# 4ducky.com

Rust port of the original 4ducky.com image board (a Picturelicious fork, PHP 5 / MySQL, ~2012–2016).
Design, layout, URLs and features are kept 1:1. The original PHP source is preserved untouched in
[`legacy/`](legacy/).

**Stack:** Rust · Axum · SQLite (sqlx) · Askama templates · argon2 · vanilla JS

## Running

```sh
cp config.example.toml config.toml   # optional, defaults work for local use
cargo run --release                  # http://127.0.0.1:8080
```

Run it from the repository root: the server serves `media/`, `images/` and `favicon.ico` from there.
The SQLite database and all uploads live in `data_dir` (default `data/`, git-ignored). Migrations run
automatically on start.

### Behind a reverse proxy

Set these in `config.toml`, otherwise form posts are rejected as cross-site and every visitor
looks like `127.0.0.1` (which closes registration via the one-account-per-IP lock):

```toml
frontend_path = "https://your-domain.tld/"   # the public URL, exactly as in the address bar
trust_proxy = true                           # take the client IP from X-Forwarded-For
secure_cookies = true                        # when the proxy terminates HTTPS
```

The proxy must append the client address to `X-Forwarded-For` (nginx:
`proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`, Caddy does it by default).

### Admin CLI

```sh
fourducky admin <name> [--revoke]                 # grant/revoke admin
fourducky settings --register on|off --upload on|off --message '<b>Dolan:</b> "..."'
fourducky invites <name> --count 5                # create invite codes (was runfav.php)
```

Register an account on the site first, then make it admin. User id 1 is the "superadmin" by default
(HoF / Ban links), see `superadmins` in the config.

## Layout

| Path | What |
|---|---|
| `src/` | server: routing (`main.rs`), sessions/CSRF (`app.rs`, `auth.rs`), pages (`browse.rs`, `view.rs`, `account.rs`, `inbox.rs`, `misc.rs`), uploads (`uploader.rs`, `imaging.rs`, `fetch.rs`), `grid.rs`, `bbcode.rs`, `captcha.rs` |
| `templates/` | Askama templates, ported markup from `legacy/templates/*.tpl.php` |
| `media/` | original CSS/images, plus `4ducky.js` (replaces jQuery + picturelicious.js/functions.js/jqpr.js/lightbox.js) and `4ducky.css` (small additions) |
| `migrations/` | SQLite schema (from `legacy/dumb.sql`) |
| `legacy/` | the original PHP site, unchanged |

## Differences to the PHP version

Behaviour and look are the same; these are the deliberate changes:

**Security**
- All SQL is parameterized (the inbox had SQL injection; the DB layer used `preg_replace /e`).
- Output is escaped by default; BBCode runs on escaped text and only allows http(s) URLs. User
  websites must be http(s) (no more `javascript:` links). Abuse report links are only clickable when http(s).
- Passwords: argon2id instead of unsalted md5. Sessions are random tokens stored hashed server-side.
- CSRF tokens on every form, AJAX call and state-changing link (logout, reset unread, manage actions);
  cross-site POSTs are rejected.
- Strict Content-Security-Policy (`script-src 'self'`): inline `onclick`/`<script>` became `data-*`
  hooks in `media/4ducky.js`.
- Remote image fetching (URL upload, comment URLs, bookmarklet) blocks private/loopback/link-local
  addresses, limits redirects, size (8 MB) and time.
- Uploads are checked by magic bytes, decoded with size limits, and get server-generated file names.
- Admin endpoints check permissions server-side (HoF/Ban only for `superadmins`); TimeBlock duration
  is computed on the server.
- Login, register, abuse and PMs are rate limited per IP/user.

**Replaced or removed**
- reCAPTCHA v1 → self-hosted image captcha.
- Google Analytics, AddThis, Facebook like-box, coin widget → removed. `/chat`, `/forum`, `/shop` keep
  their layout and take an optional embed URL from the config.
- No e-mail: accounts are active right after registering (as they were in practice).
- The bookmarklet opens a small first-party popup with a "Post" button instead of uploading from a
  cross-site iframe (modern browsers block third-party cookies; the old flow was also a CSRF hole).
- jQuery slimScroll → native thin scrollbars.

**Bugs fixed on the way**
- White-style users couldn't comment (form was inside the black-style branch).
- Blocking a user from the profile page wiped your website field.
- Comments could still be posted to closed threads via AJAX.
- `.b2 { width: 64x }` CSS typo made guest teaser thumbnails overflow (fixed in `4ducky.css`).
- Quicktagger referenced a missing `#home` element and never worked.

The original content is kept verbatim, including rank badges and texts, for archival purposes.