From d0f6b83423ebf16e47b5f4df4629da796fffde58 Mon Sep 17 00:00:00 2001
From: Las Zenow <zenow@tormail.org>
Date: Thu, 9 May 2013 09:42:03 +0200
Subject: [PATCH 1/3] Add a 404 page

---
 admin.go           | 16 ++++++++--------
 cover.go           |  6 +++---
 reader.go          | 16 ++++++++--------
 template.go        |  1 +
 templates/404.html | 12 ++++++++++++
 trantor.go         | 17 +++++++++++++----
 6 files changed, 45 insertions(+), 23 deletions(-)
 create mode 100644 templates/404.html

diff --git a/admin.go b/admin.go
index b06c88d..67e87a3 100644
--- a/admin.go
+++ b/admin.go
@@ -15,7 +15,7 @@ type settingsData struct {
 
 func settingsHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	if sess.User == "" {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	if r.Method == "POST" {
@@ -40,7 +40,7 @@ func settingsHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 
 func deleteHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	if sess.User == "" {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 
@@ -80,13 +80,13 @@ func deleteHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 
 func editHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	if sess.User == "" {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	id := bson.ObjectIdHex(mux.Vars(r)["id"])
 	books, _, err := db.GetBooks(bson.M{"_id": id})
 	if err != nil {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 
@@ -108,7 +108,7 @@ func cleanEmptyStr(s []string) []string {
 
 func saveHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	if sess.User == "" {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 
@@ -131,7 +131,7 @@ func saveHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	book["keywords"] = keywords(book)
 	err := db.UpdateBook(id, book)
 	if err != nil {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 
@@ -160,7 +160,7 @@ type newData struct {
 
 func newHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	if sess.User == "" {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 
@@ -203,7 +203,7 @@ func newHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 
 func storeHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	if sess.User == "" {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 
diff --git a/cover.go b/cover.go
index 876f7a8..ff9f220 100644
--- a/cover.go
+++ b/cover.go
@@ -26,7 +26,7 @@ func coverHandler(w http.ResponseWriter, r *http.Request) {
 	id := bson.ObjectIdHex(vars["id"])
 	books, _, err := db.GetBooks(bson.M{"_id": id})
 	if err != nil || len(books) == 0 {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	book := books[0]
@@ -34,7 +34,7 @@ func coverHandler(w http.ResponseWriter, r *http.Request) {
 	if !book.Active {
 		sess := GetSession(r)
 		if sess.User == "" {
-			http.NotFound(w, r)
+			notFound(w)
 			return
 		}
 	}
@@ -48,7 +48,7 @@ func coverHandler(w http.ResponseWriter, r *http.Request) {
 	}
 	if err != nil {
 		log.Println("Error while opening image:", err)
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	defer f.Close()
diff --git a/reader.go b/reader.go
index ed035e5..d030c3f 100644
--- a/reader.go
+++ b/reader.go
@@ -131,14 +131,14 @@ func readStartHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	id := mux.Vars(r)["id"]
 	e, _ := openReadEpub(w, r, sess)
 	if e == nil {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	defer e.Close()
 
 	it, err := e.Spine()
 	if err != nil {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	http.Redirect(w, r, "/read/"+id+"/"+it.Url(), http.StatusTemporaryRedirect)
@@ -149,7 +149,7 @@ func readHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	file := mux.Vars(r)["file"]
 	e, book := openReadEpub(w, r, sess)
 	if e == nil {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	defer e.Close()
@@ -195,32 +195,32 @@ func contentHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	id := vars["id"]
 	file := vars["file"]
 	if file == "" {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 
 	books, _, err := db.GetBooks(bson.M{"_id": bson.ObjectIdHex(id)})
 	if err != nil || len(books) == 0 {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	book := books[0]
 	if !book.Active {
 		if sess.User == "" {
-			http.NotFound(w, r)
+			notFound(w)
 			return
 		}
 	}
 	e, err := OpenBook(book.File)
 	if err != nil {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	defer e.Close()
 
 	html, err := e.OpenFile(file)
 	if err != nil {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	defer html.Close()
diff --git a/template.go b/template.go
index d35184f..a5ca948 100644
--- a/template.go
+++ b/template.go
@@ -25,6 +25,7 @@ func GetStatus(w http.ResponseWriter, r *http.Request) Status {
 
 var templates = template.Must(template.ParseFiles(TEMPLATE_PATH+"header.html",
 	TEMPLATE_PATH+"footer.html",
+	TEMPLATE_PATH+"404.html",
 	TEMPLATE_PATH+"index.html",
 	TEMPLATE_PATH+"about.html",
 	TEMPLATE_PATH+"book.html",
diff --git a/templates/404.html b/templates/404.html
new file mode 100644
index 0000000..c5555cd
--- /dev/null
+++ b/templates/404.html
@@ -0,0 +1,12 @@
+{{template "header.html" .}}
+
+<div class="row">
+<div class="span10 offset1">
+	<h4>Page not found</h4>
+	<p>
+	The requested page don't exist.
+	</p>
+</div>
+</div>
+
+{{template "footer.html"}}
diff --git a/trantor.go b/trantor.go
index 7e917cf..d106a20 100644
--- a/trantor.go
+++ b/trantor.go
@@ -53,7 +53,7 @@ func bookHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	id := bson.ObjectIdHex(mux.Vars(r)["id"])
 	books, _, err := db.GetBooks(bson.M{"_id": id})
 	if err != nil || len(books) == 0 {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	db.IncVisit(id)
@@ -65,7 +65,7 @@ func downloadHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	id := bson.ObjectIdHex(mux.Vars(r)["id"])
 	books, _, err := db.GetBooks(bson.M{"_id": id})
 	if err != nil || len(books) == 0 {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	book := books[0]
@@ -73,7 +73,7 @@ func downloadHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	if !book.Active {
 		sess := GetSession(r)
 		if sess.User == "" {
-			http.NotFound(w, r)
+			notFound(w)
 			return
 		}
 	}
@@ -81,7 +81,7 @@ func downloadHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	fs := db.GetFS(FS_BOOKS)
 	f, err := fs.OpenId(book.File)
 	if err != nil {
-		http.NotFound(w, r)
+		notFound(w)
 		return
 	}
 	defer f.Close()
@@ -115,6 +115,11 @@ func indexHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	loadTemplate(w, "index", data)
 }
 
+func notFound(w http.ResponseWriter) {
+	w.WriteHeader(http.StatusNotFound)
+	loadTemplate(w, "404", nil)
+}
+
 func main() {
 	db = initDB()
 	defer db.Close()
@@ -128,6 +133,10 @@ func main() {
 
 func setUpRouter() {
 	r := mux.NewRouter()
+	var notFoundHandler http.HandlerFunc
+	notFoundHandler = GatherStats(func(w http.ResponseWriter, r *http.Request, sess *Session) { notFound(w) })
+	r.NotFoundHandler = notFoundHandler
+
 	r.HandleFunc("/", GatherStats(indexHandler))
 	r.HandleFunc("/book/{id:[0-9a-fA-F]+}", GatherStats(bookHandler))
 	r.HandleFunc("/search/", GatherStats(searchHandler))

From 41258ee8631805f8fba8e142ec43476de65d0bee Mon Sep 17 00:00:00 2001
From: Las Zenow <zenow@tormail.org>
Date: Thu, 9 May 2013 09:42:58 +0200
Subject: [PATCH 2/3] Check if the ObjectIds are valid.

---
 admin.go   | 13 +++++++------
 cover.go   |  4 ++++
 reader.go  |  5 ++++-
 stats.go   | 15 +++++++++------
 trantor.go | 16 ++++++++++++++--
 5 files changed, 38 insertions(+), 15 deletions(-)

diff --git a/admin.go b/admin.go
index 67e87a3..a5558ef 100644
--- a/admin.go
+++ b/admin.go
@@ -48,7 +48,7 @@ func deleteHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	var isNew bool
 	ids := strings.Split(mux.Vars(r)["ids"], "/")
 	for _, idStr := range ids {
-		if idStr == "" {
+		if !bson.IsObjectIdHex(idStr) {
 			continue
 		}
 
@@ -79,11 +79,12 @@ func deleteHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 }
 
 func editHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
-	if sess.User == "" {
+	idStr := mux.Vars(r)["id"]
+	if sess.User == "" || !bson.IsObjectIdHex(idStr) {
 		notFound(w)
 		return
 	}
-	id := bson.ObjectIdHex(mux.Vars(r)["id"])
+	id := bson.ObjectIdHex(idStr)
 	books, _, err := db.GetBooks(bson.M{"_id": id})
 	if err != nil {
 		notFound(w)
@@ -107,12 +108,12 @@ func cleanEmptyStr(s []string) []string {
 }
 
 func saveHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
-	if sess.User == "" {
+	idStr := mux.Vars(r)["id"]
+	if sess.User == "" || !bson.IsObjectIdHex(idStr) {
 		notFound(w)
 		return
 	}
 
-	idStr := mux.Vars(r)["id"]
 	id := bson.ObjectIdHex(idStr)
 	title := r.FormValue("title")
 	publisher := r.FormValue("publisher")
@@ -210,7 +211,7 @@ func storeHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	var titles []string
 	ids := strings.Split(mux.Vars(r)["ids"], "/")
 	for _, idStr := range ids {
-		if idStr == "" {
+		if !bson.IsObjectIdHex(idStr) {
 			continue
 		}
 
diff --git a/cover.go b/cover.go
index ff9f220..dba08f3 100644
--- a/cover.go
+++ b/cover.go
@@ -23,6 +23,10 @@ import (
 
 func coverHandler(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)
+	if !bson.IsObjectIdHex(vars["id"]) {
+		notFound(w)
+		return
+	}
 	id := bson.ObjectIdHex(vars["id"])
 	books, _, err := db.GetBooks(bson.M{"_id": id})
 	if err != nil || len(books) == 0 {
diff --git a/reader.go b/reader.go
index d030c3f..2664776 100644
--- a/reader.go
+++ b/reader.go
@@ -172,6 +172,9 @@ func readHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 func openReadEpub(w http.ResponseWriter, r *http.Request, sess *Session) (*epubgo.Epub, Book) {
 	var book Book
 	id := mux.Vars(r)["id"]
+	if !bson.IsObjectIdHex(id) {
+		return nil, book
+	}
 	books, _, err := db.GetBooks(bson.M{"_id": bson.ObjectIdHex(id)})
 	if err != nil || len(books) == 0 {
 		return nil, book
@@ -194,7 +197,7 @@ func contentHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 	vars := mux.Vars(r)
 	id := vars["id"]
 	file := vars["file"]
-	if file == "" {
+	if file == "" || !bson.IsObjectIdHex(id) {
 		notFound(w)
 		return
 	}
diff --git a/stats.go b/stats.go
index 4751f46..53cc01a 100644
--- a/stats.go
+++ b/stats.go
@@ -60,18 +60,21 @@ func appendMuxVars(vars map[string]string, stats map[string]interface{}) {
 	for key, value := range vars {
 		switch {
 		case key == "id":
-			stats["id"] = bson.ObjectIdHex(value)
+			if bson.IsObjectIdHex(value) {
+				stats["id"] = bson.ObjectIdHex(value)
+			}
 		case key == "ids":
 			var objectIds []bson.ObjectId
 			ids := strings.Split(value, "/")
 			for _, id := range ids {
-				if id == "" {
-					continue
+				if bson.IsObjectIdHex(value) {
+					objectIds = append(objectIds, bson.ObjectIdHex(id))
 				}
-				objectIds = append(objectIds, bson.ObjectIdHex(id))
 			}
-			stats["ids"] = objectIds
-			stats["id"] = objectIds[0]
+			if len(objectIds) > 0 {
+				stats["ids"] = objectIds
+				stats["id"] = objectIds[0]
+			}
 		default:
 			stats[key] = value
 		}
diff --git a/trantor.go b/trantor.go
index d106a20..418f53e 100644
--- a/trantor.go
+++ b/trantor.go
@@ -48,9 +48,15 @@ type bookData struct {
 }
 
 func bookHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
+	idStr := mux.Vars(r)["id"]
+	if !bson.IsObjectIdHex(idStr) {
+		notFound(w)
+		return
+	}
+
 	var data bookData
 	data.S = GetStatus(w, r)
-	id := bson.ObjectIdHex(mux.Vars(r)["id"])
+	id := bson.ObjectIdHex(idStr)
 	books, _, err := db.GetBooks(bson.M{"_id": id})
 	if err != nil || len(books) == 0 {
 		notFound(w)
@@ -62,7 +68,13 @@ func bookHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
 }
 
 func downloadHandler(w http.ResponseWriter, r *http.Request, sess *Session) {
-	id := bson.ObjectIdHex(mux.Vars(r)["id"])
+	idStr := mux.Vars(r)["id"]
+	if !bson.IsObjectIdHex(idStr) {
+		notFound(w)
+		return
+	}
+
+	id := bson.ObjectIdHex(idStr)
 	books, _, err := db.GetBooks(bson.M{"_id": id})
 	if err != nil || len(books) == 0 {
 		notFound(w)

From 155144d86ea942cba649549b36308f478242c5d7 Mon Sep 17 00:00:00 2001
From: Las Zenow <zenow@tormail.org>
Date: Tue, 28 May 2013 01:22:22 +0200
Subject: [PATCH 3/3] Produce prev link only if it's not empty

---
 reader.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/reader.go b/reader.go
index 2664776..da5e89c 100644
--- a/reader.go
+++ b/reader.go
@@ -75,7 +75,9 @@ func getNextPrev(e *epubgo.Epub, file string, id string, base string) (string, s
 		return "", ""
 	}
 
-	prev = genLink(id, base, prev)
+	if prev != "" {
+		prev = genLink(id, base, prev)
+	}
 	if spine.Next() == nil {
 		next = genLink(id, base, spine.Url())
 	}