Merge pull request #15 from JustKato/feature/admin-interface

Everything seems stable! Been tested just by myself, so if some other people could do some security testing, it'd be awesome!

.env.example

@@ -22,3 +22,7 @@ CLEANUP_MAX_AGE=43200 # Default is a month
 # Maximum pad file lenght, this is in characters, a character is one byte.
 # Default: 524288 ( 500kb )
 MAXIMUM_PAD_SIZE=524288
+
+# Your admin access token
+# If the value is not defined the admin interface will not be available
+# ADMIN_TOKEN=SUPER_SECRET_ADMIN_TOKEN

Changelog.md

@@ -1,3 +1,6 @@
+# 1.4.0 🖌
+Syntax highlight has been implemented, as well as a couple security concerns being patched. Thank you to everyone that has helped me out with those
+
 # 1.3.0 👀
 Implemented a views system, now everyone can see how many times a pad has been accessed, an auto-save has also been added for those views to file in the `data` dir.
 

Dockerfile

@@ -1,9 +1,27 @@
-FROM alpine
+# Importing golang 1.18 to use as a builder for our source
+FROM golang:1.18 as builder
 
-LABEL version="1.3.0"
+# Use the /src directory as a workdir
+WORKDIR /src
 
-# Copy the distribution files
-COPY ./dist /app
+# Copy the src to /src
+COPY . ./
+
+# Download dependencies
+RUN go mod download
+
+# Build the executable
+RUN CGO_ENABLED=0 go build -a -installsuffix cgo -o freepad .
+
+# Import alpine linux as a base
+FROM scratch
+
+LABEL version="1.4.0"
+
+# Copy the files from the builder to the new image
+COPY --from=builder /src/freepad /app/freepad
+COPY --from=builder /src/templates /app/templates
+COPY --from=builder /src/static /app/static
 
 # Make /app the work directory
 WORKDIR /app

docker-compose.example.yaml

@@ -3,13 +3,13 @@ version: '3'
 services:
   freepad:
     # Uncomment the bellow to use the production docker image from the docker repository
-    # image: 
+    image: justkato/freepad
     # Comment the build line if you are just looking to use a docker-compose file
-    build: .
+    # build: .
     # I don't recommend changing the 8080 as there would be no reason to,
     # simply change the 3113 port to anything you would like for the container to listen on
     ports:
-      - 3113:8080
+      - 8080:8080
     # This will read from your .env variables, in that file you will find the documentation as well
     environment:
       - DOMAIN_BASE

lib/controllers/controllers_admin.go

@@ -0,0 +1,62 @@
+package controllers
+
+import (
+	"crypto/sha512"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+
+	"github.com/JustKato/FreePad/lib/helper"
+	"github.com/gin-gonic/gin"
+)
+
+func AdminMiddleware(router *gin.RouterGroup) {
+
+	// Handl
+	router.Use(func(ctx *gin.Context) {
+
+		// Check which route we are accessing
+		fmt.Println(`Accesing: `, ctx.Request.RequestURI)
+
+		// Check if the request is other than the login request
+		if ctx.Request.RequestURI != "/admin/login" {
+			// Check if the user is logged-in
+
+			fmt.Println(`Checking if admin`)
+
+			if !IsAdmin(ctx) {
+				// Not an admin, redirect to homepage
+				ctx.Redirect(http.StatusTemporaryRedirect, "/")
+				ctx.Abort()
+
+				fmt.Println(`Not an admin!`)
+				return
+			}
+
+		}
+
+	})
+
+}
+
+func IsAdmin(ctx *gin.Context) bool {
+	adminToken, err := ctx.Cookie("admin_token")
+	if err != nil {
+		return false
+	}
+
+	// Encode the real token
+	sha512Hasher := sha512.New()
+	sha512Hasher.Write([]byte(helper.GetAdminToken()))
+	hashHexToken := sha512Hasher.Sum(nil)
+	trueToken := hex.EncodeToString(hashHexToken)
+
+	// Check if the user's admin token matches the token
+	if adminToken != "" && adminToken == trueToken {
+		// Yep, it's the admin!
+		return true
+	}
+
+	// Definitely not an admin
+	return false
+}

lib/controllers/controllers_header.go

@@ -6,7 +6,7 @@ func ApplyHeaders(router *gin.Engine) {
 
 	router.Use(func(ctx *gin.Context) {
 		// Apply the header
-		ctx.Header("FreePad-Version", "1.3.0")
+		ctx.Header("FreePad-Version", "1.4.0")
 
 		// Move on
 		ctx.Next()

lib/helper/helper_main.go

@@ -72,3 +72,18 @@ func GetCacheMapLimit() int {
 
 	return rez
 }
+
+// Get the admin token used to authenticate as an admin
+func GetAdminToken() string {
+	// Get the admin login from the environment
+	adminToken, exists := os.LookupEnv("ADMIN_TOKEN")
+
+	// Check if the admin token was defined
+	if !exists {
+		// The admin token was not defined, disable admin logins
+		return ""
+	}
+
+	// Return the admin token
+	return adminToken
+}

lib/objects/objects_post.go

@@ -26,6 +26,13 @@ type Post struct {
 	Views        uint32 `json:"views"`
 }
 
+func (p *Post) Delete() error {
+	filePath := path.Join(getStorageDirectory(), p.Name)
+
+	// Remove the file and return the result
+	return os.Remove(filePath)
+}
+
 // Get the path to the views JSON
 func getViewsFilePath() (string, error) {
 	// Get the path to the storage then append the const name for the storage file
@@ -34,7 +41,7 @@ func getViewsFilePath() (string, error) {
 	// Check if the file exists
 	if _, err := os.Stat(filePath); errors.Is(err, os.ErrNotExist) {
 		// Create the file
-		err := os.WriteFile(filePath, []byte(""), 0777)
+		err := os.WriteFile(filePath, []byte(""), 0640)
 		if err != nil {
 			return ``, err
 		}
@@ -94,7 +101,7 @@ func LoadViewsCache() error {
 	return nil
 }
 
-func AddViewToPost(postName string) uint32 {
+func AddViewToPost(postName string, incrementViews bool) uint32 {
 	// Lock the viewers mapping
 	viewersLock.Lock()
 
@@ -104,8 +111,10 @@ func AddViewToPost(postName string) uint32 {
 		ViewsCache[postName] = 0
 	}
 
-	// Add to the counter
-	ViewsCache[postName]++
+	if incrementViews {
+		// Add to the counter
+		ViewsCache[postName]++
+	}
 
 	// Unlock
 	viewersLock.Unlock()
@@ -126,7 +135,7 @@ func SavePostViewsCache() error {
 		return err
 	}
 
-	f, err := os.OpenFile(viewsFilePath, os.O_WRONLY|os.O_CREATE, 0777)
+	f, err := os.OpenFile(viewsFilePath, os.O_WRONLY|os.O_CREATE, 0640)
 	if err != nil {
 		return err
 	}
@@ -162,7 +171,7 @@ func getStorageDirectory() string {
 	// Check if the base storage path exists
 	if _, err := os.Stat(baseStoragePath); os.IsNotExist(err) {
 		// Looks like the base storage path was NOT set, create the dir
-		err = os.Mkdir(baseStoragePath, 0777)
+		err = os.Mkdir(baseStoragePath, 0640)
 		// Check for errors
 		if err != nil {
 			// No way this sends an error unless it goes horribly wrong.
@@ -175,7 +184,7 @@ func getStorageDirectory() string {
 }
 
 // Get a post from the file system
-func GetPost(fileName string) Post {
+func GetPost(fileName string, incrementViews bool) Post {
 	// Get the base storage directory and make sure it exists
 	storageDir := getStorageDirectory()
 
@@ -183,7 +192,7 @@ func GetPost(fileName string) Post {
 	filePath := fmt.Sprintf("%s%s", storageDir, fileName)
 
 	// Get the post views and add 1 to them
-	postViews := AddViewToPost(fileName)
+	postViews := AddViewToPost(fileName, incrementViews)
 
 	p := Post{
 		Name:         fileName,
@@ -233,8 +242,6 @@ func WritePost(p Post) error {
 	if err != nil {
 		return err
 	}
-	// Actually close the file
-	defer f.Close()
 
 	// Write the contnets
 	_, err = f.WriteString(p.Content)
@@ -242,11 +249,7 @@ func WritePost(p Post) error {
 		return err
 	}
 
-	if err := f.Close(); err != nil {
-		return err
-	}
-
-	return nil
+	return f.Close()
 }
 
 // Cleanup all of the older posts based on the environment settings
@@ -301,3 +304,30 @@ func CleanupPosts(age int) {
 
 	}
 }
+
+func GetAllPosts() []Post {
+	// Initialize the list of posts
+	postList := []Post{}
+
+	// Get the posts storage directory
+	storageDir := getStorageDirectory()
+
+	// Read the directory listing
+	files, err := os.ReadDir(storageDir)
+	// Check if thereh as been an issues with reading the directory contents
+	if err != nil {
+		// Log the error
+		fmt.Println("Error::GetAllPosts:", err)
+		// Return an empty list to have a clean fallback
+		return []Post{}
+	}
+
+	// Go through all of the files
+	for _, v := range files {
+		// Process the file into a pad
+		postList = append(postList, GetPost(v.Name(), false))
+	}
+
+	// Return the post list
+	return postList
+}

lib/routes/routes_admin.go

@@ -0,0 +1,95 @@
+package routes
+
+import (
+	"encoding/hex"
+	"fmt"
+	"net/http"
+
+	"github.com/JustKato/FreePad/lib/controllers"
+	"github.com/JustKato/FreePad/lib/helper"
+	"github.com/JustKato/FreePad/lib/objects"
+	"github.com/gin-gonic/gin"
+
+	"crypto/sha512"
+)
+
+var adminLoginToken string = ""
+
+func AdminRoutes(router *gin.RouterGroup) {
+
+	adminLoginToken = helper.GetAdminToken()
+
+	// Apply the admin middleware for identification
+	controllers.AdminMiddleware(router)
+
+	// Admin login route
+	router.GET("/login", func(ctx *gin.Context) {
+		ctx.HTML(200, "admin_login.html", gin.H{
+			"title":       "Login Login",
+			"domain_base": helper.GetDomainBase(),
+		})
+	})
+
+	router.POST("/login", func(ctx *gin.Context) {
+
+		// Get the value of the admin token
+		adminToken := ctx.PostForm("admin-token")
+
+		// Check if the input admin token matches our admin token
+		if adminLoginToken != "" && adminLoginToken == adminToken {
+
+			sha512Hasher := sha512.New()
+			sha512Hasher.Write([]byte(adminToken))
+
+			// Set the cookie to be an admin
+			hashHexToken := sha512Hasher.Sum(nil)
+			hashToken := hex.EncodeToString(hashHexToken)
+
+			// Set the cookie
+			ctx.SetCookie("admin_token", hashToken, 60*60, "/", helper.GetDomainBase(), true, true)
+
+			ctx.Request.Method = "GET"
+
+			// Redirect the user to the admin page
+			ctx.Redirect(http.StatusFound, "/admin/view")
+			return
+		} else {
+			ctx.Request.Method = "GET"
+
+			// Redirect the user to the admin page
+			ctx.Redirect(http.StatusFound, "/admin/login?fail")
+			return
+		}
+
+	})
+
+	router.GET("/delete/:padname", func(ctx *gin.Context) {
+		// Get the pad name that we bout' to delete
+		padName := ctx.Param("padname")
+
+		// Try and get the pad, check if valid
+		pad := objects.GetPost(padName, false)
+
+		// Delete the pad
+		err := pad.Delete()
+		fmt.Println(err)
+
+		// Redirect the user to the admin page
+		ctx.Redirect(http.StatusFound, "/admin/view")
+	})
+
+	// Admin view route
+	router.GET("/view", func(ctx *gin.Context) {
+
+		// Get all of the pads as a listing
+		padList := objects.GetAllPosts()
+
+		ctx.HTML(200, "admin_view.html", gin.H{
+			"title":       "Admin",
+			"padList":     padList,
+			"domain_base": helper.GetDomainBase(),
+		})
+
+	})
+
+}

lib/routes/routes_home.go

@@ -39,9 +39,9 @@ func HomeRoutes(router *gin.Engine) {
 		if err == nil {
 			postName = newPostName
 		}
-		postName = sanitize.AlphaNumeric(postName, true)
+		postName = sanitize.XSS(sanitize.SingleLine(postName))
 
-		post := objects.GetPost(postName)
+		post := objects.GetPost(postName, true)
 
 		c.HTML(200, "page.html", gin.H{
 			"title":          postName,
@@ -63,7 +63,7 @@ func HomeRoutes(router *gin.Engine) {
 		if err == nil {
 			postName = newPostName
 		}
-		postName = sanitize.AlphaNumeric(postName, true)
+		postName = sanitize.XSS(sanitize.SingleLine(postName))
 
 		p := objects.Post{
 			Name:         postName,

main.go

@@ -46,6 +46,9 @@ func main() {
 	// Implement the rate limiter
 	controllers.DoRateLimit(router)
 
+	// Admin Routing
+	routes.AdminRoutes(router.Group("/admin"))
+
 	// Add Routes
 	routes.HomeRoutes(router)
 

static/css/main.css

@@ -1,3 +1,5 @@
+@import url('https://fonts.googleapis.com/css2?family=Roboto+Mono:wght@300&display=swap');
+
 :root {
     --color-border-default: #444c56;
     --color-fg-default: #adbac7;
@@ -35,6 +37,48 @@ main#main-card {
     right: .5rem;
 }
 
+.hidden {
+    display: none !important;
+}
+
+#pad-content, #textarea-preview {
+    tab-size: 2;
+
+    font-family: 'Roboto Mono', monospace !important;
+}
+
+#pad-content-area {
+    position: relative;
+
+    display: flex;
+    flex-flow: column;
+}
+
+.edit-content-text {
+    display: none;
+}
+
+.read-only-content .edit-content-text {
+    display: block !important;
+}
+
+.read-only-content .view-content-text {
+    display: none !important;
+}
+
+#pad-content-toggler {
+    position: absolute;
+    top: .5rem;
+    right: .5rem;
+
+    user-select: none;
+}
+
+#textarea-preview {
+    max-height: calc(17rem + 30vh);
+    min-height: 17rem;
+    overflow: auto;
+}
 
 textarea:focus,
 input[type="text"]:focus,
@@ -56,3 +100,27 @@ input[type="color"]:focus,
   box-shadow: none;
   outline: 0 none;
 }
+
+
+/* ===== Scrollbar CSS ===== */
+  /* Firefox */
+  * {
+    scrollbar-width: thin;
+    scrollbar-color: #3b3b3b #ffffff00;
+  }
+
+  /* Chrome, Edge, and Safari */
+  *::-webkit-scrollbar {
+    width: 7px;
+    height: 7px;
+  }
+
+  *::-webkit-scrollbar-track {
+    background: #ffffff00;
+  }
+
+  *::-webkit-scrollbar-thumb {
+    background-color: #3b3b3b;
+    border-radius: 2px;
+    border: 1px solid #ffffff00;
+  }

static/js/pad-scripts.js

@@ -3,12 +3,12 @@ function sendMyData(el) {
     const formData = new FormData();
 
     // Check if the writing watch was sending something already
-    if ( !!window.writingWatch ) {
+    if (!!window.writingWatch) {
         // Clear old timeout
         clearTimeout(window.writingWatch);
     }
 
-    if ( el.value.length > maximumPadSize ) {
+    if (el.value.length > maximumPadSize) {
         let err = new Error(`Your Pad is too big! Please keep it limited to ${maximumPadSize} characters!`);
         alert(err);
         throw err;
@@ -16,6 +16,13 @@ function sendMyData(el) {
 
     el.setAttribute(`readonly`, `1`);
 
+    const textareaPreview = document.getElementById(`textarea-preview`)
+    if (!!textareaPreview) {
+        textareaPreview.textContent = el.value;
+
+        hljs.highlightElement(document.getElementById(`textarea-preview`));
+    }
+
     formData.set("content", el.value);
 
     updateStatus(`Attempting to save...`, `text-warning`);
@@ -24,36 +31,36 @@ function sendMyData(el) {
         body: formData,
         method: "post",
     })
-    .then( resp => {
-        resp.json()
-        .then( e => {
-            document.getElementById(`last_modified_`).value = e.pad.last_modified;
-            updateStatus(`Succesfully Saved`, `text-success`);
+        .then(resp => {
+            resp.json()
+                .then(e => {
+                    document.getElementById(`last_modified_`).value = e.pad.last_modified;
+                    updateStatus(`Succesfully Saved`, `text-success`);
+                })
+                .catch(err => {
+                    updateStatus(`Failed to Save`, `text-danger`);
+                    console.error(err);
+                })
         })
-        .catch( err => {
+        .catch(err => {
             updateStatus(`Failed to Save`, `text-danger`);
             console.error(err);
         })
-    })
-    .catch( err => {
-        updateStatus(`Failed to Save`, `text-danger`);
-        console.error(err);
-    })
-    .finally( () => {
-        el.removeAttribute(`readonly`);
-    })
+        .finally(() => {
+            el.removeAttribute(`readonly`);
+        })
 }
 
 function toggleWritingWatch(el) {
 
     // Check if the writing watch was sending something already
-    if ( !!window.writingWatch ) {
+    if (!!window.writingWatch) {
         // Clear old timeout
         clearTimeout(window.writingWatch);
     }
 
     // Set a timeout for the action
-    window.writingWatch = setTimeout( () => {
+    window.writingWatch = setTimeout(() => {
         // Send out the data
         sendMyData(el)
     }, 750)
@@ -74,7 +81,7 @@ function getLocalArchives() {
     let a = localStorage.getItem(`${padTitle}_archives`);
 
     // Check if we had anything in storage for the archives
-    if ( a == null ) {
+    if (a == null) {
         // There were nothing in storage
         return [];
     }
@@ -82,7 +89,7 @@ function getLocalArchives() {
     try {
         // Try and parse the json
         a = JSON.parse(a);
-    } catch ( err ) {
+    } catch (err) {
         // Return null of the fail
         return [];
     }
@@ -93,7 +100,7 @@ function getLocalArchives() {
 function storeArchives(archives) {
 
     // Check if the provided list is an array
-    if ( !Array.isArray(archives) ) return;
+    if (!Array.isArray(archives)) return;
 
     // Set the current archives
     localStorage.setItem(`${padTitle}_archives`, JSON.stringify(archives));
@@ -105,13 +112,13 @@ function renderArchivesSelection() {
     const archivesSelection = document.getElementById(`archives-selection`);
     const rowTemplate = document.getElementById(`archive-selection-example`);
     // Clear any old optiosn
-    archivesSelection.querySelectorAll(`.dropdown-item:not(#do-archive-button):not(#archive-selection-example)`).forEach( el => {
+    archivesSelection.querySelectorAll(`.dropdown-item:not(#do-archive-button):not(#archive-selection-example)`).forEach(el => {
         // Remove the element
         el.remove();
     })
 
     // Get the current list of available archives
-    for ( let a of getLocalArchives() ) {
+    for (let a of getLocalArchives()) {
         // Clone the template row
         const row = rowTemplate.cloneNode(true);
 
@@ -130,7 +137,7 @@ function renderArchivesSelection() {
 
             let resp = confirm("Load contents of pad from memory? This will overwrite the current pad for everyone.");
 
-            if ( !!resp ) {
+            if (!!resp) {
                 document.getElementById(`pad-content`).value = a.content;
             }
         })
@@ -142,7 +149,7 @@ function renderArchivesSelection() {
 function saveLocalArchive() {
     let resp = confirm("Save a local copy of the current Pad?");
 
-    if ( !resp ) {
+    if (!resp) {
         // Do not
         return;
     }
@@ -173,7 +180,7 @@ function generateQRCode() {
     // Add new qr
     new QRCode(qrcodeContainer, {
         text: window.location.toString(),
-        width:  256,
+        width: 256,
         height: 256,
         colorDark: "#555273",
         colorLight: "#ffffff",
@@ -184,11 +191,35 @@ function generateQRCode() {
     MicroModal.show(`qrmodal`)
 }
 
-document.addEventListener(`DOMContentLoaded`, e => {
+function toggleTextareaPreview() {
+    setTextareaPreview(!document.getElementById(`pad-content-toggler`).classList.contains(`read-only`))
+}
 
-    { // Textarea Focusing
-        const textarea = document.getElementById(`pad-content`);
+// t == true - Read Only
+// t == false - Edit mode
+function setTextareaPreview(t = true) {
+    const prev = document.getElementById(`textarea-preview`)
+    const textarea = document.getElementById(`pad-content`);
+    const toggler = document.getElementById(`pad-content-toggler`);
+    const padContentArea = document.getElementById(`pad-content-area`);
 
+    if (t) {
+        // Toggle read only
+        prev.classList.remove(`hidden`)
+        toggler.classList.add(`read-only`);
+
+        padContentArea.classList.add(`read-only-content`);
+
+        textarea.classList.add(`hidden`);
+    } else {
+        // Toggle edit mode
+        prev.classList.add(`hidden`)
+        toggler.classList.remove(`read-only`);
+
+        padContentArea.classList.remove(`read-only-content`);
+
+
+        textarea.classList.remove(`hidden`);
         // Focus
         textarea.focus();
         // Scroll
@@ -197,6 +228,38 @@ document.addEventListener(`DOMContentLoaded`, e => {
         textarea.setSelectionRange(textarea.value.length, textarea.value.length);
     }
 
+}
+
+document.addEventListener(`DOMContentLoaded`, e => {
+
+    { // Textarea Handling
+        const textarea = document.getElementById(`pad-content`);
+        setTextareaPreview(!!textarea.value);
+
+        // Make sure tabs are taken into consideration
+        textarea.addEventListener('keydown', function (e) {
+            if (e.key == 'Tab') {
+                e.preventDefault();
+                const start = this.selectionStart;
+                const end = this.selectionEnd;
+
+                // set textarea value to: text before caret + tab + text after caret
+                this.value = this.value.substring(0, start) +
+                    "\t" + this.value.substring(end);
+
+                // put caret at right position again
+                this.selectionStart =
+                    this.selectionEnd = start + 1;
+            }
+        });
+    }
+
+    try { // highlights
+        hljs.highlightElement(document.getElementById(`textarea-preview`));
+    } catch ( err ) {
+        console.err(err);
+    }
+
     { // Archives
         renderArchivesSelection()
     }

static/js/pad.js

@@ -14,8 +14,14 @@ class Pad {
         // Create a new blob of the contents of the pad
         var blob = new Blob([ document.getElementById(`pad-content`).value ], { type: "text/plain;charset=utf-8" });
 
+        let downloadFileName = this.title;
+        if ( !this.title.includes(`.`) ) {
+            // Append a default file format
+            downloadFileName += `.txt`;
+        }
+
         // Save the blob as
-        saveAs(blob, `${this.title}.txt`);
+        saveAs(blob, `${downloadFileName}`);
     }
 
 }

static/vendor/bootstrap/darkmode.min.js

@@ -0,0 +1,6 @@
+/*!
+ * Bootstrap-Dark-5 v1.1.3 (https://vinorodrigues.github.io/bootstrap-dark-5/)
+ * Copyright 2021 Vino Rodrigues
+ * Licensed under MIT (https://github.com/vinorodrigues/bootstrap-dark-5/blob/main/LICENSE.md)
+ */
+"use strict";class DarkMode{constructor(){this._hasGDPRConsent=!1,this.cookieExpiry=365,"loading"===document.readyState?document.addEventListener("DOMContentLoaded",(function(){DarkMode.onDOMContentLoaded()})):DarkMode.onDOMContentLoaded()}get inDarkMode(){return DarkMode.getColorScheme()==DarkMode.VALUE_DARK}set inDarkMode(e){this.setDarkMode(e,!1)}get hasGDPRConsent(){return this._hasGDPRConsent}set hasGDPRConsent(e){if(this._hasGDPRConsent=e,e){const e=DarkMode.readCookie(DarkMode.DATA_KEY);e&&(DarkMode.saveCookie(DarkMode.DATA_KEY,"",-1),localStorage.setItem(DarkMode.DATA_KEY,e))}else{const e=localStorage.getItem(DarkMode.DATA_KEY);e&&(localStorage.removeItem(DarkMode.DATA_KEY),DarkMode.saveCookie(DarkMode.DATA_KEY,e))}}get documentRoot(){return document.getElementsByTagName("html")[0]}static saveCookie(e,o="",t=365){let a="";if(t){const e=new Date;e.setTime(e.getTime()+24*t*60*60*1e3),a="; expires="+e.toUTCString()}document.cookie=e+"="+o+a+"; SameSite=Strict; path=/"}saveValue(e,o,t=this.cookieExpiry){this.hasGDPRConsent?DarkMode.saveCookie(e,o,t):localStorage.setItem(e,o)}static readCookie(e){const o=e+"=",t=document.cookie.split(";");for(let e=0;e<t.length;e++){const a=t[e].trim();if(a.startsWith(o))return a.substring(o.length)}return""}readValue(e){if(this.hasGDPRConsent)return DarkMode.readCookie(e);{const o=localStorage.getItem(e);return o||""}}eraseValue(e){this.hasGDPRConsent?this.saveValue(e,"",-1):localStorage.removeItem(e)}getSavedColorScheme(){const e=this.readValue(DarkMode.DATA_KEY);return e||""}getPreferedColorScheme(){return window.matchMedia&&window.matchMedia("(prefers-color-scheme: dark)").matches?DarkMode.VALUE_DARK:window.matchMedia&&window.matchMedia("(prefers-color-scheme: light)").matches?DarkMode.VALUE_LIGHT:""}setDarkMode(e,o=!0){const t=document.querySelectorAll("[data-"+DarkMode.DATA_SELECTOR+"]");if(0==t.length)e?(this.documentRoot.classList.remove(DarkMode.CLASS_NAME_LIGHT),this.documentRoot.classList.add(DarkMode.CLASS_NAME_DARK)):(this.documentRoot.classList.remove(DarkMode.CLASS_NAME_DARK),this.documentRoot.classList.add(DarkMode.CLASS_NAME_LIGHT));else for(let o=0;o<t.length;o++)t[o].setAttribute("data-"+DarkMode.DATA_SELECTOR,e?DarkMode.VALUE_DARK:DarkMode.VALUE_LIGHT);o&&this.saveValue(DarkMode.DATA_KEY,e?DarkMode.VALUE_DARK:DarkMode.VALUE_LIGHT)}toggleDarkMode(e=!0){let o;const t=document.querySelector("[data-"+DarkMode.DATA_SELECTOR+"]");o=t?t.getAttribute("data-"+DarkMode.DATA_SELECTOR)==DarkMode.VALUE_DARK:this.documentRoot.classList.contains(DarkMode.CLASS_NAME_DARK),this.setDarkMode(!o,e)}resetDarkMode(){this.eraseValue(DarkMode.DATA_KEY);const e=this.getPreferedColorScheme();if(e)this.setDarkMode(e==DarkMode.VALUE_DARK,!1);else{const e=document.querySelectorAll("[data-"+DarkMode.DATA_SELECTOR+"]");if(0==e.length)this.documentRoot.classList.remove(DarkMode.CLASS_NAME_LIGHT),this.documentRoot.classList.remove(DarkMode.CLASS_NAME_DARK);else for(let o=0;o<e.length;o++)e[o].setAttribute("data-"+DarkMode.DATA_SELECTOR,"")}}static getColorScheme(){const e=document.querySelector("[data-"+DarkMode.DATA_SELECTOR+"]");if(e){const o=e.getAttribute("data-"+DarkMode.DATA_SELECTOR);return o==DarkMode.VALUE_DARK||o==DarkMode.VALUE_LIGHT?o:""}return darkmode.documentRoot.classList.contains(DarkMode.CLASS_NAME_DARK)?DarkMode.VALUE_DARK:darkmode.documentRoot.classList.contains(DarkMode.CLASS_NAME_LIGHT)?DarkMode.VALUE_LIGHT:""}static updatePreferedColorSchemeEvent(){let e=darkmode.getSavedColorScheme();e||(e=darkmode.getPreferedColorScheme(),e&&darkmode.setDarkMode(e==DarkMode.VALUE_DARK,!1))}static onDOMContentLoaded(){let e=darkmode.readValue(DarkMode.DATA_KEY);e||(e=DarkMode.getColorScheme(),e||(e=darkmode.getPreferedColorScheme()));const o=e==DarkMode.VALUE_DARK;darkmode.setDarkMode(o,!1),window.matchMedia&&window.matchMedia("(prefers-color-scheme: dark)").addEventListener("change",(function(){DarkMode.updatePreferedColorSchemeEvent()}))}}DarkMode.DATA_KEY="bs.prefers-color-scheme",DarkMode.DATA_SELECTOR="bs-color-scheme",DarkMode.VALUE_LIGHT="light",DarkMode.VALUE_DARK="dark",DarkMode.CLASS_NAME_LIGHT="light",DarkMode.CLASS_NAME_DARK="dark";const darkmode=new DarkMode;

static/vendor/hljs/theme.css

@@ -0,0 +1,98 @@
+/*!
+  Theme: a11y-dark
+  Author: @ericwbailey
+  Maintainer: @ericwbailey
+
+  Based on the Tomorrow Night Eighties theme: https://github.com/isagalaev/highlight.js/blob/master/src/styles/tomorrow-night-eighties.css
+*/
+
+.hljs {
+  background: #2b2b2b;
+  color: #f8f8f2;
+}
+
+/* Comment */
+.hljs-comment,
+.hljs-quote {
+  color: #d4d0ab;
+}
+
+/* Red */
+.hljs-variable,
+.hljs-template-variable,
+.hljs-tag,
+.hljs-name,
+.hljs-selector-id,
+.hljs-selector-class,
+.hljs-regexp,
+.hljs-deletion {
+  color: #ffa07a;
+}
+
+/* Orange */
+.hljs-number,
+.hljs-built_in,
+.hljs-literal,
+.hljs-type,
+.hljs-params,
+.hljs-meta,
+.hljs-link {
+  color: #f5ab35;
+}
+
+/* Yellow */
+.hljs-attribute {
+  color: #ffd700;
+}
+
+/* Green */
+.hljs-string,
+.hljs-symbol,
+.hljs-bullet,
+.hljs-addition {
+  color: #abe338;
+}
+
+/* Blue */
+.hljs-title,
+.hljs-section {
+  color: #00e0e0;
+}
+
+/* Purple */
+.hljs-keyword,
+.hljs-selector-tag {
+  color: #dcc6e0;
+}
+
+.hljs-emphasis {
+  font-style: italic;
+}
+
+.hljs-strong {
+  font-weight: bold;
+}
+
+@media screen and (-ms-high-contrast: active) {
+  .hljs-addition,
+  .hljs-attribute,
+  .hljs-built_in,
+  .hljs-bullet,
+  .hljs-comment,
+  .hljs-link,
+  .hljs-literal,
+  .hljs-meta,
+  .hljs-number,
+  .hljs-params,
+  .hljs-string,
+  .hljs-symbol,
+  .hljs-type,
+  .hljs-quote {
+        color: highlight;
+    }
+
+    .hljs-keyword,
+    .hljs-selector-tag {
+        font-weight: bold;
+    }
+}

templates/inc/footer.html

@@ -1,4 +1,4 @@
 {{ define "inc/footer.html"}}
-    <script src="https://cdn.jsdelivr.net/npm/bootstrap-dark-5@1.1.3/dist/js/darkmode.min.js"></script>
+    <script src="/static/vendor/bootstrap/darkmode.min.js"></script>
     <script src="/static/js/main.js"></script>
 {{ end }}

templates/inc/header.html

@@ -14,7 +14,7 @@
 
     <meta name="color-scheme" content="light dark">
 
-    <link href="https://cdn.jsdelivr.net/npm/bootstrap-dark-5@1.1.3/dist/css/bootstrap-nightshade.min.css" rel="stylesheet">
+    <link href="/static/vendor/bootstrap/bootstrap-nightshade.min.css" rel="stylesheet">
     <!-- Love https://vinorodrigues.github.io/bootstrap-dark-5/ -->
     <link rel="stylesheet" href="/static/css/main.css">
 </head>

templates/pages/admin_login.html

@@ -0,0 +1,42 @@
+{{ template "inc/header.html" .}}
+
+<body>
+
+    <main id="main-card" class="container rounded mt-5 shadow-sm">
+        <div class="p-3">
+
+            <a href="/" class="logo-container w-100 d-flex mb-4">
+                <img src="/static/img/logo_transparent.png" alt="Logo" style="max-width: 50%; margin: 0 auto;" class="mx-auto">
+            </a>
+
+            <div class="form-group my-4">
+                <form class="search-action input-group" method="post" action="/admin/login">
+                    <input autocomplete="off" type="password" class="form-control form-control-lg" name="admin-token" placeholder="Your Admin token" aria-label="Your Admin token" aria-describedby="admin-token-button" id="admin-token">
+
+                    <button class="btn btn-primary" type="submit" id="admin-token-button">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="24 " height="24 " fill="currentColor" class="bi bi-box-arrow-in-right" viewBox="0 0 16 16">
+                            <path fill-rule="evenodd" d="M6 3.5a.5.5 0 0 1 .5-.5h8a.5.5 0 0 1 .5.5v9a.5.5 0 0 1-.5.5h-8a.5.5 0 0 1-.5-.5v-2a.5.5 0 0 0-1 0v2A1.5 1.5 0 0 0 6.5 14h8a1.5 1.5 0 0 0 1.5-1.5v-9A1.5 1.5 0 0 0 14.5 2h-8A1.5 1.5 0 0 0 5 3.5v2a.5.5 0 0 0 1 0v-2z"/>
+                            <path fill-rule="evenodd" d="M11.854 8.354a.5.5 0 0 0 0-.708l-3-3a.5.5 0 1 0-.708.708L10.293 7.5H1.5a.5.5 0 0 0 0 1h8.793l-2.147 2.146a.5.5 0 0 0 .708.708l3-3z"/>
+                        </svg>
+                    </button>
+
+                </form>
+                <small class="text-muted">Access the admin interface for FreePad, this can only be done through the Admin Token.</small>
+            </div>
+        </div>
+
+        <footer class="text-muted py-5 border-top text-center">
+            <p class="mb-1">
+                FreePad by <a href="https://justkato.me/">©Kato Twofold</a>
+            </p>
+            <p class="mb-0">
+                FreePad is freely available over on our <a href="https://github.com/JustKato/FreePad">GitHub</a>
+            </p>
+        </footer>
+
+    </main>
+
+    {{ template "inc/theme-toggle.html" .}}
+</body>
+
+{{ template "inc/footer.html" .}}

templates/pages/admin_view.html

@@ -0,0 +1,94 @@
+{{ template "inc/header.html" .}}
+
+<style>
+
+    .pad-instance {
+        display: flex;
+        flex-flow: row;
+        justify-content: space-between;
+        align-items: center;
+    }
+
+    #pad-list {
+        max-height: 30rem;
+        overflow-x: hidden;
+        overflow-y: auto;
+    }
+
+    .pad-name {
+        max-width: 30%;
+        overflow: hidden;
+    }
+
+</style>
+
+<body>
+
+    <main id="main-card" class="container rounded mt-5 shadow-sm">
+        <div class="p-3">
+
+            <a href="/" class="logo-container w-100 d-flex mb-4">
+                <img src="/static/img/logo_transparent.png" alt="Logo" style="max-width: 50%; margin: 0 auto;" class="mx-auto">
+            </a>
+
+            <div class="form-group my-4 border-top p-3 border">
+
+                <div class="pad-instance my-2 border-bottom">
+                    <div class="pad-name col-5">
+                        Pad Name
+                    </div>
+                    <div class="pad-last-view col-1">
+                        Views
+                    </div>
+                    <div class="pad-last-modified col-4">
+                        Create Date
+                    </div>
+                    <div class="col-2">
+                        Actions
+                    </div>
+                </div>
+
+                <div id="pad-list" >
+                    {{ range $indx, $element := .padList }}
+
+                        <div class="pad-instance my-2">
+                            <div class="pad-name col-5">
+                                <a href="/{{ $element.Name }}">
+                                    {{ $element.Name }}
+                                </a>
+                            </div>
+                            <div class="pad-last-view col-1">
+                                {{ $element.Views }}
+                            </div>
+                            <div class="pad-last-modified col-4">
+                                {{ $element.LastModified }}
+                            </div>
+                            <div class="col-2">
+                                <div onclick="doDelete({{ $element.Name }})" class="btn btn-danger">
+                                    Delete
+                                </div>
+                            </div>
+                        </div>
+    
+                    {{ end }}
+                </div>
+
+            </div>
+        </div>
+
+    </main>
+
+    {{ template "inc/theme-toggle.html" .}}
+</body>
+
+<script>
+    function doDelete(id) {
+        // Confirm deletion
+        if ( confirm("Confirm pad deletion?") ) {
+            // Do delete
+            window.location.href = `/admin/delete/${id}`;
+        }
+    }
+</script>
+
+{{ template "inc/footer.html" .}}

templates/pages/index.html

@@ -46,6 +46,22 @@
                     just write it in the box above and get to the right page, write anything in
                     and access the same address on any other device to get your info!
                 </p>
+                <small>A couple hints:</small>
+                <p>
+                    Pads take into consideration file extensions, use <code>.json</code>, 
+                    <code>.js</code>, <code>.cpp</code>, <code>.txt</code>, etc... to help 
+                    parse your type of file
+                </p>
+                <p>
+                    The archival feature helps you store information on your local machine! Save your 
+                    pads and you can always come back and rewrite them exactly as they have been
+                </p>
+                <p>
+                    All pads can be publicly edited, so if you choose some common name 
+                    and someone elses accesses the link they can completely remove/edit 
+                    what you wrote, not to mention seein that information, so refrain 
+                    from sharing important data here.
+                </p>
             </div>
         </div>
 

templates/pages/page.html

@@ -21,6 +21,8 @@
     var padTitle = {{.title }};
 </script>
 
+<link rel="stylesheet" href="/static/vendor/hljs/theme.css">
+
 <body>
 
     <main id="main-card" class="container rounded mt-5 shadow-sm">
@@ -35,9 +37,27 @@
 
         <h2 class="mb-4">{{.title}}</h2>
 
-        <textarea maxlength="{{.maximumPadSize}}" name="pad-content" id="pad-content" onchange="sendMyData(this)"
-            onkeydown="updateStatus(`Not Saved`, `text-warning`); toggleWritingWatch(this)"
-            class="form-control">{{.post_content}}</textarea>
+        <div id="pad-content-area">
+            <div class="btn-sm btn" id="pad-content-toggler" onclick="toggleTextareaPreview()">
+                <span class="edit-content-text" title="Edit Content">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-pencil" viewBox="0 0 16 16">
+                        <path d="M12.146.146a.5.5 0 0 1 .708 0l3 3a.5.5 0 0 1 0 .708l-10 10a.5.5 0 0 1-.168.11l-5 2a.5.5 0 0 1-.65-.65l2-5a.5.5 0 0 1 .11-.168l10-10zM11.207 2.5 13.5 4.793 14.793 3.5 12.5 1.207 11.207 2.5zm1.586 3L10.5 3.207 4 9.707V10h.5a.5.5 0 0 1 .5.5v.5h.5a.5.5 0 0 1 .5.5v.5h.293l6.5-6.5zm-9.761 5.175-.106.106-1.528 3.821 3.821-1.528.106-.106A.5.5 0 0 1 5 12.5V12h-.5a.5.5 0 0 1-.5-.5V11h-.5a.5.5 0 0 1-.468-.325z"/>
+                    </svg>
+                </span>
+                <span class="view-content-text" title="ReadOnly">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-eyeglasses" viewBox="0 0 16 16" style="margin-top: 1rem;">
+                        <path d="M4 6a2 2 0 1 1 0 4 2 2 0 0 1 0-4zm2.625.547a3 3 0 0 0-5.584.953H.5a.5.5 0 0 0 0 1h.541A3 3 0 0 0 7 8a1 1 0 0 1 2 0 3 3 0 0 0 5.959.5h.541a.5.5 0 0 0 0-1h-.541a3 3 0 0 0-5.584-.953A1.993 1.993 0 0 0 8 6c-.532 0-1.016.208-1.375.547zM14 8a2 2 0 1 1-4 0 2 2 0 0 1 4 0z"/>
+                    </svg>
+                </span>
+            </div>
+
+            <pre><code id="textarea-preview" class="form-control hidden">{{.post_content}}</code></pre>
+
+            <textarea maxlength="{{.maximumPadSize}}" name="pad-content" id="pad-content" onchange="sendMyData(this)"
+                onkeydown="updateStatus(`Not Saved`, `text-warning`); toggleWritingWatch(this)"
+                class="form-control hidden">{{.post_content}}</textarea>
+        </div>
+
 
         <div id="pad-status" class="my-4 row">
             <div class="col-md-12 col-lg-4 col-xl-4" title="Status">
@@ -192,10 +212,11 @@
 <script src="/static/js/fileSaver.js"></script>
 <script src="/static/js/pad.js"></script>
 <script src="/static/js/pad-scripts.js"></script>
+<script src="/static/vendor/hljs/highlight.min.js"></script>
 
-<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js" integrity="sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM" crossorigin="anonymous"></script>
-<script src="https://cdn.rawgit.com/davidshimjs/qrcodejs/gh-pages/qrcode.min.js"></script>
-<script src="https://unpkg.com/micromodal/dist/micromodal.min.js"></script>
+<script src="/static/vendor/bootstrap/bootstrap.bundle.min.js"></script>
+<script src="/static/vendor/qrcodejs/qrcode.min.js"></script>
+<script src="/static/vendor/micromodal/micromodal.min.js"></script>
 
 <script>
     window.pad = new Pad({{.title }}, {{.last_modified }});