw you've created many issues for these things before by yourself: Of course, if we declined a feature in the past and there is no new discussion, we'll still decline it. :smiley:

Cheers for keeping such a valuable project healthy and vivid.

Cheers back to you for all those fixes and addressing a lot of (partially old) issues for features we should have implemented long time ago… :stuck_out_tongue_winking_eye:

As I saw, @elrido also did a PR review on your proposed PR to address some coding issues. If you'll propose the PR(s) then here, we'll likely may also have some more things to discuss and review.
In general, I'd want to say we, however, very much appreciate your changes and the work you've put into this. :smiley:

[Haocen]

Thanks for the input, I've updated the issue with latest discussion.
I'll be sure to link my PR to individual issues it fix & implement when I open them.

Sorry for bring up some already declined proposals. I was too lazy to maintain both patched master branch and personal branch in same repo as the commit history can become really tangled, when doing the compare everything not included in master branch popup, including those have been declined.

I'll be sure to exclude those changes we don't want, I'm listing them here to avoid accidentally include them when I work on new PRs.

[Haocen]

Hi, I wonder if we're good with the latest list I proposed?
If so I can start working on the PRs, starting from the bugfixes.

[rugk]

I guess so, yes. I have nothing more to add. @elrido, do you? (I guess he's reviewing the PR already, anyway… :wink:)

[elrido]

Nope, lets get that PR, to trigger the unit tests and do a final review.

[r4sas]

To avoid creating more issues, proposing here: do not show "Raw text" button if no text provided in paste (when only file was sent).

[rugk]

Good idea, although I'm still always in favor to track bugs in issues, but okay, fine.

[ZerooCool]

Need #651 for fix opengraph

[Haocen]

Hi, sorry for leave this hanging so long.
I'll pick up from where I left and try to complete re-implementing the attachment preview very soon.
Regarding other issues you would like to fix, I'll take a look when I finish all outstanding issues listed.

[Haocen]

The auto theme switch and copy by clicking on copy hint will be next thing I'll work on.
Following that, I'll work on mobile navbar auto expand/collapse.

[elrido]

Keep in mind that we will have to migrate to bootstrap 4 or 5 if it gets released soon. So maybe don't spend a lot of time on fixing the bootstrap 3 mobile navbar (which IMHO is still working fine on the devices I have access to).

[Haocen]

I looked at the boostrap 4 navbar and it seemed there isn't any feature that will automatically expand collapsed navbar on small screen devices.
The problem I'm trying to solve here is when send being clicked on mobile device while navbar is collapsed, the screen looks as if it is freezed, because the Sending... status message was displayed in navbar such that user cannot see it if navbar is not expanded.

[elrido]

Or we could move that "Sending..." message out of the navbar into the main tag further below? It might belong better with all the other status messages, warnings and errors - all such temporary notifications in one place.
https://github.com/PrivateBin/PrivateBin/blob/33bcce593a3e8baa7ebdf6abf00175b399582fc9/tpl/bootstrap.php#L449-L457

[rugk]

IMHO I like that message being in the navbar on desktop device… when you have such a status, you hide al buttons anyway as they make no sense to click on it.
Plus: It avoids "visual interference" i.e. bumping up and down of the main text content e.g. when PrivateBin is processing something.

(Disclaimer: Note IIIRC I was also the one, who introduced that behaviour.)