openwrite 0.17.1__tar.gz → 0.17.2__tar.gz

{openwrite-0.17.1/openwrite.egg-info → openwrite-0.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openwrite
-Version: 0.17.1
+Version: 0.17.2
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
                                Version 3, 19 November 2007
         

{openwrite-0.17.1 → openwrite-0.17.2}/openwrite/gemini_single.py

@@ -1,7 +1,8 @@
 import os, subprocess
+import re
 from dotenv import load_dotenv
 from openwrite.utils.db import init_engine, SessionLocal
-from openwrite.utils.models import Blog, Post, User, View
+from openwrite.utils.models import Blog, Post, User, View, Page
 from openwrite.utils.helpers import anonymize
 from md2gemini import md2gemini
 from datetime import datetime, timezone
@@ -11,28 +12,28 @@ def blog_index(req):
     global session
     try:
         blog = session.query(Blog).filter_by(name="default").first()
-                if not blog:
-                    return "not found"
-                posts = (session.query(Post)
-                        .filter_by(blog=blog.id)
-                        .order_by(Post.id.desc())
-                        .all())
-                pages = (session.query(Page)
-                        .filter(Page.blog == blog.id, Page.show == "1").all())
-                homepage = session.query(Page).filter(Page.blog == blog.id, Page.url == "").first()
-                body = f"# 📓 {blog.title}\n\n"
-                posts_data = ""
-                for post in posts:
-                    posts_data += f"=> /b/{blogname}/{post.link} {post.title}\n\n"
-                pages_data = ""
-                for page in pages:
-                    pages_data += f"=> /b/{blogname}/{page.url} {page.name}\n\n"
-                content = pages_data + "\n"
-                content += homepage.content_raw.replace('{posts}', f"\n{posts_data}")
-                content = re.sub(r'!\[(.*?)\]\((.*?)\s*=\d+x\d+\)', r'![\1](\2)', content)
-                body += md2gemini(content)
-                
-                return body
+        if not blog:
+            return "not found"
+        posts = (session.query(Post)
+                .filter_by(blog=blog.id, isdraft="0")
+                .order_by(Post.id.desc())
+                .all())
+        pages = (session.query(Page)
+                .filter(Page.blog == blog.id, Page.show == "1").all())
+        homepage = session.query(Page).filter(Page.blog == blog.id, Page.url == "").first()
+        body = f"# 📓 {blog.title}\n\n"
+        posts_data = ""
+        for post in posts:
+            posts_data += f"=> /p/{post.link} {post.title}\n\n"
+        pages_data = ""
+        for page in pages:
+            pages_data += f"=> /p/{page.url} {page.name}\n\n"
+        content = pages_data + "\n"
+        content += homepage.content_raw.replace('{posts}', f"\n{posts_data}") if homepage else posts_data
+        content = re.sub(r'!\[(.*?)\]\((.*?)\s*=\d+x\d+\)', r'![\1](\2)', content)
+        body += md2gemini(content)
+
+        return body
     finally:
         session.close()
 
@@ -55,7 +56,7 @@ def blog_post(req):
                             .filter_by(blog=blog.id, url=slug)
                             .first())
                 if page:
-                    content = f"=> /b/{blog.name} 📓 {blog.title}\n\n"
+                    content = f"=> / 📓 {blog.title}\n\n"
                     content += page.content_raw
                     content = re.sub(r'!\[(.*?)\]\((.*?)\s*=\d+x\d+\)', r'![\1](\2)', content)
                     return md2gemini(content)
@@ -72,7 +73,7 @@ def blog_post(req):
                 session.commit()
 
             post.authorname = user.username
-            gemtext = f"=> /b/{blog.name} 📓 {blog.title}\n"
+            gemtext = f"=> / 📓 {blog.title}\n"
             gemtext += f"# 🧾 {post.title}\n\n"
             gemtext += f"{post.date} "
             if post.author != "0":

{openwrite-0.17.1 → openwrite-0.17.2}/openwrite/routes/blog.py

@@ -1,4 +1,4 @@
-from flask import Blueprint, render_template, redirect, request, g, Response, abort, send_file, jsonify
+from flask import Blueprint, render_template, redirect, request, g, Response, abort, send_file, jsonify, current_app
 from openwrite.utils.models import Blog, Post, User, View, Like, Page, PostDraft, Comment
 from openwrite.utils.tags import get_post_tags, parse_tags_from_posts_syntax, get_posts_by_tags
 from openwrite.utils.helpers import gen_link, sanitize_html, anonymize, get_ip
@@ -457,10 +457,15 @@ def like():
 
 
 def serve_rss(blog):
-    """
-    Here we just serve static RSS files :)
-    """
-    return send_file(f"{g.mainpath}/static/feed/{blog.name}.xml")
+    """Generate a missing feed, then serve the cached file as usual."""
+    if blog is None:
+        abort(404)
+    directory = current_app.config.get('RSS_DIRECTORY', f'{g.mainpath}/static/feed')
+    path = os.path.join(directory, f'{blog.name}.xml')
+    if not os.path.isfile(path):
+        from openwrite.routes.dashboard import generate_rss
+        generate_rss(blog.name)
+    return send_file(path, mimetype='application/rss+xml')
 
 
 @blog_bp.route("/comment", methods=['POST'])

{openwrite-0.17.1 → openwrite-0.17.2}/openwrite/routes/dashboard.py

@@ -1,4 +1,4 @@
-from flask import Blueprint, render_template, redirect, request, g, abort, Response
+from flask import Blueprint, render_template, redirect, request, g, abort, Response, current_app
 from openwrite.utils.models import Blog, Post, User, View, Like, Page, Settings, Tag, PostTag
 from openwrite.utils.helpers import sanitize_html, gen_link, safe_css, is_html, get_themes
 from openwrite.utils.tags import parse_tags_from_input, update_post_tags, get_post_tags
@@ -14,6 +14,7 @@ from zoneinfo import ZoneInfo
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.primitives import serialization
 import json
+import os
 import bcrypt
 import markdown
 from bs4 import BeautifulSoup
@@ -672,7 +673,10 @@ def generate_rss(blog):
     fg.image(url="https://openwrite.io/static/favicon.png")
     fg.title(b.title)
 
-    if b.access == "domain":
+    if g.mode == "single":
+        blog_url = f"https://{g.main_domain}"
+        post_base_url = f"{blog_url}/p"
+    elif b.access == "domain":
         blog_url = f"https://{b.name}.{g.main_domain}"
         post_base_url = blog_url
     else:
@@ -694,5 +698,6 @@ def generate_rss(blog):
         fe.content(content=p.content_html, type="CDATA")
         fe.published(p.date.replace(tzinfo=timezone.utc))
 
-    rssfeed = fg.rss_str(pretty=True)
-    fg.rss_file(f"{g.mainpath}/static/feed/{b.name}.xml")
+    directory = current_app.config.get('RSS_DIRECTORY', f'{g.mainpath}/static/feed')
+    os.makedirs(directory, exist_ok=True)
+    fg.rss_file(os.path.join(directory, f'{b.name}.xml'))

{openwrite-0.17.1 → openwrite-0.17.2}/openwrite/routes/upload.py

@@ -1,9 +1,8 @@
 from flask import Blueprint, request, jsonify, g, send_from_directory, abort
-from openwrite.utils.models import User
 from werkzeug.utils import secure_filename
 from PIL import Image
 import os
-import hashlib
+from uuid import uuid4
 import requests
 
 upload_bp = Blueprint("upload", __name__)
@@ -43,11 +42,7 @@ def upload_image():
         return jsonify({"error": g.trans['not_image']}), 400
 
     file.stream.seek(0)
-    user = g.db.query(User).filter_by(id=g.user).first()
-
-    m = hashlib.md5()
-    m.update(filename.encode() + user.username.encode())
-    filename = f"{m.hexdigest()}.{extension}"
+    filename = f"{uuid4().hex}.{extension}"
 
     if STORAGE_BACKEND == "bunny":
         url = f"https://storage.bunnycdn.com/{BUNNY_ZONE}/{filename}"

openwrite-0.17.2/openwrite/static/feed/default.xml

@@ -0,0 +1,2 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0"><channel><title>singletest.open.write</title><link>https://singletest.open.write</link><description>x</description><docs>http://www.rssboard.org/rss-specification</docs><generator>python-feedgen</generator><image><url>https://openwrite.io/static/favicon.png</url><title>singletest.open.write</title><link>https://singletest.open.write</link></image><lastBuildDate>Sat, 07 Nov 2026 22:26:48 +0000</lastBuildDate><ttl>5</ttl><item><title>this is a test</title><link>https://singletest.open.write/p/this-is-a-test</link><description>test...</description><content:encoded><![CDATA[<p>test</p>]]></content:encoded><pubDate>Sat, 07 Nov 2026 22:26:48 +0000</pubDate></item><item><title>test</title><link>https://singletest.open.write/p/test-2</link><description>test2...</description><content:encoded><![CDATA[<p>test2</p>]]></content:encoded><pubDate>Sat, 07 Nov 2026 22:26:48 +0000</pubDate></item><item><title>test</title><link>https://singletest.open.write/p/test</link><description>test...</description><content:encoded><![CDATA[<p>test</p>]]></content:encoded><pubDate>Sat, 07 Nov 2026 22:26:48 +0000</pubDate></item></channel></rss>

{openwrite-0.17.1 → openwrite-0.17.2}/openwrite/static/feed/testx.xml

@@ -1,2 +1,2 @@
 <?xml version='1.0' encoding='UTF-8'?>
-<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0"><channel><title>testx</title><link>https://multitest.open.write/b/testx</link><description>x</description><docs>http://www.rssboard.org/rss-specification</docs><generator>python-feedgen</generator><image><url>https://openwrite.io/static/favicon.png</url><title>testx</title><link>https://multitest.open.write/b/testx</link></image><lastBuildDate>Sat, 07 Nov 2026 21:25:55 +0000</lastBuildDate><ttl>5</ttl><item><title>this is a test</title><link>https://multitest.open.write/b/testx/this-is-a-test</link><description>test2...</description><content:encoded><![CDATA[<p>test2</p>]]></content:encoded><pubDate>Sat, 07 Nov 2026 21:25:55 +0000</pubDate></item></channel></rss>
+<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0"><channel><title>testx</title><link>https://multitest.open.write/b/testx</link><description>x</description><docs>http://www.rssboard.org/rss-specification</docs><generator>python-feedgen</generator><image><url>https://openwrite.io/static/favicon.png</url><title>testx</title><link>https://multitest.open.write/b/testx</link></image><lastBuildDate>Sat, 07 Nov 2026 22:26:48 +0000</lastBuildDate><ttl>5</ttl><item><title>this is a test</title><link>https://multitest.open.write/b/testx/this-is-a-test</link><description>test2...</description><content:encoded><![CDATA[<p>test2</p>]]></content:encoded><pubDate>Sat, 07 Nov 2026 22:26:48 +0000</pubDate></item></channel></rss>

{openwrite-0.17.1 → openwrite-0.17.2}/openwrite/static/script/post_preview.js

@@ -10,6 +10,12 @@
     placeholder.textContent = frame.dataset.placeholder;
     placeholder.className = 'placeholder';
     let timer;
+    let previewPort;
+    let latestHtml = '';
+
+    function sendPreview() {
+        if (previewPort) previewPort.postMessage(latestHtml);
+    }
 
     function withToc(html) {
         // The template stays detached: authored HTML is never inserted into the editor.
@@ -60,16 +66,31 @@
         if (!toggle.checked) return;
         let html = editor.value.trim() ? converter.makeHtml(editor.value) : placeholder.outerHTML;
         if (tocToggle.checked) html = withToc(html);
-        // No script or same-origin permissions: authored HTML stays inside the frame.
-        // CSP also prevents embedded frames, forms, and external styles from loading.
+        latestHtml = html;
+        if (frame.hasAttribute('srcdoc')) {
+            sendPreview();
+            return;
+        }
+        // Load the frame once. Only our nonce-protected updater may run; authored
+        // scripts stay blocked and the frame has no same-origin permissions.
+        const nonce = Array.from(crypto.getRandomValues(new Uint8Array(16)), byte => byte.toString(16).padStart(2, '0')).join('');
+        frame.addEventListener('load', () => {
+            // Connect only the initial, empty document. A port stays with that
+            // document, so later iframe navigation cannot receive draft content.
+            const channel = new MessageChannel();
+            previewPort = channel.port1;
+            frame.contentWindow.postMessage('openwrite-preview-connect', '*', [channel.port2]);
+            sendPreview();
+        }, {once: true});
         frame.srcdoc = `<!doctype html><html><head><meta charset="utf-8">
-            <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src http: https: data:; media-src http: https:; base-uri 'none'; form-action 'none'">
+            <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'nonce-${nonce}'; style-src 'unsafe-inline'; img-src http: https: data:; media-src http: https:; base-uri 'none'; form-action 'none'">
             <style>
                 * { box-sizing: border-box; }
+                html { overflow-anchor: none; scroll-behavior: auto; }
                 body { margin: 0; padding: 0 1rem 1rem; color: #e9d4ce;
                        font: 16px/1.6 system-ui, sans-serif; overflow-wrap: anywhere; }
                 h1, h2, h3, h4, h5, h6 { line-height: 1.3; margin: 1em 0 .5em; }
-                body > :first-child { margin-top: 0; }
+                #preview-content > :first-child { margin-top: 0; }
                 p, ul, ol, pre, blockquote, table { margin: 0 0 1em; }
                 a { color: #b8a0eb; }
                 img, video { max-width: 100%; height: auto; }
@@ -84,7 +105,47 @@
                 .post-toc ul { margin: .35rem 0 0; padding-left: 1.25rem; }
                 .post-toc li { margin: .15rem 0; }
                 [id^="post-section-"] { scroll-margin-top: 1rem; }
-            </style></head><body>${html}</body></html>`;
+            </style></head><body><div id="preview-content"></div>
+            <script nonce="${nonce}">
+            (() => {
+                const content = document.getElementById('preview-content');
+                window.addEventListener('message', event => {
+                    if (event.source !== parent || event.data !== 'openwrite-preview-connect' || !event.ports[0]) return;
+                    event.ports[0].onmessage = ({data}) => {
+                        if (typeof data !== 'string') return;
+                        const x = window.scrollX, y = window.scrollY;
+                        const template = document.createElement('template');
+                        template.innerHTML = data;
+                        template.content.querySelectorAll('script, meta, base, link, iframe, object, embed').forEach(node => node.remove());
+                        // Keep unchanged blocks (especially loaded images) in place.
+                        const oldNodes = [...content.childNodes];
+                        const newNodes = [...template.content.childNodes];
+                        let start = 0, oldEnd = oldNodes.length, newEnd = newNodes.length;
+                        while (start < oldEnd && start < newEnd && oldNodes[start].isEqualNode(newNodes[start])) start++;
+                        while (oldEnd > start && newEnd > start && oldNodes[oldEnd - 1].isEqualNode(newNodes[newEnd - 1])) { oldEnd--; newEnd--; }
+                        const fragment = document.createDocumentFragment();
+                        for (let i = start; i < newEnd; i++) fragment.append(newNodes[i]);
+                        const range = document.createRange();
+                        range.setStart(content, start);
+                        range.setEnd(content, oldEnd);
+                        range.deleteContents();
+                        range.insertNode(fragment);
+                        window.scrollTo({left: x, top: y, behavior: 'instant'});
+                    };
+                }, {once: true});
+                // Keep TOC links inside this document; other links must not replace it.
+                document.addEventListener('click', event => {
+                    const link = event.target.closest('a');
+                    if (!link) return;
+                    event.preventDefault();
+                    const href = link.getAttribute('href') || '';
+                    if (href.startsWith('about:srcdoc#') || href.startsWith('#')) {
+                        const id = href.slice(href.indexOf('#') + 1);
+                        document.getElementById(id)?.scrollIntoView();
+                    }
+                });
+            })();
+            </script></body></html>`;
     }
 
     toggle.addEventListener('change', () => {
@@ -92,7 +153,6 @@
         panel.hidden = !toggle.checked;
         layout.classList.toggle('has-preview', toggle.checked);
         if (toggle.checked) render();
-        else frame.removeAttribute('srcdoc');
     });
 
     editor.addEventListener('input', () => {

{openwrite-0.17.1 → openwrite-0.17.2}/openwrite/templates/new_post.html

@@ -46,7 +46,7 @@
     <div class="post-editor" id="post-editor">
         <textarea autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" name="content" class="post_content" placeholder="{{ _('content') }}">{% if form_data %}{{ form_data.get('content_raw', '') }}{% elif post %}{{ post.content_raw }}{% endif %}</textarea>
         <section class="live-preview-panel" id="live-preview-panel" aria-label="{{ live_preview_label }}" hidden>
-            <iframe id="live-preview-frame" title="{{ live_preview_label }}" sandbox="" referrerpolicy="no-referrer" data-placeholder="{{ preview_hint }}"></iframe>
+            <iframe id="live-preview-frame" title="{{ live_preview_label }}" sandbox="allow-scripts" referrerpolicy="no-referrer" data-placeholder="{{ preview_hint }}"></iframe>
         </section>
     </div>
     <input type="hidden" name="content_raw" id="content_raw" value="{% if post %}{{ post.content_raw }}{% endif %}">

{openwrite-0.17.1 → openwrite-0.17.2/openwrite.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openwrite
-Version: 0.17.1
+Version: 0.17.2
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
                                Version 3, 19 November 2007
         

{openwrite-0.17.1 → openwrite-0.17.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "openwrite"
-version = "0.17.1"
+version = "0.17.2"
 license = { file = "LICENSE" }
 dependencies = [
     "flask",

openwrite-0.17.1/openwrite/static/feed/default.xml

@@ -1,2 +0,0 @@
-<?xml version='1.0' encoding='UTF-8'?>
-<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0"><channel><title>singletest.open.write</title><link>https://default.singletest.open.write</link><description>x</description><docs>http://www.rssboard.org/rss-specification</docs><generator>python-feedgen</generator><image><url>https://openwrite.io/static/favicon.png</url><title>singletest.open.write</title><link>https://default.singletest.open.write</link></image><lastBuildDate>Sat, 07 Nov 2026 21:25:56 +0000</lastBuildDate><ttl>5</ttl><item><title>this is a test</title><link>https://default.singletest.open.write/this-is-a-test</link><description>test...</description><content:encoded><![CDATA[<p>test</p>]]></content:encoded><pubDate>Sat, 07 Nov 2026 21:25:56 +0000</pubDate></item><item><title>test</title><link>https://default.singletest.open.write/test-2</link><description>test2...</description><content:encoded><![CDATA[<p>test2</p>]]></content:encoded><pubDate>Sat, 07 Nov 2026 21:25:56 +0000</pubDate></item><item><title>test</title><link>https://default.singletest.open.write/test</link><description>test...</description><content:encoded><![CDATA[<p>test</p>]]></content:encoded><pubDate>Sat, 07 Nov 2026 21:25:56 +0000</pubDate></item></channel></rss>