issue-link js-issue-link" data-error-text="Failed to load title" data-id="4042462726" data-permission-text="Title is private" data-url="https://github.com/csd113/RustChan/issues/13" data-hovercard-type="issue" data-hovercard-url="/csd113/RustChan/issues/13/hovercard" href="https://github.com/csd113/RustChan/issues/13">#13 – Constant-time comparison** - Replaced custom `constant_time_eq` with `subtle::ConstantTimeEq` - Use: `a.ct_eq(b).into()` - Added import: `use subtle::ConstantTimeEq as _` - Removed hand-rolled implementation - **#16 – Poll vote race condition** - Updated `cast_vote` query: - JOINs `polls` table - Adds expiry guard: ```sql AND (p.expires_at IS NULL OR p.expires_at > unixepoch()) ``` - Prevents race between handler validation and INSERT - **#25 – `edit_window_secs` semantics** - `0` → no time limit (skips check via `Option`) - Negative → fallback to 300s - Positive → used as-is --- #### `handlers/admin/backup.rs` - **#19 – SQLite validation** - Added magic byte check (`b"SQLite format 3\0"`) after extracting `chan.db` - Applied to: - `admin_restore` - `restore_saved_board_backup` - Invalid DB now returns `400 Bad Request` before `rusqlite` usage - **#30 – Duplicate encoding logic removed** - Removed inner `encode_q` / `nibble` definitions - Introduced single module-level `encode_q` - Shared across: - `admin_restore` - `restore_saved_board_backup` - `board_restore` --- #### `db/logging.rs` (moved from `logging.rs`) - **#33 – Log rotation** - Replaced `rolling::never` with `rolling::daily` - Logs now rotate automatically: ``` rustchan.log.YYYY-MM-DD ``` - **Location + API updates** - Moved file to: `db/logging.rs` - Renamed `log_dir` → `db_dir` - Logs now stored alongside `chan.db` - Updated documentation accordingly --- ### Required Follow-ups - Update module declaration: ```rust // db/mod.rs pub mod logging;

Commits

Commits on Mar 18, 2026

bugfixes