Bug fixes (real breakage):
Newsletter nudge — was calling /api/study-account/profile (wrong endpoint, ignored subscription). Now correctly calls /api/study-account/preferences with PATCH. Security: Email regex — replaced the permissive [^\s@]+@[^\s@]+ pattern with a proper RFC-compliant regex in contact.js and downloads.js Avatar magic bytes — server now checks actual PNG/JPEG/GIF/WEBP header bytes, not just the data URL prefix Certificate rate limit — public /api/public/certificate/:token now has a 30 req/15min limiter Session absolute TTL — admin sessions now have a 30-day hard cap; a stolen token can no longer be kept alive indefinitely by passive reads Account lockout — 5 failed logins locks a study account for 1 hour CSP headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers added globally Data integrity: Cascade delete — deleting a study account now also removes their certificates, community posts, comments, and progress file UX / reliability: Escape key on modals — all 3 modal groups (study index, notes, account) now close on Escape Display name min-length — empty spaces-only names rejected; if provided, must be ≥2 chars Note save rate limit — 30 saves/minute per user max Analytics fetch timeout — 5s AbortController so a hanging server doesn't block the browser indefinitely Email validation on signup — frontend catches bad email formats before hitting the server Cleanup: Deduplicated download forms — StudyDownloadForm and ResourceDownloadForm now share a single DownloadForm base; both are now thin wrappers
This commit is contained in:
nmemmert
+15
-98
@@ -29,12 +29,15 @@ function usePageTracking() {
|
||||
useEffect(() => {
|
||||
if (localStorage.getItem(CONSENT_KEY) !== 'accepted') return
|
||||
const referrer = document.referrer || ''
|
||||
const controller = new AbortController()
|
||||
const timeout = setTimeout(() => controller.abort(), 5000)
|
||||
fetch('/api/analytics/pageview', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ path: location.pathname, referrer }),
|
||||
keepalive: true,
|
||||
}).catch(() => {})
|
||||
signal: controller.signal,
|
||||
}).catch(() => {}).finally(() => clearTimeout(timeout))
|
||||
}, [location.pathname])
|
||||
}
|
||||
|
||||
@@ -150,13 +153,12 @@ function HeadlinerWidget() {
|
||||
)
|
||||
}
|
||||
|
||||
function StudyDownloadForm({ buttonText = 'Download Guide' }: { buttonText?: string }) {
|
||||
function DownloadForm({ endpoint, extraBody, buttonText }: { endpoint: string; extraBody?: Record<string, string>; buttonText: string }) {
|
||||
const [fields, setFields] = useState({ firstName: '', lastName: '', email: '' })
|
||||
const [subscribe, setSubscribe] = useState(true)
|
||||
const [honey, setHoney] = useState('')
|
||||
const [status, setStatus] = useState<'idle' | 'submitting' | 'error' | 'success'>('idle')
|
||||
const [errorMsg, setErrorMsg] = useState('')
|
||||
const [successMsg, setSuccessMsg] = useState('')
|
||||
const [downloadUrl, setDownloadUrl] = useState('')
|
||||
|
||||
function handleChange(e: React.ChangeEvent<HTMLInputElement>) {
|
||||
@@ -167,14 +169,13 @@ function StudyDownloadForm({ buttonText = 'Download Guide' }: { buttonText?: str
|
||||
e.preventDefault()
|
||||
setStatus('submitting')
|
||||
setErrorMsg('')
|
||||
setSuccessMsg('')
|
||||
setDownloadUrl('')
|
||||
|
||||
try {
|
||||
const res = await fetch('/api/study-downloads/titus', {
|
||||
const res = await fetch(endpoint, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ ...fields, subscribe, _honey: honey }),
|
||||
body: JSON.stringify({ ...extraBody, ...fields, subscribe, _honey: honey }),
|
||||
})
|
||||
|
||||
const data = await res.json().catch(() => ({})) as { message?: string; downloadUrl?: string }
|
||||
@@ -185,7 +186,6 @@ function StudyDownloadForm({ buttonText = 'Download Guide' }: { buttonText?: str
|
||||
}
|
||||
|
||||
setStatus('success')
|
||||
setSuccessMsg('Your download should start now. If not, use the link below.')
|
||||
setDownloadUrl(data.downloadUrl)
|
||||
window.location.assign(data.downloadUrl)
|
||||
} catch {
|
||||
@@ -228,10 +228,10 @@ function StudyDownloadForm({ buttonText = 'Download Guide' }: { buttonText?: str
|
||||
<span>Subscribe me to updates from Verse by Verse with Nate.</span>
|
||||
</label>
|
||||
{status === 'error' && <p className="contact-error">{errorMsg}</p>}
|
||||
{status === 'success' && <p className="study-download-success">{successMsg}</p>}
|
||||
{status === 'success' && downloadUrl && (
|
||||
{status === 'success' && (
|
||||
<p className="study-download-success">
|
||||
<a href={downloadUrl}>Click here if your download does not start automatically.</a>
|
||||
Your download should start now.{' '}
|
||||
{downloadUrl && <a href={downloadUrl}>Click here if it does not start automatically.</a>}
|
||||
</p>
|
||||
)}
|
||||
<button type="submit" className="btn-primary" disabled={status === 'submitting'}>
|
||||
@@ -241,95 +241,12 @@ function StudyDownloadForm({ buttonText = 'Download Guide' }: { buttonText?: str
|
||||
)
|
||||
}
|
||||
|
||||
function StudyDownloadForm({ buttonText = 'Download Guide' }: { buttonText?: string }) {
|
||||
return <DownloadForm endpoint="/api/study-downloads/titus" buttonText={buttonText} />
|
||||
}
|
||||
|
||||
function ResourceDownloadForm({ resourceId, buttonText }: { resourceId: string; buttonText: string }) {
|
||||
const [fields, setFields] = useState({ firstName: '', lastName: '', email: '' })
|
||||
const [subscribe, setSubscribe] = useState(true)
|
||||
const [honey, setHoney] = useState('')
|
||||
const [status, setStatus] = useState<'idle' | 'submitting' | 'error' | 'success'>('idle')
|
||||
const [errorMsg, setErrorMsg] = useState('')
|
||||
const [successMsg, setSuccessMsg] = useState('')
|
||||
const [downloadUrl, setDownloadUrl] = useState('')
|
||||
|
||||
function handleChange(e: React.ChangeEvent<HTMLInputElement>) {
|
||||
setFields(f => ({ ...f, [e.target.name]: e.target.value }))
|
||||
}
|
||||
|
||||
async function handleSubmit(e: React.FormEvent) {
|
||||
e.preventDefault()
|
||||
setStatus('submitting')
|
||||
setErrorMsg('')
|
||||
setSuccessMsg('')
|
||||
setDownloadUrl('')
|
||||
|
||||
try {
|
||||
const res = await fetch('/api/resource-download', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ resourceId, ...fields, subscribe, _honey: honey }),
|
||||
})
|
||||
|
||||
const data = await res.json().catch(() => ({})) as { message?: string; downloadUrl?: string }
|
||||
if (!res.ok || !data.downloadUrl) {
|
||||
setErrorMsg(data.message ?? 'Could not process your request. Please try again.')
|
||||
setStatus('error')
|
||||
return
|
||||
}
|
||||
|
||||
setStatus('success')
|
||||
setSuccessMsg('Your download should start now. If not, use the link below.')
|
||||
setDownloadUrl(data.downloadUrl)
|
||||
window.location.assign(data.downloadUrl)
|
||||
} catch {
|
||||
setErrorMsg('Could not connect. Please try again later.')
|
||||
setStatus('error')
|
||||
}
|
||||
}
|
||||
|
||||
return (
|
||||
<form className="study-download-form" onSubmit={handleSubmit} noValidate>
|
||||
<input
|
||||
type="text"
|
||||
className="contact-honeypot"
|
||||
tabIndex={-1}
|
||||
autoComplete="off"
|
||||
aria-hidden="true"
|
||||
value={honey}
|
||||
onChange={e => setHoney(e.target.value)}
|
||||
/>
|
||||
<div className="study-download-grid">
|
||||
<label>
|
||||
First Name
|
||||
<input type="text" name="firstName" required autoComplete="given-name" value={fields.firstName} onChange={handleChange} />
|
||||
</label>
|
||||
<label>
|
||||
Last Name
|
||||
<input type="text" name="lastName" required autoComplete="family-name" value={fields.lastName} onChange={handleChange} />
|
||||
</label>
|
||||
<label>
|
||||
Email
|
||||
<input type="email" name="email" required autoComplete="email" value={fields.email} onChange={handleChange} />
|
||||
</label>
|
||||
</div>
|
||||
<label className="contact-consent">
|
||||
<input
|
||||
type="checkbox"
|
||||
checked={subscribe}
|
||||
onChange={e => setSubscribe(e.target.checked)}
|
||||
/>
|
||||
<span>Subscribe me to updates from Verse by Verse with Nate.</span>
|
||||
</label>
|
||||
{status === 'error' && <p className="contact-error">{errorMsg}</p>}
|
||||
{status === 'success' && <p className="study-download-success">{successMsg}</p>}
|
||||
{status === 'success' && downloadUrl && (
|
||||
<p className="study-download-success">
|
||||
<a href={downloadUrl}>Click here if your download does not start automatically.</a>
|
||||
</p>
|
||||
)}
|
||||
<button type="submit" className="btn-primary" disabled={status === 'submitting'}>
|
||||
{status === 'submitting' ? 'Preparing Download...' : buttonText}
|
||||
</button>
|
||||
</form>
|
||||
)
|
||||
return <DownloadForm endpoint="/api/resource-download" extraBody={{ resourceId }} buttonText={buttonText} />
|
||||
}
|
||||
|
||||
function buildCustomResourceDownloadId(id: string) {
|
||||
|
||||
+35
-2
@@ -521,6 +521,15 @@ export function StudyLandingPage({ content }: Props) {
|
||||
setEnrollMessage('')
|
||||
}
|
||||
|
||||
useEffect(() => {
|
||||
if (studyModal === 'none') return
|
||||
function onKeyDown(e: KeyboardEvent) {
|
||||
if (e.key === 'Escape') closeStudyModal()
|
||||
}
|
||||
document.addEventListener('keydown', onKeyDown)
|
||||
return () => document.removeEventListener('keydown', onKeyDown)
|
||||
}, [studyModal])
|
||||
|
||||
useEffect(() => {
|
||||
let cancelled = false
|
||||
|
||||
@@ -697,9 +706,11 @@ export function StudyLandingPage({ content }: Props) {
|
||||
<div style={{ display: 'flex', gap: '0.75rem', flexWrap: 'wrap' }}>
|
||||
<button type="button" className="btn-primary" style={{ fontSize: '0.85rem', padding: '0.4rem 1rem' }} onClick={async () => {
|
||||
try {
|
||||
await fetch('/api/study-account/profile', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ subscribeNewsletter: true }) })
|
||||
await fetch('/api/study-account/preferences', { method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ subscribeNewsletter: true, studyRemindersEnabled: auth.studyRemindersEnabled === true }) })
|
||||
setAuth(prev => ({ ...prev, subscribeNewsletter: true }))
|
||||
} catch {}
|
||||
} catch {
|
||||
// Silently continue — preference will sync on next account load
|
||||
}
|
||||
setNewsletterNudgeDone(true)
|
||||
setShowNewsletterNudge(false)
|
||||
}}>Yes, subscribe me</button>
|
||||
@@ -928,6 +939,10 @@ export function StudySignupPage() {
|
||||
setMessage('Please enter your email and password.')
|
||||
return
|
||||
}
|
||||
if (!/^[a-zA-Z0-9._%+\-]{1,64}@[a-zA-Z0-9.\-]{1,253}\.[a-zA-Z]{2,}$/.test(email.trim())) {
|
||||
setMessage('Please enter a valid email address.')
|
||||
return
|
||||
}
|
||||
setBusy(true)
|
||||
setMessage('')
|
||||
try {
|
||||
@@ -1523,6 +1538,15 @@ export function ColossiansStudySectionPage({ content }: Props) {
|
||||
setNotesModalOpen(false)
|
||||
}
|
||||
|
||||
useEffect(() => {
|
||||
if (!notesModalOpen) return
|
||||
function onKeyDown(e: KeyboardEvent) {
|
||||
if (e.key === 'Escape') closeNotesModal()
|
||||
}
|
||||
document.addEventListener('keydown', onKeyDown)
|
||||
return () => document.removeEventListener('keydown', onKeyDown)
|
||||
}, [notesModalOpen])
|
||||
|
||||
function appendSelectedTextToNotes(selectedText: string) {
|
||||
if (!selectedText.trim()) return
|
||||
setNoteText(prev => prev ? `${prev.trim()}\n\n${selectedText.trim()}` : selectedText.trim())
|
||||
@@ -2500,6 +2524,15 @@ export function StudyAccountPage() {
|
||||
setEnrollMessage('')
|
||||
}
|
||||
|
||||
useEffect(() => {
|
||||
if (accountModal === 'none') return
|
||||
function onKeyDown(e: KeyboardEvent) {
|
||||
if (e.key === 'Escape') closeAccountModal()
|
||||
}
|
||||
document.addEventListener('keydown', onKeyDown)
|
||||
return () => document.removeEventListener('keydown', onKeyDown)
|
||||
}, [accountModal])
|
||||
|
||||
if (!auth.checked) {
|
||||
return (
|
||||
<main className="thanks-page" aria-label="Loading">
|
||||
|
||||
Reference in New Issue
Block a user