petrbalvin/volumen
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity
21 Commits 2 Branches 6 Tags
73be893bf833ada9dcad8367038b1f44955b0a1e
Commit Graph
6 Commits
Author SHA1 Message Date
petrbalvin 73be893bf8 feat: add scheduled publishing with publish_at frontmatter field 
Posts with a future publish_at date are hidden from the public API
and feeds, same as drafts. The admin form exposes a Publish at field.
 2026-06-25 22:06:49 +02:00
petrbalvin 52be2bb996 security: CORS preflight, session invalidation, CSRF on preview, symlink containment, and hardening 
- Add OPTIONS /api/volumen/* for CORS preflight (S-22).
- Invalidate session in require_login! when user no longer exists (S-8).
- Add check_csrf! to POST /admin/preview (S-1).
- Use File.realpath for symlink-safe containment in media_file (S-2).
- Memoize Users#all with mtime-based invalidation (S-12).
- Document that empty permitted_hosts means allow-all (S-5).
- Warn and fall back to random when session_key is too short (S-20).
 2026-06-25 22:06:49 +02:00
petrbalvin 5b8236c0a4 test: add sitemap.xml endpoint test 
Verify content type, urlset structure, post URL presence, and draft exclusion.
 2026-06-25 22:06:49 +02:00
petrbalvin 263e794669 security: hide draft posts from public detail endpoint 
Add post.draft? check to GET /api/volumen/posts/:slug so guessing a
draft slug returns 404 like the list endpoint already does.
 2026-06-25 22:06:49 +02:00
petrbalvin 4597c685da test: add RSS feed endpoint tests 
Verify content type, RSS structure, draft exclusion, and language
element.
 2026-06-25 21:41:19 +02:00
petrbalvin dd3efe870e feat: initial release of volumen — a file-based Markdown blog engine 2026-06-21 13:15:06 +02:00