Merge branch 'master' into burnafterreading-fix, regression in expired paste error

.codeclimate.yml

@@ -1,5 +1,19 @@
 ---
-engines:
+version: "2"
+checks:
+  file-lines:
+    config:
+      threshold: 2000
+  method-complexity:
+    config:
+      threshold: 550
+  method-count:
+    config:
+      threshold: 50
+  method-lines:
+    config:
+      threshold: 250
+plugins:
   csslint:
     enabled: true
   duplication:
@@ -12,6 +26,8 @@ engines:
     enabled: true
   fixme:
     enabled: true
+  nodesecurity:
+    enabled: true
   phpmd:
     enabled: true
     checks:
@@ -29,11 +45,20 @@ engines:
         enabled: false
       CleanCode/StaticAccess:
         enabled: false
-ratings:
+  sonar-php:
-  paths:
+    enabled: true
-  - "css/privatebin.css"
+    config:
-  - "css/bootstrap/privatebin.css"
+      tests_patterns:
-  - "js/privatebin.js"
+        - tst/**
-  - "lib/**.php"
+exclude_patterns:
-  - "index.php"
+  - "cfg/"
-exclude_paths: []
+  - "css/"
+  - "!css/privatebin.css"
+  - "!css/noscript.css"
+  - "!css/bootstrap/privatebin.css"
+  - "js/"
+  - "!js/privatebin.js"
+  - "!js/common.js"
+  - "!js/test/"
+  - "vendor/"
+

.eslintignore

@@ -1 +1,2 @@
-**/*{.,-}min.js
+js/*.js
+!js/privatebin.js

.eslintrc

@@ -11,6 +11,15 @@ env:
 
 globals:
   sjcl: false
+  DOMPurify: false
+  after: true
+  before: true
+  cleanup: true
+  describe: false
+  it: false
+  jsc: false
+  jsdom: true
+  kjua: true
 
 # http://eslint.org/docs/rules/
 rules:
@@ -66,7 +75,6 @@ rules:
   no-case-declarations: 2
   no-div-regex: 2
   no-else-return: 0
-  no-empty-label: 2
   no-empty-pattern: 2
   no-eq-null: 2
   no-eval: 2
@@ -91,7 +99,7 @@ rules:
   no-octal-escape: 2
   no-octal: 2
   no-proto: 2
-  no-redeclare: 2
+  no-redeclare: 0
   no-return-assign: 2
   no-script-url: 2
   no-self-compare: 2
@@ -187,7 +195,9 @@ rules:
   operator-linebreak: 0
   padded-blocks: 0
   quote-props: 0
-  quotes: 0
+  quotes:
+    - error
+    - single
   require-jsdoc: 0
   semi-spacing: 0
   semi: 0

.gitattributes

@@ -2,8 +2,6 @@ doc/ export-ignore
 tst/ export-ignore
 js/.istanbul.yml export-ignore
 js/test.js export-ignore
-js/mocha-3.2.0.js export-ignore
-css/mocha-3.2.0.css export-ignore
 .codeclimate.yml export-ignore
 .csslintrc export-ignore
 .dockerignore export-ignore

.github/ISSUE_TEMPLATE.md

@@ -35,5 +35,4 @@ If you have access to the server log files, also copy them here.
 <!-- The version of PrivateBin, if you use an unstable version paste the commit hash or the GitHub link to the commit here (you can get it by running `git rev-parse HEAD`) -->
 **PrivateBin version:**
 
-* I can reproduce this issue on <https://privatebin.net>: Yes / No
+I can reproduce this issue on <https://privatebin.net>: Yes / No
-

.gitignore

@@ -1,7 +1,7 @@
 # Ignore server files for safety
 .htaccess
 .htpasswd
-cfg/conf.ini
+cfg/conf.php
 
 # Ignore data/
 data/

.jshintrc

@@ -0,0 +1,46 @@
+{
+    "bitwise": true,
+    "curly": true,
+    "eqeqeq": true,
+    "esversion": 5,
+    "forin": true,
+    "freeze": true,
+    "futurehostile": true,
+    "latedef": "nofunc",
+    "maxcomplexity": 25,
+    "maxdepth": 3,
+    "maxparams": 4,
+    "maxstatements": 100,
+    "noarg": true,
+    "nonbsp": true,
+    "nonew": true,
+    "quotmark": "single",
+    "singleGroups": true,
+    "strict": true,
+    "undef": true,
+    "unused": true,
+    "jquery": true,
+    "browser": true,
+    "predef": {
+      "after": true,
+      "before": true,
+      "cleanup": true,
+      "console": true,
+      "describe": false,
+      "document": true,
+      "fs": false,
+      "global": true,
+      "exports": true,
+      "it": false,
+      "jsc": false,
+      "jsdom": true,
+      "require": false,
+      "setTimeout": false,
+      "window": true
+    },
+    "globals": {
+      "sjcl": true,
+      "DOMPurify": true,
+      "kjua": true
+    }
+}

.nsprc

@@ -0,0 +1 @@
+{}

.styleci.yml

@@ -3,14 +3,17 @@ preset: recommended
 risky: false
 
 enabled:
-  - no_empty_comment
   - align_equals
-  - long_array_syntax
   - concat_with_spaces
+  - long_array_syntax
+  - no_empty_comment
+  - pre_increment
 
 disabled:
   - blank_line_after_opening_tag
   - blank_line_before_return
+  - blank_line_before_throw
+  - blank_line_before_try
   - concat_without_spaces
   - declare_equal_normalize
   - heredoc_to_nowdoc
@@ -21,6 +24,7 @@ disabled:
   - phpdoc_separation
   - phpdoc_single_line_var_spacing
   - phpdoc_summary
+  - post_increment
   - short_array_syntax
   - single_line_after_imports
   - unalign_equals

.travis.yml

@@ -6,23 +6,30 @@ php:
   - '5.6'
   - '7.0'
   - '7.1'
+  - '7.2'
 
 # as this is a php project, node.js v4 (for JS unit testing) isn't installed
 install:
-  - rm -rf ~/.nvm && git clone https://github.com/creationix/nvm.git ~/.nvm && (cd ~/.nvm && git checkout `git describe --abbrev=0 --tags`) && source ~/.nvm/nvm.sh && nvm install 4
+  - if [ ! -d "$HOME/.nvm" ]; then mkdir -p $HOME/.nvm && curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.8/install.sh | NVM_METHOD=script bash; fi
+  - source ~/.nvm/nvm.sh && nvm install 4
 
 before_script:
   - composer install -n
   - npm install -g mocha
-  - cd js
+  - cd js && npm install jsverify jsdom@9 jsdom-global@2 mime-types
-  - npm install jsverify jsdom jsdom-global
-  - cd ..
 
 script:
-  - cd tst && ../vendor/bin/phpunit
+  - mocha
-  - cd ../js && mocha
+  - cd ../tst && ../vendor/bin/phpunit
 
 after_script:
-  - cd ..
+  - ../vendor/bin/test-reporter --coverage-report log/coverage-clover.xml
-  - vendor/bin/codacycoverage clover tst/log/coverage-clover.xml
+  - cd .. && vendor/bin/codacycoverage clover tst/log/coverage-clover.xml
-  - vendor/bin/test-reporter --coverage-report tst/log/coverage-clover.xml
+
+cache:
+  directories:
+    - $HOME/.composer/cache/files
+    - $HOME/.composer/cache/vcs
+    - $HOME/.nvm
+    - $HOME/.npm
+    - js/node_modules

CHANGELOG.md

@@ -6,6 +6,8 @@
     * CHANGED: Minimum required PHP version is 5.4 (#186)
     * CHANGED: Shipped .htaccess files were updated for Apache 2.4 (#192)
     * CHANGED: Cleanup of bootstrap template variants and moved icons to `img` directory
+  * **1.1.1 (2017-10-06)**
+    * CHANGED: Switched to `.php` file extension for configuration file, to avoid leaking configuration data in unprotected installation.
   * **1.1 (2016-12-26)**
     * ADDED: Translations for Italian and Russian
     * ADDED: Loading message displayed until decryption succeeded for slower (in terms of CPU or network) systems

Dockerfile

@@ -3,15 +3,24 @@ FROM php:apache
 RUN apt-get update && apt-get install -y \
         libfreetype6-dev \
         libjpeg62-turbo-dev \
-        libpng12-dev \
+        libpng-dev \
         wget \
         zip \
-        unzip; \
+        unzip && \
     # We install and enable php-gd
-    docker-php-ext-configure gd --with-freetype-dir=/usr/include/ --with-jpeg-dir=/usr/include/; \
+    docker-php-ext-configure gd --with-freetype-dir=/usr/include/ --with-jpeg-dir=/usr/include/ &&\
-    docker-php-ext-install -j$(nproc) gd; \
+    docker-php-ext-install -j$(nproc) gd && \
-
     # We enable Apache's mod_rewrite
     a2enmod rewrite
 
-COPY . .
+
+# Copy app content
+COPY . /var/www/html
+
+# Copy start script
+RUN mv /var/www/html/docker/entrypoint.sh / && \
+    rm -r /var/www/html/docker
+
+VOLUME /var/www/html/data
+
+CMD /entrypoint.sh

INSTALL.md

@@ -3,12 +3,13 @@
 **TL;DR:** Download the
 [latest release archive](https://github.com/PrivateBin/PrivateBin/releases/latest)
 and extract it in your web hosts folder where you want to install your PrivateBin
-instance. We try to provide a safe default configuration, but we advise you to
+instance. We try to provide a mostly safe default configuration, but we urge you to
-check the options and adjust them as you see fit.
+check the [security section](#hardening-and-security) below and the [configuration
+options](#configuration) to adjust as you see fit.
 
-## Basic installation
+**NOTE:** See [our FAQ](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-can-i-securely-clonedownload-your-project) for information how to securely download the PrivateBin release files.
 
-### Requirements
+### Minimal requirements
 
 - PHP version 5.4 or above
 - _one_ of the following sources of cryptographically safe randomness is required:
@@ -20,37 +21,11 @@ check the options and adjust them as you see fit.
   
   Mcrypt needs to be able to access `/dev/urandom`. This means if `open_basedir` is set, it must include this file.
 - GD extension
-- some disk space or (optional) a database supported by [PDO](https://secure.php.net/manual/book.pdo.php)
+- some disk space or (optionally) a database supported by [PDO](https://secure.php.net/manual/book.pdo.php)
-- ability to create files and folders in the installation directory and the PATH
+- ability to create files and folders in the installation directory and the PATH defined in index.php
 - A web browser with javascript support
 
-### Configuration
+## Hardening and security
-
-In the file `cfg/conf.ini` you can configure PrivateBin. A `cfg/conf.ini.sample`
-is provided containing all options and default values. You can copy it to
-`cfg/conf.ini` and adapt it as needed. The config file is divided into multiple
-sections, which are enclosed in square brackets.
-
-In the `[main]` section you can enable or disable the discussion feature, set
-the limit of stored pastes and comments in bytes. The `[traffic]` section lets
-you set a time limit in seconds. Users may not post more often then this limit
-to your PrivateBin installation.
-
-More details can be found in the
-[configuration documentation](https://github.com/PrivateBin/PrivateBin/wiki/Configuration).
-
-## Further configuration
-
-After (or before) setting up PrivateBin, also set up HTTPS, as without HTTPS
-PrivateBin is not secure. (
-[More information](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-should-i-setup-https))
-
-If you want to use PrivateBin behind Cloudflare, make sure you disabled Rocket
-loader and unchecked "Javascript" for Auto Minify, found in your domain settings,
-under "Speed". (More information
-[in this FAQ entry](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#user-content-how-to-make-privatebin-work-when-using-cloudflare-for-ddos-protection))
-
-## Advanced installation
 
 ### Changing the path
 
@@ -75,6 +50,29 @@ process (see also
 > PrivateBin will look for your includes / data here:
 > /home/example.com/secret/privatebin
 
+### Transport security
+
+When setting up PrivateBin, also set up HTTPS, if you haven't already. Without HTTPS
+PrivateBin is not secure, as the javascript files could be manipulated during transmission.
+For more information on this, see our [FAQ entry on HTTPS setup](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#how-should-i-setup-https).
+
+## Configuration
+
+In the file `cfg/conf.php` you can configure PrivateBin. A `cfg/conf.sample.php`
+is provided containing all options and default values. You can copy it to
+`cfg/conf.php` and adapt it as needed. The config file is divided into multiple
+sections, which are enclosed in square brackets.
+
+In the `[main]` section you can enable or disable the discussion feature, set
+the limit of stored pastes and comments in bytes. The `[traffic]` section lets
+you set a time limit in seconds. Users may not post more often then this limit
+to your PrivateBin installation.
+
+More details can be found in the
+[configuration documentation](https://github.com/PrivateBin/PrivateBin/wiki/Configuration).
+
+## Advanced installation
+
 ### Web server configuration
 
 A `robots.txt` file is provided in the root dir of PrivateBin. It disallows all
@@ -88,6 +86,13 @@ some known robots and link-scanning bots. If you use Apache, you can rename the
 file to `.htaccess` to enable this feature. If you use another webserver, you
 have to configure it manually to do the same.
 
+### On using Cloudflare
+
+If you want to use PrivateBin behind Cloudflare, make sure you have disabled the Rocket
+loader and unchecked "Javascript" for Auto Minify, found in your domain settings,
+under "Speed". (More information
+[in this FAQ entry](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#user-content-how-to-make-privatebin-work-when-using-cloudflare-for-ddos-protection))
+
 ### Using a database instead of flat files
 
 In the configuration file the `[model]` and `[model_options]` sections let you
@@ -118,32 +123,36 @@ For reference or if you want to create the table schema for yourself (replace
 `prefix_` with your own table prefix and create the table schema with phpMyAdmin
 or the MYSQL console):
 
-    CREATE TABLE prefix_paste (
+```sql
-        dataid CHAR(16) NOT NULL,
+CREATE TABLE prefix_paste (
-        data BLOB,
+    dataid CHAR(16) NOT NULL,
-        postdate INT,
+    data BLOB,
-        expiredate INT,
+    postdate INT,
-        opendiscussion INT,
+    expiredate INT,
-        burnafterreading INT,
+    opendiscussion INT,
-        meta TEXT,
+    burnafterreading INT,
-        attachment MEDIUMBLOB,
+    meta TEXT,
-        attachmentname BLOB,
+    attachment MEDIUMBLOB,
-        PRIMARY KEY (dataid)
+    attachmentname BLOB,
-    );
+    PRIMARY KEY (dataid)
+);
 
-    CREATE TABLE prefix_comment (
+CREATE TABLE prefix_comment (
-        dataid CHAR(16),
+    dataid CHAR(16),
-        pasteid CHAR(16),
+    pasteid CHAR(16),
-        parentid CHAR(16),
+    parentid CHAR(16),
-        data BLOB,
+    data BLOB,
-        nickname BLOB,
+    nickname BLOB,
-        vizhash BLOB,
+    vizhash BLOB,
-        postdate INT,
+    postdate INT,
-        PRIMARY KEY (dataid)
+    PRIMARY KEY (dataid)
-    );
+);
-    CREATE INDEX parent ON prefix_comment(pasteid);
+CREATE INDEX parent ON prefix_comment(pasteid);
 
-    CREATE TABLE prefix_config (
+CREATE TABLE prefix_config (
-        id CHAR(16) NOT NULL, value TEXT, PRIMARY KEY (id)
+    id CHAR(16) NOT NULL, value TEXT, PRIMARY KEY (id)
-    );
+);
-    INSERT INTO prefix_config VALUES('VERSION', '1.1');
+INSERT INTO prefix_config VALUES('VERSION', '1.1');
+```
+
+In PostgreSQL, the attachment column needs to be TEXT and not BLOB or MEDIUMBLOB.

LICENSE.md

@@ -30,6 +30,16 @@ the following restrictions:
 
 3. This notice may not be removed or altered from any source distribution.
 
+### MIT license for kjua
+
+Copyright (c) 2016 Lars Jung (https://larsjung.de)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 ## GNU General Public License, version 2.0, for SJCL, rawdeflate and rawinflate
 
 _Version 2, June 1991_

README.md

@@ -7,18 +7,18 @@
 [![Codacy Badge](https://api.codacy.com/project/badge/Coverage/094500f62abf4c9aa0c8a8a4520e4789)](https://www.codacy.com/app/PrivateBin/PrivateBin)
 [![Test Coverage](https://codeclimate.com/github/PrivateBin/PrivateBin/badges/coverage.svg)](https://codeclimate.com/github/PrivateBin/PrivateBin/coverage) [![Code Coverage](https://scrutinizer-ci.com/g/PrivateBin/PrivateBin/badges/coverage.png?b=master)](https://scrutinizer-ci.com/g/PrivateBin/PrivateBin/?branch=master)
 
-*Current version: 1.1*
+*Current version: 1.1.1*
 
-**PrivateBin** is a minimalist, open source online pastebin where the server has
+**PrivateBin** is a minimalist, open source online [pastebin](https://en.wikipedia.org/wiki/Pastebin)
-zero knowledge of pasted data.
+where the server has zero knowledge of pasted data.
 
-Data is encrypted/decrypted in the browser using 256bit AES in [Galois Counter mode](https://en.wikipedia.org/wiki/Galois/Counter_Mode).
+Data is encrypted and decrypted in the browser using 256bit AES in [Galois Counter mode](https://en.wikipedia.org/wiki/Galois/Counter_Mode).
 
 This is a fork of ZeroBin, originally developed by
-[Sébastien Sauvage](https://github.com/sebsauvage/ZeroBin). It was refactored
+[Sébastien Sauvage](https://github.com/sebsauvage/ZeroBin). ZeroBin was refactored
-to allow easier and cleaner extensions and has now many more features than the
+to allow easier and cleaner extensions. PrivateBin has many more features than the
-original. It is however still fully compatible to the original ZeroBin 0.19
+original ZeroBin. It is, however, still fully compatible to the original ZeroBin 0.19
-data storage scheme. Therefore such installations can be upgraded to this fork
+data storage scheme. Therefore, such installations can be upgraded to PrivateBin
 without losing any data.
 
 ## What PrivateBin provides
@@ -38,37 +38,37 @@ without losing any data.
 
 ## What it doesn't provide
 
-- As a user you have to trust the server administrator, your internet provider
+- As a user you have to trust the server administrator not to inject any malicious
-  and any country the traffic passes not to inject any malicious javascript code.
+  javascript code.
-  For a basic security the PrivateBin installation *has to provide HTTPS*!
+  For basic security, the PrivateBin installation *has to provide HTTPS*!
-  Additionally it should be secured by
+  Otherwise you would also have to trust your internet provider, and any country
+  the traffic passes through.
+  Additionally the instance should be secured by
   [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) and
   ideally by [HPKP](https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning) using a
-  certificate either validated by a trusted third party (check the certificate
+  certificate. It can use traditional certificate authorities and/or use
-  when first using a new PrivateBin instance) or self-signed by the server
-  operator, validated using a
   [DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions)
   protected
   [DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities)
   record.
 
 - The "key" used to encrypt the paste is part of the URL. If you publicly post
-  the URL of a paste that is not password-protected, everybody can read it.
+  the URL of a paste that is not password-protected, anyone can read it.
-  Use a password if you want your paste to be private. In this case make sure to
+  Use a password if you want your paste to be private. In this case, make sure to
-  use a strong password and do only share it privately and end-to-end-encrypted.
+  use a strong password and only share it privately and end-to-end-encrypted.
 
 - A server admin might be forced to hand over access logs to the authorities.
-  PrivateBin encrypts your text and the discussion contents, but who accessed it
+  PrivateBin encrypts your text and the discussion contents, but who accessed a
-  first might still be disclosed via such access logs.
+  paste (first) might still be disclosed via access logs.
 
 - In case of a server breach your data is secure as it is only stored encrypted
-  on the server. However the server could be misused or the server admin could
+  on the server. However, the server could be misused or the server admin could
   be legally forced into sending malicious JavaScript to all web users, which
-  grabs the decryption key and send it to the server when a user accesses a
+  grabs the decryption key and sends it to the server when a user accesses a
   PrivateBin.  
-  Therefore do not access any PrivateBin instance if you think it has been
+  Therefore, do not access any PrivateBin instance if you think it has been
   compromised. As long as no user accesses this instance with a previously
-  generated URL, the content can''t be decrypted.
+  generated URL, the content can't be decrypted.
 
 ## Options
 

cfg/conf.sample.php

@@ -1,3 +1,4 @@
+;<?php http_response_code(403); /*
 ; config file for PrivateBin
 ;
 ; An explanation of each setting can be find online at https://github.com/PrivateBin/PrivateBin/wiki/Configuration.
@@ -51,6 +52,10 @@ languageselection = false
 ; the pastes encryption key
 ; urlshortener = "https://shortener.example.com/api?link="
 
+; (optional) Let users create a QR code for sharing the paste URL with one click.
+; It works both when a new paste is created and when you view a paste.
+; qrcode = true
+
 ; (optional) IP based icons are a weak mechanism to detect if a comment was from
 ; a different user when the same username was used in a comment. It might be
 ; used to get the IP of a non anonymous comment poster if the server salt is
@@ -64,7 +69,7 @@ languageselection = false
 ; scripts or run your site behind certain DDoS-protection services.
 ; Check the documentation at https://content-security-policy.com/
 ; Note: If you use a bootstrap theme, you can remove the allow-popups from the sandbox restrictions.
-; cspheader = "default-src 'none'; manifest-src 'self'; connect-src *; script-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; referrer no-referrer; sandbox allow-same-origin allow-scripts allow-forms allow-popups"
+; cspheader = "default-src 'none'; manifest-src 'self'; connect-src *; script-src 'self'; style-src 'self'; font-src 'self'; img-src 'self' data:; media-src data:; object-src data:; Referrer-Policy: 'no-referrer'; sandbox allow-same-origin allow-scripts allow-forms allow-popups"
 
 ; stay compatible with PrivateBin Alpha 0.19, less secure
 ; if enabled will use base64.js version 1.7 instead of 2.1.9 and sha1 instead of

composer.json

@@ -11,12 +11,6 @@
         "source": "https://github.com/PrivateBin/PrivateBin",
         "docs": "https://zerobin.dssr.ch/documentation/"
     },
-    "repositories": [
-        {
-            "type": "vcs",
-            "url": "https://github.com/PrivateBin/PrivateBin"
-        }
-    ],
     "require": {
         "php": "^5.4.0 || ^7.0",
         "paragonie/random_compat": "2.0.4",

css/bootstrap/privatebin.css

@@ -6,7 +6,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 body {
@@ -68,14 +68,37 @@ body.loading {
 	margin-right: 8px;
 }
 
-#image img {
+#attachmentPreview img {
 	max-width: 100%;
 	height: auto;
 	margin-bottom: 20px;
 }
 
+#attachmentPreview .pdfPreview {
+	width: 100%;
+	height: 100vh;
+	margin-bottom: 20px;
+}
+
+.dragAndDropFile{
+        color:#777;
+        font-size:1em;
+        display:inline;
+}
+
+
 #deletelink {
 	float: right;
+	margin-left: 5px;
+}
+
+#qrcodemodalClose {
+	float: right;
+}
+#qrcode-display {
+	width: 200px;
+	height: 200px;
+	margin: auto;
 }
 
 #pastelink {

css/noscript.css

@@ -6,7 +6,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.0
+ * @version   1.1.1
  */
 
 /* When there is no script at all other */

css/privatebin.css

@@ -6,7 +6,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 /*  CSS Reset from YUI 3.4.1 (build 4118) - Copyright 2011 Yahoo! Inc. All rights reserved.
@@ -104,11 +104,23 @@ h3.title {
 	font-family: Consolas, "Lucida Console", "DejaVu Sans Mono", Monaco, monospace;
 }
 
-#image img {
+#attachmentPreview img {
 	max-width: 100%;
 	height: auto;
 }
 
+#attachmentPreview .pdfPreview {
+	width: 100%;
+	height: 100vh;
+	margin-bottom: 20px;
+}
+
+.dragAndDropFile{
+        color:#777;
+        font-size:1em;
+        display:inline;
+}
+
 #status {
 	clear: both;
 	padding: 5px 10px;
@@ -132,7 +144,7 @@ h3.title {
 
 #toolbar, #status { margin-bottom: 5px; }
 
-#copyhint { color: #666; font-size: 0.85em; }
+#copyhint { color: #666; font-size: 0.85em }
 
 button, .button {
 	color: #fff;
@@ -249,7 +261,7 @@ input {
 	font-weight: bold !important;
 }
 
-#image, .nonworking {
+#attachmentPreview, .nonworking {
 	background-color: #fff;
 	color: #000;
 	width: 100%;

docker-compose.yml

@@ -0,0 +1,15 @@
+version: '3'
+
+services:
+  privatebin:
+    build: .
+    ports:
+      - "3000:80"
+    volumes:
+      - data:/var/www/html/data
+      # Optionally mount a custom config file
+      #- /srv/docker/privatebin/conf.php:/var/www/html/cfg/conf.php
+    
+volumes:
+  data:
+

docker/entrypoint.sh

@@ -0,0 +1,4 @@
+#! /bin/sh
+
+chown -R www-data /var/www/html/data
+apache2-foreground

i18n/de.json

@@ -132,6 +132,8 @@
     "Cloned: '%s'": "Geklont: '%s'",
     "The cloned file '%s' was attached to this paste.": "Die geklonte Datei '%s' wurde angehängt.",
     "Attach a file": "Datei anhängen",
+    "alternatively drag & drop a file or paste an image from the clipboard": "Alternativ Drag & Drop einer Datei oder einfügen eines Bildes aus der Zwischenablage",
+    "File too large, to display a preview. Please download the attachment.": "Datei zu groß, um als Vorschau angezeigt zu werden. Bitte Anhang herunterladen.",
     "Remove attachment": "Anhang entfernen",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "Dein Browser unterstützt das hochladen von verschlüsselten Dateien nicht. Bitte verwende einen neueren Browser.",

i18n/es.json

@@ -93,7 +93,7 @@
     "Anonymous":
         "Anónimo",
     "Avatar generated from IP address":
-        "Avatar anónimo (Vizhash de la dirección IP)",
+        "Avatar generado a partir de la dirección IP",
     "Add comment":
         "Añadir comentario",
     "Optional nickname…":
@@ -130,8 +130,10 @@
     "Markdown": "Markdown",
     "Download attachment": "Descargar adjunto",
     "Cloned: '%s'": "Clonado: '%s'.",
-    "The cloned file '%s' was attached to this paste.": "The cloned file '%s' was attached to this paste.",
+    "The cloned file '%s' was attached to this paste.": "El archivo clonado '%s' ha sido adjuntado a este texto.",
     "Attach a file": "Adjuntar archivo",
+    "alternatively drag & drop a file or paste an image from the clipboard": "alternatively drag & drop a file or paste an image from the clipboard",
+    "File too large, to display a preview. Please download the attachment.": "File too large, to display a preview. Please download the attachment.",
     "Remove attachment": "Remover adjunto",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "Tu navegador no admite la carga de archivos cifrados. Utilice un navegador más reciente.",
@@ -147,9 +149,9 @@
     "Enter password":
         "Ingrese contraseña",
     "Loading…": "Cargando…",
-    "Decrypting paste…": "Decrypting paste…",
+    "Decrypting paste…": "Descifrando texto…",
-    "Preparing new paste…": "Preparing new paste…",
+    "Preparing new paste…": "Preparando texto nuevo…",
     "In case this message never disappears please have a look at <a href=\"https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-the-loading-message-go-away\">this FAQ for information to troubleshoot</a>.":
         "En caso de que este mensaje nunca desaparezca por favor revise <a href=\"https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-the-loading-message-go-away\">este FAQ para obtener información para solucionar problemas</a>.",
-    "+++ no paste text +++": "+++ no paste text +++"
+    "+++ no paste text +++": "+++ sin texto +++"
 }

i18n/fr.json

@@ -1,7 +1,7 @@
 {
     "PrivateBin": "PrivateBin",
     "%s is a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted <i>in the browser</i> using 256 bits AES. More information on the <a href=\"https://privatebin.info/\">project page</a>.":
-        "%s est un 'pastebin' (ou gestionnaire d'extraits de texte et de code source) minimaliste et open source, dans lequel le serveur n'a aucune connaissance des données envoyées. Les données sont chiffrées/déchiffrées <i>dans le navigateur</i> par un chiffrage AES 256 bits. Plus d'informations sur <a href=\"https://privatebin.info/\">la page du projet</a>.",
+        "%s est un 'pastebin' (ou gestionnaire d'extraits de texte et de code source) minimaliste et open source, dans lequel le serveur n'a aucune connaissance des données envoyées. Les données sont chiffrées/déchiffrées <i>dans le navigateur</i> par un chiffrement AES 256 bits. Plus d'informations sur <a href=\"https://privatebin.info/\">la page du projet</a>.",
     "Because ignorance is bliss":
         "Parce que l'ignorance c'est le bonheur",
     "en": "fr",
@@ -83,7 +83,7 @@
     "Could not decrypt data (Wrong key?)":
         "Impossible de déchiffrer les données (mauvaise clé ?)",
     "Could not delete the paste, it was not stored in burn after reading mode.":
-        "Impossible de supprimer le paste, car il n'a pas été stoclé en mode \"Effacer après lecture\".",
+        "Impossible de supprimer le paste, car il n'a pas été stocké en mode \"Effacer après lecture\".",
     "FOR YOUR EYES ONLY. Don't close this window, this message can't be displayed again.":
         "POUR VOS YEUX UNIQUEMENT. Ne fermez pas cette fenêtre, ce paste ne pourra plus être affiché.",
     "Could not decrypt comment; Wrong key?":
@@ -93,7 +93,7 @@
     "Anonymous":
         "Anonyme",
     "Avatar generated from IP address":
-        "Avatar anonyme (Vizhash de l'adresse IP)",
+        "Avatar généré à partir de l'adresse IP",
     "Add comment":
         "Ajouter un commentaire",
     "Optional nickname…":
@@ -123,7 +123,7 @@
     "Could not create paste: %s":
         "Impossible de créer le paste : %s",
     "Cannot decrypt paste: Decryption key missing in URL (Did you use a redirector or an URL shortener which strips part of the URL?)":
-        "Impossible de déchiffrer le paste : Clé de déchiffrage manquante dans l'URL (Avez-vous utilisé un redirecteur ou un site de réduction d'URL qui supprime une partie de l'URL ?)",
+        "Impossible de déchiffrer le paste : Clé de déchiffrement manquante dans l'URL (Avez-vous utilisé un redirecteur ou un site de réduction d'URL qui supprime une partie de l'URL ?)",
     "B": "o",
     "KiB": "Kio",
     "MiB": "Mio",
@@ -139,8 +139,10 @@
     "Markdown": "Markdown",
     "Download attachment": "Télécharger la pièce jointe",
     "Cloned: '%s'": "Cloner '%s'",
-    "The cloned file '%s' was attached to this paste.": "The cloned file '%s' was attached to this paste.",
+    "The cloned file '%s' was attached to this paste.": "Le fichier cloné '%s' a été attaché à ce paste.",
     "Attach a file": "Attacher un fichier ",
+    "alternatively drag & drop a file or paste an image from the clipboard": "alternatively drag & drop a file or paste an image from the clipboard",
+    "File too large, to display a preview. Please download the attachment.": "File too large, to display a preview. Please download the attachment.",
     "Remove attachment": "Enlever l'attachement",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "Votre navigateur ne supporte pas l'envoi de fichiers chiffrés. Merci d'utiliser un navigateur plus récent.",
@@ -156,9 +158,9 @@
     "Enter password":
         "Entrez le mot de passe",
     "Loading…": "Chargement…",
-    "Decrypting paste…": "Decrypting paste…",
+    "Decrypting paste…": "Déchiffrement du paste…",
-    "Preparing new paste…": "Preparing new paste…",
+    "Preparing new paste…": "Préparation du paste…",
     "In case this message never disappears please have a look at <a href=\"https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-the-loading-message-go-away\">this FAQ for information to troubleshoot</a>.":
         "Si ce message ne disparaîssait pas, jetez un oeil à <a href=\"https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-the-loading-message-go-away\">cette FAQ pour des idées de résolution</a> (en Anglais).",
-    "+++ no paste text +++": "+++ no paste text +++"
+    "+++ no paste text +++": "+++ pas de paste-text +++"
 }

i18n/it.json

@@ -132,6 +132,8 @@
     "Cloned: '%s'": "Clonato: '%s'",
     "The cloned file '%s' was attached to this paste.": "Il file clonato '%s' era allegato a questo messaggio.",
     "Attach a file": "Allega un file",
+    "alternatively drag & drop a file or paste an image from the clipboard": "alternatively drag & drop a file or paste an image from the clipboard",
+    "File too large, to display a preview. Please download the attachment.": "File too large, to display a preview. Please download the attachment.",
     "Remove attachment": "Rimuovi allegato",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "Il tuo browser non supporta l'invio di file cifrati. Utilizza un browser più recente.",

i18n/no.json

@@ -132,6 +132,8 @@
     "Cloned: '%s'": "Kopiert: '%s'",
     "The cloned file '%s' was attached to this paste.": "The cloned file '%s' was attached to this paste.",
     "Attach a file": "Legg til fil",
+    "alternatively drag & drop a file or paste an image from the clipboard": "alternatively drag & drop a file or paste an image from the clipboard",
+    "File too large, to display a preview. Please download the attachment.": "File too large, to display a preview. Please download the attachment.",
     "Remove attachment": "Slett vedlegg",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "Nettleseren din støtter ikke å laste opp krypterte filer. Vennligst bruk en nyere nettleser.",

i18n/oc.json

@@ -1,9 +1,9 @@
 {
     "PrivateBin": "PrivateBin",
     "%s is a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted <i>in the browser</i> using 256 bits AES. More information on the <a href=\"https://privatebin.info/\">project page</a>.":
-        "%s es un 'pastebin' (o gestionari d'extrachs de tèxte e còdi font) minimalista e open source, dins lo qual lo servidor a pas cap de coneissença de las donadas mandadas. Las donadas son chifradas/deschifradas <i>dins lo navigator</i> per un chiframent AES 256 bits. Mai informacions sus <a href=\"https://privatebin.info/\">la pagina del projècte</a>.",
+        "%s es un 'pastebin' (o gestionari d’extrachs de tèxte e còdi font) minimalista e open source, dins lo qual lo servidor a pas cap de coneissença de las donadas mandadas. Las donadas son chifradas/deschifradas <i>dins lo navigator</i> per un chiframent AES 256 bits. Mai informacions sus <a href=\"https://privatebin.info/\">la pagina del projècte</a>.",
     "Because ignorance is bliss":
-        "Perque l'ignorància es bonaür",
+        "Perque lo bonaür es l’ignorància",
     "en": "oc",
     "Paste does not exist, has expired or has been deleted.":
         "Lo tèxte existís pas, a expirat, o es estat suprimit.",
@@ -32,11 +32,11 @@
     "Paste was properly deleted.":
         "Lo tèxte es estat correctament suprimit.",
     "JavaScript is required for %s to work.<br />Sorry for the inconvenience.":
-        "JavaScript es requesit per far foncionar %s. <br />O planhèm per l'inconvenient.",
+        "JavaScript es requesit per far foncionar %s. <br />O planhèm per l’inconvenient.",
     "%s requires a modern browser to work.":
         "%s necessita un navigator modèrn per foncionar.",
     "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Encora sus Internet Explorer ? Fasètz-vos una favor, passatz a un navigator modèrn :",
+        "Encora sus Internet Explorer ? Fasètz-vos una favor, passatz a un navigator modèrn :",
     "New":
         "Nòu",
     "Send":
@@ -67,7 +67,7 @@
     "Never":
         "Jamai",
     "Note: This is a test service: Data may be deleted anytime. Kittens will die if you abuse this service.":
-        "Nota : Aquò es un servici d'espròva : las donadas pòdon èsser suprimidas a cada moment. De catons moriràn s'abusatz d'aqueste servici.",
+        "Nota : Aquò es un servici d’espròva : las donadas pòdon èsser suprimidas a cada moment. De catons moriràn s’abusatz d’aqueste servici.",
     "This document will expire in %d seconds.":
         ["Ce document expirera dans %d seconde.", "Aqueste document expirarà dins %d segondas."],
     "This document will expire in %d minutes.":
@@ -79,21 +79,21 @@
     "This document will expire in %d months.":
         ["Ce document expirera dans %d mois.", "Aqueste document expirarà dins %d meses."],
     "Please enter the password for this paste:":
-        "Picatz lo senhal per aqueste tèxte :",
+        "Picatz lo senhal per aqueste tèxte :",
     "Could not decrypt data (Wrong key?)":
-        "Impossible de deschifrar las donadas (marrida clau ?)",
+        "Impossible de deschifrar las donadas (marrida clau ?)",
     "Could not delete the paste, it was not stored in burn after reading mode.":
         "Impossible de suprimir lo tèxte, perque es pas estat gardat en mòde \"Escafar aprèp lectura\".",
     "FOR YOUR EYES ONLY. Don't close this window, this message can't be displayed again.":
         "PER VÒSTRES UÈLHS SOLAMENT. Tampetz pas aquesta fenèstra, aqueste tèxte poirà pas mai èsser afichat.",
     "Could not decrypt comment; Wrong key?":
-        "Impossible de deschifrar lo comentari ; marrida clau ?",
+        "Impossible de deschifrar lo comentari ; marrida clau ?",
     "Reply":
         "Respondre",
     "Anonymous":
         "Anonime",
     "Avatar generated from IP address":
-        "Avatar anonime (Vizhash de l'adreça IP)",
+        "Avatar anonime (Vizhash de l’adreça IP)",
     "Add comment":
         "Apondre un comentari",
     "Optional nickname…":
@@ -105,25 +105,25 @@
     "Comment posted.":
         "Comentari mandat.",
     "Could not refresh display: %s":
-        "Impossible d'actualizar l'afichatge : %s",
+        "Impossible d’actualizar l’afichatge : %s",
     "unknown status":
         "Estatut desconegut",
     "server error or not responding":
         "Lo servidor respond pas o a rencontrat una error",
     "Could not post comment: %s":
-        "Impossible de mandar lo comentari : %s",
+        "Impossible de mandar lo comentari : %s",
     "Please move your mouse for more entropy…":
         "Mercés de bolegar vòstra mirga per mai entropia…",
     "Sending paste…":
         "Mandadís del tèxte…",
     "Your paste is <a id=\"pasteurl\" href=\"%s\">%s</a> <span id=\"copyhint\">(Hit [Ctrl]+[c] to copy)</span>":
-        "Vòstre tèxte es disponible a l'adreça <a id=\"pasteurl\" href=\"%s\">%s</a> <span id=\"copyhint\">(Picatz sus [Ctrl]+[c] per copiar)</span>",
+        "Vòstre tèxte es disponible a l’adreça <a id=\"pasteurl\" href=\"%s\">%s</a> <span id=\"copyhint\">(Picatz sus [Ctrl]+[c] per copiar)</span>",
     "Delete data":
         "Supprimir las donadas del tèxte",
     "Could not create paste: %s":
-        "Impossible de crear lo tèxte : %s",
+        "Impossible de crear lo tèxte : %s",
     "Cannot decrypt paste: Decryption key missing in URL (Did you use a redirector or an URL shortener which strips part of the URL?)":
-        "Impossible de deschifrar lo tèxte : Clau de deschiframent absenta de l'URL (Avètz utilizat un redirector o un site de reduccion d'URL que suprimís una partida de l'URL ?)",
+        "Impossible de deschifrar lo tèxte : clau de deschiframent absenta de l’URL (Avètz utilizat un redirector o un site de reduccion d’URL que suprimís una partida de l’URL ?)",
     "B": "o",
     "KiB": "Kio",
     "MiB": "Mio",
@@ -138,15 +138,17 @@
     "Source Code": "Còdi font",
     "Markdown": "Markdown",
     "Download attachment": "Telecargar la pèça junta",
-    "Cloned: '%s'": "Clonar: '%s'",
+    "Cloned: '%s'": "Clonar : '%s'",
-    "The cloned file '%s' was attached to this paste.": "The cloned file '%s' was attached to this paste.",
+    "The cloned file '%s' was attached to this paste.": "Aqueste fichièr clonat '%s' es estat ajustat a aqueste tèxte.",
-    "Attach a file": "Juntar un fichièr ",
+    "Attach a file": "Juntar un fichièr",
-    "Remove attachment": "Levar la pèca junta",
+    "alternatively drag & drop a file or paste an image from the clipboard": "autrament lisatz lo fichièr o pegatz l’imatge del quichapapièrs",
+    "File too large, to display a preview. Please download the attachment.": "Fichièr tròp pesuc per mostrar un apercebut. Telecargatz la pèca junta.",
+    "Remove attachment": "Levar la pèça junta",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
-        "Vòstre navigator es pas compatible amb lo mandadís de fichièrs chifrats. Mercés d'emplegar un navigator mai recent.",
+        "Vòstre navigator es pas compatible amb lo mandadís de fichièrs chifrats. Mercés d’emplegar un navigator mai recent.",
     "Invalid attachment.": "Pèça junta invalida.",
     "Options": "Opcions",
-    "Shorten URL": "Acorchir l'URL",
+    "Shorten URL": "Acorchir l’URL",
     "Editor": "Editar",
     "Preview": "Previsualizar",
     "%s requires the PATH to end in a \"%s\". Please update the PATH in your index.php.":
@@ -156,9 +158,9 @@
     "Enter password":
         "Picatz lo senhal",
     "Loading…": "Cargament…",
-    "Decrypting paste…": "Decrypting paste…",
+    "Decrypting paste…": "Deschirament del tèxte…",
-    "Preparing new paste…": "Preparing new paste…",
+    "Preparing new paste…": "Preparacion…",
     "In case this message never disappears please have a look at <a href=\"https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-the-loading-message-go-away\">this FAQ for information to troubleshoot</a>.":
-        "Se per cas aqueste messatge quita pas de s'afichar mercés de gaitar <a href=\"https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-the-loading-message-go-away\">aquesta FAQ per las solucions</a> (en Anglés).",
+        "Se per cas aqueste messatge quita pas de s’afichar mercés de gaitar <a href=\"https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-the-loading-message-go-away\">aquesta FAQ per las solucions</a> (en anglés).",
-    "+++ no paste text +++": "+++ no paste text +++"
+    "+++ no paste text +++": "+++ cap de tèxte pegat +++"
 }

i18n/pl.json

@@ -132,6 +132,8 @@
     "Cloned: '%s'": "Sklonowano: '%s'",
     "The cloned file '%s' was attached to this paste.": "The cloned file '%s' was attached to this paste.",
     "Attach a file": "Załącz plik",
+    "alternatively drag & drop a file or paste an image from the clipboard": "alternatively drag & drop a file or paste an image from the clipboard",
+    "File too large, to display a preview. Please download the attachment.": "File too large, to display a preview. Please download the attachment.",
     "Remove attachment": "Usuń załącznik",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "Twoja przeglądarka nie wspiera wysyłania zaszyfrowanych plików. Użyj nowszej przeglądarki.",

i18n/pt.json

@@ -132,6 +132,8 @@
     "Cloned: '%s'": "Clonado: '%s'",
     "The cloned file '%s' was attached to this paste.": "O arquivo clonado '%s' foi anexado a essa cópia.",
     "Attach a file": "Anexar um arquivo",
+    "alternatively drag & drop a file or paste an image from the clipboard": "alternatively drag & drop a file or paste an image from the clipboard",
+    "File too large, to display a preview. Please download the attachment.": "File too large, to display a preview. Please download the attachment.",
     "Remove attachment": "Remover anexo",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "Seu navegador não permite subir arquivos cifrados. Por favor, utilize um navegador mais recente.",

i18n/ru.json

@@ -142,6 +142,8 @@
     "The cloned file '%s' was attached to this paste.":
         "Дубликат файла '%s' был прикреплен к этой записи.",
     "Attach a file": "Прикрепить файл",
+    "alternatively drag & drop a file or paste an image from the clipboard": "alternatively drag & drop a file or paste an image from the clipboard",
+    "File too large, to display a preview. Please download the attachment.": "File too large, to display a preview. Please download the attachment.",
     "Remove attachment": "Удалить вложение",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "Ваш браузер не поддерживает отправку зашифрованных файлов. Используйте более новый браузер.",

i18n/sl.json

@@ -141,6 +141,8 @@
     "Cloned: '%s'": "'%s' klonirana",
     "The cloned file '%s' was attached to this paste.": "The cloned file '%s' was attached to this paste.",
     "Attach a file": "Pripni datoteko",
+    "alternatively drag & drop a file or paste an image from the clipboard": "alternatively drag & drop a file or paste an image from the clipboard",
+    "File too large, to display a preview. Please download the attachment.": "File too large, to display a preview. Please download the attachment.",
     "Remove attachment": "Odstrani priponko",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "Tvoj brskalnik ne omogoča nalaganje zakodiranih datotek. Prosim uporabi novejši brskalnik.",

i18n/zh.json

@@ -132,6 +132,8 @@
     "Cloned: '%s'": "克隆: '%s'",
     "The cloned file '%s' was attached to this paste.": "克隆文件 '%s' 已附加到此粘贴。",
     "Attach a file": "添加一个附件",
+    "alternatively drag & drop a file or paste an image from the clipboard": "alternatively drag & drop a file or paste an image from the clipboard",
+    "File too large, to display a preview. Please download the attachment.": "File too large, to display a preview. Please download the attachment.",
     "Remove attachment": "移除附件",
     "Your browser does not support uploading encrypted files. Please use a newer browser.":
         "您的浏览器不支持上传加密的文件，请使用更新的浏览器。",

js/common.js

@@ -0,0 +1,154 @@
+'use strict';
+
+// testing prerequisites
+global.assert = require('assert');
+global.jsc = require('jsverify');
+global.jsdom = require('jsdom-global');
+global.cleanup = global.jsdom();
+global.fs = require('fs');
+
+// application libraries to test
+global.$ = global.jQuery = require('./jquery-3.1.1');
+global.sjcl = require('./sjcl-1.0.6');
+global.Base64 = require('./base64-2.1.9').Base64;
+global.RawDeflate = require('./rawdeflate-0.5').RawDeflate;
+global.RawDeflate.inflate = require('./rawinflate-0.3').RawDeflate.inflate;
+require('./prettify');
+global.prettyPrint = window.PR.prettyPrint;
+global.prettyPrintOne = window.PR.prettyPrintOne;
+global.showdown = require('./showdown-1.6.1');
+global.DOMPurify = require('./purify-1.0.3');
+require('./bootstrap-3.3.7');
+require('./privatebin');
+
+// internal variables
+var a2zString = ['a','b','c','d','e','f','g','h','i','j','k','l','m',
+                     'n','o','p','q','r','s','t','u','v','w','x','y','z'],
+    alnumString = a2zString.concat(['0','1','2','3','4','5','6','7','8','9']),
+    queryString = alnumString.concat(['+','%','&','.','*','-','_']),
+    base64String = alnumString.concat(['+','/','=']).concat(
+        a2zString.map(function(c) {
+            return c.toUpperCase();
+        })
+    ),
+    schemas = ['ftp','gopher','http','https','ws','wss'],
+    supportedLanguages = ['de', 'es', 'fr', 'it', 'no', 'pl', 'pt', 'oc', 'ru', 'sl', 'zh'],
+    mimeTypes = ['image/png', 'application/octet-stream'],
+    formats = ['plaintext', 'markdown', 'syntaxhighlighting'],
+    /**
+     * character to HTML entity lookup table
+     *
+     * @see    {@link https://github.com/janl/mustache.js/blob/master/mustache.js#L60}
+     */
+    entityMap = {
+        '&': '&',
+        '<': '&lt;',
+        '>': '&gt;',
+        '"': '&quot;',
+        "'": '&#39;',
+        '/': '&#x2F;',
+        '`': '&#x60;',
+        '=': '&#x3D;'
+    },
+    logFile = fs.createWriteStream('test.log'),
+    mimeFile = fs.createReadStream('/etc/mime.types'),
+    mimeLine = '';
+
+// redirect console messages to log file
+console.info = console.warn = console.error = function () {
+    logFile.write(Array.prototype.slice.call(arguments).join('') + '\n');
+};
+
+// populate mime types from environment
+mimeFile.on('data', function(data) {
+    mimeLine += data;
+    var index = mimeLine.indexOf('\n');
+    while (index > -1) {
+        var line = mimeLine.substring(0, index);
+        mimeLine = mimeLine.substring(index + 1);
+        parseMime(line);
+        index = mimeLine.indexOf('\n');
+    }
+});
+
+mimeFile.on('end', function() {
+    if (mimeLine.length > 0) {
+        parseMime(mimeLine);
+    }
+});
+
+function parseMime(line) {
+    // ignore comments
+    var index = line.indexOf('#');
+    if (index > -1) {
+        line = line.substring(0, index);
+    }
+
+    // ignore bits after tabs
+    index = line.indexOf('\t');
+    if (index > -1) {
+        line = line.substring(0, index);
+    }
+    if (line.length > 0) {
+        mimeTypes.push(line);
+    }
+}
+
+// common testing helper functions
+
+/**
+ * convert all applicable characters to HTML entities
+ *
+ * @see    {@link https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content}
+ * @name   htmlEntities
+ * @function
+ * @param  {string} str
+ * @return {string} escaped HTML
+ */
+exports.htmlEntities = function(str) {
+    return String(str).replace(
+        /[&<>"'`=\/]/g, function(s) {
+            return entityMap[s];
+        });
+};
+
+// provides random lowercase characters from a to z
+exports.jscA2zString = function() {
+    return jsc.elements(a2zString);
+};
+
+// provides random lowercase alpha numeric characters (a to z and 0 to 9)
+exports.jscAlnumString = function() {
+    return jsc.elements(alnumString);
+};
+
+// provides random characters allowed in GET queries
+exports.jscQueryString = function() {
+    return jsc.elements(queryString);
+};
+
+// provides random characters allowed in base64 encoded strings
+exports.jscBase64String = function() {
+    return jsc.elements(base64String);
+};
+
+// provides a random URL schema supported by the whatwg-url library
+exports.jscSchemas = function() {
+    return jsc.elements(schemas);
+};
+
+// provides a random supported language string
+exports.jscSupportedLanguages = function() {
+    return jsc.elements(supportedLanguages);
+};
+
+// provides a random mime type
+exports.jscMimeTypes = function() {
+    return jsc.elements(mimeTypes);
+};
+
+// provides a random PrivateBin paste formatter
+exports.jscFormats = function() {
+    return jsc.elements(formats);
+};
+

js/test.js

@@ -1,673 +0,0 @@
-'use strict';
-var jsc = require('jsverify'),
-    jsdom = require('jsdom-global'),
-    cleanup = jsdom(),
-
-    a2zString = ['a','b','c','d','e','f','g','h','i','j','k','l','m',
-                 'n','o','p','q','r','s','t','u','v','w','x','y','z'],
-    alnumString = a2zString.concat(['0','1','2','3','4','5','6','7','8','9']),
-    queryString = alnumString.concat(['+','%','&','.','*','-','_']),
-    base64String = alnumString.concat(['+','/','=']).concat(
-        a2zString.map(function(c) {
-            return c.toUpperCase();
-        })
-    ),
-    // schemas supported by the whatwg-url library
-    schemas = ['ftp','gopher','http','https','ws','wss'],
-    supportedLanguages = ['de', 'es', 'fr', 'it', 'no', 'pl', 'pt', 'oc', 'ru', 'sl', 'zh'],
-    logFile = require('fs').createWriteStream('test.log');
-
-global.$ = global.jQuery = require('./jquery-3.1.1');
-global.sjcl = require('./sjcl-1.0.6');
-global.Base64 = require('./base64-2.1.9').Base64;
-global.RawDeflate = require('./rawdeflate-0.5').RawDeflate;
-global.RawDeflate.inflate = require('./rawinflate-0.3').RawDeflate.inflate;
-require('./privatebin');
-
-// redirect console messages to log file
-console.warn = console.error = function (msg) {
-    logFile.write(msg + '\n');
-}
-
-describe('Helper', function () {
-    describe('secondsToHuman', function () {
-        after(function () {
-            cleanup();
-        });
-
-        jsc.property('returns an array with a number and a word', 'integer', function (number) {
-            var result = $.PrivateBin.Helper.secondsToHuman(number);
-            return Array.isArray(result) &&
-                result.length === 2 &&
-                result[0] === parseInt(result[0], 10) &&
-                typeof result[1] === 'string';
-        });
-        jsc.property('returns seconds on the first array position', 'integer 59', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[0] === number;
-        });
-        jsc.property('returns seconds on the second array position', 'integer 59', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'second';
-        });
-        jsc.property('returns minutes on the first array position', 'integer 60 3599', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[0] === Math.floor(number / 60);
-        });
-        jsc.property('returns minutes on the second array position', 'integer 60 3599', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'minute';
-        });
-        jsc.property('returns hours on the first array position', 'integer 3600 86399', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[0] === Math.floor(number / (60 * 60));
-        });
-        jsc.property('returns hours on the second array position', 'integer 3600 86399', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'hour';
-        });
-        jsc.property('returns days on the first array position', 'integer 86400 5184000', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[0] === Math.floor(number / (60 * 60 * 24));
-        });
-        jsc.property('returns days on the second array position', 'integer 86400 5184000', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'day';
-        });
-        // max safe integer as per http://ecma262-5.com/ELS5_HTML.htm#Section_8.5
-        jsc.property('returns months on the first array position', 'integer 5184000 9007199254740991', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[0] === Math.floor(number / (60 * 60 * 24 * 30));
-        });
-        jsc.property('returns months on the second array position', 'integer 5184000 9007199254740991', function (number) {
-            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'month';
-        });
-    });
-
-    // this test is not yet meaningful using jsdom, as it does not contain getSelection support.
-    // TODO: This needs to be tested using a browser.
-    describe('selectText', function () {
-        jsc.property(
-            'selection contains content of given ID',
-            jsc.nearray(jsc.nearray(jsc.elements(alnumString))),
-            'nearray string',
-            function (ids, contents) {
-                var html = '',
-                    result = true;
-                ids.forEach(function(item, i) {
-                    html += '<div id="' + item.join('') + '">' + $.PrivateBin.Helper.htmlEntities(contents[i] || contents[0]) + '</div>';
-                });
-                var clean = jsdom(html);
-                ids.forEach(function(item, i) {
-                    $.PrivateBin.Helper.selectText(item.join(''));
-                    // TODO: As per https://github.com/tmpvar/jsdom/issues/321 there is no getSelection in jsdom, yet.
-                    // Once there is one, uncomment the line below to actually check the result.
-                    //result *= (contents[i] || contents[0]) === window.getSelection().toString();
-                });
-                clean();
-                return Boolean(result);
-            }
-        );
-    });
-
-    describe('setElementText', function () {
-        after(function () {
-            cleanup();
-        });
-
-        jsc.property(
-            'replaces the content of an element',
-            jsc.nearray(jsc.nearray(jsc.elements(alnumString))),
-            'nearray string',
-            'string',
-            function (ids, contents, replacingContent) {
-                var html = '',
-                    result = true;
-                ids.forEach(function(item, i) {
-                    html += '<div id="' + item.join('') + '">' + $.PrivateBin.Helper.htmlEntities(contents[i] || contents[0]) + '</div>';
-                });
-                var elements = $('<body />').html(html);
-                ids.forEach(function(item, i) {
-                    var id = item.join(''),
-                        element = elements.find('#' + id).first();
-                    $.PrivateBin.Helper.setElementText(element, replacingContent);
-                    result *= replacingContent === element.text();
-                });
-                return Boolean(result);
-            }
-        );
-    });
-
-    describe('urls2links', function () {
-        after(function () {
-            cleanup();
-        });
-
-        jsc.property(
-            'ignores non-URL content',
-            'string',
-            function (content) {
-                var element = $('<div>' + content + '</div>'),
-                    before = element.html();
-                $.PrivateBin.Helper.urls2links(element);
-                return before === element.html();
-            }
-        );
-        jsc.property(
-            'replaces URLs with anchors',
-            'string',
-            jsc.elements(['http', 'https', 'ftp']),
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.array(jsc.elements(queryString)),
-            jsc.array(jsc.elements(queryString)),
-            'string',
-            function (prefix, schema, address, query, fragment, postfix) {
-                var query = query.join(''),
-                    fragment = fragment.join(''),
-                    url = schema + '://' + address.join('') + '/?' + query + '#' + fragment,
-                    prefix = $.PrivateBin.Helper.htmlEntities(prefix),
-                    postfix = ' ' + $.PrivateBin.Helper.htmlEntities(postfix),
-                    element = $('<div>' + prefix + url + postfix + '</div>');
-
-                // special cases: When the query string and fragment imply the beginning of an HTML entity, eg. &#0 or &#x
-                if (
-                    query.slice(-1) === '&' &&
-                    (parseInt(fragment.substring(0, 1), 10) >= 0 || fragment.charAt(0) === 'x' )
-                )
-                {
-                    url = schema + '://' + address.join('') + '/?' + query.substring(0, query.length - 1);
-                    postfix = '';
-                    element = $('<div>' + prefix + url + '</div>');
-                }
-
-                $.PrivateBin.Helper.urls2links(element);
-                return element.html() === $('<div>' + prefix + '<a href="' + url + '" rel="nofollow">' + url + '</a>' + postfix + '</div>').html();
-            }
-        );
-        jsc.property(
-            'replaces magnet links with anchors',
-            'string',
-            jsc.array(jsc.elements(queryString)),
-            'string',
-            function (prefix, query, postfix) {
-                var url = 'magnet:?' + query.join(''),
-                    prefix = $.PrivateBin.Helper.htmlEntities(prefix),
-                    postfix = $.PrivateBin.Helper.htmlEntities(postfix),
-                    element = $('<div>' + prefix + url + ' ' + postfix + '</div>');
-                $.PrivateBin.Helper.urls2links(element);
-                return element.html() === $('<div>' + prefix + '<a href="' + url + '" rel="nofollow">' + url + '</a> ' + postfix + '</div>').html();
-            }
-        );
-    });
-
-    describe('sprintf', function () {
-        after(function () {
-            cleanup();
-        });
-
-        jsc.property(
-            'replaces %s in strings with first given parameter',
-            'string',
-            '(small nearray) string',
-            'string',
-            function (prefix, params, postfix) {
-                prefix    =    prefix.replace(/%(s|d)/g, '%%');
-                params[0] = params[0].replace(/%(s|d)/g, '%%');
-                postfix   =   postfix.replace(/%(s|d)/g, '%%');
-                var result = prefix + params[0] + postfix;
-                params.unshift(prefix + '%s' + postfix);
-                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
-            }
-        );
-        jsc.property(
-            'replaces %d in strings with first given parameter',
-            'string',
-            '(small nearray) nat',
-            'string',
-            function (prefix, params, postfix) {
-                prefix  =  prefix.replace(/%(s|d)/g, '%%');
-                postfix = postfix.replace(/%(s|d)/g, '%%');
-                var result = prefix + params[0] + postfix;
-                params.unshift(prefix + '%d' + postfix);
-                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
-            }
-        );
-        jsc.property(
-            'replaces %d in strings with 0 if first parameter is not a number',
-            'string',
-            '(small nearray) falsy',
-            'string',
-            function (prefix, params, postfix) {
-                prefix  =  prefix.replace(/%(s|d)/g, '%%');
-                postfix = postfix.replace(/%(s|d)/g, '%%');
-                var result = prefix + '0' + postfix;
-                params.unshift(prefix + '%d' + postfix);
-                return result === $.PrivateBin.Helper.sprintf.apply(this, params)
-            }
-        );
-        jsc.property(
-            'replaces %d and %s in strings in order',
-            'string',
-            'nat',
-            'string',
-            'string',
-            'string',
-            function (prefix, uint, middle, string, postfix) {
-                prefix  =  prefix.replace(/%(s|d)/g, '%%');
-                middle  =  middle.replace(/%(s|d)/g, '%%');
-                postfix = postfix.replace(/%(s|d)/g, '%%');
-                var params = [prefix + '%d' + middle + '%s' + postfix, uint, string],
-                    result = prefix + uint + middle + string + postfix;
-                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
-            }
-        );
-        jsc.property(
-            'replaces %d and %s in strings in reverse order',
-            'string',
-            'nat',
-            'string',
-            'string',
-            'string',
-            function (prefix, uint, middle, string, postfix) {
-                prefix  =  prefix.replace(/%(s|d)/g, '%%');
-                middle  =  middle.replace(/%(s|d)/g, '%%');
-                postfix = postfix.replace(/%(s|d)/g, '%%');
-                var params = [prefix + '%s' + middle + '%d' + postfix, string, uint],
-                    result = prefix + string + middle + uint + postfix;
-                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
-            }
-        );
-    });
-
-    describe('getCookie', function () {
-        jsc.property(
-            'returns the requested cookie',
-            'nearray asciinestring',
-            'nearray asciistring',
-            function (labels, values) {
-                var selectedKey = '', selectedValue = '',
-                    cookieArray = [],
-                    count = 0;
-                labels.forEach(function(item, i) {
-                    // deliberatly using a non-ascii key for replacing invalid characters
-                    var key = item.replace(/[\s;,=]/g, Array(i+2).join('£')),
-                        value = (values[i] || values[0]).replace(/[\s;,=]/g, '');
-                    cookieArray.push(key + '=' + value);
-                    if (Math.random() < 1 / i || selectedKey === key)
-                    {
-                        selectedKey = key;
-                        selectedValue = value;
-                    }
-                });
-                var clean = jsdom('', {cookie: cookieArray}),
-                    result = $.PrivateBin.Helper.getCookie(selectedKey);
-                clean();
-                return result === selectedValue;
-            }
-        );
-    });
-
-    describe('baseUri', function () {
-        before(function () {
-            $.PrivateBin.Helper.reset();
-        });
-
-        jsc.property(
-            'returns the URL without query & fragment',
-            jsc.elements(schemas),
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.array(jsc.elements(queryString)),
-            'string',
-            function (schema, address, query, fragment) {
-                var expected = schema + '://' + address.join('') + '/',
-                    clean = jsdom('', {url: expected + '?' + query.join('') + '#' + fragment}),
-                    result = $.PrivateBin.Helper.baseUri();
-                $.PrivateBin.Helper.reset();
-                clean();
-                return expected === result;
-            }
-        );
-    });
-
-    describe('htmlEntities', function () {
-        after(function () {
-            cleanup();
-        });
-
-        jsc.property(
-            'removes all HTML entities from any given string',
-            'string',
-            function (string) {
-                var result = $.PrivateBin.Helper.htmlEntities(string);
-                return !(/[<>"'`=\/]/.test(result)) && !(string.indexOf('&') > -1 && !(/&amp;/.test(result)));
-            }
-        );
-    });
-});
-
-describe('I18n', function () {
-    describe('translate', function () {
-        before(function () {
-            $.PrivateBin.I18n.reset();
-        });
-
-        jsc.property(
-            'returns message ID unchanged if no translation found',
-            'string',
-            function (messageId) {
-                messageId   = messageId.replace(/%(s|d)/g, '%%');
-                var plurals = [messageId, messageId + 's'],
-                    fake    = [messageId],
-                    result  = $.PrivateBin.I18n.translate(messageId);
-                $.PrivateBin.I18n.reset();
-
-                var alias = $.PrivateBin.I18n._(messageId);
-                $.PrivateBin.I18n.reset();
-
-                var p_result = $.PrivateBin.I18n.translate(plurals);
-                $.PrivateBin.I18n.reset();
-
-                var p_alias = $.PrivateBin.I18n._(plurals);
-                $.PrivateBin.I18n.reset();
-
-                var f_result = $.PrivateBin.I18n.translate(fake);
-                $.PrivateBin.I18n.reset();
-
-                var f_alias = $.PrivateBin.I18n._(fake);
-                $.PrivateBin.I18n.reset();
-
-                return messageId === result && messageId === alias &&
-                    messageId === p_result && messageId === p_alias &&
-                    messageId === f_result && messageId === f_alias;
-            }
-        );
-        jsc.property(
-            'replaces %s in strings with first given parameter',
-            'string',
-            '(small nearray) string',
-            'string',
-            function (prefix, params, postfix) {
-                prefix    =    prefix.replace(/%(s|d)/g, '%%');
-                params[0] = params[0].replace(/%(s|d)/g, '%%');
-                postfix   =   postfix.replace(/%(s|d)/g, '%%');
-                var translation = prefix + params[0] + postfix;
-                params.unshift(prefix + '%s' + postfix);
-                var result = $.PrivateBin.I18n.translate.apply(this, params);
-                $.PrivateBin.I18n.reset();
-                var alias = $.PrivateBin.I18n._.apply(this, params);
-                $.PrivateBin.I18n.reset();
-                return translation === result && translation === alias;
-            }
-        );
-    });
-
-    describe('getPluralForm', function () {
-        before(function () {
-            $.PrivateBin.I18n.reset();
-        });
-
-        jsc.property(
-            'returns valid key for plural form',
-            jsc.elements(supportedLanguages),
-            'integer',
-            function(language, n) {
-                $.PrivateBin.I18n.reset(language);
-                var result = $.PrivateBin.I18n.getPluralForm(n);
-                // arabic seems to have the highest plural count with 6 forms
-                return result >= 0 && result <= 5;
-            }
-        );
-    });
-
-    // loading of JSON via AJAX needs to be tested in the browser, this just mocks it
-    // TODO: This needs to be tested using a browser.
-    describe('loadTranslations', function () {
-        before(function () {
-            $.PrivateBin.I18n.reset();
-        });
-
-        jsc.property(
-            'downloads and handles any supported language',
-            jsc.elements(supportedLanguages),
-            function(language) {
-                var clean = jsdom('', {url: 'https://privatebin.net/', cookie: ['lang=' + language]});
-
-                $.PrivateBin.I18n.reset('en');
-                $.PrivateBin.I18n.loadTranslations();
-                $.PrivateBin.I18n.reset(language, require('../i18n/' + language + '.json'));
-                var result = $.PrivateBin.I18n.translate('en'),
-                    alias  = $.PrivateBin.I18n._('en');
-
-                clean();
-                return language === result && language === alias;
-            }
-        );
-    });
-});
-
-describe('CryptTool', function () {
-    describe('cipher & decipher', function () {
-        this.timeout(30000);
-        it('can en- and decrypt any message', function () {
-            jsc.check(jsc.forall(
-                'string',
-                'string',
-                'string',
-                function (key, password, message) {
-                    return message === $.PrivateBin.CryptTool.decipher(
-                        key,
-                        password,
-                        $.PrivateBin.CryptTool.cipher(key, password, message)
-                    );
-                }
-            ),
-            // reducing amount of checks as running 100 takes about 5 minutes
-            {tests: 5, quiet: true});
-        });
-
-        // The below static unit tests are included to ensure deciphering of "classic"
-        // SJCL based pastes still works
-        it(
-            'supports PrivateBin v1 ciphertext (SJCL & Base64 2.1.9)',
-            function () {
-                // Of course you can easily decipher the following texts, if you like.
-                // Bonus points for finding their sources and hidden meanings.
-                var paste1 = $.PrivateBin.CryptTool.decipher(
-                    '6t2qsmLyfXIokNCL+3/yl15rfTUBQvm5SOnFPvNE7Q8=',
-                    // -- "That's amazing. I've got the same combination on my luggage."
-                    Array.apply(0, Array(6)).map(function(_,b) { return b + 1; }).join(''),
-                    '{"iv":"4HNFIl7eYbCh6HuShctTIA==","v":1,"iter":10000,"ks":256,"ts":128,"mode":"gcm","adata":"","cipher":"aes","salt":"u0lQvePq6L0=","ct":"fGPUVrDyaVr1ZDGb+kqQ3CPEW8x4YKGfzHDmA0Vjkh250aWNe7Cnigkps9aaFVMX9AaerrTp3yZbojJtNqVGMfLdUTu+53xmZHqRKxCCqSfDNSNoW4Oxk5OVgAtRyuG4bXHDsWTXDNz2xceqzVFqhkwTwlUchrV7uuFK/XUKTNjPFM744moivIcBbfM2FOeKlIFs8RYPYuvqQhp2rMLlNGwwKh//4kykQsHMQDeSDuJl8stMQzgWR/btUBZuwNZEydkMH6IPpTdf5WTSrZ+wC2OK0GutCm4UaEe6txzaTMfu+WRVu4PN6q+N+2zljWJ1XdpVcN/i0Sv4QVMym0Xa6y0eccEhj/69o47PmExmMMeEwExImPalMNT9JUSiZdOZJ/GdzwrwoIuq1mdQR6vSH+XJ/8jXJQ7bjjJVJYXTcT0Di5jixArI2Kpp1GGlGVFbLgPugwU1wczg+byqeDOAECXRRnQcogeaJtVcRwXwfy4j3ORFcblYMilxyHqKBewcYPRVBGtBs50cVjSIkAfR84rnc1nfvnxK/Gmm+4VBNHI6ODWNpRolVMCzXjbKYnV3Are5AgSpsTqaGl41VJGpcco6cAwi4K0Bys1seKR+bLSdUgqRrkEqSRSdu3/VTu9HhEk8an0rjTE4CBB5/LMn16p0TGLoOb32odKFIEtpanVvLjeyiVMvSxcgYLNnTi/5FiaAC4pJxRD+AZHedU1FICUeEXxIcac/4E5qjkHjX9SpQtLl80QLIVnjNliZm7QLB/nKu7W8Jb0+/CiTdV3Q9LhxlH4ciprnX+W0B00BKYFHnL9jRVzKdXhf1EHydbXMAfpCjHAXIVCkFakJinQBDIIw/SC6Yig0u0ddEID2B7LYAP1iE4RZwzTrxCB+ke2jQr8c20Jj6u6ShFOPC9DCw9XupZ4HAalVG00kSgjus+b8zrVji3/LKEhb4EBzp1ctBJCFTeXwej8ZETLoXTylev5dlwZSYAbuBPPcbFR/xAIPx3uDabd1E1gTqUc68ICIGhd197Mb2eRWiSvHr5SPsASerMxId6XA6+iQlRiI+NDR+TGVNmCnfxSlyPFMOHGTmslXOGIqGfBR8l4ft8YVZ70lCwmwTuViGc75ULSf9mM57/LmRzQFMYQtvI8IFK9JaQEMY5xz0HLtR4iyQUUdwR9e0ytBNdWF2a2WPDEnJuY/QJo4GzTlgv4QUxMXI5htsn2rf0HxCFu7Po8DNYLxTS+67hYjDIYWYaEIc8LXWMLyDm9C5fARPJ4F2BIWgzgzkNj+dVjusft2XnziamWdbS5u3kuRlVuz5LQj+R5imnqQAincdZTkTT1nYx+DatlOLllCYIHffpI="}'
-                ),
-                paste2 = $.PrivateBin.CryptTool.decipher(
-                    's9pmKZKOBN7EVvHpTA8jjLFH3Xlz/0l8lB4+ONPACrM=',
-                    '', // no password
-                    '{"iv":"WA42mdxIVXUwBqZu7JYNiw==","v":1,"iter":10000,"ks":256,"ts":128,"mode":"gcm","adata":"","cipher":"aes","salt":"jN6CjbQMJCM=","ct":"kYYMo5DFG1+w0UHiYXT5pdV0IUuXxzOlslkW/c3DRCbGFROCVkAskHce7HoRczee1N9c5MhHjVMJUIZE02qIS8UyHdJ/GqcPVidTUcj9rnDNWsTXkjVv8jCwHS/cwmAjDTWpwp5ThECN+ov/wNp/NdtTj8Qj7f/T3rfZIOCWfwLH9s4Des35UNcUidfPTNQ1l0Gm0X+r98CCUSYZjQxkZc6hRZBLPQ8EaNVooUwd5eP4GiYlmSDNA0wOSA+5isPYxomVCt+kFf58VBlNhpfNi7BLYAUTPpXT4SfH5drR9+C7NTeZ+tTCYjbU94PzYItOpu8vgnB1/a6BAM5h3m9w+giUb0df4hgTWeZnZxLjo5BN8WV+kdTXMj3/Vv0gw0DQrDcCuX/cBAjpy3lQGwlAN1vXoOIyZJUjMpQRrOLdKvLB+zcmVNtGDbgnfP2IYBzk9NtodpUa27ne0T0ZpwOPlVwevsIVZO224WLa+iQmmHOWDFFpVDlS0t0fLfOk7Hcb2xFsTxiCIiyKMho/IME1Du3X4e6BVa3hobSSZv0rRtNgY1KcyYPrUPW2fxZ+oik3y9SgGvb7XpjVIta8DWlDWRfZ9kzoweWEYqz9IA8Xd373RefpyuWI25zlHoX3nwljzsZU6dC//h/Dt2DNr+IAvKO3+u23cWoB9kgcZJ2FJuqjLvVfCF+OWcig7zs2pTYJW6Rg6lqbBCxiUUlae6xJrjfv0pzD2VYCLY7v1bVTagppwKzNI3WaluCOrdDYUCxUSe56yd1oAoLPRVbYvomRboUO6cjQhEknERyvt45og2kORJOEJayHW+jZgR0Y0jM3Nk17ubpij2gHxNx9kiLDOiCGSV5mn9mV7qd3HHcOMSykiBgbyzjobi96LT2dIGLeDXTIdPOog8wyobO4jWq0GGs0vBB8oSYXhHvixZLcSjX2KQuHmEoWzmJcr3DavdoXZmAurGWLKjzEdJc5dSD/eNr99gjHX7wphJ6umKMM+fn6PcbYJkhDh2GlJL5COXjXfm/5aj/vuyaRRWZMZtmnYpGAtAPg7AUG"}'
-                );
-
-                if (!paste1.includes('securely packed in iron') || !paste2.includes('Sol is right')) {
-                    throw Error('v1 (SJCL based) pastes could not be deciphered');
-                }
-            }
-        );
-
-        it(
-            'supports ZeroBin ciphertext (SJCL & Base64 1.7)',
-            function () {
-                var newBase64 = global.Base64;
-                global.Base64 = require('./base64-1.7').Base64;
-                jsdom();
-                delete require.cache[require.resolve('./privatebin')];
-                require('./privatebin');
-
-                // Of course you can easily decipher the following texts, if you like.
-                // Bonus points for finding their sources and hidden meanings.
-                var paste1 = $.PrivateBin.CryptTool.decipher(
-                    '6t2qsmLyfXIokNCL+3/yl15rfTUBQvm5SOnFPvNE7Q8=',
-                    // -- "That's amazing. I've got the same combination on my luggage."
-                    Array.apply(0, Array(6)).map(function(_,b) { return b + 1; }).join(''),
-                    '{"iv":"aTnR2qBL1CAmLX8FdWe3VA==","v":1,"iter":10000,"ks":256,"ts":128,"mode":"gcm","adata":"","cipher":"aes","salt":"u0lQvePq6L0=","ct":"A3nBTvICZtYy6xqbIJE0c8Veored5lMJUGgGUm4581wjrPFlU0Q0tUZSf+RUUoZj2jqDa4kiyyZ5YNMe30hNMV0oVSalNhRgD9svVMnPuF162IbyhVCwr7ULjT981CHxVlGNqGqmIU6L/XixgdArxAA8x1GCrfAkBWWGeq8Qw5vJPG/RCHpwR4Wy3azrluqeyERBzmaOQjO/kM35TiI6IrLYFyYyL7upYlxAaxS0XBMZvN8QU8Lnerwvh5JVC6OkkKrhogajTJIKozCF79yI78c50LUh7tTuI3Yoh7+fXxhoODvQdYFmoiUlrutN7Y5ZMRdITvVu8fTYtX9c7Fiufmcq5icEimiHp2g1bvfpOaGOsFT+XNFgC9215jcp5mpBdN852xs7bUtw+nDrf+LsDEX6iRpRZ+PYgLDN5xQT1ByEtYbeP+tO38pnx72oZdIB3cj8UkOxnxdNiZM5YB5egn4jUj1fHot1I69WoTiUJipZ5PIATv7ScymRB+AYzjxjurQ9lVfX9QtAbEH2dhdmoUo3IDRSXpWNCe9RC1aUIyWfZO7oI7FEohNscHNTLEcT+wFnFUPByLlXmjNZ7FKeNpvUm3jTY4t4sbZH8o2dUl624PAw1INcJ6FKqWGWwoFT2j1MYC+YV/LkLTdjuWfayvwLMh27G/FfKCRbW36vqinegqpPDylsx9+3oFkEw3y5Z8+44oN91rE/4Md7JhPJeRVlFC9TNCj4dA+EVhbbQqscvSnIH2uHkMw7mNNo7xba/YT9KoPDaniqnYqb+q2pX1WNWE7dLS2wfroMAS3kh8P22DAV37AeiNoD2PcI6ZcHbRdPa+XRrRcJhSPPW7UQ0z4OvBfjdu/w390QxAxSxvZewoh49fKKB6hTsRnZb4tpHkjlww=="}'
-                ),
-                paste2 = $.PrivateBin.CryptTool.decipher(
-                    's9pmKZKOBN7EVvHpTA8jjLFH3Xlz/0l8lB4+ONPACrM=',
-                    '', // no password
-                    '{"iv":"Z7lAZQbkrqGMvruxoSm6Pw==","v":1,"iter":10000,"ks":256,"ts":128,"mode":"gcm","adata":"","cipher":"aes","salt":"jN6CjbQMJCM=","ct":"PuOPWB3i2FPcreSrLYeQf84LdE8RHjsc+MGtiOr4b7doNyWKYtkNorbRadxaPnEee2/Utrp1MIIfY5juJSy8RGwEPX5ciWcYe6EzsXWznsnvhmpKNj9B7eIIrfSbxfy8E2e/g7xav1nive+ljToka3WT1DZ8ILQd/NbnJeHWaoSEOfvz8+d8QJPb1tNZvs7zEY95DumQwbyOsIMKAvcZHJ9OJNpujXzdMyt6DpcFcqlldWBZ/8q5rAUTw0HNx/rCgbhAxRYfNoTLIcMM4L0cXbPSgCjwf5FuO3EdE13mgEDhcClW79m0QvcnIh8xgzYoxLbp0+AwvC/MbZM8savN/0ieWr2EKkZ04ggiOIEyvfCUuNprQBYO+y8kKduNEN6by0Yf4LRCPfmwN+GezDLuzTnZIMhPbGqUAdgV6ExqK2ULEEIrQEMoOuQIxfoMhqLlzG79vXGt2O+BY+4IiYfvmuRLks4UXfyHqxPXTJg48IYbGs0j4TtJPUgp3523EyYLwEGyVTAuWhYAmVIwd/hoV7d7tmfcF73w9dufDFI3LNca2KxzBnWNPYvIZKBwWbq8ncxkb191dP6mjEi7NnhqVk5A6vIBbu4AC5PZf76l6yep4xsoy/QtdDxCMocCXeAML9MQ9uPQbuspOKrBvMfN5igA1kBqasnxI472KBNXsdZnaDddSVUuvhTcETM="}'
-                );
-
-                global.Base64 = newBase64;
-                jsdom();
-                delete require.cache[require.resolve('./privatebin')];
-                require('./privatebin');
-                if (!paste1.includes('securely packed in iron') || !paste2.includes('Sol is right')) {
-                    throw Error('v1 (SJCL based) pastes could not be deciphered');
-                }
-            }
-        );
-    });
-
-    describe('isEntropyReady & addEntropySeedListener', function () {
-        it(
-            'lets us know that enough entropy is collected or make us wait for it',
-            function(done) {
-                if ($.PrivateBin.CryptTool.isEntropyReady()) {
-                    done();
-                } else {
-                    $.PrivateBin.CryptTool.addEntropySeedListener(function() {
-                        done();
-                    });
-                }
-            }
-        );
-    });
-
-    describe('getSymmetricKey', function () {
-        var keys = [];
-
-        // the parameter is used to ensure the test is run more then one time
-        jsc.property(
-            'returns random, non-empty keys',
-            'nat',
-            function(n) {
-                var key = $.PrivateBin.CryptTool.getSymmetricKey(),
-                    result = (key !== '' && keys.indexOf(key) === -1);
-                keys.push(key);
-                return result;
-            }
-        );
-    });
-
-    describe('Base64.js vs SJCL.js vs abab.js', function () {
-        jsc.property(
-            'these all return the same base64 string',
-            'string',
-            function(string) {
-                var base64 = Base64.toBase64(string),
-                    sjcl = global.sjcl.codec.base64.fromBits(global.sjcl.codec.utf8String.toBits(string)),
-                    abab = window.btoa(Base64.utob(string));
-                return base64 === sjcl && sjcl === abab;
-            }
-        );
-    });
-});
-
-describe('Model', function () {
-    describe('getPasteId', function () {
-        before(function () {
-            $.PrivateBin.Model.reset();
-            cleanup();
-        });
-
-        jsc.property(
-            'returns the query string without separator, if any',
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.nearray(jsc.elements(queryString)),
-            'string',
-            function (schema, address, query, fragment) {
-                var queryString = query.join(''),
-                    clean = jsdom('', {
-                        url: schema.join('') + '://' + address.join('') +
-                             '/?' + queryString + '#' + fragment
-                    }),
-                    result = $.PrivateBin.Model.getPasteId();
-                $.PrivateBin.Model.reset();
-                clean();
-                return queryString === result;
-            }
-        );
-        jsc.property(
-            'throws exception on empty query string',
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.nearray(jsc.elements(a2zString)),
-            'string',
-            function (schema, address, fragment) {
-                var clean = jsdom('', {
-                        url: schema.join('') + '://' + address.join('') +
-                             '/#' + fragment
-                    }),
-                    result = false;
-                try {
-                    $.PrivateBin.Model.getPasteId();
-                }
-                catch(err) {
-                    result = true;
-                }
-                $.PrivateBin.Model.reset();
-                clean();
-                return result;
-            }
-        );
-    });
-
-    describe('getPasteKey', function () {
-        jsc.property(
-            'returns the fragment of the URL',
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.array(jsc.elements(queryString)),
-            jsc.nearray(jsc.elements(base64String)),
-            function (schema, address, query, fragment) {
-                var fragmentString = fragment.join(''),
-                    clean = jsdom('', {
-                        url: schema.join('') + '://' + address.join('') +
-                             '/?' + query.join('') + '#' + fragmentString
-                    }),
-                    result = $.PrivateBin.Model.getPasteKey();
-                $.PrivateBin.Model.reset();
-                clean();
-                return fragmentString === result;
-            }
-        );
-        jsc.property(
-            'returns the fragment stripped of trailing query parts',
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.array(jsc.elements(queryString)),
-            jsc.nearray(jsc.elements(base64String)),
-            jsc.array(jsc.elements(queryString)),
-            function (schema, address, query, fragment, trail) {
-                var fragmentString = fragment.join(''),
-                    clean = jsdom('', {
-                        url: schema.join('') + '://' + address.join('') + '/?' +
-                             query.join('') + '#' + fragmentString + '&' + trail.join('')
-                    }),
-                    result = $.PrivateBin.Model.getPasteKey();
-                $.PrivateBin.Model.reset();
-                clean();
-                return fragmentString === result;
-            }
-        );
-        jsc.property(
-            'throws exception on empty fragment of the URL',
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.nearray(jsc.elements(a2zString)),
-            jsc.array(jsc.elements(queryString)),
-            function (schema, address, query) {
-                var clean = jsdom('', {
-                        url: schema.join('') + '://' + address.join('') +
-                             '/?' + query.join('')
-                    }),
-                    result = false;
-                try {
-                    $.PrivateBin.Model.getPasteKey();
-                }
-                catch(err) {
-                    result = true;
-                }
-                $.PrivateBin.Model.reset();
-                clean();
-                return result;
-            }
-        );
-    });
-});

js/test/Alert.js

@@ -0,0 +1,226 @@
+'use strict';
+var common = require('../common');
+
+describe('Alert', function () {
+    describe('showStatus', function () {
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'shows a status message',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (icon, message) {
+                icon = icon.join('');
+                message = message.join('');
+                var expected = '<div id="status" role="alert" ' +
+                    'class="statusmessage alert alert-info"><span ' +
+                    'class="glyphicon glyphicon-' + icon +
+                    '" aria-hidden="true"></span> ' + message + '</div>';
+                $('body').html(
+                    '<div id="status" role="alert" class="statusmessage ' +
+                    'alert alert-info hidden"><span class="glyphicon ' +
+                    'glyphicon-info-sign" aria-hidden="true"></span> </div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showStatus(message, icon);
+                var result = $('body').html();
+                return expected === result;
+            }
+        );
+    });
+
+    describe('showError', function () {
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'shows an error message',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (icon, message) {
+                icon = icon.join('');
+                message = message.join('');
+                var expected = '<div id="errormessage" role="alert" ' +
+                    'class="statusmessage alert alert-danger"><span ' +
+                    'class="glyphicon glyphicon-' + icon +
+                    '" aria-hidden="true"></span> ' + message + '</div>';
+                $('body').html(
+                    '<div id="errormessage" role="alert" class="statusmessage ' +
+                    'alert alert-danger hidden"><span class="glyphicon ' +
+                    'glyphicon-alert" aria-hidden="true"></span> </div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showError(message, icon);
+                var result = $('body').html();
+                return expected === result;
+            }
+        );
+    });
+
+    describe('showRemaining', function () {
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'shows remaining time',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            'integer',
+            function (message, string, number) {
+                message = message.join('');
+                string = string.join('');
+                var expected = '<div id="remainingtime" role="alert" ' +
+                    'class="alert alert-info"><span ' +
+                    'class="glyphicon glyphicon-fire" aria-hidden="true">' +
+                    '</span> ' + string + message + number + '</div>';
+                $('body').html(
+                    '<div id="remainingtime" role="alert" class="hidden ' +
+                    'alert alert-info"><span class="glyphicon ' +
+                    'glyphicon-fire" aria-hidden="true"></span> </div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showRemaining(['%s' + message + '%d', string, number]);
+                var result = $('body').html();
+                return expected === result;
+            }
+        );
+    });
+
+    describe('showLoading', function () {
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'shows a loading message',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (message, icon) {
+                message = message.join('');
+                icon = icon.join('');
+                var defaultMessage = 'Loading…';
+                if (message.length === 0) {
+                    message = defaultMessage;
+                }
+                var expected = '<ul class="nav navbar-nav"><li ' +
+                    'id="loadingindicator" class="navbar-text"><span ' +
+                    'class="glyphicon glyphicon-' + icon +
+                    '" aria-hidden="true"></span> ' + message + '</li></ul>';
+                $('body').html(
+                    '<ul class="nav navbar-nav"><li id="loadingindicator" ' +
+                    'class="navbar-text hidden"><span class="glyphicon ' +
+                    'glyphicon-time" aria-hidden="true"></span> ' +
+                    defaultMessage + '</li></ul>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showLoading(message, icon);
+                var result = $('body').html();
+                return expected === result;
+            }
+        );
+    });
+
+    describe('hideLoading', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'hides the loading message',
+            function() {
+                $('body').html(
+                    '<ul class="nav navbar-nav"><li id="loadingindicator" ' +
+                    'class="navbar-text"><span class="glyphicon ' +
+                    'glyphicon-time" aria-hidden="true"></span> ' +
+                    'Loading…</li></ul>'
+                );
+                $('body').addClass('loading');
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.hideLoading();
+                assert.ok(
+                    !$('body').hasClass('loading') &&
+                    $('#loadingindicator').hasClass('hidden')
+                );
+            }
+        );
+    });
+
+    describe('hideMessages', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'hides all messages',
+            function() {
+                $('body').html(
+                    '<div id="status" role="alert" class="statusmessage ' +
+                    'alert alert-info"><span class="glyphicon ' +
+                    'glyphicon-info-sign" aria-hidden="true"></span> </div>' +
+                    '<div id="errormessage" role="alert" class="statusmessage ' +
+                    'alert alert-danger"><span class="glyphicon ' +
+                    'glyphicon-alert" aria-hidden="true"></span> </div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.hideMessages();
+                assert.ok(
+                    $('#status').hasClass('hidden') &&
+                    $('#errormessage').hasClass('hidden')
+                );
+            }
+        );
+    });
+
+    describe('setCustomHandler', function () {
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'calls a given handler function',
+            'nat 3',
+            jsc.array(common.jscAlnumString()),
+            function (trigger, message) {
+                message = message.join('');
+                var handlerCalled = false,
+                    defaultMessage = 'Loading…',
+                    functions = [
+                        $.PrivateBin.Alert.showStatus,
+                        $.PrivateBin.Alert.showError,
+                        $.PrivateBin.Alert.showRemaining,
+                        $.PrivateBin.Alert.showLoading
+                    ];
+                if (message.length === 0) {
+                    message = defaultMessage;
+                }
+                $('body').html(
+                    '<ul class="nav navbar-nav"><li id="loadingindicator" ' +
+                    'class="navbar-text hidden"><span class="glyphicon ' +
+                    'glyphicon-time" aria-hidden="true"></span> ' +
+                    defaultMessage + '</li></ul>' +
+                    '<div id="remainingtime" role="alert" class="hidden ' +
+                    'alert alert-info"><span class="glyphicon ' +
+                    'glyphicon-fire" aria-hidden="true"></span> </div>' +
+                    '<div id="status" role="alert" class="statusmessage ' +
+                    'alert alert-info"><span class="glyphicon ' +
+                    'glyphicon-info-sign" aria-hidden="true"></span> </div>' +
+                    '<div id="errormessage" role="alert" class="statusmessage ' +
+                    'alert alert-danger"><span class="glyphicon ' +
+                    'glyphicon-alert" aria-hidden="true"></span> </div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.setCustomHandler(function(id, $element) {
+                    handlerCalled = true;
+                    return jsc.random(0, 1) ? true : $element;
+                });
+                functions[trigger](message);
+                return handlerCalled;
+            }
+        );
+    });
+});
+

js/test/AttachmentViewer.js

@@ -0,0 +1,97 @@
+'use strict';
+var common = require('../common');
+
+describe('AttachmentViewer', function () {
+    describe('setAttachment, showAttachment, removeAttachment, hideAttachment, hideAttachmentPreview, hasAttachment, getAttachment & moveAttachmentTo', function () {
+        this.timeout(30000);
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'displays & hides data as requested',
+            common.jscMimeTypes(),
+            jsc.nearray(common.jscBase64String()),
+            'string',
+            'string',
+            'string',
+            function (mimeType, base64, filename, prefix, postfix) {
+                var clean = jsdom(),
+                    data = 'data:' + mimeType + ';base64,' + base64.join(''),
+                    previewSupported = (
+                        mimeType.substring(0, 6) === 'image/' ||
+                        mimeType.substring(0, 6) === 'audio/' ||
+                        mimeType.substring(0, 6) === 'video/' ||
+                        mimeType.match(/\/pdf/i)
+                    ),
+                    results = [];
+                prefix = prefix.replace(/%(s|d)/g, '%%');
+                postfix = postfix.replace(/%(s|d)/g, '%%');
+                $('body').html(
+                    '<div id="attachment" role="alert" class="hidden alert ' +
+                    'alert-info"><span class="glyphicon glyphicon-download-' +
+                    'alt" aria-hidden="true"></span> <a class="alert-link">' +
+                    'Download attachment</a></div><div id="attachmentPrevie' +
+                    'w" class="hidden"></div>'
+                );
+                $.PrivateBin.AttachmentViewer.init();
+                results.push(
+                    !$.PrivateBin.AttachmentViewer.hasAttachment() &&
+                    $('#attachment').hasClass('hidden') &&
+                    $('#attachmentPreview').hasClass('hidden')
+                );
+                if (filename.length) {
+                    $.PrivateBin.AttachmentViewer.setAttachment(data, filename);
+                } else {
+                    $.PrivateBin.AttachmentViewer.setAttachment(data);
+                }
+                var attachment = $.PrivateBin.AttachmentViewer.getAttachment();
+                results.push(
+                    $.PrivateBin.AttachmentViewer.hasAttachment() &&
+                    $('#attachment').hasClass('hidden') &&
+                    $('#attachmentPreview').hasClass('hidden') &&
+                    attachment[0] === data &&
+                    attachment[1] === filename
+                );
+                $.PrivateBin.AttachmentViewer.showAttachment();
+                results.push(
+                    !$('#attachment').hasClass('hidden') &&
+                    (previewSupported ? !$('#attachmentPreview').hasClass('hidden') : $('#attachmentPreview').hasClass('hidden'))
+                );
+                $.PrivateBin.AttachmentViewer.hideAttachment();
+                results.push(
+                    $('#attachment').hasClass('hidden') &&
+                    (previewSupported ? !$('#attachmentPreview').hasClass('hidden') : $('#attachmentPreview').hasClass('hidden'))
+                );
+                if (previewSupported) {
+                    $.PrivateBin.AttachmentViewer.hideAttachmentPreview();
+                    results.push($('#attachmentPreview').hasClass('hidden'));
+                }
+                $.PrivateBin.AttachmentViewer.showAttachment();
+                results.push(
+                    !$('#attachment').hasClass('hidden') &&
+                    (previewSupported ? !$('#attachmentPreview').hasClass('hidden') : $('#attachmentPreview').hasClass('hidden'))
+                );
+                var element = $('<div></div>');
+                $.PrivateBin.AttachmentViewer.moveAttachmentTo(element, prefix + '%s' + postfix);
+                if (filename.length) {
+                    results.push(
+                        element.children()[0].href === data &&
+                        element.children()[0].getAttribute('download') === filename &&
+                        element.children()[0].text === prefix + filename + postfix
+                    );
+                } else {
+                    results.push(element.children()[0].href === data);
+                }
+                $.PrivateBin.AttachmentViewer.removeAttachment();
+                results.push(
+                    $('#attachment').hasClass('hidden') &&
+                    $('#attachmentPreview').hasClass('hidden')
+                );
+                clean();
+                return results.every(element => element);
+            }
+        );
+    });
+});
+

js/test/CryptTool.js

@@ -0,0 +1,207 @@
+'use strict';
+require('../common');
+
+describe('CryptTool', function () {
+    describe('cipher & decipher', function () {
+        this.timeout(30000);
+        it('can en- and decrypt any message', function () {
+            jsc.check(jsc.forall(
+                'string',
+                'string',
+                'string',
+                function (key, password, message) {
+                    return message === $.PrivateBin.CryptTool.decipher(
+                        key,
+                        password,
+                        $.PrivateBin.CryptTool.cipher(key, password, message)
+                    );
+                }
+            ),
+            // reducing amount of checks as running 100 takes about 5 minutes
+            {tests: 5, quiet: true});
+        });
+
+        // The below static unit tests are included to ensure deciphering of "classic"
+        // SJCL based pastes still works
+        it(
+            'supports PrivateBin v1 ciphertext (SJCL & Base64 2.1.9)',
+            function () {
+                // Of course you can easily decipher the following texts, if you like.
+                // Bonus points for finding their sources and hidden meanings.
+                var paste1 = $.PrivateBin.CryptTool.decipher(
+                    '6t2qsmLyfXIokNCL+3/yl15rfTUBQvm5SOnFPvNE7Q8=',
+                    // -- "That's amazing. I've got the same combination on my luggage."
+                    Array.apply(0, Array(6)).map(function(_,b) { return b + 1; }).join(''),
+                    '{"iv":"4HNFIl7eYbCh6HuShctTIA==","v":1,"iter":10000,"ks"' +
+                    ':256,"ts":128,"mode":"gcm","adata":"","cipher":"aes","sa' +
+                    'lt":"u0lQvePq6L0=","ct":"fGPUVrDyaVr1ZDGb+kqQ3CPEW8x4YKG' +
+                    'fzHDmA0Vjkh250aWNe7Cnigkps9aaFVMX9AaerrTp3yZbojJtNqVGMfL' +
+                    'dUTu+53xmZHqRKxCCqSfDNSNoW4Oxk5OVgAtRyuG4bXHDsWTXDNz2xce' +
+                    'qzVFqhkwTwlUchrV7uuFK/XUKTNjPFM744moivIcBbfM2FOeKlIFs8RY' +
+                    'PYuvqQhp2rMLlNGwwKh//4kykQsHMQDeSDuJl8stMQzgWR/btUBZuwNZ' +
+                    'EydkMH6IPpTdf5WTSrZ+wC2OK0GutCm4UaEe6txzaTMfu+WRVu4PN6q+' +
+                    'N+2zljWJ1XdpVcN/i0Sv4QVMym0Xa6y0eccEhj/69o47PmExmMMeEwEx' +
+                    'ImPalMNT9JUSiZdOZJ/GdzwrwoIuq1mdQR6vSH+XJ/8jXJQ7bjjJVJYX' +
+                    'TcT0Di5jixArI2Kpp1GGlGVFbLgPugwU1wczg+byqeDOAECXRRnQcoge' +
+                    'aJtVcRwXwfy4j3ORFcblYMilxyHqKBewcYPRVBGtBs50cVjSIkAfR84r' +
+                    'nc1nfvnxK/Gmm+4VBNHI6ODWNpRolVMCzXjbKYnV3Are5AgSpsTqaGl4' +
+                    '1VJGpcco6cAwi4K0Bys1seKR+bLSdUgqRrkEqSRSdu3/VTu9HhEk8an0' +
+                    'rjTE4CBB5/LMn16p0TGLoOb32odKFIEtpanVvLjeyiVMvSxcgYLNnTi/' +
+                    '5FiaAC4pJxRD+AZHedU1FICUeEXxIcac/4E5qjkHjX9SpQtLl80QLIVn' +
+                    'jNliZm7QLB/nKu7W8Jb0+/CiTdV3Q9LhxlH4ciprnX+W0B00BKYFHnL9' +
+                    'jRVzKdXhf1EHydbXMAfpCjHAXIVCkFakJinQBDIIw/SC6Yig0u0ddEID' +
+                    '2B7LYAP1iE4RZwzTrxCB+ke2jQr8c20Jj6u6ShFOPC9DCw9XupZ4HAal' +
+                    'VG00kSgjus+b8zrVji3/LKEhb4EBzp1ctBJCFTeXwej8ZETLoXTylev5' +
+                    'dlwZSYAbuBPPcbFR/xAIPx3uDabd1E1gTqUc68ICIGhd197Mb2eRWiSv' +
+                    'Hr5SPsASerMxId6XA6+iQlRiI+NDR+TGVNmCnfxSlyPFMOHGTmslXOGI' +
+                    'qGfBR8l4ft8YVZ70lCwmwTuViGc75ULSf9mM57/LmRzQFMYQtvI8IFK9' +
+                    'JaQEMY5xz0HLtR4iyQUUdwR9e0ytBNdWF2a2WPDEnJuY/QJo4GzTlgv4' +
+                    'QUxMXI5htsn2rf0HxCFu7Po8DNYLxTS+67hYjDIYWYaEIc8LXWMLyDm9' +
+                    'C5fARPJ4F2BIWgzgzkNj+dVjusft2XnziamWdbS5u3kuRlVuz5LQj+R5' +
+                    'imnqQAincdZTkTT1nYx+DatlOLllCYIHffpI="}'
+                ),
+                paste2 = $.PrivateBin.CryptTool.decipher(
+                    's9pmKZKOBN7EVvHpTA8jjLFH3Xlz/0l8lB4+ONPACrM=',
+                    '', // no password
+                    '{"iv":"WA42mdxIVXUwBqZu7JYNiw==","v":1,"iter":10000,"ks"' +
+                    ':256,"ts":128,"mode":"gcm","adata":"","cipher":"aes","sa' +
+                    'lt":"jN6CjbQMJCM=","ct":"kYYMo5DFG1+w0UHiYXT5pdV0IUuXxzO' +
+                    'lslkW/c3DRCbGFROCVkAskHce7HoRczee1N9c5MhHjVMJUIZE02qIS8U' +
+                    'yHdJ/GqcPVidTUcj9rnDNWsTXkjVv8jCwHS/cwmAjDTWpwp5ThECN+ov' +
+                    '/wNp/NdtTj8Qj7f/T3rfZIOCWfwLH9s4Des35UNcUidfPTNQ1l0Gm0X+' +
+                    'r98CCUSYZjQxkZc6hRZBLPQ8EaNVooUwd5eP4GiYlmSDNA0wOSA+5isP' +
+                    'YxomVCt+kFf58VBlNhpfNi7BLYAUTPpXT4SfH5drR9+C7NTeZ+tTCYjb' +
+                    'U94PzYItOpu8vgnB1/a6BAM5h3m9w+giUb0df4hgTWeZnZxLjo5BN8WV' +
+                    '+kdTXMj3/Vv0gw0DQrDcCuX/cBAjpy3lQGwlAN1vXoOIyZJUjMpQRrOL' +
+                    'dKvLB+zcmVNtGDbgnfP2IYBzk9NtodpUa27ne0T0ZpwOPlVwevsIVZO2' +
+                    '24WLa+iQmmHOWDFFpVDlS0t0fLfOk7Hcb2xFsTxiCIiyKMho/IME1Du3' +
+                    'X4e6BVa3hobSSZv0rRtNgY1KcyYPrUPW2fxZ+oik3y9SgGvb7XpjVIta' +
+                    '8DWlDWRfZ9kzoweWEYqz9IA8Xd373RefpyuWI25zlHoX3nwljzsZU6dC' +
+                    '//h/Dt2DNr+IAvKO3+u23cWoB9kgcZJ2FJuqjLvVfCF+OWcig7zs2pTY' +
+                    'JW6Rg6lqbBCxiUUlae6xJrjfv0pzD2VYCLY7v1bVTagppwKzNI3WaluC' +
+                    'OrdDYUCxUSe56yd1oAoLPRVbYvomRboUO6cjQhEknERyvt45og2kORJO' +
+                    'EJayHW+jZgR0Y0jM3Nk17ubpij2gHxNx9kiLDOiCGSV5mn9mV7qd3HHc' +
+                    'OMSykiBgbyzjobi96LT2dIGLeDXTIdPOog8wyobO4jWq0GGs0vBB8oSY' +
+                    'XhHvixZLcSjX2KQuHmEoWzmJcr3DavdoXZmAurGWLKjzEdJc5dSD/eNr' +
+                    '99gjHX7wphJ6umKMM+fn6PcbYJkhDh2GlJL5COXjXfm/5aj/vuyaRRWZ' +
+                    'MZtmnYpGAtAPg7AUG"}'
+                );
+
+                assert.ok(
+                    paste1.includes('securely packed in iron') &&
+                    paste2.includes('Sol is right')
+                );
+            }
+        );
+
+        it(
+            'supports ZeroBin ciphertext (SJCL & Base64 1.7)',
+            function () {
+                var newBase64 = global.Base64;
+                global.Base64 = require('../base64-1.7').Base64;
+                jsdom();
+                delete require.cache[require.resolve('../privatebin')];
+                require('../privatebin');
+
+                // Of course you can easily decipher the following texts, if you like.
+                // Bonus points for finding their sources and hidden meanings.
+                var paste1 = $.PrivateBin.CryptTool.decipher(
+                    '6t2qsmLyfXIokNCL+3/yl15rfTUBQvm5SOnFPvNE7Q8=',
+                    // -- "That's amazing. I've got the same combination on my luggage."
+                    Array.apply(0, Array(6)).map(function(_,b) { return b + 1; }).join(''),
+                    '{"iv":"aTnR2qBL1CAmLX8FdWe3VA==","v":1,"iter":10000,"ks"' +
+                    ':256,"ts":128,"mode":"gcm","adata":"","cipher":"aes","sa' +
+                    'lt":"u0lQvePq6L0=","ct":"A3nBTvICZtYy6xqbIJE0c8Veored5lM' +
+                    'JUGgGUm4581wjrPFlU0Q0tUZSf+RUUoZj2jqDa4kiyyZ5YNMe30hNMV0' +
+                    'oVSalNhRgD9svVMnPuF162IbyhVCwr7ULjT981CHxVlGNqGqmIU6L/Xi' +
+                    'xgdArxAA8x1GCrfAkBWWGeq8Qw5vJPG/RCHpwR4Wy3azrluqeyERBzma' +
+                    'OQjO/kM35TiI6IrLYFyYyL7upYlxAaxS0XBMZvN8QU8Lnerwvh5JVC6O' +
+                    'kkKrhogajTJIKozCF79yI78c50LUh7tTuI3Yoh7+fXxhoODvQdYFmoiU' +
+                    'lrutN7Y5ZMRdITvVu8fTYtX9c7Fiufmcq5icEimiHp2g1bvfpOaGOsFT' +
+                    '+XNFgC9215jcp5mpBdN852xs7bUtw+nDrf+LsDEX6iRpRZ+PYgLDN5xQ' +
+                    'T1ByEtYbeP+tO38pnx72oZdIB3cj8UkOxnxdNiZM5YB5egn4jUj1fHot' +
+                    '1I69WoTiUJipZ5PIATv7ScymRB+AYzjxjurQ9lVfX9QtAbEH2dhdmoUo' +
+                    '3IDRSXpWNCe9RC1aUIyWfZO7oI7FEohNscHNTLEcT+wFnFUPByLlXmjN' +
+                    'Z7FKeNpvUm3jTY4t4sbZH8o2dUl624PAw1INcJ6FKqWGWwoFT2j1MYC+' +
+                    'YV/LkLTdjuWfayvwLMh27G/FfKCRbW36vqinegqpPDylsx9+3oFkEw3y' +
+                    '5Z8+44oN91rE/4Md7JhPJeRVlFC9TNCj4dA+EVhbbQqscvSnIH2uHkMw' +
+                    '7mNNo7xba/YT9KoPDaniqnYqb+q2pX1WNWE7dLS2wfroMAS3kh8P22DA' +
+                    'V37AeiNoD2PcI6ZcHbRdPa+XRrRcJhSPPW7UQ0z4OvBfjdu/w390QxAx' +
+                    'SxvZewoh49fKKB6hTsRnZb4tpHkjlww=="}'
+                ),
+                paste2 = $.PrivateBin.CryptTool.decipher(
+                    's9pmKZKOBN7EVvHpTA8jjLFH3Xlz/0l8lB4+ONPACrM=',
+                    '', // no password
+                    '{"iv":"Z7lAZQbkrqGMvruxoSm6Pw==","v":1,"iter":10000,"ks"' +
+                    ':256,"ts":128,"mode":"gcm","adata":"","cipher":"aes","sa' +
+                    'lt":"jN6CjbQMJCM=","ct":"PuOPWB3i2FPcreSrLYeQf84LdE8RHjs' +
+                    'c+MGtiOr4b7doNyWKYtkNorbRadxaPnEee2/Utrp1MIIfY5juJSy8RGw' +
+                    'EPX5ciWcYe6EzsXWznsnvhmpKNj9B7eIIrfSbxfy8E2e/g7xav1nive+' +
+                    'ljToka3WT1DZ8ILQd/NbnJeHWaoSEOfvz8+d8QJPb1tNZvs7zEY95Dum' +
+                    'QwbyOsIMKAvcZHJ9OJNpujXzdMyt6DpcFcqlldWBZ/8q5rAUTw0HNx/r' +
+                    'CgbhAxRYfNoTLIcMM4L0cXbPSgCjwf5FuO3EdE13mgEDhcClW79m0Qvc' +
+                    'nIh8xgzYoxLbp0+AwvC/MbZM8savN/0ieWr2EKkZ04ggiOIEyvfCUuNp' +
+                    'rQBYO+y8kKduNEN6by0Yf4LRCPfmwN+GezDLuzTnZIMhPbGqUAdgV6Ex' +
+                    'qK2ULEEIrQEMoOuQIxfoMhqLlzG79vXGt2O+BY+4IiYfvmuRLks4UXfy' +
+                    'HqxPXTJg48IYbGs0j4TtJPUgp3523EyYLwEGyVTAuWhYAmVIwd/hoV7d' +
+                    '7tmfcF73w9dufDFI3LNca2KxzBnWNPYvIZKBwWbq8ncxkb191dP6mjEi' +
+                    '7NnhqVk5A6vIBbu4AC5PZf76l6yep4xsoy/QtdDxCMocCXeAML9MQ9uP' +
+                    'QbuspOKrBvMfN5igA1kBqasnxI472KBNXsdZnaDddSVUuvhTcETM="}'
+                );
+
+                global.Base64 = newBase64;
+                jsdom();
+                delete require.cache[require.resolve('../privatebin')];
+                require('../privatebin');
+                assert.ok(
+                    paste1.includes('securely packed in iron') &&
+                    paste2.includes('Sol is right')
+                );
+            }
+        );
+    });
+
+    describe('isEntropyReady & addEntropySeedListener', function () {
+        it(
+            'lets us know that enough entropy is collected or make us wait for it',
+            function(done) {
+                if ($.PrivateBin.CryptTool.isEntropyReady()) {
+                    done();
+                } else {
+                    $.PrivateBin.CryptTool.addEntropySeedListener(function() {
+                        done();
+                    });
+                }
+            }
+        );
+    });
+
+    describe('getSymmetricKey', function () {
+        var keys = [];
+
+        // the parameter is used to ensure the test is run more then one time
+        jsc.property(
+            'returns random, non-empty keys',
+            function() {
+                var key = $.PrivateBin.CryptTool.getSymmetricKey(),
+                    result = (key !== '' && keys.indexOf(key) === -1);
+                keys.push(key);
+                return result;
+            }
+        );
+    });
+
+    describe('Base64.js vs SJCL.js vs abab.js', function () {
+        jsc.property(
+            'these all return the same base64 string',
+            'string',
+            function(string) {
+                var base64 = Base64.toBase64(string),
+                    sjcl = global.sjcl.codec.base64.fromBits(global.sjcl.codec.utf8String.toBits(string)),
+                    abab = window.btoa(Base64.utob(string));
+                return base64 === sjcl && sjcl === abab;
+            }
+        );
+    });
+});
+

js/test/DiscussionViewer.js

@@ -0,0 +1,116 @@
+'use strict';
+var common = require('../common');
+
+describe('DiscussionViewer', function () {
+    describe('handleNotification, prepareNewDiscussion, addComment, finishDiscussion, getReplyMessage, getReplyNickname, getReplyCommentId & highlightComment', function () {
+        this.timeout(30000);
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'displays & hides comments as requested',
+            jsc.array(
+                jsc.record({
+                    idArray: jsc.nearray(common.jscAlnumString()),
+                    parentidArray: jsc.nearray(common.jscAlnumString()),
+                    data: jsc.string,
+                    meta: jsc.record({
+                        nickname: jsc.string,
+                        postdate: jsc.nat,
+                        vizhash: jsc.string
+                    })
+                })
+            ),
+            'nat',
+            'bool',
+            'string',
+            'string',
+            jsc.elements(['loading', 'danger', 'other']),
+            'nestring',
+            function (comments, commentKey, fadeOut, nickname, message, alertType, alert) {
+                var clean = jsdom(),
+                    results = [];
+                $('body').html(
+                    '<div id="discussion"><h4>Discussion</h4>' +
+                    '<div id="commentcontainer"></div></div><div id="templates">' +
+                    '<article id="commenttemplate" class="comment">' +
+                    '<div class="commentmeta"><span class="nickname">name</span>' +
+                    '<span class="commentdate">0000-00-00</span></div>' +
+                    '<div class="commentdata">c</div>' +
+                    '<button class="btn btn-default btn-sm">Reply</button>' +
+                    '</article><p id="commenttailtemplate" class="comment">' +
+                    '<button class="btn btn-default btn-sm">Add comment</button>' +
+                    '</p><div id="replytemplate" class="reply hidden">' +
+                    '<input type="text" id="nickname" class="form-control" ' +
+                    'title="Optional nickname…" placeholder="Optional ' +
+                    'nickname…" /><textarea id="replymessage" ' +
+                    'class="replymessage form-control" cols="80" rows="7">' +
+                    '</textarea><br /><div id="replystatus" role="alert" ' +
+                    'class="statusmessage hidden alert"><span class="glyphicon" ' +
+                    'aria-hidden="true"></span> </div><button id="replybutton" ' +
+                    'class="btn btn-default btn-sm">Post comment</button></div></div>'
+                );
+                $.PrivateBin.Model.init();
+                $.PrivateBin.DiscussionViewer.init();
+                results.push(
+                    !$('#discussion').hasClass('hidden')
+                );
+                $.PrivateBin.DiscussionViewer.prepareNewDiscussion();
+                results.push(
+                    $('#discussion').hasClass('hidden')
+                );
+                comments.forEach(function (comment) {
+                    comment.id = comment.idArray.join('');
+                    comment.parentid = comment.parentidArray.join('');
+                    $.PrivateBin.DiscussionViewer.addComment(comment, comment.data, comment.meta.nickname);
+                });
+                results.push(
+                    $('#discussion').hasClass('hidden')
+                );
+                $.PrivateBin.DiscussionViewer.finishDiscussion();
+                results.push(
+                    !$('#discussion').hasClass('hidden') &&
+                    comments.length + 1 >= $('#commentcontainer').children().length
+                );
+                if (comments.length > 0) {
+                    if (commentKey >= comments.length) {
+                        commentKey = commentKey % comments.length;
+                    }
+                    $.PrivateBin.DiscussionViewer.highlightComment(comments[commentKey].id, fadeOut);
+                    results.push(
+                        $('#comment_' + comments[commentKey].id).hasClass('highlight')
+                    );
+                }
+                $('#commentcontainer').find('button')[0].click();
+                results.push(
+                    !$('#reply').hasClass('hidden')
+                );
+                $('#reply #nickname').val(nickname);
+                $('#reply #replymessage').val(message);
+                $.PrivateBin.DiscussionViewer.getReplyCommentId();
+                results.push(
+                    $.PrivateBin.DiscussionViewer.getReplyNickname() === $('#reply #nickname').val() &&
+                    $.PrivateBin.DiscussionViewer.getReplyMessage() === $('#reply #replymessage').val()
+                );
+                var notificationResult = $.PrivateBin.DiscussionViewer.handleNotification(alertType === 'other' ? alert : alertType);
+                if (alertType === 'loading') {
+                    results.push(notificationResult === false);
+                } else {
+                    results.push(
+                        alertType === 'danger' ? (
+                            notificationResult.hasClass('alert-danger') &&
+                            !notificationResult.hasClass('alert-info')
+                        ) : (
+                            !notificationResult.hasClass('alert-danger') &&
+                            notificationResult.hasClass('alert-info')
+                        )
+                    );
+                }
+                clean();
+                return results.every(element => element);
+            }
+        );
+    });
+});
+

js/test/Editor.js

@@ -0,0 +1,74 @@
+'use strict';
+require('../common');
+
+describe('Editor', function () {
+    describe('show, hide, getText, setText & isPreview', function () {
+        this.timeout(30000);
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'returns text fed into the textarea, handles editor tabs',
+            'string',
+            function (text) {
+                var clean = jsdom(),
+                    results = [];
+                $('body').html(
+                    '<ul id="editorTabs" class="nav nav-tabs hidden"><li ' +
+                    'role="presentation" class="active"><a id="messageedit" ' +
+                    'href="#">Editor</a></li><li role="presentation"><a ' +
+                    'id="messagepreview" href="#">Preview</a></li></ul><div ' +
+                    'id="placeholder" class="hidden">+++ no paste text +++</div>' +
+                    '<div id="prettymessage" class="hidden"><pre id="prettyprint" ' +
+                    'class="prettyprint linenums:1"></pre></div><div ' +
+                    'id="plaintext" class="hidden"></div><p><textarea ' +
+                    'id="message" name="message" cols="80" rows="25" ' +
+                    'class="form-control hidden"></textarea></p>'
+                );
+                $.PrivateBin.Editor.init();
+                results.push(
+                    $('#editorTabs').hasClass('hidden') &&
+                    $('#message').hasClass('hidden')
+                );
+                $.PrivateBin.Editor.show();
+                results.push(
+                    !$('#editorTabs').hasClass('hidden') &&
+                    !$('#message').hasClass('hidden')
+                );
+                $.PrivateBin.Editor.hide();
+                results.push(
+                    $('#editorTabs').hasClass('hidden') &&
+                    $('#message').hasClass('hidden')
+                );
+                $.PrivateBin.Editor.show();
+                $.PrivateBin.Editor.focusInput();
+                results.push(
+                    $.PrivateBin.Editor.getText().length === 0
+                );
+                $.PrivateBin.Editor.setText(text);
+                results.push(
+                    $.PrivateBin.Editor.getText() === $('#message').val()
+                );
+                $.PrivateBin.Editor.setText();
+                results.push(
+                    !$.PrivateBin.Editor.isPreview() &&
+                    !$('#message').hasClass('hidden')
+                );
+                $('#messagepreview').click();
+                results.push(
+                    $.PrivateBin.Editor.isPreview() &&
+                    $('#message').hasClass('hidden')
+                );
+                $('#messageedit').click();
+                results.push(
+                    !$.PrivateBin.Editor.isPreview() &&
+                    !$('#message').hasClass('hidden')
+                );
+                clean();
+                return results.every(element => element);
+            }
+        );
+    });
+});
+

js/test/Helper.js

@@ -0,0 +1,278 @@
+'use strict';
+var common = require('../common');
+
+describe('Helper', function () {
+    describe('secondsToHuman', function () {
+        after(function () {
+            cleanup();
+        });
+
+        jsc.property('returns an array with a number and a word', 'integer', function (number) {
+            var result = $.PrivateBin.Helper.secondsToHuman(number);
+            return Array.isArray(result) &&
+                result.length === 2 &&
+                result[0] === parseInt(result[0], 10) &&
+                typeof result[1] === 'string';
+        });
+        jsc.property('returns seconds on the first array position', 'integer 59', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[0] === number;
+        });
+        jsc.property('returns seconds on the second array position', 'integer 59', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'second';
+        });
+        jsc.property('returns minutes on the first array position', 'integer 60 3599', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[0] === Math.floor(number / 60);
+        });
+        jsc.property('returns minutes on the second array position', 'integer 60 3599', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'minute';
+        });
+        jsc.property('returns hours on the first array position', 'integer 3600 86399', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[0] === Math.floor(number / (60 * 60));
+        });
+        jsc.property('returns hours on the second array position', 'integer 3600 86399', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'hour';
+        });
+        jsc.property('returns days on the first array position', 'integer 86400 5184000', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[0] === Math.floor(number / (60 * 60 * 24));
+        });
+        jsc.property('returns days on the second array position', 'integer 86400 5184000', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'day';
+        });
+        // max safe integer as per http://ecma262-5.com/ELS5_HTML.htm#Section_8.5
+        jsc.property('returns months on the first array position', 'integer 5184000 9007199254740991', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[0] === Math.floor(number / (60 * 60 * 24 * 30));
+        });
+        jsc.property('returns months on the second array position', 'integer 5184000 9007199254740991', function (number) {
+            return $.PrivateBin.Helper.secondsToHuman(number)[1] === 'month';
+        });
+    });
+
+    // this test is not yet meaningful using jsdom, as it does not contain getSelection support.
+    // TODO: This needs to be tested using a browser.
+    describe('selectText', function () {
+        this.timeout(30000);
+        jsc.property(
+            'selection contains content of given ID',
+            jsc.nearray(jsc.nearray(common.jscAlnumString())),
+            'nearray string',
+            function (ids, contents) {
+                var html = '',
+                    result = true;
+                ids.forEach(function(item, i) {
+                    html += '<div id="' + item.join('') + '">' + common.htmlEntities(contents[i] || contents[0]) + '</div>';
+                });
+                var clean = jsdom(html);
+                // TODO: As per https://github.com/tmpvar/jsdom/issues/321 there is no getSelection in jsdom, yet.
+                // Once there is one, uncomment the block below to actually check the result.
+                /*
+                ids.forEach(function(item, i) {
+                    $.PrivateBin.Helper.selectText(item.join(''));
+                    result *= (contents[i] || contents[0]) === window.getSelection().toString();
+                });
+                */
+                clean();
+                return Boolean(result);
+            }
+        );
+    });
+
+    describe('urls2links', function () {
+        after(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'ignores non-URL content',
+            'string',
+            function (content) {
+                return content === $.PrivateBin.Helper.urls2links(content);
+            }
+        );
+        jsc.property(
+            'replaces URLs with anchors',
+            'string',
+            jsc.elements(['http', 'https', 'ftp']),
+            jsc.nearray(common.jscA2zString()),
+            jsc.array(common.jscQueryString()),
+            jsc.array(common.jscQueryString()),
+            'string',
+            function (prefix, schema, address, query, fragment, postfix) {
+                var query = query.join(''),
+                    fragment = fragment.join(''),
+                    url = schema + '://' + address.join('') + '/?' + query + '#' + fragment,
+                    prefix = common.htmlEntities(prefix),
+                    postfix = ' ' + common.htmlEntities(postfix);
+
+                // special cases: When the query string and fragment imply the beginning of an HTML entity, eg. &#0 or &#x
+                if (
+                    query.slice(-1) === '&' &&
+                    (parseInt(fragment.substring(0, 1), 10) >= 0 || fragment.charAt(0) === 'x' )
+                )
+                {
+                    url = schema + '://' + address.join('') + '/?' + query.substring(0, query.length - 1);
+                    postfix = '';
+                }
+
+                return prefix + '<a href="' + url + '" rel="nofollow">' + url + '</a>' + postfix === $.PrivateBin.Helper.urls2links(prefix + url + postfix);
+            }
+        );
+        jsc.property(
+            'replaces magnet links with anchors',
+            'string',
+            jsc.array(common.jscQueryString()),
+            'string',
+            function (prefix, query, postfix) {
+                var url = 'magnet:?' + query.join('').replace(/^&+|&+$/gm,''),
+                    prefix = common.htmlEntities(prefix),
+                    postfix = common.htmlEntities(postfix);
+                return prefix + '<a href="' + url + '" rel="nofollow">' + url + '</a> ' + postfix === $.PrivateBin.Helper.urls2links(prefix + url + ' ' + postfix);
+            }
+        );
+    });
+
+    describe('sprintf', function () {
+        after(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'replaces %s in strings with first given parameter',
+            'string',
+            '(small nearray) string',
+            'string',
+            function (prefix, params, postfix) {
+                prefix    =    prefix.replace(/%(s|d)/g, '%%');
+                params[0] = params[0].replace(/%(s|d)/g, '%%');
+                postfix   =   postfix.replace(/%(s|d)/g, '%%');
+                var result = prefix + params[0] + postfix;
+                params.unshift(prefix + '%s' + postfix);
+                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
+            }
+        );
+        jsc.property(
+            'replaces %d in strings with first given parameter',
+            'string',
+            '(small nearray) nat',
+            'string',
+            function (prefix, params, postfix) {
+                prefix  =  prefix.replace(/%(s|d)/g, '%%');
+                postfix = postfix.replace(/%(s|d)/g, '%%');
+                var result = prefix + params[0] + postfix;
+                params.unshift(prefix + '%d' + postfix);
+                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
+            }
+        );
+        jsc.property(
+            'replaces %d in strings with 0 if first parameter is not a number',
+            'string',
+            '(small nearray) falsy',
+            'string',
+            function (prefix, params, postfix) {
+                prefix  =  prefix.replace(/%(s|d)/g, '%%');
+                postfix = postfix.replace(/%(s|d)/g, '%%');
+                var result = prefix + '0' + postfix;
+                params.unshift(prefix + '%d' + postfix);
+                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
+            }
+        );
+        jsc.property(
+            'replaces %d and %s in strings in order',
+            'string',
+            'nat',
+            'string',
+            'string',
+            'string',
+            function (prefix, uint, middle, string, postfix) {
+                prefix  =  prefix.replace(/%(s|d)/g, '%%');
+                middle  =  middle.replace(/%(s|d)/g, '%%');
+                postfix = postfix.replace(/%(s|d)/g, '%%');
+                var params = [prefix + '%d' + middle + '%s' + postfix, uint, string],
+                    result = prefix + uint + middle + string + postfix;
+                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
+            }
+        );
+        jsc.property(
+            'replaces %d and %s in strings in reverse order',
+            'string',
+            'nat',
+            'string',
+            'string',
+            'string',
+            function (prefix, uint, middle, string, postfix) {
+                prefix  =  prefix.replace(/%(s|d)/g, '%%');
+                middle  =  middle.replace(/%(s|d)/g, '%%');
+                postfix = postfix.replace(/%(s|d)/g, '%%');
+                var params = [prefix + '%s' + middle + '%d' + postfix, string, uint],
+                    result = prefix + string + middle + uint + postfix;
+                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
+            }
+        );
+    });
+
+    describe('getCookie', function () {
+        this.timeout(30000);
+        jsc.property(
+            'returns the requested cookie',
+            'nearray asciinestring',
+            'nearray asciistring',
+            function (labels, values) {
+                var selectedKey = '', selectedValue = '',
+                    cookieArray = [];
+                labels.forEach(function(item, i) {
+                    // deliberatly using a non-ascii key for replacing invalid characters
+                    var key = item.replace(/[\s;,=]/g, Array(i+2).join('£')),
+                        value = (values[i] || values[0]).replace(/[\s;,=]/g, '');
+                    cookieArray.push(key + '=' + value);
+                    if (Math.random() < 1 / i || selectedKey === key)
+                    {
+                        selectedKey = key;
+                        selectedValue = value;
+                    }
+                });
+                var clean = jsdom('', {cookie: cookieArray}),
+                    result = $.PrivateBin.Helper.getCookie(selectedKey);
+                clean();
+                return result === selectedValue;
+            }
+        );
+    });
+
+    describe('baseUri', function () {
+        this.timeout(30000);
+        before(function () {
+            $.PrivateBin.Helper.reset();
+        });
+
+        jsc.property(
+            'returns the URL without query & fragment',
+            common.jscSchemas(),
+            jsc.nearray(common.jscA2zString()),
+            jsc.array(common.jscQueryString()),
+            'string',
+            function (schema, address, query, fragment) {
+                var expected = schema + '://' + address.join('') + '/',
+                    clean = jsdom('', {url: expected + '?' + query.join('') + '#' + fragment}),
+                    result = $.PrivateBin.Helper.baseUri();
+                $.PrivateBin.Helper.reset();
+                clean();
+                return expected === result;
+            }
+        );
+    });
+
+    describe('htmlEntities', function () {
+        after(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'removes all HTML entities from any given string',
+            'string',
+            function (string) {
+                var result = common.htmlEntities(string);
+                return !(/[<>"'`=\/]/.test(result)) && !(string.indexOf('&') > -1 && !(/&amp;/.test(result)));
+            }
+        );
+    });
+});
+

js/test/I18n.js

@@ -0,0 +1,128 @@
+'use strict';
+var common = require('../common');
+
+describe('I18n', function () {
+    describe('translate', function () {
+        before(function () {
+            $.PrivateBin.I18n.reset();
+        });
+
+        jsc.property(
+            'returns message ID unchanged if no translation found',
+            'string',
+            function (messageId) {
+                messageId   = messageId.replace(/%(s|d)/g, '%%');
+                var plurals = [messageId, messageId + 's'],
+                    fake    = [messageId],
+                    result  = $.PrivateBin.I18n.translate(messageId);
+                $.PrivateBin.I18n.reset();
+
+                var alias = $.PrivateBin.I18n._(messageId);
+                $.PrivateBin.I18n.reset();
+
+                var pluralResult = $.PrivateBin.I18n.translate(plurals);
+                $.PrivateBin.I18n.reset();
+
+                var pluralAlias = $.PrivateBin.I18n._(plurals);
+                $.PrivateBin.I18n.reset();
+
+                var fakeResult = $.PrivateBin.I18n.translate(fake);
+                $.PrivateBin.I18n.reset();
+
+                var fakeAlias = $.PrivateBin.I18n._(fake);
+                $.PrivateBin.I18n.reset();
+
+                return messageId === result && messageId === alias &&
+                    messageId === pluralResult && messageId === pluralAlias &&
+                    messageId === fakeResult && messageId === fakeAlias;
+            }
+        );
+        jsc.property(
+            'replaces %s in strings with first given parameter',
+            'string',
+            '(small nearray) string',
+            'string',
+            function (prefix, params, postfix) {
+                prefix    =    prefix.replace(/%(s|d)/g, '%%');
+                params[0] = params[0].replace(/%(s|d)/g, '%%');
+                postfix   =   postfix.replace(/%(s|d)/g, '%%');
+                var translation = prefix + params[0] + postfix;
+                params.unshift(prefix + '%s' + postfix);
+                var result = $.PrivateBin.I18n.translate.apply(this, params);
+                $.PrivateBin.I18n.reset();
+                var alias = $.PrivateBin.I18n._.apply(this, params);
+                $.PrivateBin.I18n.reset();
+                return translation === result && translation === alias;
+            }
+        );
+    });
+
+    describe('getPluralForm', function () {
+        before(function () {
+            $.PrivateBin.I18n.reset();
+        });
+
+        jsc.property(
+            'returns valid key for plural form',
+            common.jscSupportedLanguages(),
+            'integer',
+            function(language, n) {
+                $.PrivateBin.I18n.reset(language);
+                var result = $.PrivateBin.I18n.getPluralForm(n);
+                // arabic seems to have the highest plural count with 6 forms
+                return result >= 0 && result <= 5;
+            }
+        );
+    });
+
+    // loading of JSON via AJAX needs to be tested in the browser, this just mocks it
+    // TODO: This needs to be tested using a browser.
+    describe('loadTranslations', function () {
+        this.timeout(30000);
+        before(function () {
+            $.PrivateBin.I18n.reset();
+        });
+
+        jsc.property(
+            'downloads and handles any supported language',
+            common.jscSupportedLanguages(),
+            function(language) {
+                var clean = jsdom('', {url: 'https://privatebin.net/', cookie: ['lang=' + language]});
+
+                $.PrivateBin.I18n.reset('en');
+                $.PrivateBin.I18n.loadTranslations();
+                $.PrivateBin.I18n.reset(language, require('../../i18n/' + language + '.json'));
+                var result = $.PrivateBin.I18n.translate('en'),
+                    alias  = $.PrivateBin.I18n._('en');
+
+                clean();
+                return language === result && language === alias;
+            }
+        );
+
+        jsc.property(
+            'should default to en',
+            function() {
+                var clean = jsdom('', {url: 'https://privatebin.net/'});
+
+                // when navigator.userLanguage is undefined and no default language
+                // is specified, it would throw an error
+                [ 'language', 'userLanguage' ].forEach(function (key) {
+                    Object.defineProperty(navigator, key, {
+                        value: undefined,
+                        writeable: false
+                    });
+                });
+
+                $.PrivateBin.I18n.reset('en');
+                $.PrivateBin.I18n.loadTranslations();
+                var result = $.PrivateBin.I18n.translate('en'),
+                    alias  = $.PrivateBin.I18n._('en');
+
+                clean();
+                return 'en' === result && 'en' === alias;
+            }
+        );
+    });
+});
+

js/test/Model.js

@@ -0,0 +1,221 @@
+'use strict';
+var common = require('../common');
+
+describe('Model', function () {
+    describe('getExpirationDefault', function () {
+        before(function () {
+            $.PrivateBin.Model.reset();
+            cleanup();
+        });
+
+        jsc.property(
+            'returns the contents of the element with id "pasteExpiration"',
+            'array asciinestring',
+            'string',
+            'small nat',
+            function (keys, value, key) {
+                keys = keys.map(common.htmlEntities);
+                value = common.htmlEntities(value);
+                var content = keys.length > key ? keys[key] : (keys.length > 0 ? keys[0] : 'null'),
+                    contents = '<select id="pasteExpiration" name="pasteExpiration">';
+                keys.forEach(function(item) {
+                    contents += '<option value="' + item + '"';
+                    if (item === content) {
+                        contents += ' selected="selected"';
+                    }
+                    contents += '>' + value + '</option>';
+                });
+                contents += '</select>';
+                $('body').html(contents);
+                var result = common.htmlEntities(
+                    $.PrivateBin.Model.getExpirationDefault()
+                );
+                $.PrivateBin.Model.reset();
+                return content === result;
+            }
+        );
+    });
+
+    describe('getFormatDefault', function () {
+        before(function () {
+            $.PrivateBin.Model.reset();
+            cleanup();
+        });
+
+        jsc.property(
+            'returns the contents of the element with id "pasteFormatter"',
+            'array asciinestring',
+            'string',
+            'small nat',
+            function (keys, value, key) {
+                keys = keys.map(common.htmlEntities);
+                value = common.htmlEntities(value);
+                var content = keys.length > key ? keys[key] : (keys.length > 0 ? keys[0] : 'null'),
+                    contents = '<select id="pasteFormatter" name="pasteFormatter">';
+                keys.forEach(function(item) {
+                    contents += '<option value="' + item + '"';
+                    if (item === content) {
+                        contents += ' selected="selected"';
+                    }
+                    contents += '>' + value + '</option>';
+                });
+                contents += '</select>';
+                $('body').html(contents);
+                var result = common.htmlEntities(
+                    $.PrivateBin.Model.getFormatDefault()
+                );
+                $.PrivateBin.Model.reset();
+                return content === result;
+            }
+        );
+    });
+
+    describe('getPasteId', function () {
+        this.timeout(30000);
+        before(function () {
+            $.PrivateBin.Model.reset();
+            cleanup();
+        });
+
+        jsc.property(
+            'returns the query string without separator, if any',
+            jsc.nearray(common.jscA2zString()),
+            jsc.nearray(common.jscA2zString()),
+            jsc.nearray(common.jscQueryString()),
+            'string',
+            function (schema, address, query, fragment) {
+                var queryString = query.join(''),
+                    clean = jsdom('', {
+                        url: schema.join('') + '://' + address.join('') +
+                             '/?' + queryString + '#' + fragment
+                    }),
+                    result = $.PrivateBin.Model.getPasteId();
+                $.PrivateBin.Model.reset();
+                clean();
+                return queryString === result;
+            }
+        );
+        jsc.property(
+            'throws exception on empty query string',
+            jsc.nearray(common.jscA2zString()),
+            jsc.nearray(common.jscA2zString()),
+            'string',
+            function (schema, address, fragment) {
+                var clean = jsdom('', {
+                        url: schema.join('') + '://' + address.join('') +
+                             '/#' + fragment
+                    }),
+                    result = false;
+                try {
+                    $.PrivateBin.Model.getPasteId();
+                }
+                catch(err) {
+                    result = true;
+                }
+                $.PrivateBin.Model.reset();
+                clean();
+                return result;
+            }
+        );
+    });
+
+    describe('getPasteKey', function () {
+        this.timeout(30000);
+        jsc.property(
+            'returns the fragment of the URL',
+            jsc.nearray(common.jscA2zString()),
+            jsc.nearray(common.jscA2zString()),
+            jsc.array(common.jscQueryString()),
+            jsc.nearray(common.jscBase64String()),
+            function (schema, address, query, fragment) {
+                var fragmentString = fragment.join(''),
+                    clean = jsdom('', {
+                        url: schema.join('') + '://' + address.join('') +
+                             '/?' + query.join('') + '#' + fragmentString
+                    }),
+                    result = $.PrivateBin.Model.getPasteKey();
+                $.PrivateBin.Model.reset();
+                clean();
+                return fragmentString === result;
+            }
+        );
+        jsc.property(
+            'returns the fragment stripped of trailing query parts',
+            jsc.nearray(common.jscA2zString()),
+            jsc.nearray(common.jscA2zString()),
+            jsc.array(common.jscQueryString()),
+            jsc.nearray(common.jscBase64String()),
+            jsc.array(common.jscQueryString()),
+            function (schema, address, query, fragment, trail) {
+                var fragmentString = fragment.join(''),
+                    clean = jsdom('', {
+                        url: schema.join('') + '://' + address.join('') + '/?' +
+                             query.join('') + '#' + fragmentString + '&' + trail.join('')
+                    }),
+                    result = $.PrivateBin.Model.getPasteKey();
+                $.PrivateBin.Model.reset();
+                clean();
+                return fragmentString === result;
+            }
+        );
+        jsc.property(
+            'throws exception on empty fragment of the URL',
+            jsc.nearray(common.jscA2zString()),
+            jsc.nearray(common.jscA2zString()),
+            jsc.array(common.jscQueryString()),
+            function (schema, address, query) {
+                var clean = jsdom('', {
+                        url: schema.join('') + '://' + address.join('') +
+                             '/?' + query.join('')
+                    }),
+                    result = false;
+                try {
+                    $.PrivateBin.Model.getPasteKey();
+                }
+                catch(err) {
+                    result = true;
+                }
+                $.PrivateBin.Model.reset();
+                clean();
+                return result;
+            }
+        );
+    });
+
+    describe('getTemplate', function () {
+        before(function () {
+            $.PrivateBin.Model.reset();
+            cleanup();
+        });
+
+        jsc.property(
+            'returns the contents of the element with id "[name]template"',
+            jsc.nearray(common.jscAlnumString()),
+            jsc.nearray(common.jscA2zString()),
+            jsc.nearray(common.jscAlnumString()),
+            function (id, element, value) {
+                id = id.join('');
+                element = element.join('');
+                value = value.join('').trim();
+
+                // <br>, <hr>, <img> and <wbr> tags can't contain strings,
+                // table tags can't be alone, so test with a <p> instead
+                if (['br', 'col', 'hr', 'img', 'tr', 'td', 'th', 'wbr'].indexOf(element) >= 0) {
+                    element = 'p';
+                }
+
+                $('body').html(
+                    '<div id="templates"><' + element + ' id="' + id +
+                    'template">' + value + '</' + element + '></div>'
+                );
+                $.PrivateBin.Model.init();
+                var template = '<' + element + ' id="' + id + '">' + value +
+                    '</' + element + '>',
+                    result = $.PrivateBin.Model.getTemplate(id).wrap('<p/>').parent().html();
+                $.PrivateBin.Model.reset();
+                return template === result;
+            }
+        );
+    });
+});
+

js/test/PasteStatus.js

@@ -0,0 +1,107 @@
+'use strict';
+var common = require('../common');
+
+describe('PasteStatus', function () {
+    describe('createPasteNotification', function () {
+        this.timeout(30000);
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'creates a notification after a successfull paste upload',
+            common.jscSchemas(),
+            jsc.nearray(common.jscA2zString()),
+            jsc.array(common.jscQueryString()),
+            'string',
+            common.jscSchemas(),
+            jsc.nearray(common.jscA2zString()),
+            jsc.array(common.jscQueryString()),
+            function (
+                schema1, address1, query1, fragment1,
+                schema2, address2, query2
+            ) {
+                var expected1 = schema1 + '://' + address1.join('') + '/?' +
+                    encodeURI(query1.join('').replace(/^&+|&+$/gm,'') + '#' + fragment1),
+                    expected2 = schema2 + '://' + address2.join('') + '/?' +
+                    encodeURI(query2.join('')),
+                    clean = jsdom();
+                $('body').html('<div><div id="deletelink"></div><div id="pastelink"></div></div>');
+                $.PrivateBin.PasteStatus.init();
+                $.PrivateBin.PasteStatus.createPasteNotification(expected1, expected2);
+                var result1 = $('#pasteurl')[0].href,
+                    result2 = $('#deletelink a')[0].href;
+                clean();
+                return result1 === expected1 && result2 === expected2;
+            }
+        );
+    });
+
+    describe('showRemainingTime', function () {
+        this.timeout(30000);
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'shows burn after reading message or remaining time',
+            'bool',
+            'nat',
+            jsc.nearray(common.jscA2zString()),
+            jsc.nearray(common.jscA2zString()),
+            jsc.nearray(common.jscQueryString()),
+            'string',
+            function (
+                burnafterreading, remainingTime,
+                schema, address, query, fragment
+            ) {
+                var clean = jsdom('', {
+                        url: schema.join('') + '://' + address.join('') +
+                             '/?' + query.join('') + '#' + fragment
+                    }),
+                    result;
+                $('body').html('<div id="remainingtime" class="hidden"></div>');
+                $.PrivateBin.PasteStatus.init();
+                $.PrivateBin.PasteStatus.showRemainingTime({
+                    'burnafterreading': burnafterreading,
+                    'remaining_time': remainingTime,
+                    'expire_date': remainingTime ? ((new Date()).getTime() / 1000) + remainingTime : 0
+                });
+                if (burnafterreading) {
+                    result = $('#remainingtime').hasClass('foryoureyesonly') &&
+                            !$('#remainingtime').hasClass('hidden');
+                } else if (remainingTime) {
+                    result =!$('#remainingtime').hasClass('foryoureyesonly') &&
+                            !$('#remainingtime').hasClass('hidden');
+                } else {
+                    result = $('#remainingtime').hasClass('hidden') &&
+                            !$('#remainingtime').hasClass('foryoureyesonly');
+                }
+                clean();
+                return result;
+            }
+        );
+    });
+
+    describe('hideMessages', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'hides all messages',
+            function() {
+                $('body').html(
+                    '<div id="remainingtime"></div><div id="pastesuccess"></div>'
+                );
+                $.PrivateBin.PasteStatus.init();
+                $.PrivateBin.PasteStatus.hideMessages();
+                assert.ok(
+                    $('#remainingtime').hasClass('hidden') &&
+                    $('#pastesuccess').hasClass('hidden')
+                );
+            }
+        );
+    });
+});
+

js/test/PasteViewer.js

@@ -0,0 +1,121 @@
+'use strict';
+var common = require('../common');
+
+describe('PasteViewer', function () {
+    describe('run, hide, getText, setText, getFormat, setFormat & isPrettyPrinted', function () {
+        this.timeout(30000);
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'displays text according to format',
+            common.jscFormats(),
+            'nestring',
+            function (format, text) {
+                var clean = jsdom(),
+                    results = [];
+                $('body').html(
+                    '<div id="placeholder" class="hidden">+++ no paste text ' +
+                    '+++</div><div id="prettymessage" class="hidden"><pre ' +
+                    'id="prettyprint" class="prettyprint linenums:1"></pre>' +
+                    '</div><div id="plaintext" class="hidden"></div>'
+                );
+                $.PrivateBin.PasteViewer.init();
+                $.PrivateBin.PasteViewer.setFormat(format);
+                $.PrivateBin.PasteViewer.setText('');
+                results.push(
+                    $('#placeholder').hasClass('hidden') &&
+                    $('#prettymessage').hasClass('hidden') &&
+                    $('#plaintext').hasClass('hidden') &&
+                    $.PrivateBin.PasteViewer.getFormat() === format &&
+                    $.PrivateBin.PasteViewer.getText() === ''
+                );
+                $.PrivateBin.PasteViewer.run();
+                results.push(
+                    !$('#placeholder').hasClass('hidden') &&
+                    $('#prettymessage').hasClass('hidden') &&
+                    $('#plaintext').hasClass('hidden')
+                );
+                $.PrivateBin.PasteViewer.hide();
+                results.push(
+                    $('#placeholder').hasClass('hidden') &&
+                    $('#prettymessage').hasClass('hidden') &&
+                    $('#plaintext').hasClass('hidden')
+                );
+                $.PrivateBin.PasteViewer.setText(text);
+                $.PrivateBin.PasteViewer.run();
+                results.push(
+                    $('#placeholder').hasClass('hidden') &&
+                    !$.PrivateBin.PasteViewer.isPrettyPrinted() &&
+                    $.PrivateBin.PasteViewer.getText() === text
+                );
+                if (format === 'markdown') {
+                    results.push(
+                        $('#prettymessage').hasClass('hidden') &&
+                        !$('#plaintext').hasClass('hidden')
+                    );
+                } else {
+                    results.push(
+                        !$('#prettymessage').hasClass('hidden') &&
+                        $('#plaintext').hasClass('hidden')
+                    );
+                }
+                clean();
+                return results.every(element => element);
+            }
+        );
+
+        jsc.property(
+            'sanitizes XSS',
+            common.jscFormats(),
+            'string',
+            // @see    {@link https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet}
+            jsc.elements([
+                '<PLAINTEXT>',
+                '></SCRIPT>">\'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>',
+                '\'\';!--"<XSS>=&{()}',
+                '<SCRIPT SRC=http://example.com/xss.js></SCRIPT>',
+                '\'">><marquee><img src=x onerror=confirm(1)></marquee>">' +
+                '</plaintext\\></|\\><plaintext/onmouseover=prompt(1)>' +
+                '<script>prompt(1)</script>@gmail.com<isindex formaction=' +
+                'javascript:alert(/XSS/) type=submit>\'-->"></script>' +
+                '<script>alert(document.cookie)</script>"><img/id="confirm' +
+                '&lpar;1)"/alt="/"src="/"onerror=eval(id)>\'">',
+                '<IMG SRC="javascript:alert(\'XSS\');">',
+                '<IMG SRC=javascript:alert(\'XSS\')>',
+                '<IMG SRC=JaVaScRiPt:alert(\'XSS\')>',
+                '<IMG SRC=javascript:alert(&quot;XSS&quot;)>',
+                '<IMG SRC=`javascript:alert("RSnake says, \'XSS\'")`>',
+                '<a onmouseover="alert(document.cookie)">xxs link</a>',
+                '<a onmouseover=alert(document.cookie)>xxs link</a>',
+                '<IMG """><SCRIPT>alert("XSS")</SCRIPT>">',
+                '<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>',
+                '<IMG STYLE="xss:expr/*XSS*/ession(alert(\'XSS\'))">',
+                '<FRAMESET><FRAME SRC="javascript:alert(\'XSS\');"></FRAMESET>',
+                '<TABLE BACKGROUND="javascript:alert(\'XSS\')">',
+                '<TABLE><TD BACKGROUND="javascript:alert(\'XSS\')">',
+                '<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="httx://xss.rocks/xss.js"></SCRIPT>'
+            ]),
+            'string',
+            function (format, prefix, xss, suffix) {
+                var clean = jsdom(),
+                    text = prefix + xss + suffix;
+                $('body').html(
+                    '<div id="placeholder" class="hidden">+++ no paste text ' +
+                    '+++</div><div id="prettymessage" class="hidden"><pre ' +
+                    'id="prettyprint" class="prettyprint linenums:1"></pre>' +
+                    '</div><div id="plaintext" class="hidden"></div>'
+                );
+                $.PrivateBin.PasteViewer.init();
+                $.PrivateBin.PasteViewer.setFormat(format);
+                $.PrivateBin.PasteViewer.setText(text);
+                $.PrivateBin.PasteViewer.run();
+                var result = $('body').html().indexOf(xss) === -1;
+                clean();
+                return result;
+            }
+        );
+    });
+});
+

js/test/Prompt.js

@@ -0,0 +1,42 @@
+'use strict';
+require('../common');
+
+describe('Prompt', function () {
+    // TODO: this does not test the prompt() fallback, since that isn't available
+    //       in nodejs -> replace the prompt in the "page" template with a modal
+    describe('requestPassword & getPassword', function () {
+        this.timeout(30000);
+        before(function () {
+            $.PrivateBin.Model.reset();
+            cleanup();
+        });
+
+        jsc.property(
+            'returns the password fed into the dialog',
+            'string',
+            function (password) {
+                password = password.replace(/\r+/g, '');
+                var clean = jsdom('', {url: 'ftp://example.com/?0'});
+                $('body').html(
+                    '<div id="passwordmodal" class="modal fade" role="dialog">' +
+                    '<div class="modal-dialog"><div class="modal-content">' +
+                    '<div class="modal-body"><form id="passwordform" role="form">' +
+                    '<div class="form-group"><input id="passworddecrypt" ' +
+                    'type="password" class="form-control" placeholder="Enter ' +
+                    'password"></div><button type="submit">Decrypt</button>' +
+                    '</form></div></div></div></div>'
+                );
+                $.PrivateBin.Model.init();
+                $.PrivateBin.Prompt.init();
+                $.PrivateBin.Prompt.requestPassword();
+                $('#passworddecrypt').val(password);
+                $('#passwordform').submit();
+                var result = $.PrivateBin.Prompt.getPassword();
+                $.PrivateBin.Model.reset();
+                clean();
+                return result === password;
+            }
+        );
+    });
+});
+

js/test/TopNav.js

@@ -0,0 +1,548 @@
+'use strict';
+var common = require('../common');
+
+describe('TopNav', function () {
+    describe('showViewButtons & hideViewButtons', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'displays & hides navigation elements for viewing an existing paste',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav class="navbar navbar-inverse navbar-static-top">' +
+                    '<div id="navbar" class="navbar-collapse collapse"><ul ' +
+                    'class="nav navbar-nav"><li><button id="newbutton" ' +
+                    'type="button" class="hidden btn btn-warning navbar-btn">' +
+                    '<span class="glyphicon glyphicon-file" aria-hidden="true">' +
+                    '</span> New</button><button id="clonebutton" type="button"' +
+                    ' class="hidden btn btn-warning navbar-btn">' +
+                    '<span class="glyphicon glyphicon-duplicate" ' +
+                    'aria-hidden="true"></span> Clone</button><button ' +
+                    'id="rawtextbutton" type="button" class="hidden btn ' +
+                    'btn-warning navbar-btn"><span class="glyphicon ' +
+                    'glyphicon-text-background" aria-hidden="true"></span> ' +
+                    'Raw text</button><button id="qrcodelink" type="button" ' +
+                    'data-toggle="modal" data-target="#qrcodemodal" ' +
+                    'class="hidden btn btn-warning navbar-btn"><span ' +
+                    'class="glyphicon glyphicon-qrcode" aria-hidden="true">' +
+                    '</span> QR code</button></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    $('#newbutton').hasClass('hidden') &&
+                    $('#clonebutton').hasClass('hidden') &&
+                    $('#rawtextbutton').hasClass('hidden') &&
+                    $('#qrcodelink').hasClass('hidden')
+                );
+                $.PrivateBin.TopNav.showViewButtons();
+                results.push(
+                    !$('#newbutton').hasClass('hidden') &&
+                    !$('#clonebutton').hasClass('hidden') &&
+                    !$('#rawtextbutton').hasClass('hidden') &&
+                    !$('#qrcodelink').hasClass('hidden')
+                );
+                $.PrivateBin.TopNav.hideViewButtons();
+                results.push(
+                    $('#newbutton').hasClass('hidden') &&
+                    $('#clonebutton').hasClass('hidden') &&
+                    $('#rawtextbutton').hasClass('hidden') &&
+                    $('#qrcodelink').hasClass('hidden')
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('showCreateButtons & hideCreateButtons', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'displays & hides navigation elements for creating a paste',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li><button id="newbutton" ' +
+                    'type="button" class="hidden">New</button></li><li><a ' +
+                    'id="expiration" href="#" class="hidden">Expiration</a>' +
+                    '</li><li><div id="burnafterreadingoption" class="hidden">' +
+                    'Burn after reading</div></li><li><div id="opendiscussion' +
+                    'option" class="hidden">Open discussion</div></li><li>' +
+                    '<div id="password" class="hidden">Password</div></li>' +
+                    '<li id="attach" class="hidden">Attach a file</li><li>' +
+                    '<a id="formatter" href="#" class="hidden">Format</a>' +
+                    '</li><li><button id="sendbutton" type="button" ' +
+                    'class="hidden">Send</button></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    $('#sendbutton').hasClass('hidden') &&
+                    $('#expiration').hasClass('hidden') &&
+                    $('#formatter').hasClass('hidden') &&
+                    $('#burnafterreadingoption').hasClass('hidden') &&
+                    $('#opendiscussionoption').hasClass('hidden') &&
+                    $('#newbutton').hasClass('hidden') &&
+                    $('#password').hasClass('hidden') &&
+                    $('#attach').hasClass('hidden')
+                );
+                $.PrivateBin.TopNav.showCreateButtons();
+                results.push(
+                    !$('#sendbutton').hasClass('hidden') &&
+                    !$('#expiration').hasClass('hidden') &&
+                    !$('#formatter').hasClass('hidden') &&
+                    !$('#burnafterreadingoption').hasClass('hidden') &&
+                    !$('#opendiscussionoption').hasClass('hidden') &&
+                    !$('#newbutton').hasClass('hidden') &&
+                    !$('#password').hasClass('hidden') &&
+                    !$('#attach').hasClass('hidden')
+                );
+                $.PrivateBin.TopNav.hideCreateButtons();
+                results.push(
+                    $('#sendbutton').hasClass('hidden') &&
+                    $('#expiration').hasClass('hidden') &&
+                    $('#formatter').hasClass('hidden') &&
+                    $('#burnafterreadingoption').hasClass('hidden') &&
+                    $('#opendiscussionoption').hasClass('hidden') &&
+                    $('#newbutton').hasClass('hidden') &&
+                    $('#password').hasClass('hidden') &&
+                    $('#attach').hasClass('hidden')
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('showNewPasteButton', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'displays the button for creating a paste',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li><button id="newbutton" type=' +
+                    '"button" class="hidden">New</button></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    $('#newbutton').hasClass('hidden')
+                );
+                $.PrivateBin.TopNav.showNewPasteButton();
+                results.push(
+                    !$('#newbutton').hasClass('hidden')
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('hideCloneButton', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'hides the button for cloning a paste',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li><button id="clonebutton" ' +
+                    'type="button" class="btn btn-warning navbar-btn">' +
+                    '<span class="glyphicon glyphicon-duplicate" aria-hidden=' +
+                    '"true"></span> Clone</button></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    !$('#clonebutton').hasClass('hidden')
+                );
+                $.PrivateBin.TopNav.hideCloneButton();
+                results.push(
+                    $('#clonebutton').hasClass('hidden')
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('hideRawButton', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'hides the raw text button',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li><button ' +
+                    'id="rawtextbutton" type="button" class="btn ' +
+                    'btn-warning navbar-btn"><span class="glyphicon ' +
+                    'glyphicon-text-background" aria-hidden="true"></span> ' +
+                    'Raw text</button></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    !$('#rawtextbutton').hasClass('hidden')
+                );
+                $.PrivateBin.TopNav.hideRawButton();
+                results.push(
+                    $('#rawtextbutton').hasClass('hidden')
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('hideFileSelector', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'hides the file attachment selection button',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li id="attach" class="hidden ' +
+                    'dropdown"><a href="#" class="dropdown-toggle" data-' +
+                    'toggle="dropdown" role="button" aria-haspopup="true" ' +
+                    'aria-expanded="false">Attach a file <span class="caret">' +
+                    '</span></a><ul class="dropdown-menu"><li id="filewrap">' +
+                    '<div><input type="file" id="file" name="file" /></div>' +
+                    '</li><li id="customattachment" class="hidden"></li><li>' +
+                    '<a id="fileremovebutton"  href="#">Remove attachment</a>' +
+                    '</li></ul></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    !$('#filewrap').hasClass('hidden')
+                );
+                $.PrivateBin.TopNav.hideFileSelector();
+                results.push(
+                    $('#filewrap').hasClass('hidden')
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('showCustomAttachment', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'display the custom file attachment',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li id="attach" class="hidden ' +
+                    'dropdown"><a href="#" class="dropdown-toggle" data-' +
+                    'toggle="dropdown" role="button" aria-haspopup="true" ' +
+                    'aria-expanded="false">Attach a file <span class="caret">' +
+                    '</span></a><ul class="dropdown-menu"><li id="filewrap">' +
+                    '<div><input type="file" id="file" name="file" /></div>' +
+                    '</li><li id="customattachment" class="hidden"></li><li>' +
+                    '<a id="fileremovebutton"  href="#">Remove attachment</a>' +
+                    '</li></ul></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    $('#customattachment').hasClass('hidden')
+                );
+                $.PrivateBin.TopNav.showCustomAttachment();
+                results.push(
+                    !$('#customattachment').hasClass('hidden')
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('collapseBar', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'collapses the navigation when displayed on a small screen',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div class="navbar-header"><button type="button" ' +
+                    'class="navbar-toggle collapsed" data-toggle="collapse" ' +
+                    'data-target="#navbar" aria-expanded="false" aria-controls' +
+                    '="navbar">Toggle navigation</button><a class="reloadlink ' +
+                    'navbar-brand" href=""><img alt="PrivateBin" ' +
+                    'src="img/icon.svg" width="38" /></a></div><div ' +
+                    'id="navbar"><ul><li><button id="newbutton" type=' +
+                    '"button" class="hidden">New</button></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    $('.navbar-toggle').hasClass('collapsed') &&
+                    $('#navbar').attr('aria-expanded') != 'true'
+                );
+                $.PrivateBin.TopNav.collapseBar();
+                results.push(
+                    $('.navbar-toggle').hasClass('collapsed') &&
+                    $('#navbar').attr('aria-expanded') != 'true'
+                );
+                $('.navbar-toggle').click();
+                results.push(
+                    !$('.navbar-toggle').hasClass('collapsed') &&
+                    $('#navbar').attr('aria-expanded') == 'true'
+                );
+                $.PrivateBin.TopNav.collapseBar();
+                results.push(
+                    $('.navbar-toggle').hasClass('collapsed') &&
+                    $('#navbar').attr('aria-expanded') == 'false'
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('getExpiration', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'returns the currently selected expiration date',
+            function () {
+                $.PrivateBin.TopNav.init();
+                assert.ok($.PrivateBin.TopNav.getExpiration() === '1week');
+            }
+        );
+    });
+
+    describe('getFileList', function () {
+        before(function () {
+            cleanup();
+        });
+
+        var File = window.File,
+            FileList = window.FileList,
+            path = require('path'),
+            mime = require('mime-types');
+
+        // mocking file input as per https://github.com/jsdom/jsdom/issues/1272
+        function createFile(file_path) {
+            var file = fs.statSync(file_path),
+                lastModified = file.mtimeMs,
+                size = file.size;
+
+            return new File(
+                [new fs.readFileSync(file_path)],
+                path.basename(file_path),
+                {
+                    lastModified,
+                    type: mime.lookup(file_path) || '',
+                }
+            )
+        }
+
+        function addFileList(input, file_paths) {
+            if (typeof file_paths === 'string')
+                file_paths = [file_paths]
+            else if (!Array.isArray(file_paths)) {
+                throw new Error('file_paths needs to be a file path string or an Array of file path strings')
+            }
+
+            const file_list = file_paths.map(fp => createFile(fp))
+            file_list.__proto__ = Object.create(FileList.prototype)
+
+            Object.defineProperty(input, 'files', {
+                value: file_list,
+                writeable: false,
+            })
+
+            return input
+        }
+
+        it(
+            'returns the selected files',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li id="attach" class="hidden ' +
+                    'dropdown"><a href="#" class="dropdown-toggle" data-' +
+                    'toggle="dropdown" role="button" aria-haspopup="true" ' +
+                    'aria-expanded="false">Attach a file <span class="caret">' +
+                    '</span></a><ul class="dropdown-menu"><li id="filewrap">' +
+                    '<div><input type="file" id="file" name="file" /></div>' +
+                    '</li><li id="customattachment" class="hidden"></li><li>' +
+                    '<a id="fileremovebutton"  href="#">Remove attachment</a>' +
+                    '</li></ul></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    $.PrivateBin.TopNav.getFileList() === null
+                );
+                addFileList($('#file')[0], [
+                    '../img/logo.svg',
+                    '../img/busy.gif'
+                ]);
+                var files = $.PrivateBin.TopNav.getFileList();
+                results.push(
+                    files[0].name === 'logo.svg' &&
+                    files[1].name === 'busy.gif'
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('getBurnAfterReading', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'returns if the burn-after-reading checkbox was ticked',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li id="burnafterreadingoption" ' +
+                    'class="hidden"><label><input type="checkbox" ' +
+                    'id="burnafterreading" name="burnafterreading" /> ' +
+                    'Burn after reading</label></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    !$.PrivateBin.TopNav.getBurnAfterReading()
+                );
+                $('#burnafterreading').attr('checked', 'checked');
+                results.push(
+                    $.PrivateBin.TopNav.getBurnAfterReading()
+                );
+                $('#burnafterreading').removeAttr('checked');
+                results.push(
+                    !$.PrivateBin.TopNav.getBurnAfterReading()
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+    describe('getOpenDiscussion', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'returns if the open-discussion checkbox was ticked',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li id="opendiscussionoption" ' +
+                    'class="hidden"><label><input type="checkbox" ' +
+                    'id="opendiscussion" name="opendiscussion" /> ' +
+                    'Open discussion</label></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    !$.PrivateBin.TopNav.getOpenDiscussion()
+                );
+                $('#opendiscussion').attr('checked', 'checked');
+                results.push(
+                    $.PrivateBin.TopNav.getOpenDiscussion()
+                );
+                $('#opendiscussion').removeAttr('checked');
+                results.push(
+                    !$.PrivateBin.TopNav.getOpenDiscussion()
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+
+
+    describe('getPassword', function () {
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'returns the contents of the password input',
+            'string',
+            function (password) {
+                password = password.replace(/\r+/g, '');
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li><div id="password" ' +
+                    'class="navbar-form hidden"><input type="password" ' +
+                    'id="passwordinput" placeholder="Password (recommended)" ' +
+                    'class="form-control" size="23" /></div></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    $.PrivateBin.TopNav.getPassword() === ''
+                );
+                $('#passwordinput').val(password);
+                results.push(
+                    $.PrivateBin.TopNav.getPassword() === password
+                );
+                $('#passwordinput').val('');
+                results.push(
+                    $.PrivateBin.TopNav.getPassword() === ''
+                );
+                cleanup();
+                return results.every(element => element);
+            }
+        );
+    });
+
+    describe('getCustomAttachment', function () {
+        before(function () {
+            cleanup();
+        });
+
+        it(
+            'returns the custom attachment element',
+            function () {
+                var results = [];
+                $('body').html(
+                    '<nav><div id="navbar"><ul><li id="attach" class="hidden ' +
+                    'dropdown"><a href="#" class="dropdown-toggle" data-' +
+                    'toggle="dropdown" role="button" aria-haspopup="true" ' +
+                    'aria-expanded="false">Attach a file <span class="caret">' +
+                    '</span></a><ul class="dropdown-menu"><li id="filewrap">' +
+                    '<div><input type="file" id="file" name="file" /></div>' +
+                    '</li><li id="customattachment" class="hidden"></li><li>' +
+                    '<a id="fileremovebutton"  href="#">Remove attachment</a>' +
+                    '</li></ul></li></ul></div></nav>'
+                );
+                $.PrivateBin.TopNav.init();
+                results.push(
+                    !$.PrivateBin.TopNav.getCustomAttachment().hasClass('test')
+                );
+                $('#customattachment').addClass('test');
+                results.push(
+                    $.PrivateBin.TopNav.getCustomAttachment().hasClass('test')
+                );
+                cleanup();
+                assert.ok(results.every(element => element));
+            }
+        );
+    });
+});
+

js/test/UiHelper.js

@@ -0,0 +1,124 @@
+'use strict';
+var common = require('../common');
+
+describe('UiHelper', function () {
+    // TODO: As per https://github.com/tmpvar/jsdom/issues/1565 there is no navigation support in jsdom, yet.
+    // for now we use a mock function to trigger the event
+    describe('historyChange', function () {
+        this.timeout(30000);
+        before(function () {
+            $.PrivateBin.Helper.reset();
+            cleanup();
+        });
+
+        jsc.property(
+            'redirects to home, when the state is null',
+            common.jscSchemas(),
+            jsc.nearray(common.jscA2zString()),
+            function (schema, address) {
+                var expected = schema + '://' + address.join('') + '/',
+                    clean = jsdom('', {url: expected});
+
+                // make window.location.href writable
+                Object.defineProperty(window.location, 'href', {
+                    writable: true,
+                    value: window.location.href
+                });
+                $.PrivateBin.UiHelper.mockHistoryChange();
+                $.PrivateBin.Helper.reset();
+                var result = window.location.href;
+                clean();
+                return expected === result;
+            }
+        );
+
+        jsc.property(
+            'does not redirect to home, when a new paste is created',
+            common.jscSchemas(),
+            jsc.nearray(common.jscA2zString()),
+            jsc.array(common.jscQueryString()),
+            jsc.nearray(common.jscBase64String()),
+            function (schema, address, query, fragment) {
+                var expected = schema + '://' + address.join('') + '/?' +
+                               query.join('') + '#' + fragment.join(''),
+                    clean = jsdom('', {url: expected});
+
+                // make window.location.href writable
+                Object.defineProperty(window.location, 'href', {
+                    writable: true,
+                    value: window.location.href
+                });
+                $.PrivateBin.UiHelper.mockHistoryChange([
+                    {type: 'newpaste'}, '', expected
+                ]);
+                $.PrivateBin.Helper.reset();
+                var result = window.location.href;
+                clean();
+                return expected === result;
+            }
+        );
+    });
+
+    describe('reloadHome', function () {
+        this.timeout(30000);
+        before(function () {
+            $.PrivateBin.Helper.reset();
+        });
+
+        jsc.property(
+            'redirects to home',
+            common.jscSchemas(),
+            jsc.nearray(common.jscA2zString()),
+            jsc.array(common.jscQueryString()),
+            jsc.nearray(common.jscBase64String()),
+            function (schema, address, query, fragment) {
+                var expected = schema + '://' + address.join('') + '/',
+                    clean = jsdom('', {
+                        url: expected + '?' + query.join('') + '#' + fragment.join('')
+                    });
+
+                // make window.location.href writable
+                Object.defineProperty(window.location, 'href', {
+                    writable: true,
+                    value: window.location.href
+                });
+                $.PrivateBin.UiHelper.reloadHome();
+                $.PrivateBin.Helper.reset();
+                var result = window.location.href;
+                clean();
+                return expected === result;
+            }
+        );
+    });
+
+    describe('isVisible', function () {
+        // TODO As per https://github.com/tmpvar/jsdom/issues/1048 there is no layout support in jsdom, yet.
+        // once it is supported or a workaround is found, uncomment the section below
+        /*
+        before(function () {
+            $.PrivateBin.Helper.reset();
+        });
+
+        jsc.property(
+            'detect visible elements',
+            jsc.nearray(common.jscAlnumString()),
+            jsc.nearray(common.jscA2zString()),
+            function (id, element) {
+                id = id.join('');
+                element = element.join('');
+                var clean = jsdom(
+                    '<' + element + ' id="' + id + '"></' + element + '>'
+                );
+                var result = $.PrivateBin.UiHelper.isVisible($('#' + id));
+                clean();
+                return result;
+            }
+        );
+        */
+    });
+
+    describe('scrollTo', function () {
+        // TODO Did not find a way to test that, see isVisible test above
+    });
+});
+

lib/Configuration.php

@@ -7,13 +7,14 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin;
 
 use Exception;
 use PDO;
+use PrivateBin\Persistence\DataStore;
 
 /**
  * Configuration
@@ -50,8 +51,9 @@ class Configuration
             'languageselection'        => false,
             'languagedefault'          => '',
             'urlshortener'             => '',
+            'qrcode'                   => true,
             'icon'                     => 'identicon',
-            'cspheader'                => 'default-src \'none\'; manifest-src \'self\'; connect-src *; script-src \'self\'; style-src \'self\'; font-src \'self\'; img-src \'self\' data:; referrer no-referrer; sandbox allow-same-origin allow-scripts allow-forms allow-popups',
+            'cspheader'                => 'default-src \'none\'; manifest-src \'self\'; connect-src *; script-src \'self\'; style-src \'self\'; font-src \'self\'; img-src \'self\' data:; media-src data:; object-src data:; Referrer-Policy: \'no-referrer\'; sandbox allow-same-origin allow-scripts allow-forms allow-popups',
             'zerobincompatibility'     => false,
         ),
         'expire' => array(
@@ -99,7 +101,20 @@ class Configuration
     public function __construct()
     {
         $config     = array();
-        $configFile = PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini';
+        $configFile = PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.php';
+        $configIni  = PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini';
+
+        // rename INI files to avoid configuration leakage
+        if (is_readable($configIni)) {
+            DataStore::prependRename($configIni, $configFile, ';');
+
+            // cleanup sample, too
+            $configIniSample = $configIni . '.sample';
+            if (is_readable($configIniSample)) {
+                DataStore::prependRename($configIniSample, PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.sample.php', ';');
+            }
+        }
+
         if (is_readable($configFile)) {
             $config = parse_ini_file($configFile, true);
             foreach (array('main', 'model', 'model_options') as $section) {
@@ -108,6 +123,7 @@ class Configuration
                 }
             }
         }
+
         $opts = '_options';
         foreach (self::getDefaults() as $section => $values) {
             // fill missing sections with default values

lib/Data/AbstractData.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Data;

lib/Data/Database.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Data;
@@ -693,9 +693,8 @@ class Database extends AbstractData
                     'CREATE INDEX IF NOT EXISTS comment_parent ON ' .
                     self::_sanitizeIdentifier('comment') . '(pasteid);'
                 );
-                // no break, continue with updates for 0.22
+                // no break, continue with updates for 0.22 and later
-            case '0.22':
+            default:
-            case '1.0':
                 self::_exec(
                     'UPDATE ' . self::_sanitizeIdentifier('config') .
                     ' SET value = ? WHERE id = ?',

lib/Data/Filesystem.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Data;
@@ -57,7 +57,7 @@ class Filesystem extends AbstractData
     public function create($pasteid, $paste)
     {
         $storagedir = self::_dataid2path($pasteid);
-        $file       = $storagedir . $pasteid;
+        $file       = $storagedir . $pasteid . '.php';
         if (is_file($file)) {
             return false;
         }
@@ -79,9 +79,7 @@ class Filesystem extends AbstractData
         if (!$this->exists($pasteid)) {
             return false;
         }
-        $paste = json_decode(
+        $paste = DataStore::get(self::_dataid2path($pasteid) . $pasteid . '.php');
-            file_get_contents(self::_dataid2path($pasteid) . $pasteid)
-        );
         if (property_exists($paste->meta, 'attachment')) {
             $paste->attachment = $paste->meta->attachment;
             unset($paste->meta->attachment);
@@ -104,8 +102,8 @@ class Filesystem extends AbstractData
         $pastedir = self::_dataid2path($pasteid);
         if (is_dir($pastedir)) {
             // Delete the paste itself.
-            if (is_file($pastedir . $pasteid)) {
+            if (is_file($pastedir . $pasteid . '.php')) {
-                unlink($pastedir . $pasteid);
+                unlink($pastedir . $pasteid . '.php');
             }
 
             // Delete discussion if it exists.
@@ -133,7 +131,26 @@ class Filesystem extends AbstractData
      */
     public function exists($pasteid)
     {
-        return is_file(self::_dataid2path($pasteid) . $pasteid);
+        $basePath  = self::_dataid2path($pasteid) . $pasteid;
+        $pastePath = $basePath . '.php';
+        // convert to PHP protected files if needed
+        if (is_readable($basePath)) {
+            DataStore::prependRename($basePath, $pastePath);
+
+            // convert comments, too
+            $discdir = self::_dataid2discussionpath($pasteid);
+            if (is_dir($discdir)) {
+                $dir = dir($discdir);
+                while (false !== ($filename = $dir->read())) {
+                    if (substr($filename, -4) !== '.php' && strlen($filename) >= 16) {
+                        $commentFilename = $discdir . $filename . '.php';
+                        DataStore::prependRename($discdir . $filename, $commentFilename);
+                    }
+                }
+                $dir->close();
+            }
+        }
+        return is_readable($pastePath);
     }
 
     /**
@@ -149,7 +166,7 @@ class Filesystem extends AbstractData
     public function createComment($pasteid, $parentid, $commentid, $comment)
     {
         $storagedir = self::_dataid2discussionpath($pasteid);
-        $file       = $storagedir . $pasteid . '.' . $commentid . '.' . $parentid;
+        $file       = $storagedir . $pasteid . '.' . $commentid . '.' . $parentid . '.php';
         if (is_file($file)) {
             return false;
         }
@@ -171,15 +188,14 @@ class Filesystem extends AbstractData
         $comments = array();
         $discdir  = self::_dataid2discussionpath($pasteid);
         if (is_dir($discdir)) {
-            // Delete all files in discussion directory
             $dir = dir($discdir);
             while (false !== ($filename = $dir->read())) {
-                // Filename is in the form pasteid.commentid.parentid:
+                // Filename is in the form pasteid.commentid.parentid.php:
                 // - pasteid is the paste this reply belongs to.
                 // - commentid is the comment identifier itself.
                 // - parentid is the comment this comment replies to (It can be pasteid)
                 if (is_file($discdir . $filename)) {
-                    $comment = json_decode(file_get_contents($discdir . $filename));
+                    $comment = DataStore::get($discdir . $filename);
                     $items   = explode('.', $filename);
                     // Add some meta information not contained in file.
                     $comment->id       = $items[1];
@@ -211,7 +227,7 @@ class Filesystem extends AbstractData
     {
         return is_file(
             self::_dataid2discussionpath($pasteid) .
-            $pasteid . '.' . $commentid . '.' . $parentid
+            $pasteid . '.' . $commentid . '.' . $parentid . '.php'
         );
     }
 
@@ -253,7 +269,14 @@ class Filesystem extends AbstractData
                     continue;
                 }
                 $thirdLevel = array_filter(
-                    scandir($path),
+                    array_map(
+                        function ($filename) {
+                            return strlen($filename) >= 20 ?
+                                substr($filename, 0, -4) :
+                                $filename;
+                        },
+                        scandir($path)
+                    ),
                     'PrivateBin\\Model\\Paste::isValidId'
                 );
                 if (count($thirdLevel) == 0) {

lib/Filter.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin;
@@ -64,7 +64,7 @@ class Filter
         $i   = 0;
         while (($size / 1024) >= 1) {
             $size = $size / 1024;
-            $i++;
+            ++$i;
         }
         return number_format($size, ($i ? 2 : 0), '.', ' ') . ' ' . I18n::_($iec[$i]);
     }
@@ -82,7 +82,7 @@ class Filter
     public static function slowEquals($a, $b)
     {
         $diff = strlen($a) ^ strlen($b);
-        for ($i = 0; $i < strlen($a) && $i < strlen($b); $i++) {
+        for ($i = 0; $i < strlen($a) && $i < strlen($b); ++$i) {
             $diff |= ord($a[$i]) ^ ord($b[$i]);
         }
         return $diff === 0;

lib/I18n.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin;

lib/Json.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin;

lib/Model.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin;

lib/Model/AbstractModel.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Model;

lib/Model/Comment.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Model;

lib/Model/Paste.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Model;
@@ -48,6 +48,11 @@ class Paste extends AbstractModel
             $data->meta->remaining_time = $data->meta->expire_date - time();
         }
 
+        // check if non-expired burn after reading paste needs to be deleted
+        if (property_exists($data->meta, 'burnafterreading') && $data->meta->burnafterreading) {
+            $this->delete();
+        }
+
         // set formatter for for the view.
         if (!property_exists($data->meta, 'formatter')) {
             // support < 0.21 syntax highlighting

lib/Persistence/AbstractPersistence.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Persistence;

lib/Persistence/DataStore.php

@@ -22,6 +22,13 @@ use PrivateBin\Json;
  */
 class DataStore extends AbstractPersistence
 {
+    /**
+     * first line in file, to protect its contents
+     *
+     * @const string
+     */
+    const PROTECTION_LINE = '<?php http_response_code(403); /*';
+
     /**
      * store the data
      *
@@ -38,10 +45,45 @@ class DataStore extends AbstractPersistence
             $filename = substr($filename, strlen($path));
         }
         try {
-            self::_store($filename, Json::encode($data));
+            self::_store($filename, self::PROTECTION_LINE . PHP_EOL . Json::encode($data));
             return true;
         } catch (Exception $e) {
             return false;
         }
     }
+
+    /**
+     * get the data
+     *
+     * @access public
+     * @static
+     * @param  string $filename
+     * @return stdClass|false  $data
+     */
+    public static function get($filename)
+    {
+        return json_decode(substr(file_get_contents($filename), strlen(self::PROTECTION_LINE . PHP_EOL)));
+    }
+
+    /**
+     * rename a file, prepending the protection line at the beginning
+     *
+     * @access public
+     * @static
+     * @param  string $srcFile
+     * @param  string $destFile
+     * @param  string $prefix (optional)
+     * @return void
+     */
+    public static function prependRename($srcFile, $destFile, $prefix = '')
+    {
+        // don't overwrite already converted file
+        if (!is_readable($destFile)) {
+            $handle = fopen($srcFile, 'r', false, stream_context_create());
+            file_put_contents($destFile, $prefix . self::PROTECTION_LINE . PHP_EOL);
+            file_put_contents($destFile, $handle, FILE_APPEND);
+            fclose($handle);
+        }
+        unlink($srcFile);
+    }
 }

lib/Persistence/PurgeLimiter.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Persistence;

lib/Persistence/ServerSalt.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Persistence;

lib/Persistence/TrafficLimiter.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin\Persistence;

lib/PrivateBin.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin;
@@ -28,7 +28,7 @@ class PrivateBin
      *
      * @const string
      */
-    const VERSION = '1.1';
+    const VERSION = '1.1.1';
 
     /**
      * minimal required PHP version
@@ -147,10 +147,7 @@ class PrivateBin
                 );
                 break;
             case 'read':
-                // reading paste is disallowed in HTML display
+                $this->_read($this->_request->getParam('pasteid'));
-                if ($this->_request->isJsonApiCall()) {
-                    $this->_read($this->_request->getParam('pasteid'));
-                }
                 break;
             case 'jsonld':
                 $this->_jsonld($this->_request->getParam('jsonld'));
@@ -179,8 +176,7 @@ class PrivateBin
         $this->_conf    = new Configuration;
         $this->_model   = new Model($this->_conf);
         $this->_request = new Request;
-        $this->_urlBase = array_key_exists('REQUEST_URI', $_SERVER) ?
+        $this->_urlBase = $this->_request->getRequestUri();
-            htmlspecialchars($_SERVER['REQUEST_URI']) : '/';
         ServerSalt::setPath($this->_conf->getKey('dir', 'traffic'));
 
         // set default language
@@ -370,12 +366,15 @@ class PrivateBin
         try {
             $paste = $this->_model->getPaste($dataid);
             if ($paste->exists()) {
-                $data              = $paste->get();
+                // reading paste is only possible via JSON call
-                $this->_doesExpire = property_exists($data, 'meta') && property_exists($data->meta, 'expire_date');
+                if ($this->_request->isJsonApiCall()) {
-                if (property_exists($data->meta, 'salt')) {
+                    $data              = $paste->get();
-                    unset($data->meta->salt);
+                    $this->_doesExpire = property_exists($data, 'meta') && property_exists($data->meta, 'expire_date');
+                    if (property_exists($data->meta, 'salt')) {
+                        unset($data->meta->salt);
+                    }
+                    $this->_data = json_encode($data);
                 }
-                $this->_data = json_encode($data);
             } else {
                 $this->_error = self::GENERIC_ERROR;
             }
@@ -429,7 +428,6 @@ class PrivateBin
 
         $page = new View;
         $page->assign('NAME', $this->_conf->getKey('name'));
-        $page->assign('CIPHERDATA', $this->_data);
         $page->assign('ERROR', I18n::_($this->_error));
         $page->assign('STATUS', I18n::_($this->_status));
         $page->assign('VERSION', self::VERSION);
@@ -451,6 +449,7 @@ class PrivateBin
         $page->assign('EXPIREDEFAULT', $this->_conf->getKey('default', 'expire'));
         $page->assign('EXPIRECLONE', !$this->_doesExpire || ($this->_doesExpire && $this->_conf->getKey('clone', 'expire')));
         $page->assign('URLSHORTENER', $this->_conf->getKey('urlshortener'));
+        $page->assign('QRCODE', $this->_conf->getKey('qrcode'));
         $page->draw($this->_conf->getKey('template'));
     }
 

lib/Request.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin;
@@ -141,7 +141,20 @@ class Request
      */
     public function getParam($param, $default = '')
     {
-        return array_key_exists($param, $this->_params) ? $this->_params[$param] : $default;
+        return array_key_exists($param, $this->_params) ?
+            $this->_params[$param] : $default;
+    }
+
+    /**
+     * Get request URI
+     *
+     * @access public
+     * @return string
+     */
+    public function getRequestUri()
+    {
+        return array_key_exists('REQUEST_URI', $_SERVER) ?
+            htmlspecialchars($_SERVER['REQUEST_URI']) : '/';
     }
 
     /**

lib/Sjcl.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin;

lib/View.php

@@ -7,7 +7,7 @@
  * @link      https://github.com/PrivateBin/PrivateBin
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   http://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.1
+ * @version   1.1.1
  */
 
 namespace PrivateBin;

lib/Vizhash16x16.php

@@ -8,7 +8,7 @@
  * @link      http://sebsauvage.net/wiki/doku.php?id=php:vizhash_gd
  * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
  * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   0.0.5 beta PrivateBin 1.1
+ * @version   0.0.5 beta PrivateBin 1.1.1
  */
 
 namespace PrivateBin;

tpl/bootstrap.php

@@ -44,6 +44,11 @@ endif;
 		<script type="text/javascript" src="js/jquery-3.1.1.js" integrity="sha512-U6K1YLIFUWcvuw5ucmMtT9HH4t0uz3M366qrF5y4vnyH6dgDzndlcGvH/Lz5k8NFh80SN95aJ5rqGZEdaQZ7ZQ==" crossorigin="anonymous"></script>
 		<script type="text/javascript" src="js/sjcl-1.0.6.js" integrity="sha512-DsyxLV/uBoQlRTJmW5Gb2SxXUXB+aYeZ6zk+NuXy8LuLyi8oGti9AGn6He5fUY2DtgQ2//RjfaZog8exFuunUQ==" crossorigin="anonymous"></script>
 <?php
+if ($QRCODE):
+?>
+		<script async type="text/javascript" src="js/kjua-0.1.2.js" integrity="sha512-hmvfOhcr4J8bjQ2GuNVzfSbuulv72wgQCJpgnXc2+cCHKqvYo8pK2nc0Q4Esem2973zo1radyIMTEkt+xJlhBA==" crossorigin="anonymous"></script>
+<?php
+endif;
 if ($ZEROBINCOMPATIBILITY):
 ?>
 		<script type="text/javascript" src="js/base64-1.7.js" integrity="sha512-JdwsSP3GyHR+jaCkns9CL9NTt4JUJqm/BsODGmYhBcj5EAPKcHYh+OiMfyHbcDLECe17TL0hjXADFkusAqiYgA==" crossorigin="anonymous"></script>
@@ -66,10 +71,11 @@ endif;
 if ($MARKDOWN):
 ?>
 		<script type="text/javascript" src="js/showdown-1.6.1.js" integrity="sha512-e6kAsBTgFnTBnEQXrq8BV6+XFwxb3kyWHeEPOl+KhxaWt3xImE2zAW2+yP3E2CQ7F9yoJl1poVU9qxkOEtVsTQ==" crossorigin="anonymous"></script>
+		<script type="text/javascript" src="js/purify-1.0.3.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-uhzhZJSgc+XJoaxCOjiuRzQaf5klPlSSVKGw69+zT72hhfLbVwB4jbwI+f7NRucuRz6u0aFGMeZ+0PnGh73iBQ==" crossorigin="anonymous"></script>
 <?php
 endif;
 ?>
-		<script type="text/javascript" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-RFxFzaLFEWaKebOSTwwDtsfv1WBl7x/FOjBeoHxTGOeuwy5jUp2Woyiw4cJUtyMMlFHMQmd4REzomUIksszKKg==" crossorigin="anonymous"></script>
+		<script type="text/javascript" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-d0gyNw98fc/n9wRYLmGo2aO6HHWxApHHmWazdu/JJBppBrev9jcKRXJBRs65LtTADUHY/Whe247xvIBDHe7EpQ==" crossorigin="anonymous"></script>
 		<!--[if lt IE 10]>
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 		<![endif]-->
@@ -87,8 +93,8 @@ if ($isCpct):
 ?> class="navbar-spacing"<?php
 endif;
 ?>>
-		<div id="passwordmodal" class="modal fade" role="dialog">
+		<div id="passwordmodal" tabindex="-1" class="modal fade" role="dialog" aria-hidden="true">
-			<div class="modal-dialog">
+			<div class="modal-dialog" role="document">
 				<div class="modal-content">
 					<div class="modal-body">
 						<form id="passwordform" role="form">
@@ -102,6 +108,22 @@ endif;
 				</div>
 			</div>
 		</div>
+<?php
+if ($QRCODE):
+?>
+		<div id="qrcodemodal" tabindex="-1" class="modal fade" aria-labelledby="qrcodemodalTitle" role="dialog" aria-hidden="true">
+			<div class="modal-dialog" role="document">
+				<div class="modal-content">
+					<div class="modal-body">
+						<div class="mx-auto" id="qrcode-display"></div>
+					</div>
+					<button type="button" class="btn btn-primary btn-block" data-dismiss="modal"><?php echo I18n::_('Close') ?></button>
+				</div>
+			</div>
+		</div>
+<?php
+endif;
+?>
 		<nav class="navbar navbar-<?php echo $isDark ? 'inverse' : 'default'; ?> navbar-<?php echo $isCpct ? 'fixed' : 'static'; ?>-top"><?php
 if ($isCpct):
 ?><div class="container"><?php
@@ -154,6 +176,15 @@ endif;
 						<button id="rawtextbutton" type="button" class="hidden btn btn-<?php echo $isDark ? 'warning' : 'default'; ?> navbar-btn">
 							<span class="glyphicon glyphicon-text-background" aria-hidden="true"></span> <?php echo I18n::_('Raw text'), PHP_EOL; ?>
 						</button>
+<?php
+if ($QRCODE):
+?>
+						<button id="qrcodelink" type="button" data-toggle="modal" data-target="#qrcodemodal" class="hidden btn btn-<?php echo $isDark ? 'warning' : 'default'; ?> navbar-btn">
+							<span class="glyphicon glyphicon-qrcode" aria-hidden="true"></span> <?php echo I18n::_('QR code'), PHP_EOL; ?>
+						</button>
+<?php
+endif;
+?>
 					</li>
 					<li class="dropdown">
 						<select id="pasteExpiration" name="pasteExpiration" class="hidden">
@@ -235,6 +266,17 @@ if ($isCpct):
 ?>
 						</ul>
 						<select id="pasteFormatter" name="pasteFormatter" class="hidden">
+<?php
+    foreach ($FORMATTER as $key => $value):
+?>
+							<option value="<?php echo $key; ?>"<?php
+        if ($key == $FORMATTERDEFAULT):
+?> selected="selected"<?php
+        endif;
+?>><?php echo $value; ?></option>
+<?php
+    endforeach;
+?>
 						</select>
 					</li>
 <?php
@@ -264,7 +306,7 @@ else:
         endif;
 ?> />
 								<?php echo I18n::_('Open discussion'), PHP_EOL; ?>
-						 	</label>
+							</label>
 						</div>
 					</li>
 <?php
@@ -274,7 +316,7 @@ if ($PASSWORD):
 ?>
 					<li>
 						<div id="password" class="navbar-form hidden">
-							<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="19" />
+							<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="23" />
 						</div>
 					</li>
 <?php
@@ -288,6 +330,7 @@ if ($FILEUPLOAD):
 								<div>
 									<input type="file" id="file" name="file" />
 								</div>
+								<div id="dragAndDropFileName" class="dragAndDropFile"><?php echo I18n::_('alternatively drag & drop a file or paste an image from the clipboard'); ?></div>
 							</li>
 							<li id="customattachment" class="hidden"></li>
 							<li>
@@ -428,20 +471,19 @@ endif;
 					<a href="https://www.opera.com/">Opera</a>,
 					<a href="https://www.google.com/chrome">Chrome</a>…
 				</div>
-				<div id="pasteSuccess" role="alert" class="hidden alert alert-success">
+				<div id="pastesuccess" role="alert" class="hidden alert alert-success">
 					<span class="glyphicon glyphicon-ok" aria-hidden="true"></span>
 					<div id="deletelink"></div>
-					<div id="pastelink">
+					<div id="pastelink"></div>
 <?php
 if (strlen($URLSHORTENER)):
 ?>
-						<button id="shortenbutton" data-shortener="<?php echo htmlspecialchars($URLSHORTENER); ?>" type="button" class="btn btn-<?php echo $isDark ? 'warning' : 'primary'; ?>">
+					<button id="shortenbutton" data-shortener="<?php echo htmlspecialchars($URLSHORTENER); ?>" type="button" class="btn btn-<?php echo $isDark ? 'warning' : 'primary'; ?>">
-							<span class="glyphicon glyphicon-send" aria-hidden="true"></span> <?php echo I18n::_('Shorten URL'), PHP_EOL; ?>
+						<span class="glyphicon glyphicon-send" aria-hidden="true"></span> <?php echo I18n::_('Shorten URL'), PHP_EOL; ?>
-						</button>
+					</button>
 <?php
 endif;
 ?>
-					</div>
 				</div>
 				<ul id="editorTabs" class="nav nav-tabs hidden">
 					<li role="presentation" class="active"><a id="messageedit" href="#"><?php echo I18n::_('Editor'); ?></a></li>
@@ -482,19 +524,18 @@ endif;
 				</div>
 			</footer>
 		</main>
-		<div id="serverdata" class="hidden" aria-hidden="true">
 <?php
 if ($DISCUSSION):
 ?>
+		<div id="serverdata" class="hidden" aria-hidden="true">
 			<div id="templates">
-				<!-- @TODO: when I intend/structure this corrrectly Firefox adds whitespaces everywhere which completly destroy the layout. (same possible when you remove the template data below and show this area in the browser) -->
 				<article id="commenttemplate" class="comment"><div class="commentmeta"><span class="nickname">name</span><span class="commentdate">0000-00-00</span></div><div class="commentdata">c</div><button class="btn btn-default btn-sm"><?php echo I18n::_('Reply'); ?></button></article>
 				<p id="commenttailtemplate" class="comment"><button class="btn btn-default btn-sm"><?php echo I18n::_('Add comment'); ?></button></p>
 				<div id="replytemplate" class="reply hidden"><input type="text" id="nickname" class="form-control" title="<?php echo I18n::_('Optional nickname…'); ?>" placeholder="<?php echo I18n::_('Optional nickname…'); ?>" /><textarea id="replymessage" class="replymessage form-control" cols="80" rows="7"></textarea><br /><div id="replystatus" role="alert" class="statusmessage hidden alert"><span class="glyphicon" aria-hidden="true"></span> </div><button id="replybutton" class="btn btn-default btn-sm"><?php echo I18n::_('Post comment'); ?></button></div>
 			</div>
+		</div>
 <?php
 endif;
 ?>
-		</div>
 	</body>
 </html>

tpl/page.php

@@ -22,6 +22,7 @@ endif;
 ?>
 		<script type="text/javascript" src="js/jquery-3.1.1.js" integrity="sha512-U6K1YLIFUWcvuw5ucmMtT9HH4t0uz3M366qrF5y4vnyH6dgDzndlcGvH/Lz5k8NFh80SN95aJ5rqGZEdaQZ7ZQ==" crossorigin="anonymous"></script>
 		<script type="text/javascript" src="js/sjcl-1.0.6.js" integrity="sha512-DsyxLV/uBoQlRTJmW5Gb2SxXUXB+aYeZ6zk+NuXy8LuLyi8oGti9AGn6He5fUY2DtgQ2//RjfaZog8exFuunUQ==" crossorigin="anonymous"></script>
+		<script type="text/javascript" src="js/kjua.min.js" integrity="sha512-hmvfOhcr4J8bjQ2GuNVzfSbuulv72wgQCJpgnXc2+cCHKqvYo8pK2nc0Q4Esem2973zo1radyIMTEkt+xJlhBA==" crossorigin="anonymous"></script>
 <?php
 if ($ZEROBINCOMPATIBILITY):
 ?>
@@ -44,10 +45,16 @@ endif;
 if ($MARKDOWN):
 ?>
 		<script type="text/javascript" src="js/showdown-1.6.1.js" integrity="sha512-e6kAsBTgFnTBnEQXrq8BV6+XFwxb3kyWHeEPOl+KhxaWt3xImE2zAW2+yP3E2CQ7F9yoJl1poVU9qxkOEtVsTQ==" crossorigin="anonymous"></script>
+		<script type="text/javascript" src="js/purify-1.0.3.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-uhzhZJSgc+XJoaxCOjiuRzQaf5klPlSSVKGw69+zT72hhfLbVwB4jbwI+f7NRucuRz6u0aFGMeZ+0PnGh73iBQ==" crossorigin="anonymous"></script>
+<?php
+endif;
+if ($QRCODE):
+?>
+		<script async type="text/javascript" src="js/kjua-0.1.2.js" integrity="sha512-hmvfOhcr4J8bjQ2GuNVzfSbuulv72wgQCJpgnXc2+cCHKqvYo8pK2nc0Q4Esem2973zo1radyIMTEkt+xJlhBA==" crossorigin="anonymous"></script>
 <?php
 endif;
 ?>
-		<script type="text/javascript" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-RFxFzaLFEWaKebOSTwwDtsfv1WBl7x/FOjBeoHxTGOeuwy5jUp2Woyiw4cJUtyMMlFHMQmd4REzomUIksszKKg==" crossorigin="anonymous"></script>
+		<script type="text/javascript" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-d0gyNw98fc/n9wRYLmGo2aO6HHWxApHHmWazdu/JJBppBrev9jcKRXJBRs65LtTADUHY/Whe247xvIBDHe7EpQ==" crossorigin="anonymous"></script>
 		<!--[if lt IE 10]>
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 		<![endif]-->
@@ -99,6 +106,13 @@ if ($EXPIRECLONE):
 endif;
 ?>
 					<button id="rawtextbutton" class="hidden"><img src="img/icon_raw.png" width="15" height="15" alt="" /><?php echo I18n::_('Raw text'); ?></button>
+<?php
+if ($QRCODE):
+?>
+					<button id="qrcodelink" class="hidden"><img src="img/icon_qr.png" width="15" height="15" alt="" /><?php echo I18n::_('QR code'); ?></button>
+<?php
+endif;
+?>
 					<div id="expiration" class="hidden button"><?php echo I18n::_('Expires'); ?>:
 						<select id="pasteExpiration" name="pasteExpiration">
 <?php
@@ -185,17 +199,22 @@ if (strlen($LANGUAGESELECTION)):
 endif;
 ?>
 				</div>
-				<div id="pasteresult" class="hidden">
+<?php
+if ($QRCODE):
+?>
+				<div id="qrcode-display"></div>
+<?php
+endif;
+?>				<div id="pastesuccess" class="hidden">
 					<div id="deletelink"></div>
-					<div id="pastelink">
+					<div id="pastelink"></div>
 <?php
 if (strlen($URLSHORTENER)):
 ?>
-						<button id="shortenbutton" data-shortener="<?php echo htmlspecialchars($URLSHORTENER); ?>"><img src="img/icon_shorten.png" width="13" height="15" /><?php echo I18n::_('Shorten URL'); ?></button>
+					<button id="shortenbutton" data-shortener="<?php echo htmlspecialchars($URLSHORTENER); ?>"><img src="img/icon_shorten.png" width="13" height="15" /><?php echo I18n::_('Shorten URL'); ?></button>
 <?php
 endif;
 ?>
-					</div>
 				</div>
 <?php
 if ($FILEUPLOAD):
@@ -204,6 +223,7 @@ if ($FILEUPLOAD):
 				<div id="attach" class="hidden">
 					<span id="clonedfile" class="hidden"><?php echo I18n::_('Cloned file attached.'); ?></span>
 					<span id="filewrap"><?php echo I18n::_('Attach a file'); ?>: <input type="file" id="file" name="file" /></span>
+					<span id="dragAndDropFileName" class="dragAndDropFile"><?php echo I18n::_('alternatively drag & drop a file or paste an image from the clipboard'); ?></span>
 					<button id="fileremovebutton"><?php echo I18n::_('Remove attachment'); ?></button>
 				</div>
 <?php
@@ -213,7 +233,7 @@ endif;
 					<button id="messageedit"><?php echo I18n::_('Editor'); ?></button>
 					<button id="messagepreview"><?php echo I18n::_('Preview'); ?></button>
 				</div>
-				<div id="image" class="hidden"></div>
+				<div id="attachmentPreview" class="hidden"></div>
 				<div id="prettymessage" class="hidden">
 					<pre id="prettyprint" class="prettyprint linenums:1"></pre>
 				</div>
@@ -227,21 +247,20 @@ endif;
 				<div id="commentcontainer"></div>
 			</div>
 		</section>
-		<div id="serverdata" class="hidden" aria-hidden="true">
 <?php
 if ($DISCUSSION):
 ?>
+		<div id="serverdata" class="hidden" aria-hidden="true">
 			<div id="templates">
-				<!-- @TODO: when I intend/structure this corrrectly Firefox adds whitespaces everywhere which completly destroy the layout. (same possible when you remove the template data below and show this area in the browser) -->
 				<article id="commenttemplate" class="comment"><div class="commentmeta"><span class="nickname">name</span><span class="commentdate">0000-00-00</span></div><div class="commentdata">c</div><button class="btn btn-default btn-sm"><?php echo I18n::_('Reply'); ?></button></article>
 				<div id="commenttailtemplate" class="comment"><button class="btn btn-default btn-sm"><?php echo I18n::_('Add comment'); ?></button></div>
 				<div id="replytemplate" class="reply hidden"><input type="text" id="nickname" class="form-control" title="<?php echo I18n::_('Optional nickname…'); ?>" placeholder="<?php echo I18n::_('Optional nickname…'); ?>" /><textarea id="replymessage" class="replymessage form-control" cols="80" rows="7"></textarea><br /><div id="replystatus" role="alert" class="statusmessage hidden alert"><span class="glyphicon" aria-hidden="true"></span> </div><button id="replybutton" class="btn btn-default btn-sm"><?php echo I18n::_('Post comment'); ?></button></div>
 			</div>
+		</div>
 <?php
 endif;
 ?>
-		</div>
+		<section class="container">
-        <section class="container">
 			<div id="noscript" role="alert" class="nonworking alert alert-info noscript-hide"><span class="glyphicon glyphicon-exclamation-sign" aria-hidden="true">
 				<span> <?php echo I18n::_('Loading…'); ?></span><br>
 				<span class="small"><?php echo I18n::_('In case this message never disappears please have a look at <a href="https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-the-loading-message-go-away">this FAQ for information to troubleshoot</a>.'); ?></span>

tst/Bootstrap.php

@@ -12,10 +12,10 @@ if (!defined('PATH')) {
     define('PATH', '..' . DIRECTORY_SEPARATOR);
 }
 if (!defined('CONF')) {
-    define('CONF', PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini');
+    define('CONF', PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.php');
 }
-if (!is_file(CONF)) {
+if (!defined('CONF_SAMPLE')) {
-    copy(CONF . '.sample', CONF);
+    define('CONF_SAMPLE', PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.sample.php');
 }
 
 require PATH . 'vendor/autoload.php';
@@ -203,6 +203,9 @@ class Helper
         if (!is_file(CONF . '.bak') && is_file(CONF)) {
             rename(CONF, CONF . '.bak');
         }
+        if (!is_file(CONF_SAMPLE . '.bak') && is_file(CONF_SAMPLE)) {
+            copy(CONF_SAMPLE, CONF_SAMPLE . '.bak');
+        }
     }
 
     /**
@@ -215,6 +218,9 @@ class Helper
         if (is_file(CONF . '.bak')) {
             rename(CONF . '.bak', CONF);
         }
+        if (is_file(CONF_SAMPLE . '.bak')) {
+            rename(CONF_SAMPLE . '.bak', CONF_SAMPLE);
+        }
     }
 
     /**

tst/ConfigurationTest.php

@@ -12,7 +12,7 @@ class ConfigurationTest extends PHPUnit_Framework_TestCase
     {
         /* Setup Routine */
         Helper::confBackup();
-        $this->_options                         = configuration::getDefaults();
+        $this->_options                         = Configuration::getDefaults();
         $this->_options['model_options']['dir'] = PATH . $this->_options['model_options']['dir'];
         $this->_options['traffic']['dir']       = PATH . $this->_options['traffic']['dir'];
         $this->_options['purge']['dir']         = PATH . $this->_options['purge']['dir'];
@@ -22,12 +22,14 @@ class ConfigurationTest extends PHPUnit_Framework_TestCase
     public function tearDown()
     {
         /* Tear Down Routine */
+        if (is_file(CONF)) {
+            unlink(CONF);
+        }
         Helper::confRestore();
     }
 
     public function testDefaultConfigFile()
     {
-        $this->assertTrue(copy(CONF . '.bak', CONF), 'copy default configuration file');
         $conf = new Configuration;
         $this->assertEquals($this->_options, $conf->get(), 'default configuration is correct');
     }
@@ -41,7 +43,9 @@ class ConfigurationTest extends PHPUnit_Framework_TestCase
 
     public function testHandleMissingConfigFile()
     {
-        @unlink(CONF);
+        if (is_file(CONF)) {
+            unlink(CONF);
+        }
         $conf = new Configuration;
         $this->assertEquals($this->_options, $conf->get(), 'returns correct defaults on missing file');
     }
@@ -135,4 +139,42 @@ class ConfigurationTest extends PHPUnit_Framework_TestCase
         $conf = new Configuration;
         $this->assertEquals('Database', $conf->getKey('class', 'model'), 'old db class gets renamed');
     }
+
+    public function testHandleConfigFileRename()
+    {
+        $options  = $this->_options;
+        Helper::createIniFile(PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini.sample', $options);
+
+        $options['main']['opendiscussion'] = true;
+        $options['main']['fileupload']     = true;
+        $options['main']['template']       = 'darkstrap';
+        Helper::createIniFile(PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini', $options);
+
+        $conf = new Configuration;
+        $this->assertFileExists(CONF, 'old configuration file gets converted');
+        $this->assertFileNotExists(PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini', 'old configuration file gets removed');
+        $this->assertFileNotExists(PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini.sample', 'old configuration sample file gets removed');
+        $this->assertTrue(
+            $conf->getKey('opendiscussion') &&
+            $conf->getKey('fileupload') &&
+            $conf->getKey('template') === 'darkstrap',
+            'configuration values get converted'
+        );
+    }
+
+    public function testRenameIniSample()
+    {
+        $iniSample = PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini.sample';
+
+        Helper::createIniFile(PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini', $this->_options);
+        if (is_file(CONF)) {
+            unlink(CONF);
+        }
+        rename(CONF_SAMPLE, $iniSample);
+        new Configuration;
+        $this->assertFileNotExists($iniSample, 'old sample file gets removed');
+        $this->assertFileExists(CONF_SAMPLE, 'new sample file gets created');
+        $this->assertFileExists(CONF, 'old configuration file gets converted');
+        $this->assertFileNotExists(PATH . 'cfg' . DIRECTORY_SEPARATOR . 'conf.ini', 'old configuration file gets removed');
+    }
 }

tst/ConfigurationTestGenerator.php

@@ -159,7 +159,7 @@ new ConfigurationTestGenerator(array(
                 array(
                     'type' => 'RegExp',
                     'args' => array(
-                        '#<link[^>]+type="text/css"[^>]+rel="stylesheet"[^>]+href="css/privatebin\.css\\?\d+\.\d+"[^>]*/>#',
+                        '#<link[^>]+type="text/css"[^>]+rel="stylesheet"[^>]+href="css/privatebin\.css\\?\d[\d\.]+\d+"[^>]*/>#',
                         '$content',
                         'outputs "page" stylesheet correctly',
                     ),
@@ -179,7 +179,7 @@ new ConfigurationTestGenerator(array(
                 array(
                     'type' => 'NotRegExp',
                     'args' => array(
-                        '#<link[^>]+type="text/css"[^>]+rel="stylesheet"[^>]+href="css/privatebin\.css\\?\d+\.\d+"[^>]*/>#',
+                        '#<link[^>]+type="text/css"[^>]+rel="stylesheet"[^>]+href="css/privatebin\.css\\?\d[\d\.]+\d+"[^>]*/>#',
                         '$content',
                         'removes "page" stylesheet correctly',
                     ),
@@ -344,7 +344,7 @@ class ConfigurationTestGenerator
      */
     private function _writeConfigurationTest()
     {
-        $defaultOptions = parse_ini_file(CONF, true);
+        $defaultOptions = parse_ini_file(CONF_SAMPLE, true);
         $code           = $this->_getHeader();
         foreach ($this->_configurations as $key => $conf) {
             $fullOptions = array_replace_recursive($defaultOptions, $conf['options']);
@@ -425,7 +425,7 @@ class ConfigurationCombinationsTest extends PHPUnit_Framework_TestCase
     {
         /* Setup Routine */
         Helper::confBackup();
-        $this->_path = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'privatebin_data';
+        $this->_path  = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'privatebin_data';
         $this->_model = Filesystem::getInstance(array('dir' => $this->_path));
         ServerSalt::setPath($this->_path);
         TrafficLimiter::setPath($this->_path);
@@ -435,9 +435,10 @@ class ConfigurationCombinationsTest extends PHPUnit_Framework_TestCase
     public function tearDown()
     {
         /* Tear Down Routine */
+        unlink(CONF);
         Helper::confRestore();
         Helper::rmDir($this->_path);
-}
+    }
 
     public function reset($configuration = array())
     {

tst/Data/FilesystemTest.php

@@ -130,4 +130,49 @@ class FilesystemTest extends PHPUnit_Framework_TestCase
         $this->assertFalse($this->_model->createComment(Helper::getPasteId(), Helper::getPasteId(), Helper::getCommentId(), $comment), 'unable to store broken comment');
         $this->assertFalse($this->_model->existsComment(Helper::getPasteId(), Helper::getPasteId(), Helper::getCommentId()), 'comment does still not exist');
     }
+
+    public function testOldFilesGetConverted()
+    {
+        // generate 10 (default purge batch size) pastes in the old format
+        $paste     = Helper::getPaste();
+        $comment   = Helper::getComment();
+        $commentid = Helper::getCommentId();
+        $ids       = array();
+        for ($i = 0, $max = 10; $i < $max; ++$i) {
+            // PHPs mt_rand only supports 32 bit or up 0x7fffffff on 64 bit systems to be precise :-/
+            $dataid = str_pad(dechex(mt_rand(0, mt_getrandmax())), 8, '0', STR_PAD_LEFT) .
+                str_pad(dechex(mt_rand(0, mt_getrandmax())), 8, '0', STR_PAD_LEFT);
+            $storagedir = $this->_path . DIRECTORY_SEPARATOR . substr($dataid, 0, 2) .
+                DIRECTORY_SEPARATOR . substr($dataid, 2, 2) . DIRECTORY_SEPARATOR;
+            $ids[$dataid] = $storagedir;
+
+            if (!is_dir($storagedir)) {
+                mkdir($storagedir, 0700, true);
+            }
+            file_put_contents($storagedir . $dataid, json_encode($paste));
+
+            $storagedir .= $dataid . '.discussion' . DIRECTORY_SEPARATOR;
+            if (!is_dir($storagedir)) {
+                mkdir($storagedir, 0700, true);
+            }
+            file_put_contents($storagedir . $dataid . '.' . $commentid . '.' . $dataid, json_encode($comment));
+        }
+        // check that all 10 pastes were converted after the purge
+        $this->_model->purge(10);
+        foreach ($ids as $dataid => $storagedir) {
+            $this->assertFileExists($storagedir . $dataid . '.php', "paste $dataid exists in new format");
+            $this->assertFileNotExists($storagedir . $dataid, "old format paste $dataid got removed");
+            $this->assertTrue($this->_model->exists($dataid), "paste $dataid exists");
+            $this->assertEquals($this->_model->read($dataid), json_decode(json_encode($paste)), "paste $dataid wasn't modified in the conversion");
+
+            $storagedir .= $dataid . '.discussion' . DIRECTORY_SEPARATOR;
+            $this->assertFileExists($storagedir . $dataid . '.' . $commentid . '.' . $dataid . '.php', "comment of $dataid exists in new format");
+            $this->assertFileNotExists($storagedir . $dataid . '.' . $commentid . '.' . $dataid, "old format comment of $dataid got removed");
+            $this->assertTrue($this->_model->existsComment($dataid, $dataid, $commentid), "comment in paste $dataid exists");
+            $comment           = json_decode(json_encode($comment));
+            $comment->id       = $commentid;
+            $comment->parentid = $dataid;
+            $this->assertEquals($this->_model->readComments($dataid), array($comment->meta->postdate => $comment), "comment of $dataid wasn't modified in the conversion");
+        }
+    }
 }

tst/I18nTest.php

@@ -150,8 +150,8 @@ class I18nTest extends PHPUnit_Framework_TestCase
         $dir        = dir(PATH . 'i18n');
         while (false !== ($file = $dir->read())) {
             if (strlen($file) === 7) {
-                $language             = substr($file, 0, 2);
+                $language            = substr($file, 0, 2);
-                $languageMessageIds   = array_keys(
+                $languageMessageIds  = array_keys(
                     json_decode(
                         file_get_contents(PATH . 'i18n' . DIRECTORY_SEPARATOR . $file),
                         true

tst/JsonApiTest.php

@@ -14,30 +14,17 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
     public function setUp()
     {
         /* Setup Routine */
-        Helper::confBackup();
         $this->_path  = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'privatebin_data';
         $this->_model = Filesystem::getInstance(array('dir' => $this->_path));
         ServerSalt::setPath($this->_path);
-        $this->reset();
-    }
 
-    public function tearDown()
-    {
-        /* Tear Down Routine */
-        Helper::confRestore();
-        Helper::rmDir($this->_path);
-    }
-
-    public function reset()
-    {
         $_POST   = array();
         $_GET    = array();
         $_SERVER = array();
         if ($this->_model->exists(Helper::getPasteId())) {
             $this->_model->delete(Helper::getPasteId());
         }
-        Helper::confRestore();
+        $options                         = parse_ini_file(CONF_SAMPLE, true);
-        $options                         = parse_ini_file(CONF, true);
         $options['purge']['dir']         = $this->_path;
         $options['traffic']['dir']       = $this->_path;
         $options['model_options']['dir'] = $this->_path;
@@ -45,15 +32,21 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
         Helper::createIniFile(CONF, $options);
     }
 
+    public function tearDown()
+    {
+        /* Tear Down Routine */
+        unlink(CONF);
+        Helper::confRestore();
+        Helper::rmDir($this->_path);
+    }
+
     /**
      * @runInSeparateProcess
      */
     public function testCreate()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -80,10 +73,8 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
      */
     public function testPut()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $paste = Helper::getPaste();
         unset($paste['meta']);
@@ -117,7 +108,6 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
      */
     public function testDelete()
     {
-        $this->reset();
         $this->_model->create(Helper::getPasteId(), Helper::getPaste());
         $this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
         $paste = $this->_model->read(Helper::getPasteId());
@@ -144,7 +134,6 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
      */
     public function testDeleteWithPost()
     {
-        $this->reset();
         $this->_model->create(Helper::getPasteId(), Helper::getPaste());
         $this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
         $paste = $this->_model->read(Helper::getPasteId());
@@ -168,7 +157,6 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
      */
     public function testRead()
     {
-        $this->reset();
         $paste                           = Helper::getPasteWithAttachment();
         $paste['meta']['attachment']     = $paste['attachment'];
         $paste['meta']['attachmentname'] = $paste['attachmentname'];
@@ -200,7 +188,6 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
      */
     public function testJsonLdPaste()
     {
-        $this->reset();
         $paste = Helper::getPasteWithAttachment();
         $this->_model->create(Helper::getPasteId(), $paste);
         $_GET['jsonld'] = 'paste';
@@ -220,7 +207,6 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
      */
     public function testJsonLdComment()
     {
-        $this->reset();
         $paste = Helper::getPasteWithAttachment();
         $this->_model->create(Helper::getPasteId(), $paste);
         $_GET['jsonld'] = 'comment';
@@ -240,7 +226,6 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
      */
     public function testJsonLdPasteMeta()
     {
-        $this->reset();
         $paste = Helper::getPasteWithAttachment();
         $this->_model->create(Helper::getPasteId(), $paste);
         $_GET['jsonld'] = 'pastemeta';
@@ -260,7 +245,6 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
      */
     public function testJsonLdCommentMeta()
     {
-        $this->reset();
         $paste = Helper::getPasteWithAttachment();
         $this->_model->create(Helper::getPasteId(), $paste);
         $_GET['jsonld'] = 'commentmeta';
@@ -280,10 +264,9 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
      */
     public function testJsonLdInvalid()
     {
-        $this->reset();
         $paste = Helper::getPasteWithAttachment();
         $this->_model->create(Helper::getPasteId(), $paste);
-        $_GET['jsonld'] = '../cfg/conf.ini';
+        $_GET['jsonld'] = CONF;
         ob_start();
         new PrivateBin;
         $content = ob_get_contents();

tst/ModelTest.php

@@ -20,13 +20,12 @@ class ModelTest extends PHPUnit_Framework_TestCase
     public function setUp()
     {
         /* Setup Routine */
-        Helper::confRestore();
         $this->_path = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'privatebin_data';
         if (!is_dir($this->_path)) {
             mkdir($this->_path);
         }
         ServerSalt::setPath($this->_path);
-        $options                   = parse_ini_file(CONF, true);
+        $options                   = parse_ini_file(CONF_SAMPLE, true);
         $options['purge']['limit'] = 0;
         $options['model']          = array(
             'class' => 'Database',
@@ -47,6 +46,7 @@ class ModelTest extends PHPUnit_Framework_TestCase
     public function tearDown()
     {
         /* Tear Down Routine */
+        unlink(CONF);
         Helper::confRestore();
         Helper::rmDir($this->_path);
     }
@@ -327,7 +327,6 @@ class ModelTest extends PHPUnit_Framework_TestCase
             'pwd' => null,
             'opt' => array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION),
         );
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $model = new Model(new Configuration);
 
@@ -382,7 +381,6 @@ class ModelTest extends PHPUnit_Framework_TestCase
             'pwd' => null,
             'opt' => array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION),
         );
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $model = new Model(new Configuration);
 
@@ -420,7 +418,6 @@ class ModelTest extends PHPUnit_Framework_TestCase
             'pwd' => null,
             'opt' => array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION),
         );
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $model = new Model(new Configuration);
 

tst/PrivateBinTest.php

@@ -16,13 +16,13 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
         /* Setup Routine */
         $this->_path  = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'privatebin_data';
         $this->_model = Filesystem::getInstance(array('dir' => $this->_path));
-        ServerSalt::setPath($this->_path);
         $this->reset();
     }
 
     public function tearDown()
     {
         /* Tear Down Routine */
+        unlink(CONF);
         Helper::confRestore();
         Helper::rmDir($this->_path);
     }
@@ -35,13 +35,12 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
         if ($this->_model->exists(Helper::getPasteId())) {
             $this->_model->delete(Helper::getPasteId());
         }
-        Helper::confRestore();
+        $options                         = parse_ini_file(CONF_SAMPLE, true);
-        $options                         = parse_ini_file(CONF, true);
         $options['purge']['dir']         = $this->_path;
         $options['traffic']['dir']       = $this->_path;
         $options['model_options']['dir'] = $this->_path;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
+        ServerSalt::setPath($this->_path);
     }
 
     /**
@@ -49,7 +48,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testView()
     {
-        $this->reset();
         ob_start();
         new PrivateBin;
         $content = ob_get_contents();
@@ -71,10 +69,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testViewLanguageSelection()
     {
-        $this->reset();
         $options                              = parse_ini_file(CONF, true);
         $options['main']['languageselection'] = true;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_COOKIE['lang'] = 'de';
         ob_start();
@@ -93,11 +89,9 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testViewForceLanguageDefault()
     {
-        $this->reset();
         $options                              = parse_ini_file(CONF, true);
         $options['main']['languageselection'] = false;
         $options['main']['languagedefault']   = 'fr';
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_COOKIE['lang'] = 'de';
         ob_start();
@@ -116,11 +110,9 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testViewUrlShortener()
     {
-        $shortener = 'https://shortener.example.com/api?link=';
+        $shortener                       = 'https://shortener.example.com/api?link=';
-        $this->reset();
         $options                         = parse_ini_file(CONF, true);
         $options['main']['urlshortener'] = $shortener;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_COOKIE['lang'] = 'de';
         ob_start();
@@ -139,7 +131,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testHtaccess()
     {
-        $this->reset();
         $file = $this->_path . DIRECTORY_SEPARATOR . '.htaccess';
         @unlink($file);
 
@@ -160,8 +151,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testConf()
     {
-        $this->reset();
-        Helper::confBackup();
         file_put_contents(CONF, '');
         new PrivateBin;
     }
@@ -171,10 +160,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreate()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -200,10 +187,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateInvalidTimelimit()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste(array('expire' => 25));
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -230,11 +215,9 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateInvalidSize()
     {
-        $this->reset();
         $options                      = parse_ini_file(CONF, true);
         $options['main']['sizelimit'] = 10;
         $options['traffic']['limit']  = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -254,10 +237,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateProxyHeader()
     {
-        $this->reset();
         $options                      = parse_ini_file(CONF, true);
         $options['traffic']['header'] = 'X_FORWARDED_FOR';
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_SERVER['HTTP_X_FORWARDED_FOR']  = '::2';
@@ -284,10 +265,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateDuplicateId()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $this->_model->create(Helper::getPasteId(), Helper::getPaste());
         $_POST                            = Helper::getPaste();
@@ -308,10 +287,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateValidExpire()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_POST['expire']                  = '5min';
@@ -341,10 +318,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateValidExpireWithDiscussion()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_POST['expire']                  = '5min';
@@ -375,10 +350,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateInvalidExpire()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_POST['expire']                  = 'foo';
@@ -405,10 +378,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateInvalidBurn()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_POST['burnafterreading']        = 'neither 1 nor 0';
@@ -429,10 +400,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateInvalidOpenDiscussion()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_POST['opendiscussion']          = 'neither 1 nor 0';
@@ -453,11 +422,9 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateAttachment()
     {
-        $this->reset();
         $options                       = parse_ini_file(CONF, true);
         $options['traffic']['limit']   = 0;
         $options['main']['fileupload'] = true;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPasteWithAttachment();
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
@@ -491,11 +458,9 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateBrokenAttachmentUpload()
     {
-        $this->reset();
         $options                       = parse_ini_file(CONF, true);
         $options['traffic']['limit']   = 0;
         $options['main']['fileupload'] = true;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST = Helper::getPasteWithAttachment();
         unset($_POST['attachment']);
@@ -517,7 +482,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateTooSoon()
     {
-        $this->reset();
         $_POST                            = Helper::getPaste();
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['REQUEST_METHOD']        = 'POST';
@@ -540,10 +504,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateValidNick()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getPaste();
         $_POST['nickname']                = Helper::getComment()['meta']['nickname'];
@@ -570,10 +532,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateInvalidNick()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getCommentPost();
         $_POST['pasteid']                 = Helper::getPasteId();
@@ -597,10 +557,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateComment()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getCommentPost();
         $_POST['pasteid']                 = Helper::getPasteId();
@@ -623,10 +581,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateInvalidComment()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getCommentPost();
         $_POST['pasteid']                 = Helper::getPasteId();
@@ -649,10 +605,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateCommentDiscussionDisabled()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getCommentPost();
         $_POST['pasteid']                 = Helper::getPasteId();
@@ -676,10 +630,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateCommentInvalidPaste()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $_POST                            = Helper::getCommentPost();
         $_POST['pasteid']                 = Helper::getPasteId();
@@ -701,10 +653,8 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testCreateDuplicateComment()
     {
-        $this->reset();
         $options                     = parse_ini_file(CONF, true);
         $options['traffic']['limit'] = 0;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
         $this->_model->create(Helper::getPasteId(), Helper::getPaste());
         $this->_model->createComment(Helper::getPasteId(), Helper::getPasteId(), Helper::getCommentId(), Helper::getComment());
@@ -724,33 +674,11 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
         $this->assertTrue($this->_model->existsComment(Helper::getPasteId(), Helper::getPasteId(), Helper::getCommentId()), 'paste exists after posting data');
     }
 
-    /**
-     * @runInSeparateProcess
-     */
-    public function testRead()
-    {
-        $this->reset();
-        $this->_model->create(Helper::getPasteId(), Helper::getPaste());
-        $_SERVER['QUERY_STRING'] = Helper::getPasteId();
-        ob_start();
-        new PrivateBin;
-        $content = ob_get_contents();
-        ob_end_clean();
-        $this->assertRegExp(
-            '#<div id="cipherdata"[^>]*>' .
-            preg_quote(htmlspecialchars(Helper::getPasteAsJson(), ENT_NOQUOTES)) .
-            '</div>#',
-            $content,
-            'outputs data correctly'
-        );
-    }
-
     /**
      * @runInSeparateProcess
      */
     public function testReadInvalidId()
     {
-        $this->reset();
         $_SERVER['QUERY_STRING'] = 'foo';
         ob_start();
         new PrivateBin;
@@ -768,7 +696,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testReadNonexisting()
     {
-        $this->reset();
         $_SERVER['QUERY_STRING'] = Helper::getPasteId();
         ob_start();
         new PrivateBin;
@@ -786,7 +713,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testReadExpired()
     {
-        $this->reset();
         $expiredPaste = Helper::getPaste(array('expire_date' => 1344803344));
         $this->_model->create(Helper::getPasteId(), $expiredPaste);
         $_SERVER['QUERY_STRING'] = Helper::getPasteId();
@@ -806,22 +732,27 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testReadBurn()
     {
-        $this->reset();
+        $paste = Helper::getPaste(array('burnafterreading' => true));
-        $burnPaste = Helper::getPaste(array('burnafterreading' => true));
+        $this->_model->create(Helper::getPasteId(), $paste);
-        $this->_model->create(Helper::getPasteId(), $burnPaste);
+        $_SERVER['QUERY_STRING']          = Helper::getPasteId();
-        $_SERVER['QUERY_STRING'] = Helper::getPasteId();
+        $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new PrivateBin;
         $content = ob_get_contents();
         ob_end_clean();
-        unset($burnPaste['meta']['salt']);
+        $response = json_decode($content, true);
-        $this->assertRegExp(
+        $this->assertEquals(0, $response['status'], 'outputs success status');
-            '#<div id="cipherdata"[^>]*>' .
+        $this->assertEquals(Helper::getPasteId(), $response['id'], 'outputs data correctly');
-            preg_quote(htmlspecialchars(Helper::getPasteAsJson($burnPaste['meta']), ENT_NOQUOTES)) .
+        $this->assertStringEndsWith('?' . $response['id'], $response['url'], 'returned URL points to new paste');
-            '</div>#',
+        $this->assertEquals($paste['data'], $response['data'], 'outputs data correctly');
-            $content,
+        $this->assertEquals($paste['meta']['formatter'], $response['meta']['formatter'], 'outputs format correctly');
-            'outputs data correctly'
+        $this->assertEquals($paste['meta']['postdate'], $response['meta']['postdate'], 'outputs postdate correctly');
-        );
+        $this->assertEquals($paste['meta']['opendiscussion'], $response['meta']['opendiscussion'], 'outputs opendiscussion correctly');
+        $this->assertEquals(1, $response['meta']['burnafterreading'], 'outputs burnafterreading correctly');
+        $this->assertEquals(0, $response['comment_count'], 'outputs comment_count correctly');
+        $this->assertEquals(0, $response['comment_offset'], 'outputs comment_offset correctly');
+        // by default it will be deleted instantly after it is read
+        $this->assertFalse($this->_model->exists(Helper::getPasteId()), 'paste exists after reading');
     }
 
     /**
@@ -829,7 +760,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testReadJson()
     {
-        $this->reset();
         $paste = Helper::getPaste();
         $this->_model->create(Helper::getPasteId(), $paste);
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
@@ -855,7 +785,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testReadInvalidJson()
     {
-        $this->reset();
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
@@ -871,53 +800,29 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testReadOldSyntax()
     {
-        $this->reset();
+        $paste = Helper::getPaste();
-        $oldPaste = Helper::getPaste();
+        $paste['meta'] = array(
-        $meta     = array(
             'syntaxcoloring' => true,
-            'postdate'       => $oldPaste['meta']['postdate'],
+            'postdate'       => $paste['meta']['postdate'],
-            'opendiscussion' => $oldPaste['meta']['opendiscussion'],
+            'opendiscussion' => $paste['meta']['opendiscussion'],
         );
-        $oldPaste['meta'] = $meta;
+        $this->_model->create(Helper::getPasteId(), $paste);
-        $this->_model->create(Helper::getPasteId(), $oldPaste);
+        $_SERVER['QUERY_STRING']          = Helper::getPasteId();
-        $_SERVER['QUERY_STRING'] = Helper::getPasteId();
+        $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new PrivateBin;
         $content = ob_get_contents();
         ob_end_clean();
-        $meta['formatter'] = 'syntaxhighlighting';
+        $response = json_decode($content, true);
-        $this->assertRegExp(
+        $this->assertEquals(0, $response['status'], 'outputs success status');
-            '#<div id="cipherdata"[^>]*>' .
+        $this->assertEquals(Helper::getPasteId(), $response['id'], 'outputs data correctly');
-            preg_quote(htmlspecialchars(Helper::getPasteAsJson($meta), ENT_NOQUOTES)) .
+        $this->assertStringEndsWith('?' . $response['id'], $response['url'], 'returned URL points to new paste');
-            '</div>#',
+        $this->assertEquals($paste['data'], $response['data'], 'outputs data correctly');
-            $content,
+        $this->assertEquals('syntaxhighlighting', $response['meta']['formatter'], 'outputs format correctly');
-            'outputs data correctly'
+        $this->assertEquals($paste['meta']['postdate'], $response['meta']['postdate'], 'outputs postdate correctly');
-        );
+        $this->assertEquals($paste['meta']['opendiscussion'], $response['meta']['opendiscussion'], 'outputs opendiscussion correctly');
-    }
+        $this->assertEquals(0, $response['comment_count'], 'outputs comment_count correctly');
-
+        $this->assertEquals(0, $response['comment_offset'], 'outputs comment_offset correctly');
-    /**
-     * @runInSeparateProcess
-     */
-    public function testReadOldFormat()
-    {
-        $this->reset();
-        $oldPaste = Helper::getPaste();
-        unset($oldPaste['meta']['formatter']);
-        $this->_model->create(Helper::getPasteId(), $oldPaste);
-        $_SERVER['QUERY_STRING'] = Helper::getPasteId();
-        ob_start();
-        new PrivateBin;
-        $content = ob_get_contents();
-        ob_end_clean();
-        $oldPaste['meta']['formatter'] = 'plaintext';
-        unset($oldPaste['meta']['salt']);
-        $this->assertRegExp(
-            '#<div id="cipherdata"[^>]*>' .
-            preg_quote(htmlspecialchars(Helper::getPasteAsJson($oldPaste['meta']), ENT_NOQUOTES)) .
-            '</div>#',
-            $content,
-            'outputs data correctly'
-        );
     }
 
     /**
@@ -925,7 +830,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testDelete()
     {
-        $this->reset();
         $this->_model->create(Helper::getPasteId(), Helper::getPaste());
         $this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
         $paste               = $this->_model->read(Helper::getPasteId());
@@ -948,7 +852,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testDeleteInvalidId()
     {
-        $this->reset();
         $this->_model->create(Helper::getPasteId(), Helper::getPaste());
         $_GET['pasteid']     = 'foo';
         $_GET['deletetoken'] = 'bar';
@@ -969,7 +872,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testDeleteInexistantId()
     {
-        $this->reset();
         $_GET['pasteid']     = Helper::getPasteId();
         $_GET['deletetoken'] = 'bar';
         ob_start();
@@ -988,7 +890,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testDeleteInvalidToken()
     {
-        $this->reset();
         $this->_model->create(Helper::getPasteId(), Helper::getPaste());
         $_GET['pasteid']     = Helper::getPasteId();
         $_GET['deletetoken'] = 'bar';
@@ -1009,7 +910,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testDeleteBurnAfterReading()
     {
-        $this->reset();
         $burnPaste = Helper::getPaste(array('burnafterreading' => true));
         $this->_model->create(Helper::getPasteId(), $burnPaste);
         $this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
@@ -1031,7 +931,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testDeleteInvalidBurnAfterReading()
     {
-        $this->reset();
         $this->_model->create(Helper::getPasteId(), Helper::getPaste());
         $this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
         $_POST['deletetoken']             = 'burnafterreading';
@@ -1052,7 +951,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testDeleteExpired()
     {
-        $this->reset();
         $expiredPaste = Helper::getPaste(array('expire_date' => 1000));
         $this->assertFalse($this->_model->exists(Helper::getPasteId()), 'paste does not exist before being created');
         $this->_model->create(Helper::getPasteId(), $expiredPaste);
@@ -1076,7 +974,6 @@ class PrivateBinTest extends PHPUnit_Framework_TestCase
      */
     public function testDeleteMissingPerPasteSalt()
     {
-        $this->reset();
         $paste = Helper::getPaste();
         unset($paste['meta']['salt']);
         $this->_model->create(Helper::getPasteId(), $paste);

tst/PrivateBinWithDbTest.php

@@ -1,7 +1,6 @@
 <?php
 
 use PrivateBin\Data\Database;
-use PrivateBin\Persistence\ServerSalt;
 
 require_once 'PrivateBinTest.php';
 
@@ -23,7 +22,6 @@ class PrivateBinWithDbTest extends PrivateBinTest
         if (!is_dir($this->_path)) {
             mkdir($this->_path);
         }
-        ServerSalt::setPath($this->_path);
         $this->_options['dsn'] = 'sqlite:' . $this->_path . DIRECTORY_SEPARATOR . 'tst.sq3';
         $this->_model          = Database::getInstance($this->_options);
         $this->reset();
@@ -37,10 +35,7 @@ class PrivateBinWithDbTest extends PrivateBinTest
         $options['model'] = array(
             'class' => 'Database',
         );
-        $options['purge']['dir']   = $this->_path;
+        $options['model_options'] = $this->_options;
-        $options['traffic']['dir'] = $this->_path;
-        $options['model_options']  = $this->_options;
-        Helper::confBackup();
         Helper::createIniFile(CONF, $options);
     }
 }

tst/README.md

@@ -10,7 +10,7 @@ and their dependencies:
 
 Example for Debian and Ubuntu:
 ```console
-$ sudo apt install phpunit php-gd php-sqlite php-xdebug
+$ sudo apt install phpunit php-gd php-sqlite3 php-xdebug
 ```
 
 To run the tests, change into the `tst` directory and run phpunit:
@@ -51,7 +51,7 @@ and jsdom-global locally:
 ```console
 $ npm install -g mocha istanbul
 $ cd PrivateBin/js
-$ npm install jsverify jsdom jsdom-global
+$ npm install jsverify jsdom@9 jsdom-global@2
 ```
 
 Example for Debian and Ubuntu, including steps to allow the current user to
@@ -63,9 +63,12 @@ $ sudo chown -R $(whoami) $(npm config get prefix)/{lib/node_modules,bin,share}
 $ ln -s /usr/bin/nodejs /usr/local/bin/node
 $ npm install -g mocha istanbul
 $ cd PrivateBin/js
-$ npm install jsverify jsdom jsdom-global
+$ npm install jsverify jsdom@9 jsdom-global@2
 ```
 
+Note: If you use a distribution that provides nodeJS >= 6, then you can install
+the latest jsdom and jsdom-global packages and don't need to use @9 and @2.
+
 To run the tests, just change into the `js` directory and run istanbul:
 ```console
 $ cd PrivateBin/js

tst/ViewTest.php

@@ -34,7 +34,6 @@ class ViewTest extends PHPUnit_Framework_TestCase
         /* Setup Routine */
         $page = new View;
         $page->assign('NAME', 'PrivateBinTest');
-        $page->assign('CIPHERDATA', Helper::getPaste()['data']);
         $page->assign('ERROR', self::$error);
         $page->assign('STATUS', self::$status);
         $page->assign('VERSION', self::$version);
@@ -56,6 +55,7 @@ class ViewTest extends PHPUnit_Framework_TestCase
         $page->assign('EXPIREDEFAULT', self::$expire_default);
         $page->assign('EXPIRECLONE', true);
         $page->assign('URLSHORTENER', '');
+        $page->assign('QRCODE', true);
 
         $dir = dir(PATH . 'tpl');
         while (false !== ($file = $dir->read())) {
@@ -96,13 +96,6 @@ class ViewTest extends PHPUnit_Framework_TestCase
     public function testTemplateRendersCorrectly()
     {
         foreach ($this->_content as $template => $content) {
-            $this->assertRegExp(
-                '#<div[^>]+id="cipherdata"[^>]*>' .
-                preg_quote(htmlspecialchars(Helper::getPaste()['data'], ENT_NOQUOTES)) .
-                '</div>#',
-                $content,
-                $template . ': outputs data correctly'
-            );
             $this->assertRegExp(
                 '#<div[^>]+id="errormessage"[^>]*>.*' . self::$error . '#s',
                 $content,