Commit Graph

10 Commits

Author SHA1 Message Date
steve 3e17574fe6 fix: upgrade to Flask 3.x and replace before_first_request
- Pin Flask to >=3.1.3 to resolve all outstanding Dependabot CVEs
  (session cookie Vary header, Werkzeug DoS/RCE/safe_join vulns)
- Replace removed @before_first_request decorator with app.app_context()
  call at module level, compatible with Flask 3.0+
2026-03-09 20:15:14 -06:00
steve 1a0a1371bc fix: correct marquee scroll speed and add code TODOs
- Fixed scrolling marquee to use a fixed px/s speed via JS instead of
  a fixed duration, preventing it from speeding up as entries are added
- Added inline TODO comments throughout codebase to track known issues
  (rate limiting, CSRF, unbounded queries, deprecated Flask decorator,
  PII logging, schema versioning, Docker non-root user, etc.)
- Added todo-to-issue GitHub Action to auto-create Issues from TODOs on push to main
- Added .claude/ to .gitignore
2026-03-09 19:30:13 -06:00
Steve Dogiakos f34c163a76 Add API to app.py so I can use n8n to export the entries.
Added opt-out newsletter checkbox and the appropriate places to insert it to the db.
2025-04-02 15:31:33 -06:00
Steve Dogiakos 75e69d5144 chore: lint and update docker-compose.yml
- Fixed port variable interpolation to use ${PORT:-8000} for a default value.
- Updated volume configuration to use a named volume (guestbook_data) mounted at /data.
- Improved YAML formatting for clarity.
2025-04-01 21:53:25 -06:00
Steve Dogiakos 6b26e22709 feat: reveal comment field dynamically after required fields are filled
- Hide comment field by default.
- Add JavaScript to reveal comment field when first name, last name, and location have at least 3 characters.
- Update form instructions to inform users about the comment field.
2025-04-01 19:19:28 -06:00
Steve Dogiakos cb9fdc6b79 feat: make email optional and add form instructions
- Display brief instructions above the guestbook form.
- Update validation: require first name, last name, and location; make email optional.
- Remove the 'required' attribute from the email input field.
- Provide context in the UI so users understand why email is optional.
2025-04-01 18:38:39 -06:00
Steve Dogiakos 1175fe2236 feat: add basic application logging
- Configure Python logging at INFO level.
- Log key events: database initialization, incoming requests, validation errors, and successful guest submissions.
- Log the number of guest entries displayed when rendering the page.

This improves observability and helps with troubleshooting.
2025-04-01 18:06:10 -06:00
Steve Dogiakos 3b28b22627 feat: add server-side input validation
- Validate that first_name, last_name, email, and location are provided
- Add regex-based email format validation in app.py
- Display error messages on the guestbook form if validation fails

These changes help ensure that only properly formatted data is stored.
2025-04-01 18:01:58 -06:00
Steve Dogiakos 03d83606b7 feat: split name into first/last and simplify form fields 2025-04-01 17:40:08 -06:00
steve 4f48124bbf feat!: migrate from Node.js to Flask with SQLite 2025-04-01 16:55:34 -06:00