lew/guestbook
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: renames some options to be a little clearer, and fixes up the module

Browse source
This commit is contained in:
Lewis Wynne 2026-04-09 18:57:58 +01:00
parent 0534b315a3
commit 726fe55eb8
5 changed files with 212 additions and 199 deletions
Download patch file Download diff file Expand all files Collapse all files

44
src/config.rs
View file

@ -9,13 +9,13 @@ pub struct Config {
pub telegram_bot_token: String,
pub telegram_chat_id: i64,
pub honeypot: bool,
pub enable_honeypot: bool,
pub max_name_length: usize,
pub max_message_length: usize,
pub max_website_length: usize,
pub open_registration: bool,
pub enable_website_field: bool,
pub allow_html_injection: bool,
pub enable_submissions: bool,
pub enable_website_links: bool,
pub enable_html_injection: bool,
pub template: Option<String>,
pub separator: String,
pub style: String,
@ -50,7 +50,7 @@ impl Config {
.map_err(|_| "BOOK_TELEGRAM_CHAT_ID is required")?
.parse()
.map_err(|_| "BOOK_TELEGRAM_CHAT_ID must be an integer")?,
honeypot: env::var("BOOK_HONEYPOT")
enable_honeypot: env::var("BOOK_ENABLE_HONEYPOT")
.map(|v| v != "false")
.unwrap_or(true),
max_name_length: env::var("BOOK_MAX_NAME_LENGTH")
@ -65,13 +65,13 @@ impl Config {
.unwrap_or_else(|_| "100".into())
.parse()
.map_err(|_| "BOOK_MAX_WEBSITE_LENGTH must be a number")?,
open_registration: env::var("BOOK_OPEN_REGISTRATION")
enable_submissions: env::var("BOOK_ENABLE_SUBMISSIONS")
.map(|v| v != "false")
.unwrap_or(true),
enable_website_field: env::var("BOOK_ENABLE_WEBSITE_FIELD")
enable_website_links: env::var("BOOK_ENABLE_WEBSITE_LINKS")
.map(|v| v != "false")
.unwrap_or(true),
allow_html_injection: env::var("BOOK_ALLOW_HTML_INJECTION")
enable_html_injection: env::var("BOOK_ENABLE_HTML_INJECTION")
.map(|v| v != "false")
.unwrap_or(true),
separator: env::var("BOOK_SEPARATOR")
@ -167,60 +167,60 @@ mod tests {
}
#[test]
fn test_enable_website_field_default() {
fn test_enable_website_links_default() {
let _lock = ENV_LOCK.lock().unwrap();
env::set_var("BOOK_TELEGRAM_BOT_TOKEN", "123:ABC");
env::set_var("BOOK_TELEGRAM_CHAT_ID", "12345");
env::remove_var("BOOK_ENABLE_WEBSITE_FIELD");
env::remove_var("BOOK_ENABLE_WEBSITE_LINKS");
let config = Config::from_env().unwrap();
assert!(config.enable_website_field);
assert!(config.enable_website_links);
env::remove_var("BOOK_TELEGRAM_BOT_TOKEN");
env::remove_var("BOOK_TELEGRAM_CHAT_ID");
}
#[test]
fn test_enable_website_field_false() {
fn test_enable_website_links_false() {
let _lock = ENV_LOCK.lock().unwrap();
env::set_var("BOOK_TELEGRAM_BOT_TOKEN", "123:ABC");
env::set_var("BOOK_TELEGRAM_CHAT_ID", "12345");
env::set_var("BOOK_ENABLE_WEBSITE_FIELD", "false");
env::set_var("BOOK_ENABLE_WEBSITE_LINKS", "false");
let config = Config::from_env().unwrap();
assert!(!config.enable_website_field);
assert!(!config.enable_website_links);
env::remove_var("BOOK_TELEGRAM_BOT_TOKEN");
env::remove_var("BOOK_TELEGRAM_CHAT_ID");
env::remove_var("BOOK_ENABLE_WEBSITE_FIELD");
env::remove_var("BOOK_ENABLE_WEBSITE_LINKS");
}
#[test]
fn test_allow_html_injection_default() {
fn test_enable_html_injection_default() {
let _lock = ENV_LOCK.lock().unwrap();
env::set_var("BOOK_TELEGRAM_BOT_TOKEN", "123:ABC");
env::set_var("BOOK_TELEGRAM_CHAT_ID", "12345");
env::remove_var("BOOK_ALLOW_HTML_INJECTION");
env::remove_var("BOOK_ENABLE_HTML_INJECTION");
let config = Config::from_env().unwrap();
assert!(config.allow_html_injection);
assert!(config.enable_html_injection);
env::remove_var("BOOK_TELEGRAM_BOT_TOKEN");
env::remove_var("BOOK_TELEGRAM_CHAT_ID");
}
#[test]
fn test_allow_html_injection_false() {
fn test_enable_html_injection_false() {
let _lock = ENV_LOCK.lock().unwrap();
env::set_var("BOOK_TELEGRAM_BOT_TOKEN", "123:ABC");
env::set_var("BOOK_TELEGRAM_CHAT_ID", "12345");
env::set_var("BOOK_ALLOW_HTML_INJECTION", "false");
env::set_var("BOOK_ENABLE_HTML_INJECTION", "false");
let config = Config::from_env().unwrap();
assert!(!config.allow_html_injection);
assert!(!config.enable_html_injection);
env::remove_var("BOOK_TELEGRAM_BOT_TOKEN");
env::remove_var("BOOK_TELEGRAM_CHAT_ID");
env::remove_var("BOOK_ALLOW_HTML_INJECTION");
env::remove_var("BOOK_ENABLE_HTML_INJECTION");
}
}

24
src/render.rs
View file

@ -20,7 +20,7 @@ pub fn render_page(template: &str, config: &Config, entries: &[Entry], form_html
}
pub fn render_form(config: &Config) -> String {
let website_section = if config.enable_website_field {
let website_section = if config.enable_website_links {
format!(
"\n<label class=\"guestbook-label\">{}</label>\n<input class=\"guestbook-input\" name=\"website\">\n",
config.label_website
@ -67,7 +67,7 @@ fn render_entries(entries: &[Entry], config: &Config) -> String {
}
fn render_entry(entry: &Entry, config: &Config) -> String {
let name = if config.allow_html_injection {
let name = if config.enable_html_injection {
entry.meta.name.clone()
} else {
escape_html(&entry.meta.name)
@ -76,7 +76,7 @@ fn render_entry(entry: &Entry, config: &Config) -> String {
"<span class=\"entry-header\">{} - <span class=\"entry-name\">{}</span>",
entry.meta.date, name
);
if config.enable_website_field && !entry.meta.website.is_empty() {
if config.enable_website_links && !entry.meta.website.is_empty() {
let website = escape_html(&entry.meta.website);
header.push_str(&format!(
" (<a class=\"entry-website\" href=\"{}\">{}</a>)",
@ -84,7 +84,7 @@ fn render_entry(entry: &Entry, config: &Config) -> String {
));
}
header.push_str("</span>");
let body = if config.allow_html_injection {
let body = if config.enable_html_injection {
entry.body.clone()
} else {
escape_html(&entry.body)
@ -109,13 +109,13 @@ mod tests {
telegram_bot_token: "fake".into(),
telegram_chat_id: 0,
honeypot: true,
enable_honeypot: true,
max_name_length: 50,
max_message_length: 1000,
max_website_length: 100,
open_registration: true,
enable_website_field: true,
allow_html_injection: true,
enable_submissions: true,
enable_website_links: true,
enable_html_injection: true,
template: None,
separator: "---".into(),
style: String::new(),
@ -234,7 +234,7 @@ mod tests {
#[test]
fn test_render_form_hides_website_when_disabled() {
let mut config = test_config();
config.enable_website_field = false;
config.enable_website_links = false;
let form = render_form(&config);
assert!(!form.contains("name=\"website\""));
assert!(!form.contains(&config.label_website));
@ -262,7 +262,7 @@ mod tests {
#[test]
fn test_render_entry_hides_website_when_disabled() {
let mut config = test_config();
config.enable_website_field = false;
config.enable_website_links = false;
let mut entry = make_entry("bob", "2026-04-09", "Hi!");
entry.meta.website = "https://bob.com".into();
let form = render_form(&config);
@ -274,7 +274,7 @@ mod tests {
#[test]
fn test_render_entry_escapes_html_when_injection_disabled() {
let mut config = test_config();
config.allow_html_injection = false;
config.enable_html_injection = false;
let entry = make_entry("<b>hacker</b>", "2026-04-09", "<script>alert('xss')</script>");
let form = render_form(&config);
let html = render_page(DEFAULT_TEMPLATE, &config, &[entry], &form);
@ -286,7 +286,7 @@ mod tests {
#[test]
fn test_render_entry_preserves_html_when_injection_enabled() {
let mut config = test_config();
config.allow_html_injection = true;
config.enable_html_injection = true;
let entry = make_entry("carol", "2026-04-09", "<b>Bold</b>");
let form = render_form(&config);
let html = render_page(DEFAULT_TEMPLATE, &config, &[entry], &form);

28
src/web.rs
View file

@ -37,7 +37,7 @@ pub fn router(state: Arc<AppState>) -> Router {
async fn index(State(state): State<Arc<AppState>>) -> Html<String> {
let entries_dir = state.config.data_dir.join("entries");
let entries = entries::read_approved(&entries_dir);
let form = if state.config.open_registration {
let form = if state.config.enable_submissions {
render::render_form(&state.config)
} else {
String::new()
@ -56,19 +56,19 @@ async fn submit(
State(state): State<Arc<AppState>>,
Form(form): Form<SubmitForm>,
) -> Html<String> {
if !state.config.open_registration {
if !state.config.enable_submissions {
return Html("Submissions are closed.".to_string());
}
// Honeypot check — silently discard
if state.config.honeypot && !form.url.is_empty() {
if state.config.enable_honeypot && !form.url.is_empty() {
return Html("Thanks! Your message is pending approval.".to_string());
}
// Validation
let name = form.name.trim().to_string();
let message = form.message.trim().to_string();
let website = if state.config.enable_website_field {
let website = if state.config.enable_website_links {
form.website.trim().to_string()
} else {
String::new()
@ -136,13 +136,13 @@ mod tests {
telegram_bot_token: "fake".into(),
telegram_chat_id: 0,
honeypot: true,
enable_honeypot: true,
max_name_length: 50,
max_message_length: 1000,
max_website_length: 100,
open_registration: true,
enable_website_field: true,
allow_html_injection: true,
enable_submissions: true,
enable_website_links: true,
enable_html_injection: true,
template: None,
separator: "---".into(),
style: String::new(),
@ -186,7 +186,7 @@ mod tests {
}
#[tokio::test]
async fn test_open_registration_shows_form() {
async fn test_enable_submissions_shows_form() {
let dir = tempfile::tempdir().unwrap();
let config = test_config(dir.path());
let (app, _rx) = test_app(config);
@ -198,7 +198,7 @@ mod tests {
async fn test_closed_registration_hides_form() {
let dir = tempfile::tempdir().unwrap();
let mut config = test_config(dir.path());
config.open_registration = false;
config.enable_submissions = false;
let (app, _rx) = test_app(config);
let html = get_index(&app).await;
assert!(!html.contains("action=\"/submit\""));
@ -208,7 +208,7 @@ mod tests {
async fn test_closed_registration_rejects_submit() {
let dir = tempfile::tempdir().unwrap();
let mut config = test_config(dir.path());
config.open_registration = false;
config.enable_submissions = false;
let (app, _rx) = test_app(config);
let (status, body) = post_form(&app, "name=test&message=hello").await;
assert_eq!(status, StatusCode::OK);
@ -234,7 +234,7 @@ mod tests {
async fn test_honeypot_disabled_allows_url_field() {
let dir = tempfile::tempdir().unwrap();
let mut config = test_config(dir.path());
config.honeypot = false;
config.enable_honeypot = false;
let (app, _rx) = test_app(config);
let (_, body) = post_form(&app, "name=user&message=hello&url=http://mysite.com").await;
assert!(body.contains("pending approval"));
@ -313,7 +313,7 @@ mod tests {
async fn test_website_field_disabled_ignores_website() {
let dir = tempfile::tempdir().unwrap();
let mut config = test_config(dir.path());
config.enable_website_field = false;
config.enable_website_links = false;
let (app, _rx) = test_app(config);
let (_, body) = post_form(&app, "name=alice&message=hello&website=http://evil.com").await;
assert!(body.contains("pending approval"));
@ -328,7 +328,7 @@ mod tests {
async fn test_website_field_disabled_hides_form_field() {
let dir = tempfile::tempdir().unwrap();
let mut config = test_config(dir.path());
config.enable_website_field = false;
config.enable_website_links = false;
let (app, _rx) = test_app(config);
let html = get_index(&app).await;
assert!(!html.contains("name=\"website\""));