྅༻ Ǭɀħ ༄༆ཉ

### Discussed in https://github.com/orgs/YOURLS/discussions/3399 Originally posted by **composertech** August 4, 2022 Hi, I observed the following behaviour. I added several new URLs through the interface. In the same session I...

A cookie pair named `username` and `password` will prevent logging in

7

YOURLS stores credentials (hashed login / password) in a uniquely named cookie, something like `yourls_75715761fe7da[...]199e566c53f27eeb`, see [`yourls_store_cookie()`](https://github.com/YOURLS/YOURLS/blob/16be4c392cb07e345521c5cbe9e0ff0ae2eb6cd4/includes/functions-auth.php#L454). Yet, if two cookies named `username` and `password` are present, it makes logging...

Use sandbox to include every user defined PHP files

1

Since YOURLS 1.9 we have a foolproof sandbox to safely include PHP files, used for plugins : https://github.com/YOURLS/YOURLS/blob/27375bc813f2ddc38030800e466babb72d7a5a66/includes/functions-plugins.php#L682-L696 Rename this function to make it more generic, update tests accordingly, and...

This is a **COPY** of **Issue 372: [Truncate yourls_log && keep stats in tact](http://code.google.com/p/yourls/issues/detail?id=372)**, filed on Google Code before the project was [moved on Github](https://github.com/ozh/google-issues-to-github). - Submitted on 2010-06-21T01:48:53.000Z by...

Possible Google Charts & off-site calls replacement

19

Currently we use 3rd party off-site libs (Google's) to display charts and favicons -- see #1555 Alternative to consider: [morris.js](https://github.com/morrisjs/morris.js) + [Raphaël](https://github.com/DmitryBaranovskiy/raphael) Examples: - http://bucketadmin.themebucket.net/morris.html - http://raphael-heat-map-demo.herokuapp.com/

Enhance cookies with prefixes ?

2

As of writing, Firefox and Chrome support "cookie prefixes". Investigate this. > The `__Secure-` prefix makes a cookie accessible from HTTPS sites only. A HTTP site can not read or...

Strenghten `yourls_is_shorturl()`

3

Things could be optimized : ```php var_dump(yourls_is_shorturl('https://ozh.in/yp')); // bool(true) var_dump(yourls_is_shorturl('http://ozh.in/yp')); // bool(true) var_dump(yourls_is_shorturl('https://www.ozh.in/yp')); // bool(false) - might be considered true - see #3242 var_dump(yourls_is_shorturl('http://www.ozh.in/yp')); // bool(false) - might be considered...

Document special files

3

We could improve documentation about some special files: - `user/db_error.php` : custom DB error page - `user/maintenance.php` : custom maintenance page - `user/favicon.(jpg|gif|png|ico|svg)` : custom favicon - `user/cache.php` : "must...

Saved for potential usage some day : * https://flagcdn.com/ has flags in PNG, JPG, WEBP, SVG and a nice [api](https://flagpedia.net/download/api). * https://restcountries.com has an API to get lots of data...

Improve stat pages

2

Stat pages are a complete shitshow exposing how bad I was at mysqling things 10 years ago (not saying I've really improved in that area :) Problems: 1. Code [has...