Skip to content

Two journal requirement, url sanitisation #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ArcaEge merged 5 commits into from
Dec 18, 2025
Merged

Two journal requirement, url sanitisation #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
15790e8
Add two devlog requirement
ArcaEge Dec 18, 2025
778482a
Hide model section if it doesn't exist (on review pages)
ArcaEge Dec 18, 2025
2fe78e2
Fix possible javascript injection
ArcaEge Dec 18, 2025
4d77027
Update to url sanitisation
ArcaEge Dec 18, 2025
99ac9c9
Shut up sentrybot
ArcaEge Dec 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@
},
"dependencies": {
"@aws-sdk/client-s3": "^3.940.0",
"@braintree/sanitize-url": "^7.1.1",
"@lucide/svelte": "^0.547.0",
"@prgm/sveltekit-progress-bar": "^3.0.2",
"@sentry/sveltekit": "^10.29.0",
Expand Down
36 changes: 19 additions & 17 deletions src/routes/dashboard/admin/review/[id]/+page.svelte
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,24 +85,26 @@
</div>
</div>

<div class="mt-2 flex flex-row">
<h2 class="grow text-2xl font-bold">3D model</h2>
<a
href={`${data.s3PublicUrl}/${data.project.project.modelFile}`}
download
class="button primary flex flex-col justify-center rounded-lg px-3 hover:outline-3 focus:outline-3"
>
<Download />
</a>
</div>
{#if data.project.project.modelFile}
<div class="mt-2 flex flex-row">
<h2 class="grow text-2xl font-bold">3D model</h2>
<a
href={`${data.s3PublicUrl}/${data.project.project.modelFile}`}
download
class="button primary flex flex-col justify-center rounded-lg px-3 hover:outline-3 focus:outline-3"
>
<Download />
</a>
</div>

<div class="themed-box flex h-100 flex-col gap-3 overflow-clip">
<Spinny3DPreview
identifier="model"
modelUrl={`${data.s3PublicUrl}/${data.project.project.modelFile}`}
sizeCutoff={8*1024*1024}
/>
</div>
<div class="themed-box flex h-100 flex-col gap-3 overflow-clip">
<Spinny3DPreview
identifier="model"
modelUrl={`${data.s3PublicUrl}/${data.project.project.modelFile}`}
sizeCutoff={8 * 1024 * 1024}
/>
</div>
{/if}

<h2 class="mt-2 text-2xl font-bold">Review</h2>
<div class="themed-box flex flex-col gap-3 p-3">
Expand Down
36 changes: 19 additions & 17 deletions src/routes/dashboard/admin/ysws-review/[id]/+page.svelte
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,24 +85,26 @@
</div>
</div>

<div class="mt-2 flex flex-row">
<h2 class="grow text-2xl font-bold">3D model</h2>
<a
href={`${data.s3PublicUrl}/${data.project.project.modelFile}`}
download
class="button primary flex flex-col justify-center rounded-lg px-3 hover:outline-3 focus:outline-3"
>
<Download />
</a>
</div>
{#if data.project.project.modelFile}
<div class="mt-2 flex flex-row">
<h2 class="grow text-2xl font-bold">3D model</h2>
<a
href={`${data.s3PublicUrl}/${data.project.project.modelFile}`}
download
class="button primary flex flex-col justify-center rounded-lg px-3 hover:outline-3 focus:outline-3"
>
<Download />
</a>
</div>

<div class="themed-box flex h-100 flex-col gap-3 overflow-clip">
<Spinny3DPreview
identifier="model"
modelUrl={`${data.s3PublicUrl}/${data.project.project.modelFile}`}
sizeCutoff={8 * 1024 * 1024}
/>
</div>
<div class="themed-box flex h-100 flex-col gap-3 overflow-clip">
<Spinny3DPreview
identifier="model"
modelUrl={`${data.s3PublicUrl}/${data.project.project.modelFile}`}
sizeCutoff={8 * 1024 * 1024}
/>
</div>
{/if}

<h2 class="mt-2 text-2xl font-bold">YSWS Review (don't use yet if you're not Arca)</h2>
<div class="themed-box flex flex-col gap-3 p-3">
Expand Down
38 changes: 24 additions & 14 deletions src/routes/dashboard/projects/[id]/ship/+page.server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import { env } from '$env/dynamic/private';
import { PutObjectCommand } from '@aws-sdk/client-s3';
import { S3 } from '$lib/server/s3';
import { ship } from '$lib/server/db/schema.js';
import { sanitizeUrl } from '@braintree/sanitize-url';

export async function load({ params, locals }) {
const id: number = parseInt(params.id);
Expand Down Expand Up @@ -79,19 +80,22 @@ export const actions = {
const editorFile = data.get('editor_file') as File;
const modelFile = data.get('model_file') as File;

const printablesUrlString =
printablesUrl && printablesUrl.toString() ? sanitizeUrl(printablesUrl.toString()) : null;

const printablesUrlValid =
printablesUrl &&
printablesUrl.toString() &&
printablesUrl.toString().trim().length < 8000 &&
isValidUrl(printablesUrl.toString().trim());
printablesUrlString &&
printablesUrlString.trim().length < 8000 &&
isValidUrl(printablesUrlString.trim()) &&
printablesUrlString !== 'about:blank';

if (!printablesUrlValid) {
return fail(400, {
invalid_printables_url: true
});
}

const printablesUrlObj = new URL(printablesUrl.toString().trim());
const printablesUrlObj = new URL(printablesUrlString.trim());

const pathMatch = printablesUrlObj.pathname.match(/\/model\/(\d+)/);
const modelId = pathMatch ? pathMatch[1] : '';
Expand Down Expand Up @@ -154,12 +158,13 @@ export const actions = {

// Editor URL
const editorUrlExists = editorUrl && editorUrl.toString();

const editorUrlString = editorUrlExists ? sanitizeUrl(editorUrl.toString()) : null;

const editorUrlValid =
editorUrlExists &&
editorUrl.toString().trim().length < 8000 &&
isValidUrl(editorUrl.toString().trim());
editorUrlString && editorUrlString.trim().length < 8000 && isValidUrl(editorUrlString.trim());

if (editorUrlExists && !editorUrlValid) {
if (editorUrlExists && (!editorUrlValid || editorUrlString === 'about:blank')) {
return fail(400, {
invalid_editor_url: true
});
Expand Down Expand Up @@ -222,7 +227,7 @@ export const actions = {
or(eq(project.status, 'building'), eq(project.status, 'rejected'))
)
)
.groupBy(project.id, project.description, project.url)
.groupBy(project.id, project.name, project.description, project.url)
.limit(1);

if (!queriedProject) {
Expand All @@ -234,6 +239,11 @@ export const actions = {
return error(400, { message: 'minimum 2h needed to ship' });
}

// Make sure it has at least 2 devlogs
if (queriedProject.devlogCount < 2) {
return error(400, { message: 'minimum 2 journal logs required to ship' });
}

if (queriedProject.description == '') {
return error(400, { message: 'project must have a description' });
}
Comment on lines 239 to 249

This comment was marked as outdated.

Sign in to view

Expand Down Expand Up @@ -264,9 +274,9 @@ export const actions = {
.update(project)
.set({
status: 'submitted',
url: printablesUrl.toString(),
url: printablesUrlString,
editorFileType: editorUrlExists ? 'url' : 'upload',
editorUrl: editorUrlExists ? editorUrl.toString() : undefined,
editorUrl: editorUrlExists ? editorUrlString : undefined,
uploadedFileUrl: editorFileExists ? editorFilePath : undefined,

modelFile: modelPath
Expand All @@ -282,10 +292,10 @@ export const actions = {
await db.insert(ship).values({
userId: locals.user.id,
projectId: queriedProject.id,
url: printablesUrl.toString(),
url: printablesUrlString,

editorFileType: editorUrlExists ? 'url' : 'upload',
editorUrl: editorUrlExists ? editorUrl.toString() : undefined,
editorUrl: editorUrlExists ? editorUrlString : undefined,
uploadedFileUrl: editorFileExists ? editorFilePath : undefined,

modelFile: modelPath
Expand Down
4 changes: 4 additions & 0 deletions src/routes/dashboard/projects/[id]/ship/+page.svelte
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,9 @@
<ChecklistItem completed={data.project.timeSpent >= 120}
>At least 120 minutes spent</ChecklistItem
>
<ChecklistItem completed={data.project.devlogCount >= 2}
>At least 2 journal logs</ChecklistItem
>
<ChecklistItem completed={data.project.description != ''}>
Project has a description
</ChecklistItem>
Expand Down Expand Up @@ -191,6 +194,7 @@
class="button sm orange"
disabled={formPending ||
data.project.timeSpent < 120 ||
data.project.devlogCount < 2 ||
data.project.description == '' ||
!printablesUrl ||
!hasEditorFile ||
Expand Down
Loading