commit ebf6a4b

URLs like {srv_baseurl}/{user}/admin/p/{md5} are valid.

But only if {md5} is in the user's timeline.

 1@@ -1065,14 +1065,18 @@ int timeline_touch(snac *snac)
 2 xs_str *timeline_fn_by_md5(snac *snac, const char *md5)
 3 /* get the filename of an entry by md5 from any timeline */
 4 {
 5-    xs_str *fn = xs_fmt("%s/private/%s.json", snac->basedir, md5);
 6+    xs_str *fn = NULL;
 7 
 8-    if (mtime(fn) == 0.0) {
 9-        fn = xs_free(fn);
10-        fn = xs_fmt("%s/public/%s.json", snac->basedir, md5);
11+    if (xs_is_hex(md5) && strlen(md5) == 32) {
12+        fn = xs_fmt("%s/private/%s.json", snac->basedir, md5);
13 
14-        if (mtime(fn) == 0.0)
15+        if (mtime(fn) == 0.0) {
16             fn = xs_free(fn);
17+            fn = xs_fmt("%s/public/%s.json", snac->basedir, md5);
18+
19+            if (mtime(fn) == 0.0)
20+                fn = xs_free(fn);
21+        }
22     }
23 
24     return fn;

 1@@ -2586,6 +2586,25 @@ int html_get_handler(const xs_dict *req, const char *q_path,
 2         }
 3     }
 4     else
 5+    if (xs_startswith(p_path, "admin/p/")) { /** unique post by md5 **/
 6+        if (!login(&snac, req)) {
 7+            *body  = xs_dup(uid);
 8+            status = 401;
 9+        }
10+        else {
11+            xs *l = xs_split(p_path, "/");
12+            char *md5 = xs_list_get(l, -1);
13+
14+            if (md5 && *md5 && timeline_here(&snac, md5)) {
15+                xs *list = xs_list_append(xs_list_new(), md5);
16+
17+                *body   = html_timeline(&snac, list, 0, 0, 0, 0, NULL, "/admin", 1);
18+                *b_size = strlen(*body);
19+                status  = 200;
20+            }
21+        }
22+    }
23+    else
24     if (strcmp(p_path, "people") == 0) { /** the list of people **/
25         if (!login(&snac, req)) {
26             *body  = xs_dup(uid);