OXYGENHUB

Security contact page: security.txt's email until the page has its own f59e9680d880

Refs #230
Author
Andy McCall @andymccall <[email protected]>
via
agent Claude Code <[email protected]> · delegate for changes, until 2026-11-13 19:00Z · key ea5f78160088
When
· 2026-10-16 08:21 UTC
Signature
✔ signed by Claude Code
Hash
f59e9680d880b1abc8c0b3ac7efb316c71d0001936e45fae4decc1f4a9829f47
Depends on
19bb31ff1f5c 2cbf6f348595 3dd6582de060
Depended on by
nothing yet
In bookmarks
api-unknown-fields cancel-landed-runs diffusion-pin-bookmark draft-ready main oh-comment-body-file proposal-list-fast
In tags
v0.6.0 v0.6.1 v0.7.0 v0.8.0 v0.9.0 v0.9.1 v0.9.11 v0.9.15 v0.9.16 v0.9.19 v0.9.2 v0.9.20 v0.9.21 v0.9.22 v0.9.23 v0.9.24 v0.9.3 v0.9.4 v0.9.5 v0.9.6 v0.9.7 v0.9.8 v0.9.9
Edits
4 atoms, 0 tree operations, 2 files

Browse the tree at this change

hide whitespace changes
modified crates/hub/src/web/security_txt.rs +6 −1
… 
49 unchanged lines
50 50 
/// `GET /security-contact`: how to report a security problem (oxygenhub#230).
51 51 
pub async fn contact_page(State(app): State<Shared>, viewer: Viewer) -> Page<ContactPage> {
52 52 
    let shell = Shell::new(&app, "/security-contact", &viewer);
53 - 
    let (email, text) = page_settings(&app).await;
53 + 
    let (mut email, text) = page_settings(&app).await;
54 + 
    // No address of its own: security.txt's, when that is an email.
55 + 
    if email.is_empty() {
56 + 
        let (contact, _) = settings(&app).await;
57 + 
        email = contact_uri(&contact).and_then(|u| u.strip_prefix("mailto:").map(String::from)).unwrap_or_default();
58 + 
    }
54 59 
    let text = if text.trim().is_empty() { DEFAULT_PAGE.to_string() } else { text };
55 60 
    Page(ContactPage { shell, email, body_html: crate::render::markdown::render(&text, "", "") })
56 61 
}
… 
120 unchanged lines
modified crates/hub/tests/accounts.rs +2 −0
… 
1370 unchanged lines
1371 1371 

    

  
    

      1372
      1372
       
      
    // /security-contact (oxygenhub#230): sensible text until it is written,

    

  
    

      1373
      1373
       
      
    // then the address and the administrator's own text.

    

  
    

      
      1374
      +
      
    set("first%40example.org", "").await;

    

  
    

      1374
      1375
       
      
    let page = get(app, "/security-contact", None).await;

    

  
    

      1375
      1376
       
      
    assert_eq!(page.status, StatusCode::OK);

    

  
    

      
      1377
      +
      
    assert!(page.body.contains("[email protected]"), "security.txt's address until the page has its own");

    

  
    

      1376
      1378
       
      
    assert!(page.body.contains("Report a security problem") && page.body.contains("tell us privately"), "{}", page.body);

    

  
    

      1377
      1379
       
      
    let r = post(

    

  
    

      1378
      1380
       
      
        app,

    

  
    

      
      
      …
      
17 unchanged lines