Knowledge Base (Posts about webapps)

LWSP upgrade for Luanti 5.17.0

bgstack15 — Mon, 07 Sep 2026 12:40:00 GMT

Luanti's recent release of version 5.17.0 added a feature that validates ContentDB package author using a simple regex, but Luanti WebServices Proxy overloads the author field with the backend server connection information, so I had to update LWSP to fix this.

The validations fit entirely in this block, in file builtin/mainmenu/content/contentdb.lua

for i = #packages, 1, -1 do
    local package = packages[i]
    if not (type(package.author) == "string" and
            type(package.name) == "string" and
            type(package.type) == "string" and
            type(package.release) == "number" and
            package.author:match("^[%w _%-.]+$") and
            package.name:match("^[a-z0-9_]+$")) then
        core.log("warning", "ContentDB: Dropping invalid package: " .. dump(package))
        table.remove(packages, i)
    end
end

So it's lua, thankfully, which is way easier for me to read than C++. An easy fix would be to adjust the client lua file to add a colon and tilde in the package author regex.

package.author:match("^[%w _%-.~:]+$") and

But seeing as how nobody else will adjust their client configs to allow that, so I adjusted lwsp to split author and host+proto with _AT_ rather than ~, and also replace a colon with _colon_. It's longer and a little less pretty, but it matches the vanilla client expectations. Not everyone who might use lwsp will use a stackrpms build of Luanti.

Progressive web app with share target for Android

bgstack15 — Sun, 06 Jul 2025 12:43:00 GMT

I have known for a while that "progressive web apps" (apparently only supported in one browser) can be "installed" as an "app" on a mobile device, and they can be the target for receiving shared items! I finally bothered to learn how to do this with my flask app stackbin!

There's a large number of steps required, and I ripped pretty much all of this (minus flask-specific troubleshooting) from reference 1. The main parts include:

Add file manifest.json on the top level virtual path of your application. I had to add some jinja2 templating to handle the static prefix for my app.

File Upload and Storage Service

bgstack15 — Thu, 21 Jan 2021 13:35:59 GMT

I present to the Internet my take on a python+flask web app! File Upload and Storage Service is a small webapp for uploading and serving files. Please run an instance behind authentication of some sort (which could be at the web server level) so malicious actors do not upload bad things to your server. Check out the code at https://gitlab.com/bgstack15/fuss. FUSS includes some cool features, like drag-and-drop upload on the optional upload page. If you disable the separate upload page, then users can just curl to the application base URL. The application dynamically discovers the path that the user used to get to the app! But admins who prefer to actually enforce a specific URL for the application can configure that in the config file. A sysvinit service script is provided, as well as a systemd service file. A dpkg recipe and also rpm spec are included. To run this application on CentOS 7, you will need pip3 and a few modules from it. This program is designed mostly as a demo of all the various bits: javascript, python and flask, apache reverse proxying, and html.

Domains for cookies for office.com

bgstack15 — Thu, 27 Oct 2016 11:54:21 GMT

Overview

As part of my security measures, I don't enable cookies by default for all sites. I enable them per-site, on an as-needed basis. So my whitelist is very large, but I think it helps more than it hinders.

Problem

So modern web applications depends on lots and lots of cookies. The office.com applications depend on a large set of domains. Here is what I have learned so far: adfs.example.com (my company's ADFS page) excel.officeapps.live.com live.com login.live.com login.microsoftonline.com login.windows.net office.com office.live.com office365.com portal.office.com powerpoint.officeapps.live.com products.office.com word-edit.officeapps.live.com