Spaces:
Sleeping
Sleeping
Commit History
-
Replace every em dash across the repo
Rewrites all 105 em dashes in place rather than swapping in hyphens, so the punctuation suits each sentence: colons where the dash introduced a definition or a list, full stops where it joined two independent clauses, commas or semicolons for asides, and parentheses for the one true mid-sentence interruption in the consent copy. One knock-on: the 'didn't produce a file' error now ends a sentence, so the following fragment starts with a capital. Touches app.py (47), CHANGELOG (15), admin/purge_submission.py (10), README (9), DELETION (9), redact_stars.py (6) and redactors/ (9). No behavior changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>6a889d3
-
Accept PDFs only, verified by content rather than filename
The uploader's type=["pdf"] filter applies to the FILENAME, so any file renamed to .pdf got through it and was handed to the redaction engine. Uploads are now checked against the "%PDF-" header in the actual bytes. - _upload_rejection() consolidates the filename, size, and content checks into one place, run cheapest-first so an oversized file is refused on its size before anything reads it. - The header is looked for in the first 1 KB rather than at byte 0, since real PDFs sometimes carry junk ahead of the header. Verified a report with leading whitespace still redacts. - Refusals name the actual problem, so a student who renamed a screenshot is told that instead of getting a generic failure. purge_submission.py now states outright that it will only ever target a .pdf path. The report ID pattern already guaranteed it; this makes it a rule rather than a consequence. Tested: ZIP, PNG, Mach-O, HTML, plain text and an empty file all refused when renamed to .pdf; .docx, .exe, r…1fc76f2
-
Add upload guardrails, deletion purge script, and longer report IDs
Pre-deployment review items: - Upload guardrails: 10 MB size, 15 page, and 30 second processing limits, each with a plain-language message. Size is checked in app.py before the bytes reach the engine; page count and the time limit are enforced in redact_bytes, which takes both as parameters and defaults them to off so the CLI stays unbounded. - Deletion: admin/purge_submission.py deletes a report AND purges it from the dataset's history, since the dataset is version-controlled and a plain delete leaves the file recoverable in the prior commit. DELETION.md explains the rationale and usage. Accepts the legacy 8-character IDs used by every report currently stored. - Report IDs: 8 hex characters from uuid4 -> 32 from secrets, making both guessing and collisions infeasible. Shown in a copy box since it is meant to be copied rather than transcribed. - Residual PII scan (redactors/residual.py): advisory, non-blocking warnings for an email address, phone number, or la…2b5e6b7