soatok / faq-off

Gamebook-style Q&A Platform - Tell sea lions and mob harassers to FAQ Off!

Hi, I'm Soatok!

I'm a gay furry computer programmer with a dhole fursona.

Everything I publish on this Github account is strictly for fun, and usually intended to benefit the furry and LGBTQIA+ communities.

I write a lot about the furry fandom, computer security, and cryptography on my blog, Dhole Moments.

Stickers by Lynx vs Jackalope

faq-off's Issues

Reflected XSS in Twitter Generic Error

Bug

A reflected XSS is present in the generic error handler. It seems that the error parameter is not sanitized before being inserted into the webpage.

Steps to reproduce:

1. go to /generic-error/twitter-error?error=<script>alert(1)</script>
2. view alert box showing execution of javascript code

Custom CSS/etc. Support

Support loading additional CSS/JS files via configuration in local/settings.php and copying the files into public/local/.

Collection Themes

Each collections should be able to specify a "theme", as provided by the site administrator. Depends on #4

Twitter Cards

Sketchy hyperlinks discourage people from reading further.

Having a Twitter card that generates an eye-pleasing SVG based on the question will improve user experience and compel the redeemable sea-lioning Internet trolls to actually read your pre-written retort for their obvious, insipid questions.

Question Box

Purpose

Sometimes we don't know up front what follow-up questions people will have. Sometimes, they have a follow-up question that isn't adequately covered by the existing follow-ups, and will continue to harass with their variant of the question.

Solution: A question box (which is disabled by default and can be enabled) that allows anonymous Internet users authenticated users to ask follow-up questions.

Rough Feature Sketch

Users will be able to enable a question box at the following levels:

1. Per Collection
2. Per Entry

The Question Box will consist of the following inputs:

1. The question.
2. Contact information for the asker (optional).
3. A checkbox to set a cookie to remember the contact information.

1. The question.
2. A checkbox to indicate whether or not to attribute the comment to the asker.

Complete Unit Test Coverage

We should have detailed unit tests that cover not only the internal functionality, but the expected results of subsequent requests.

For example, if you create a new author profile with a random screen name, you should then be able to access /@{$username} and get an HTTP 2xx response rather than an HTTP 3xx response.

Author Collaboration

Users should be able to invite other users to share an author profile.

The user that creates the author will be the owner, the invited users are merely "contributors".

The access controls logic is already present, we just need a user interface for managing this.