changes required for jsdoc, adding legacy.js to code coverage

updating PHP dependencies (they remain unchanged), committing lock for github dependency graph support
incrementing version number in preparation of release
2026-04-19 21:58:08 -04:00 · 2019-09-22 21:18:19 +02:00 · 2019-09-22 19:52:25 +02:00 · 2019-09-22 19:42:04 +02:00 · 2019-09-20 07:06:38 +02:00 · 2019-09-20 07:04:26 +02:00
71 changed files with 4287 additions and 569 deletions
@@ -1,3 +1,4 @@
+---
 parserOptions:
  ecmaVersion: 2017

@@ -11,17 +12,16 @@ env:
  es6: true
  jquery: true
  node: true
+  mocha: true

 globals:
-  DOMPurify: false
-  after: true
-  before: true
-  cleanup: true
-  describe: false
-  it: false
-  jsc: false
-  jsdom: true
-  kjua: true
+  DOMPurify: readonly
+  cleanup: writable
+  describe: readonly
+  jsc: readonly
+  jsdom: writable
+  kjua: writable
+  WebCrypto: writable

 # http://eslint.org/docs/rules/
 rules:
@@ -1,5 +1,6 @@
 doc/ export-ignore
 tst/ export-ignore
+img/browserstack.svg export-ignore
 js/.istanbul.yml export-ignore
 js/.nycrc.yml export-ignore
 js/common.js export-ignore
@@ -18,4 +19,6 @@ js/test/ export-ignore
 .styleci.yml export-ignore
 .travis.yml export-ignore
 composer.json export-ignore
+composer.lock export-ignore
 BADGES.md export-ignore
+CODE_OF_CONDUCT.md export-ignore
@@ -12,10 +12,6 @@ data/
 doc/*
 !doc/*.md

-# Ignore developers composer status so it isn't accidentally checked in,
-# see https://github.com/PrivateBin/PrivateBin/issues/84
-composer.lock
-
 # Ignore vendor dir of Composer except PHP files
 vendor/*.*
 vendor/*/*.*
@@ -2,3 +2,11 @@ RewriteEngine on
 RewriteCond !%{HTTP_USER_AGENT} "Let's Encrypt validation server" [NC]
 RewriteCond %{HTTP_USER_AGENT} ^.*(bot|spider|crawl|https?://|WhatsApp|SkypeUriPreview|facebookexternalhit) [NC]
 RewriteRule .* - [R=403,L]
+
+<IfModule mod_php7.c>
+php_value max_execution_time 30
+php_value post_max_size 10M
+php_value upload_max_size 10M
+php_value upload_max_filesize 10M
+php_value max_file_uploads 100
+</IfModule>
@@ -1,5 +1,7 @@
 language: php
 sudo: false
+# only needed for PHP 5.5 support as of 2019-07
+dist: trusty
 php:
  - '5.5'
  - '5.6'
@@ -7,3 +7,5 @@
 [![SensioLabsInsight](https://insight.sensiolabs.com/projects/57c9e74e-c6f9-4de6-a876-df66ec2ea1ff/mini.png)](https://insight.sensiolabs.com/projects/57c9e74e-c6f9-4de6-a876-df66ec2ea1ff)  
 [![Codacy Badge](https://api.codacy.com/project/badge/Coverage/094500f62abf4c9aa0c8a8a4520e4789)](https://www.codacy.com/app/PrivateBin/PrivateBin)
 [![Test Coverage](https://codeclimate.com/github/PrivateBin/PrivateBin/badges/coverage.svg)](https://codeclimate.com/github/PrivateBin/PrivateBin/coverage) [![Code Coverage](https://scrutinizer-ci.com/g/PrivateBin/PrivateBin/badges/coverage.png?b=master)](https://scrutinizer-ci.com/g/PrivateBin/PrivateBin/?branch=master)
+
+[![BrowserStack - cross browser testing](img/browserstack.svg)](https://www.browserstack.com/)
@@ -1,6 +1,23 @@
 # PrivateBin version history

-  * **1.3 (not yet released)**
+  * **1.4 (not yet released)**
+  * **1.3.1 (2019-09-22)**
+    * ADDED: Translation for Bulgarian (#455)
+    * CHANGED: Improved mobile UI - obscured send button and hard to click shortener button (#477)
+    * CHANGED: Enhanced URL shortener integration (#479)
+    * CHANGED: Improved file upload drag & drop UI (#317)
+    * CHANGED: Increased default size limit from 2 to 10 MiB, switch data from BLOB to MEDIUMBLOB in MySQL (#458)
+    * CHANGED: Upgrading libraries to: DOMpurify 2.0.1
+    * FIXED: Enabling browsers without WASM to create pastes and read uncompressed ones (#454)
+    * FIXED: Cloning related issues (#489, #491, #493, #494)
+    * FIXED: Enable file operation only when editing (#497) 
+    * FIXED: Clicking 'New' on a previously submitted paste does not blank address bar (#354)
+    * FIXED: Clear address bar when create new paste from existing paste (#479)
+    * FIXED: Discussion section not hiding when new/clone paste is clicked on (#484)
+    * FIXED: Showdown.js error when posting svg qrcode (#485)
+    * FIXED: Failed to handle the case where user cancelled attachment selection properly (#487)
+    * FIXED: Displaying the appropriate errors in older browsers (#508)
+  * **1.3 (2019-07-09)**
    * ADDED: Translation for Czech (#424)
    * ADDED: Threat modeled the application (#177)
    * ADDED: Made compression configurable (#38)
@@ -0,0 +1,9 @@
+# Netiquette
+
+As suggested by the current project hoster, we are hereby referring to
+[RFC 1855](https://tools.ietf.org/html/rfc1855) as a minimum set of guidelines
+of Network Etiquette for individuals interacting on this project.
+
+The maintainers of this project reserve the right to remove unlawful or
+disrupting content and block users that repeatedly disturb the project at their
+discretion.
@@ -25,6 +25,7 @@ Sébastien Sauvage - original idea and main developer
 * PunKeel - first docker container
 * thororm - Display of video, audio & PDF, drag & drop, preview of attachments
 * Harald Leithner - base58 encoding of key
+* Haocen - lots of bugfixes and UI improvements

 ## Translations
 * Hexalyse - French
@@ -42,3 +43,4 @@ Sébastien Sauvage - original idea and main developer
 * Michael van Schaik - Dutch
 * Péter Tabajdi - Hungarian
 * info-path - Czech
+* BigWax - Bulgarian
@@ -139,7 +139,7 @@ For reference or if you want to create the table schema for yourself to avoid ha
 ```sql
 CREATE TABLE prefix_paste (
    dataid CHAR(16) NOT NULL,
-    data BLOB,
+    data MEDIUMBLOB,
    postdate INT,
    expiredate INT,
    opendiscussion INT,
@@ -165,7 +165,7 @@ CREATE INDEX parent ON prefix_comment(pasteid);
 CREATE TABLE prefix_config (
    id CHAR(16) NOT NULL, value TEXT, PRIMARY KEY (id)
 );
-INSERT INTO prefix_config VALUES('VERSION', '1.3');
+INSERT INTO prefix_config VALUES('VERSION', '1.3.1');
 ```

 In **PostgreSQL**, the data, attachment, nickname and vizhash columns needs to be TEXT and not BLOB or MEDIUMBLOB.
@@ -1,6 +1,6 @@
 # [![PrivateBin](https://cdn.rawgit.com/PrivateBin/assets/master/images/preview/logoSmall.png)](https://privatebin.info/)

-*Current version: 1.3*
+*Current version: 1.3.1*

 **PrivateBin** is a minimalist, open source online [pastebin](https://en.wikipedia.org/wiki/Pastebin)
 where the server has zero knowledge of pasted data.
@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.3.1   | :heavy_check_mark: |
+| < 1.3.1 | :x:                |
+
+## Reporting a Vulnerability
+
+You can send us email at security@privatebin.org. You should be able to get
+a response within a week (usually during the next weekend). The respondee will
+reply from their personal address and can offer you their GPG public key to
+support end-to-end encrypted communication on sensitive topics or attachments.
+
+You can also contact us via the regular issue tracker if the risk of early
+publication is low or you would request input from other PrivateBin users.
@@ -29,8 +29,8 @@ defaultformatter = "plaintext"
 ; (optional) set a syntax highlighting theme, as found in css/prettify/
 ; syntaxhighlightingtheme = "sons-of-obsidian"

-; size limit per paste or comment in bytes, defaults to 2 Mebibytes
-sizelimit = 2097152
+; size limit per paste or comment in bytes, defaults to 10 Mebibytes
+sizelimit = 10485760

 ; template to include, default is "bootstrap" (tpl/bootstrap.php)
 template = "bootstrap"
@@ -68,9 +68,18 @@ languageselection = false
 ; custom scripts from third-party domains to your templates, e.g. tracking
 ; scripts or run your site behind certain DDoS-protection services.
 ; Check the documentation at https://content-security-policy.com/
-; Note: If you use a bootstrap theme, you can remove the allow-popups from the sandbox restrictions.
-; By default this disallows to load images from third-party servers, e.g. when they are embedded in pastes. If you wish to allow that, you can adjust the policy here. See https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-it-load-embedded-images for details.
-; cspheader = "default-src 'none'; manifest-src 'self'; connect-src *; script-src 'self' 'unsafe-eval'; style-src 'self'; font-src 'self'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals"
+; Notes:
+; - If you use a bootstrap theme, you can remove the allow-popups from the
+;   sandbox restrictions.
+; - By default this disallows to load images from third-party servers, e.g. when
+;   they are embedded in pastes. If you wish to allow that, you can adjust the
+;   policy here. See https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-not-it-load-embedded-images
+;   for details.
+; - The 'unsafe-eval' is used in two cases; to check if the browser supports
+;   async functions and display an error if not and for Chrome to enable
+;   webassembly support (used for zlib compression). You can remove it if Chrome
+;   doesn't need to be supported and old browsers don't need to be warned.
+; cspheader = "default-src 'none'; manifest-src 'self'; connect-src * blob:; script-src 'self' 'unsafe-eval'; style-src 'self'; font-src 'self'; img-src 'self' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals"

 ; stay compatible with PrivateBin Alpha 0.19, less secure
 ; if enabled will use base64.js version 1.7 instead of 2.1.9 and sha1 instead of
@@ -6,7 +6,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 body {
@@ -80,10 +80,29 @@ body.loading {
 	margin-bottom: 20px;
 }

+#dropzone {
+	text-align: center;
+	position: fixed;
+	top: 0;
+	left: 0;
+	width: 100%;
+	height: 100%;
+	z-index: 1000;
+	opacity: 0.6;
+	background-color: #99ccff;
+	background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24'%3E%3Cpath d='M0 0h24v24H0z' fill='none'/%3E%3Cpath d='M19.35 10.04C18.67 6.59 15.64 4 12 4 9.11 4 6.6 5.64 5.35 8.04 2.34 8.36 0 10.91 0 14c0 3.31 2.69 6 6 6h13c2.76 0 5-2.24 5-5 0-2.64-2.05-4.78-4.65-4.96zM14 13v4h-4v-4H7l5-5 5 5h-3z'/%3E%3C/svg%3E");
+	background-repeat: no-repeat;
+	background-position: center;
+	background-size: 25vh;
+	outline: 2px dashed #228bff;
+	outline-offset: -50px;
+}
+
 .dragAndDropFile{
 	color: #777;
 	font-size: 1em;
 	display: inline;
+	white-space: normal;
 }

 #deletelink {
@@ -112,8 +131,9 @@ body.loading {
 	margin-bottom: 10px;
 }

-#message {
+#message, .replymessage {
 	font-family: monospace;
+	resize: vertical;
 }

 #nickname {
@@ -124,6 +144,10 @@ body.loading {
 	margin-bottom: 10px;
 }

+#filewrap {
+	transition: background-color 0.75s ease-out;
+}
+
 .comment {
 	border-left: 1px solid #ccc;
 	padding: 5px 0 5px 10px;
@@ -131,7 +155,7 @@ body.loading {
 	transition: background-color 0.75s ease-out;
 }

-.comment.highlight {
+.highlight {
 	background-color: #ffdd86;
 	transition: background-color 0.2s ease-in;
 }
@@ -147,3 +171,12 @@ li.L0, li.L1, li.L2, li.L3, li.L5, li.L6, li.L7, li.L8 {
 .dark-theme .alert-info .alert-link {
 	color: #fff;
 }
+
+/* address 2K or 4K monitors when using bootstrap 3 */
+@media (min-width: 1280px) {
+	.container {
+		width: 100%;
+		padding-left: 4ch;
+		padding-right: 4ch;
+	}
+}
@@ -6,7 +6,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 /* When there is no script at all other */
@@ -6,7 +6,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 /*  CSS Reset from YUI 3.4.1 (build 4118) - Copyright 2011 Yahoo! Inc. All rights reserved.
@@ -102,6 +102,7 @@ h3.title {
 	padding: 5px;
 	white-space: pre-wrap;
 	font-family: Consolas, "Lucida Console", "DejaVu Sans Mono", Monaco, monospace;
+	resize: vertical;
 }

 #attachmentPreview img {
@@ -115,10 +116,29 @@ h3.title {
 	margin-bottom: 20px;
 }

+#dropzone {
+	text-align: center;
+	position: fixed;
+	top: 0;
+	left: 0;
+	width: 100%;
+	height: 100%;
+	z-index: 1000;
+	opacity: 0.6;
+	background-color: #99ccff;
+	background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='24' height='24' viewBox='0 0 24 24'%3E%3Cpath d='M0 0h24v24H0z' fill='none'/%3E%3Cpath d='M19.35 10.04C18.67 6.59 15.64 4 12 4 9.11 4 6.6 5.64 5.35 8.04 2.34 8.36 0 10.91 0 14c0 3.31 2.69 6 6 6h13c2.76 0 5-2.24 5-5 0-2.64-2.05-4.78-4.65-4.96zM14 13v4h-4v-4H7l5-5 5 5h-3z'/%3E%3C/svg%3E");
+	background-repeat: no-repeat;
+	background-position: center;
+	background-size: 25vh;
+	outline: 2px dashed #228bff;
+	outline-offset: -50px;
+}
+
 .dragAndDropFile{
 	color: #777;
 	font-size: 1em;
 	display: inline;
+	white-space: normal;
 }

 #status {
@@ -405,6 +425,15 @@ h4.title {

 .commentdate { color: #bfcede; }

+#filewrap {
+	transition: background-color 0.75s ease-out;
+}
+
+.highlight {
+	background-color: #ffdd86;
+	transition: background-color 0.2s ease-in;
+}
+
 img.vizhash {
 	width: 16px;
 	height: 16px;
@@ -55,6 +55,6 @@ $ ln -s /usr/bin/nodejs /usr/local/bin/node
 To generate the documentation, change into the main directory and run phpdoc:
 ```console
 $ cd PrivateBin
-$ jsdoc -p -d doc/jsdoc js/privatebin.js
+$ jsdoc -p -d doc/jsdoc js/privatebin.js js/legacy.js
 ```

@@ -0,0 +1,164 @@
+{
+    "PrivateBin": "PrivateBin",
+    "%s is a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted <i>in the browser</i> using 256 bits AES. More information on the <a href=\"https://privatebin.info/\">project page</a>.":
+        "%s е изчистен и изцяло достъпен като отворен код, онлайн \"paste\" услуга, където сървъра не знае подадената информация. Тя се шифрова/дешифрова <i>във браузъра</i> използвайки 256 битов AES алгоритъм. Повече информация може да намерите на <a href=\"https://privatebin.info/\">страницата на проекта (Английски)</a>",
+    "Because ignorance is bliss":
+        "Невежеството е блаженство",
+    "en": "bg",
+    "Paste does not exist, has expired or has been deleted.":
+        "Информацията не съществува, срокът и е изтекъл или е била изтрита.",
+    "%s requires php %s or above to work. Sorry.":
+        "%s има нужда от PHP %s или по-нова, за да работи. Съжалявам.",
+    "%s requires configuration section [%s] to be present in configuration file.":
+        "%s задължава отдела от настройките [%s] да съществува във файла със настройките.",
+    "Please wait %d seconds between each post.":
+        "Моля изчакайте %d секунди между всяка публикация.",
+    "Paste is limited to %s of encrypted data.":
+        "Съдържанието е ограничено до %s криптирана информация.",
+    "Invalid data.":
+        "Невалидна информация.",
+    "You are unlucky. Try again.":
+        "Нямаш късмет. Пробвай отново.",
+    "Error saving comment. Sorry.":
+        "Грешка в запазването на коментара. Съжалявам.",
+    "Error saving paste. Sorry.":
+        "Грешка в записването на информацията. Съжалявам.",
+    "Invalid paste ID.":
+        "Невалиден идентификационен код.",
+    "Paste is not of burn-after-reading type.":
+        "Информацията не е от тип \"унищожаване след преглед\".",
+    "Wrong deletion token. Paste was not deleted.":
+        "Невалиден код за изтриване. Информацията Ви не беше изтрита.",
+    "Paste was properly deleted.":
+        "Информацията Ви е изтрита.",
+    "JavaScript is required for %s to work.<br />Sorry for the inconvenience.":
+        "Услугата %s се нуждае от JavaScript, за да работи.<br />Съжаляваме за неудобството.",
+    "%s requires a modern browser to work.":
+        "%s се нуждае от съвременен браузър за да работи.",
+    "New":
+        "Създаване",
+    "Send":
+        "Изпрати",
+    "Clone":
+        "Дублирай",
+    "Raw text":
+        "Чист текст",
+    "Expires":
+        "Изтича",
+    "Burn after reading":
+        "Унищожи след преглед",
+    "Open discussion":
+        "Отворена дискусия",
+    "Password (recommended)":
+        "Парола (препоръчва се)",
+    "Discussion":
+        "Коментари",
+    "Toggle navigation":
+        "Включи или Изключи навигацията",
+    "%d seconds": ["%d секунди", "%d секунда"],
+    "%d minutes": ["%d минути", "%d минута"],
+    "%d hours": ["%d часа", "%d час"],
+    "%d days": ["%d дни", "%d ден"],
+    "%d weeks": ["%d седмици", "%d седмица"],
+    "%d months": ["%d месеци", "%d месец"],
+    "%d years": ["%d години", "%d година"],
+    "Never":
+        "Никога",
+    "Note: This is a test service: Data may be deleted anytime. Kittens will die if you abuse this service.":
+        "Забележка: Това е пробна услуга: Информацията може да бъде изтрита по всяко време. Котета ще измрат ако злоупотребиш с услугата.",
+    "This document will expire in %d seconds.":
+        ["Този документ изтича след една секунда.", "Този документ изтича след %d секунди."],
+    "This document will expire in %d minutes.":
+        ["Този документ изтича след една минута.", "Този документ изтича след %d минути."],
+    "This document will expire in %d hours.":
+        ["Този документ изтича след един час.", "Този документ изтича след %d часа."],
+    "This document will expire in %d days.":
+        ["Този документ изтича след един ден.", "Този документ изтича след %d дни."],
+    "This document will expire in %d months.":
+        ["Този документ изтича след една година.", "Този документ изтича след %d години."],
+    "Please enter the password for this paste:":
+        "Моля въведете паролата за това съдържание:",
+    "Could not decrypt data (Wrong key?)":
+        "Информацията не можеше да се дешифрова (Грешен ключ?)",
+    "Could not delete the paste, it was not stored in burn after reading mode.":
+        "Изтриването на информацията беше неуспешно. Тя не е от тип \"унищожаване след преглед\".",
+    "FOR YOUR EYES ONLY. Don't close this window, this message can't be displayed again.":
+        "САМО ЗА ВАШИТЕ ОЧИ. Не затваряйте прозореца, понеже тази информация няма да може да бъде показана отново.",
+    "Could not decrypt comment; Wrong key?":
+        "Дешифроването на коментара беше неуспешно. Грешен ключ?",
+    "Reply":
+        "Отговор",
+    "Anonymous":
+        "Безименен",
+    "Avatar generated from IP address":
+        "Аватар (на базата на IP адреса Ви)",
+    "Add comment":
+        "Добави коментар",
+    "Optional nickname…":
+        "Избирателен псевдоним",
+    "Post comment":
+        "Публикувай коментара",
+    "Sending comment…":
+        "Изпращане на коментара Ви…",
+    "Comment posted.":
+        "Коментара Ви е публикуван.",
+    "Could not refresh display: %s":
+        "Презареждането на екрана беше неуспешно: %s",
+    "unknown status":
+        "Неизвестно състояние",
+    "server error or not responding":
+        "Грешка в сървъра или не отговаря",
+    "Could not post comment: %s":
+        "Публикуването на коментара Ви беше неуспешно: %s",
+    "Sending paste…":
+        "Изпращане на информацията Ви…",
+    "Your paste is <a id=\"pasteurl\" href=\"%s\">%s</a> <span id=\"copyhint\">(Hit [Ctrl]+[c] to copy)</span>":
+        "Вашата връзка е <a id=\"pasteurl\" href=\"%s\">%s</a> <span id=\"copyhint\">(Натиснете [Ctrl]+[c] за да копирате)</span>",
+    "Delete data":
+        "Изтриване на информацията",
+    "Could not create paste: %s":
+        "Създаването на връзката ви беше неуспешно: %s",
+    "Cannot decrypt paste: Decryption key missing in URL (Did you use a redirector or an URL shortener which strips part of the URL?)":
+        "Дешифроването на информацията беше неуспешно: Ключа за декриптиране липсва във връзката (Да не сте използвали услуга за пренасочване или скъсяване на връзката, което би изрязало части от нея?)",
+    "Format": "Format",
+    "Plain Text": "Чист текст",
+    "Source Code": "Изходен код",
+    "Markdown": "Markdown",
+    "Download attachment": "Свали прикачения файл",
+    "Cloned: '%s'": "Дублирано: '%s'",
+    "The cloned file '%s' was attached to this paste.": "Дублирания файл '%s' беше прикачен.",
+    "Attach a file": "Прикачи файл",
+    "alternatively drag & drop a file or paste an image from the clipboard": "Също можеш да пуснеш файла върху този прозорец или да поставиш изображение от клипборда",
+    "File too large, to display a preview. Please download the attachment.": "Файла е твърде голям, за да се представи визуализация. Моля, свалете файла.",
+    "Remove attachment": "Премахнете файла",
+    "Your browser does not support uploading encrypted files. Please use a newer browser.":
+        "Браузърът ви не поддържа прикачване на шифровани файлове. Моля, използвайте по-нов браузър",
+    "Invalid attachment.": "Невалидно прикачване.",
+    "Options": "Настройки",
+    "Shorten URL": "Скъси връзката",
+    "Editor": "Редактор",
+    "Preview": "Визуализация",
+    "%s requires the PATH to end in a \"%s\". Please update the PATH in your index.php.":
+        "PATH трябва да е във края на \"%s\" за да може %s да работи правилно. Моля обновете PATH във вашият index.php .",
+    "Decrypt":
+        "Дешифровай",
+    "Enter password":
+        "Въведи паролата",
+    "Loading…": "Зареждане…",
+    "Decrypting paste…": "Дешифроване на информацията…",
+    "Preparing new paste…": "Приготвяне на връзката Ви…",
+    "In case this message never disappears please have a look at <a href=\"%s\">this FAQ for information to troubleshoot</a>.":
+        "Във случай, че това съобщение не изчезне след време, моля прегледайте <a href=\"%s\">този FAQ (Английски)</a>, за информация, която би ви помогнала.",
+    "+++ no paste text +++": "+++ няма текстово съдържание +++",
+    "Could not get paste data: %s":
+        "Взимането на информацията беше неуспешно: %s",
+    "QR code": "QR код",
+    "This website is using an insecure HTTP connection! Please use it only for testing.":
+        "Този сайт използва несигурна HTTP връзка. Моля използвайте само за проби.",
+    "For more information <a href=\"%s\">see this FAQ entry</a>.":
+        "<a href=\"%s\">Вижте тази страница</a> за повече информация.",
+    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
+        "Браузъра ви може да се нуждае от HTTPS връзка за да използва WebCrypto API. Пробвай <a href=\"%s\">да минеш на HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
+}
@@ -35,8 +35,6 @@
        "JavaScript is required for %s to work.<br />Sorry for the inconvenience.",
    "%s requires a modern browser to work.":
        "%%s requires a modern browser to work.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:",
    "New":
        "Nový",
    "Send":
@@ -155,11 +153,12 @@
    "Could not get paste data: %s":
        "Could not get paste data: %s",
    "QR code": "QR code",
-    "I love you too, bot…": "I love you too, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "This website is using an insecure HTTP connection! Please use it only for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "For more information <a href=\"%s\">see this FAQ entry</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "JavaScript ist eine Voraussetzung, um %s zu nutzen.<br />Bitte entschuldige die Unannehmlichkeiten.",
    "%s requires a modern browser to work.":
        "%s setzt einen modernen Browser voraus, um funktionieren zu können.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Du benutzt immer noch den Internet Explorer? Tu Dir einen Gefallen und wechsle zu einem moderneren Browser:",
    "New":
        "Neu",
    "Send":
@@ -155,11 +153,12 @@
    "Could not get paste data: %s":
        "Text konnte nicht geladen werden: %s",
    "QR code": "QR code",
-    "I love you too, bot…": "Ich mag Dich auch, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "Diese Webseite verwendet eine unsichere HTTP Verbindung! Bitte benutze sie nur zum Testen.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "<a href=\"%s\">Besuche diesen FAQ Eintrag</a> für weitere Informationen dazu.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Dein Browser benötigt möglicherweise eine HTTPS Verbindung um das WebCrypto API nutzen zu können. Versuche <a href=\"%s\">auf HTTPS zu wechseln</a>."
+        "Dein Browser benötigt möglicherweise eine HTTPS Verbindung um das WebCrypto API nutzen zu können. Versuche <a href=\"%s\">auf HTTPS zu wechseln</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Dein Browser unterstützt WebAssembly nicht, welches für zlib Komprimierung benötigt wird. Du kannst unkomprimierte Dokumente erzeugen, aber keine komprimierten lesen."
 }
@@ -35,8 +35,6 @@
        "JavaScript es necesario para que %s funcione.<br />Sentimos los inconvenientes ocasionados.",
    "%s requires a modern browser to work.":
        "%s requiere un navegador moderno para funcionar.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "¿Sigues usando Internet Explorer? Hazte un favor, cambia a un navegador moderno:",
    "New":
        "Nuevo",
    "Send":
@@ -155,11 +153,12 @@
    "Could not get paste data: %s":
        "No se pudieron obtener los datos: %s",
    "QR code": "Código QR",
-    "I love you too, bot…": "I love you too, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "This website is using an insecure HTTP connection! Please use it only for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "For more information <a href=\"%s\">see this FAQ entry</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "JavaScript est requis pour faire fonctionner %s. <br />Désolé pour cet inconvénient.",
    "%s requires a modern browser to work.":
        "%s nécessite un navigateur moderne pour fonctionner.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Encore sur Internet Explorer ? Faites-vous une faveur, passez à un navigateur moderne :",
    "New":
        "Nouveau",
    "Send":
@@ -164,11 +162,12 @@
    "Could not get paste data: %s":
        "Impossible d'obtenir les données du paste: %s",
    "QR code": "QR code",
-    "I love you too, bot…": "Je t’aime aussi, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "Ce site web utilise une connexion HTTP non sécurisée ! Veuillez l’utiliser uniquement pour des tests.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "Pour plus d'informations <a href=\"%s\">consultez cette rubrique de la FAQ</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Votre navigateur peut nécessiter une connexion HTTPS pour prendre en charge l’API WebCrypto. Essayez <a href=\"%s\">de passer en HTTPS</a>."
+        "Votre navigateur peut nécessiter une connexion HTTPS pour prendre en charge l’API WebCrypto. Essayez <a href=\"%s\">de passer en HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "JavaScript szükséges a %s működéséhez. Elnézést a fennakadásért.",
    "%s requires a modern browser to work.":
        "A %s működéséhez a jelenleginél újabb böngészőre van szükség.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Még mindig Internet Explorert használsz? Ideje váltani:",
    "New":
        "Új",
    "Send":
@@ -155,11 +153,12 @@
    "Could not get paste data: %s":
        "Could not get paste data: %s",
    "QR code": "QR code",
-    "I love you too, bot…": "I love you too, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "This website is using an insecure HTTP connection! Please use it only for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "For more information <a href=\"%s\">see this FAQ entry</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "%s funziona solo con JavaScript attivo.<br />Ci dispiace per l'inconveniente.",
    "%s requires a modern browser to work.":
        "%s richiede un browser moderno e aggiornato per funzionare.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Usi ancora Internet Explorer? Ti consigliamo di passare ad un browser più sicuro:",
    "New":
        "Nuovo",
    "Send":
@@ -155,11 +153,12 @@
    "Could not get paste data: %s":
        "Could not get paste data: %s",
    "QR code": "QR code",
-    "I love you too, bot…": "I love you too, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "This website is using an insecure HTTP connection! Please use it only for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "For more information <a href=\"%s\">see this FAQ entry</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "JavaScript vereist om %s te laten werken.<br />Sorry voor het ongemak.",
    "%s requires a modern browser to work.":
        "%s vereist een moderne browser om te kunnen werken ",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Gebruik je nog steeds Internet explorer? Doe jezelf een plezier en maak gebruik van een moderne browser:",
    "New":
        "Nieuw",
    "Send":
@@ -155,11 +153,12 @@
    "Could not get paste data: %s":
        "Could not get paste data: %s",
    "QR code": "QR code",
-    "I love you too, bot…": "I love you too, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "This website is using an insecure HTTP connection! Please use it only for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "For more information <a href=\"%s\">see this FAQ entry</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "Javascript kreves for at %s skal fungere<br />Beklager.",
    "%s requires a modern browser to work.":
        "%s krever en moderne nettleser for å fungere.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Fortsatt bruker av Internet Explorer? Gjør deg selv en tjeneste og bytt til en moderne nettleser:",
    "New":
        "Ny",
    "Send":
@@ -154,12 +152,13 @@
    "+++ no paste text +++": "+++ ingen innleggstekst +++",
    "Could not get paste data: %s":
        "Kunne ikke hente utklippsdata: %s",
-    "QR code": "QR code",
-    "I love you too, bot…": "I love you too, bot…",
+    "QR code": "QR kode",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
-        "This website is using an insecure HTTP connection! Please use it only for testing.",
+        "Denne websiden bruker usikker HTTP tilkobling! Bruk den kun for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
-        "For more information <a href=\"%s\">see this FAQ entry</a>.",
+        "For mer informasjon <a href=\"%s\">se ofte stilte spørsmål</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Din nettleser har behov for HTTPS tilkobling for å støtte WebCrypto biblioteket. Prøv å <a href=\"%s\">bytt til HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "JavaScript es requesit per far foncionar %s. <br />O planhèm per l’inconvenient.",
    "%s requires a modern browser to work.":
        "%s necessita un navigator modèrn per foncionar.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Encora sus Internet Explorer ? Fasètz-vos una favor, passatz a un navigator modèrn :",
    "New":
        "Nòu",
    "Send":
@@ -164,11 +162,12 @@
    "Could not get paste data: %s":
        "Recuperacion impossibla de las donadas copiadas : %s",
    "QR code": "Còdi QR",
-    "I love you too, bot…": "T’aimi tanben, robòt…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "Aqueste site utiliza una connexion HTTP pas segura ! Mercés de l’utilizar pas que per d’ensages.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "Per mai d’informacions <a href=\"%s\">vejatz aqueste article de FAQ</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Se pòt que vòstre navigator faga besonh d’una connexion HTTPS per èsser compatible amb l’API WebCrypto. Ensajatz de <a href=\"%s\">passar al HTTPS</a>."
+        "Se pòt que vòstre navigator faga besonh d’una connexion HTTPS per èsser compatible amb l’API WebCrypto. Ensajatz de <a href=\"%s\">passar al HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "Do działania %sa jest wymagany JavaScript. Przepraszamy za tę niedogodność.",
    "%s requires a modern browser to work.":
        "%s wymaga do działania nowoczesnej przeglądarki.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Cały czas używasz Internet Explorera? Zrób sobie przysługę, przesiądź się na nowoczesną przeglądarkę:",
    "New":
        "Nowa",
    "Send":
@@ -155,11 +153,12 @@
    "Could not get paste data: %s":
        "Nie można było pobrać danych wklejki: %s",
    "QR code": "Kod QR",
-    "I love you too, bot…": "I love you too, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "This website is using an insecure HTTP connection! Please use it only for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "For more information <a href=\"%s\">see this FAQ entry</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "JavaScript é necessário para que %s funcione.<br />Pedimos desculpas pela inconveniência.",
    "%s requires a modern browser to work.":
        "%s requer um navegador moderno para funcionar.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Ainda usando Internet Explorer? Faça-se um favor, mude para um navegador moderno:",
    "New":
        "Novo",
    "Send":
@@ -155,11 +153,12 @@
    "Could not get paste data: %s":
        "Could not get paste data: %s",
    "QR code": "QR code",
-    "I love you too, bot…": "I love you too, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "This website is using an insecure HTTP connection! Please use it only for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "For more information <a href=\"%s\">see this FAQ entry</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "Для работы %s требуется включенный JavaScript.<br />Приносим извинения за неудобства.",
    "%s requires a modern browser to work.":
        "Для работы %s требуется более современный браузер.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "До сих пор используете Internet Explorer? Пожалейте себя, перейдите на более современный браузер:",
    "New":
        "Новая запись",
    "Send":
@@ -164,12 +162,13 @@
    "+++ no paste text +++": "+++ в записи нет текста +++",
    "Could not get paste data: %s":
        "Не удалось получить данные записи: %s",
-    "QR code": "QR code",
-    "I love you too, bot…": "I love you too, bot…",
+    "QR code": "QR код",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
-        "This website is using an insecure HTTP connection! Please use it only for testing.",
+        "Данный сайт использует незащищенное HTTP подключение! Пожалуйста используйте его только для тестирования.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
-        "For more information <a href=\"%s\">see this FAQ entry</a>.",
+        "Для продробностей <a href=\"%s\">прочтите информацию в FAQ</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Ваш браузер требует использования HTTPS подключения для поддержки WebCrypto API. Попробуйте <a href=\"%s\">переключиться на HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "Da %s deluje, moraš vklopiti JavaScript.<br />Oprosti za povročene nevšečnosti.",
    "%s requires a modern browser to work.":
        "%s za svoje delovanje potrebuje moderen brskalnik.",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "Še vedno uporabljaš Internet Explorer? Naredi si uslugo, preklopi na moderen brskalnik:",
    "New":
        "Nov prilepek",
    "Send":
@@ -164,11 +162,12 @@
    "Could not get paste data: %s":
        "Could not get paste data: %s",
    "QR code": "QR code",
-    "I love you too, bot…": "I love you too, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "This website is using an insecure HTTP connection! Please use it only for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "For more information <a href=\"%s\">see this FAQ entry</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -35,8 +35,6 @@
        "%s需要JavaScript来进行加解密。<br />给你带来的不便敬请谅解。",
    "%s requires a modern browser to work.":
        "%s需要在现代浏览器上工作。",
-    "Still using Internet Explorer? Do yourself a favor, switch to a modern browser:":
-        "还在使用Internet Explorer？对自己好点，换一个现代浏览器：",
    "New":
        "新建",
    "Send":
@@ -155,11 +153,12 @@
    "Could not get paste data: %s":
        "无法获取粘贴数据：%s",
    "QR code": "二维码",
-    "I love you too, bot…": "I love you too, bot…",
    "This website is using an insecure HTTP connection! Please use it only for testing.":
        "This website is using an insecure HTTP connection! Please use it only for testing.",
    "For more information <a href=\"%s\">see this FAQ entry</a>.":
        "For more information <a href=\"%s\">see this FAQ entry</a>.",
    "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.":
-        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>."
+        "Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href=\"%s\">switching to HTTPS</a>.",
+    "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones.":
+        "Your browser doesn't support WebAssembly, used for zlib compression. You can create uncompressed documents, but can't read compressed ones."
 }
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 21.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 490.1 105.6" style="enable-background:new 0 0 490.1 105.6;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#F4B960;}
+	.st1{fill:#E66F32;}
+	.st2{fill:#E43C41;}
+	.st3{fill:#BDD041;}
+	.st4{fill:#6DB54C;}
+	.st5{fill:#AEDAE6;}
+	.st6{fill:#56B8DE;}
+	.st7{fill:#00B1D5;}
+	.st8{fill:url(#SVGID_1_);}
+	.st9{fill:#221F1F;}
+	.st10{fill:#FFFFFF;}
+	.st11{fill:#000111;}
+</style>
+<title>Browserstack-logo-white</title>
+<circle class="st0" cx="52.8" cy="52.8" r="52.8"/>
+<circle class="st1" cx="47.5" cy="47.5" r="47.5"/>
+<circle class="st2" cx="53.8" cy="41.1" r="41.1"/>
+<circle class="st3" cx="57.1" cy="44.4" r="37.8"/>
+<circle class="st4" cx="54.3" cy="47.2" r="35.1"/>
+<circle class="st5" cx="48.8" cy="41.7" r="29.5"/>
+<circle class="st6" cx="53.6" cy="36.8" r="24.7"/>
+<circle class="st7" cx="56.6" cy="39.9" r="21.7"/>
+<radialGradient id="SVGID_1_" cx="53.45" cy="63.02" r="18.57" gradientTransform="matrix(1 0 0 -1 0 106)" gradientUnits="userSpaceOnUse">
+	<stop  offset="0" style="stop-color:#797979"/>
+	<stop  offset="1" style="stop-color:#4C4C4C"/>
+</radialGradient>
+<circle class="st8" cx="53.5" cy="43" r="18.6"/>
+<circle class="st9" cx="53.5" cy="43" r="18.6"/>
+<ellipse transform="matrix(0.4094 -0.9123 0.9123 0.4094 2.8913 76.9251)" class="st10" cx="60.9" cy="36.2" rx="5.7" ry="3.7"/>
+<path class="st11" d="M122.5,32.6c0-0.3,0.3-0.6,0.6-0.6c0,0,0,0,0.1,0h16.6c9.5,0,13.9,4.4,13.9,11c0.2,3.7-1.8,7.2-5.2,8.8v0.1
+	c3.7,1.5,6.1,5.2,6,9.3c0,8.2-5.6,12.2-15.4,12.2h-16c-0.3,0-0.6-0.2-0.7-0.5c0,0,0,0,0-0.1L122.5,32.6L122.5,32.6z M139.6,49.1
+	c3.9,0,6.4-2.2,6.4-5.4s-2.4-5.5-6.4-5.5h-8.9c-0.2,0-0.4,0.1-0.4,0.3c0,0,0,0,0,0.1v10.2c0,0.2,0.1,0.3,0.3,0.4c0,0,0,0,0.1,0
+	H139.6L139.6,49.1z M130.6,66.9h9.3c4.3,0,6.8-2.3,6.8-5.8s-2.4-5.7-6.7-5.7h-9.3c-0.2,0-0.4,0.1-0.4,0.3c0,0,0,0,0,0.1v10.7
+	C130.3,66.8,130.4,66.9,130.6,66.9C130.6,66.9,130.6,66.9,130.6,66.9L130.6,66.9z"/>
+<path class="st11" d="M159.9,73.3c-0.3,0-0.6-0.2-0.7-0.5c0,0,0,0,0-0.1V44.6c0-0.3,0.3-0.6,0.6-0.6c0,0,0,0,0.1,0h6
+	c0.3,0,0.6,0.2,0.7,0.5c0,0,0,0,0,0.1v2.5h0.1c1.5-2.2,4.2-3.8,8.2-3.8c2.4,0,4.8,0.8,6.6,2.4c0.3,0.3,0.4,0.5,0.1,0.8l-3.5,4.1
+	c-0.2,0.3-0.6,0.4-0.9,0.2c0,0,0,0-0.1,0c-1.4-0.9-3-1.4-4.7-1.4c-4.1,0-6,2.7-6,7.4v15.9c0,0.3-0.3,0.6-0.6,0.6c0,0,0,0-0.1,0
+	H159.9L159.9,73.3z"/>
+<path class="st11" d="M182.9,65.8c-0.8-2.3-1.1-4.8-1.1-7.2c-0.1-2.5,0.3-4.9,1.1-7.2c1.8-5.1,6.6-8.1,13.1-8.1s11.2,3,13,8.1
+	c0.8,2.3,1.1,4.8,1.1,7.2c0.1,2.5-0.3,4.9-1.1,7.2c-1.8,5.1-6.6,8.1-13,8.1S184.7,71,182.9,65.8z M201.9,64c0.5-1.7,0.8-3.6,0.7-5.4
+	c0.1-1.8-0.1-3.7-0.7-5.4c-0.9-2.5-3.3-4-5.9-3.8c-2.6-0.2-5.1,1.4-6,3.8c-0.5,1.8-0.8,3.6-0.7,5.4c-0.1,1.8,0.1,3.7,0.7,5.4
+	c0.9,2.5,3.4,4,6,3.8C198.6,68,201,66.5,201.9,64L201.9,64z"/>
+<path class="st11" d="M241.9,73.3c-0.4,0-0.7-0.3-0.8-0.6L235,53.9h-0.1l-6.2,18.7c-0.1,0.4-0.4,0.6-0.8,0.6h-5.4
+	c-0.4,0-0.7-0.3-0.8-0.6l-10-28.1c-0.1-0.2,0-0.5,0.2-0.6c0.1,0,0.2-0.1,0.3,0h6.3c0.4,0,0.8,0.2,0.9,0.6l6.1,19.3h0.1l6-19.3
+	c0.1-0.4,0.5-0.6,0.9-0.6h4.7c0.4,0,0.7,0.2,0.9,0.6l6.4,19.3h0.1l5.8-19.3c0.1-0.4,0.5-0.7,0.9-0.6h6.3c0.2-0.1,0.5,0.1,0.5,0.3
+	c0,0.1,0,0.2,0,0.3l-10,28.1c-0.1,0.4-0.4,0.6-0.8,0.6L241.9,73.3L241.9,73.3z"/>
+<path class="st11" d="M259.3,69.3c-0.2-0.2-0.3-0.6-0.1-0.8c0,0,0,0,0.1-0.1l3.7-3.6c0.3-0.2,0.7-0.2,0.9,0c2.6,2.1,5.9,3.3,9.3,3.3
+	c3.9,0,5.9-1.5,5.9-3.5c0-1.8-1.1-2.9-5.2-3.2l-3.4-0.3c-6.4-0.6-9.7-3.6-9.7-8.6c0-5.7,4.4-9.2,12.3-9.2c4.2-0.1,8.4,1.2,11.9,3.6
+	c0.3,0.2,0.3,0.5,0.2,0.8c0,0,0,0,0,0.1l-3.2,3.6c-0.2,0.3-0.6,0.3-0.9,0.1c-2.5-1.5-5.4-2.4-8.3-2.4c-3.1,0-4.8,1.3-4.8,3
+	s1.1,2.7,5.2,3.1l3.4,0.3c6.6,0.6,9.8,3.8,9.8,8.6c0,5.8-4.6,9.9-13.3,9.9C268,74,263.2,72.4,259.3,69.3z"/>
+<path class="st11" d="M291.2,65.8c-0.8-2.3-1.2-4.7-1.1-7.2c-0.1-2.5,0.3-4.9,1-7.2c1.8-5.1,6.6-8.1,12.9-8.1c6.5,0,11.2,3.1,13,8.1
+	c0.7,2.1,1,4.1,1,8.8c0,0.3-0.3,0.6-0.6,0.6c0,0-0.1,0-0.1,0h-19.5c-0.2,0-0.4,0.1-0.4,0.3c0,0,0,0,0,0.1c0,0.8,0.2,1.5,0.5,2.2
+	c1,2.9,3.5,4.4,7.1,4.4c2.7,0.1,5.4-0.9,7.4-2.8c0.2-0.3,0.7-0.4,1-0.1c0,0,0,0,0,0l3.9,3.2c0.2,0.1,0.3,0.5,0.2,0.7
+	c0,0.1-0.1,0.1-0.1,0.1c-2.7,2.9-7.2,5-13,5C297.8,73.9,293,70.9,291.2,65.8z M310.4,52.8c-0.9-2.4-3.2-3.8-6.2-3.8
+	s-5.4,1.4-6.2,3.8c-0.3,0.8-0.4,1.6-0.4,2.5c0,0.2,0.1,0.3,0.3,0.4c0,0,0,0,0.1,0h12.4c0.2,0,0.4-0.1,0.4-0.3c0,0,0,0,0-0.1
+	C310.8,54.5,310.6,53.6,310.4,52.8L310.4,52.8z"/>
+<path class="st11" d="M323.6,73.3c-0.3,0-0.6-0.2-0.7-0.5c0,0,0,0,0-0.1V44.6c0-0.3,0.3-0.6,0.6-0.6c0,0,0,0,0.1,0h6
+	c0.3,0,0.6,0.2,0.7,0.5c0,0,0,0,0,0.1v2.5h0.1c1.5-2.2,4.2-3.8,8.2-3.8c2.4,0,4.8,0.8,6.6,2.4c0.3,0.3,0.4,0.5,0.1,0.8l-3.5,4.1
+	c-0.2,0.3-0.6,0.4-0.9,0.2c0,0,0,0-0.1,0c-1.4-0.9-3-1.4-4.7-1.4c-4.1,0-6,2.7-6,7.4v15.9c0,0.3-0.3,0.6-0.6,0.6c0,0,0,0-0.1,0
+	H323.6L323.6,73.3z"/>
+<path class="st11" d="M346.5,68.5c-0.3-0.2-0.4-0.6-0.2-0.9c0,0,0,0,0,0l4.1-4.4c0.2-0.3,0.6-0.3,0.9-0.1c0,0,0,0,0,0
+	c3.5,2.7,7.7,4.2,12.1,4.4c5.3,0,8.4-2.5,8.4-6c0-3-2-4.9-8.1-5.7l-2.4-0.3c-8.6-1.1-13.5-4.9-13.5-11.8c0-7.5,5.9-12.4,15.1-12.4
+	c5.1-0.1,10.1,1.4,14.5,4.2c0.3,0.1,0.4,0.4,0.2,0.7c0,0.1-0.1,0.1-0.1,0.2l-3.1,4.5c-0.2,0.3-0.6,0.4-0.9,0.2
+	c-3.2-2.1-6.9-3.2-10.7-3.2c-4.5,0-7,2.3-7,5.5c0,2.9,2.2,4.8,8.2,5.6l2.4,0.3c8.6,1.1,13.3,4.9,13.3,12c0,7.3-5.7,12.8-16.8,12.8
+	C356.3,73.9,350,71.5,346.5,68.5z"/>
+<path class="st11" d="M393.3,73.8c-6.4,0-8.8-2.9-8.8-8.6V49.8c0-0.2-0.1-0.3-0.3-0.4c0,0,0,0-0.1,0H382c-0.3,0-0.6-0.2-0.7-0.5
+	c0,0,0,0,0-0.1v-4.1c0-0.3,0.3-0.6,0.6-0.6c0,0,0,0,0.1,0h2.1c0.2,0,0.4-0.1,0.4-0.3c0,0,0,0,0-0.1v-8c0-0.3,0.3-0.6,0.6-0.6
+	c0,0,0,0,0.1,0h6c0.3,0,0.6,0.2,0.7,0.5c0,0,0,0,0,0.1v8c0,0.2,0.1,0.3,0.3,0.4c0,0,0,0,0.1,0h4.2c0.3,0,0.6,0.2,0.7,0.5
+	c0,0,0,0,0,0.1v4.1c0,0.3-0.3,0.6-0.6,0.6c0,0,0,0-0.1,0h-4.2c-0.2,0-0.4,0.1-0.4,0.3c0,0,0,0,0,0.1V65c0,2.1,0.9,2.7,3,2.7h1.6
+	c0.3,0,0.6,0.2,0.7,0.5c0,0,0,0,0,0.1v4.9c0,0.3-0.3,0.6-0.6,0.6c0,0,0,0-0.1,0L393.3,73.8L393.3,73.8z"/>
+<path class="st11" d="M421.2,73.3c-0.3,0-0.6-0.2-0.7-0.5c0,0,0,0,0-0.1v-2.1h0c-1.5,2-4.5,3.4-8.9,3.4c-5.8,0-10.6-2.8-10.6-8.9
+	c0-6.4,4.9-9.3,12.7-9.3h6.4c0.2,0,0.4-0.1,0.4-0.3c0,0,0,0,0-0.1v-1.4c0-3.3-1.7-4.9-7-4.9c-2.6-0.1-5.1,0.6-7.2,2
+	c-0.3,0.2-0.7,0.2-0.9-0.1c0,0,0,0,0-0.1l-2.4-4c-0.2-0.2-0.1-0.6,0.1-0.8c0,0,0,0,0,0c2.6-1.7,6-2.9,11.2-2.9
+	c9.6,0,13.2,3,13.2,10.2v19.1c0,0.3-0.3,0.6-0.6,0.6c0,0,0,0-0.1,0H421.2L421.2,73.3z M420.4,63.4v-2.2c0-0.2-0.1-0.3-0.3-0.4
+	c0,0,0,0-0.1,0h-5.2c-4.7,0-6.8,1.2-6.8,3.9c0,2.4,1.9,3.6,5.5,3.6C417.9,68.4,420.4,66.8,420.4,63.4L420.4,63.4z"/>
+<path class="st11" d="M433.1,65.8c-0.7-2.3-1.1-4.8-1-7.2c-0.1-2.4,0.3-4.9,1-7.2c1.8-5.2,6.7-8.1,13.1-8.1c4.2-0.2,8.2,1.5,11,4.6
+	c0.2,0.2,0.2,0.6,0,0.8c0,0,0,0-0.1,0.1l-4.1,3.3c-0.3,0.2-0.7,0.2-0.9-0.1c0,0,0,0,0-0.1c-1.5-1.7-3.6-2.6-5.9-2.5
+	c-2.8,0-5,1.3-5.9,3.8c-0.5,1.8-0.8,3.6-0.7,5.4c-0.1,1.8,0.1,3.7,0.7,5.5c0.9,2.5,3.1,3.8,5.9,3.8c2.2,0.1,4.4-0.9,5.9-2.6
+	c0.2-0.3,0.6-0.3,0.9-0.1c0,0,0,0,0,0l4.1,3.3c0.3,0.2,0.3,0.5,0.1,0.8c0,0,0,0-0.1,0.1c-2.9,3-6.9,4.6-11,4.5
+	C439.8,73.9,435,71.1,433.1,65.8z"/>
+<path class="st11" d="M482.8,73.3c-0.4,0-0.8-0.2-1-0.6l-8-12.3l-4.3,4.6v7.7c0,0.3-0.3,0.6-0.6,0.6c0,0,0,0-0.1,0h-6
+	c-0.3,0-0.6-0.2-0.7-0.5c0,0,0,0,0-0.1V32.6c0-0.3,0.3-0.6,0.6-0.6c0,0,0,0,0.1,0h6c0.3,0,0.6,0.2,0.7,0.5c0,0,0,0,0,0.1v23.8
+	l10.8-11.8c0.3-0.4,0.8-0.6,1.2-0.6h6.7c0.2,0,0.4,0.1,0.4,0.3c0,0.1,0,0.3-0.1,0.3l-10.1,10.7L490,72.7c0.1,0.2,0.1,0.4,0,0.5
+	c-0.1,0.1-0.2,0.1-0.3,0.1H482.8L482.8,73.3z"/>
+</svg>
@@ -1,5 +1,6 @@
 ---
 include:
+  - legacy.js
  - privatebin.js
 reporter:
  - text
@@ -16,9 +16,10 @@ global.zlib = require('./zlib-1.2.11').zlib;
 require('./prettify');
 global.prettyPrint = window.PR.prettyPrint;
 global.prettyPrintOne = window.PR.prettyPrintOne;
-global.showdown = require('./showdown-1.9.0');
-global.DOMPurify = require('./purify-1.0.11');
+global.showdown = require('./showdown-1.9.1');
+global.DOMPurify = require('./purify-2.0.1');
 global.baseX = require('./base-x-3.0.5.1').baseX;
+global.Legacy = require('./legacy').Legacy;
 require('./bootstrap-3.3.7');
 require('./privatebin');

@@ -0,0 +1,311 @@
+/**
+ * PrivateBin
+ *
+ * a zero-knowledge paste bin
+ *
+ * @see       {@link https://github.com/PrivateBin/PrivateBin}
+ * @copyright 2012 Sébastien SAUVAGE ({@link http://sebsauvage.net})
+ * @license   {@link https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License}
+ * @version   1.3.1
+ * @name      Legacy
+ * @namespace
+ */
+
+/**
+ * IMPORTANT NOTICE FOR DEVELOPERS:
+ * The logic in this file is intended to run in legacy browsers. Avoid any use of:
+ * - jQuery (doesn't work in older browsers)
+ * - ES5 or newer in general
+ * - const/let, use the traditional var declarations instead
+ * - async/await or Promises, use traditional callbacks
+ * - shorthand function notation "() => output", use the full "function() {return output;}" style
+ * - IE doesn't support:
+ *   - URL(), use the traditional window.location object
+ *   - endsWith(), use indexof()
+ * - yes, this logic needs to support IE 6, to at least display the error message
+ */
+
+'use strict';
+(function() {
+    /**
+     * compatibility check
+     *
+     * @name   Check
+     * @class
+     */
+    var Check = (function () {
+        var me = {};
+
+        /**
+         * Status of the initial check, true means it passed
+         *
+         * @private
+         * @prop   {bool}
+         */
+        var status = false;
+
+        /**
+         * Initialization check did run
+         *
+         * @private
+         * @prop   {bool}
+         */
+        var init = false;
+
+        /**
+         * blacklist of UserAgents (parts) known to belong to a bot
+         *
+         * @private
+         * @enum   {Array}
+         * @readonly
+         */
+        var badBotUA = [
+            'Bot',
+            'bot'
+        ];
+
+        /**
+         * whitelist of top level domains to consider a secure context,
+         * regardless of protocol
+         *
+         * @private
+         * @enum   {Array}
+         * @readonly
+         */
+        var tld = [
+            '.onion',
+            '.i2p'
+        ];
+
+        /**
+         * whitelist of hostnames to consider a secure context,
+         * regardless of protocol
+         *
+         * @private
+         * @enum   {Array}
+         * @readonly
+         */
+        // whitelists of TLDs & local hostnames
+        var hostname = [
+            'localhost',
+            '127.0.0.1',
+            '[::1]'
+        ];
+
+        /**
+         * check if the context is secure
+         *
+         * @private
+         * @name   Check.isSecureContext
+         * @function
+         * @return {bool}
+         */
+        function isSecureContext()
+        {
+            // use .isSecureContext if available
+            if (window.isSecureContext === true || window.isSecureContext === false) {
+                return window.isSecureContext;
+            }
+
+            // HTTP is obviously insecure
+            if (window.location.protocol !== 'http:') {
+                return true;
+            }
+
+            // filter out actually secure connections over HTTP
+            for (var i = 0; i < tld.length; i++) {
+                if (
+                    window.location.hostname.indexOf(
+                        tld[i],
+                        window.location.hostname.length - tld[i].length
+                    ) !== -1
+                ) {
+                    return true;
+                }
+            }
+
+            // whitelist localhost for development
+            for (var j = 0; j < hostname.length; j++) {
+                if (window.location.hostname === hostname[j]) {
+                    return true;
+                }
+            }
+
+            // totally INSECURE http protocol!
+            return false;
+        }
+
+        /**
+         * checks whether this is a bot we dislike
+         *
+         * @private
+         * @name   Check.isBadBot
+         * @function
+         * @return {bool}
+         */
+        function isBadBot() {
+            // check whether a bot user agent part can be found in the current
+            // user agent
+            for (var i = 0; i < badBotUA.length; i++) {
+                if (navigator.userAgent.indexOf(badBotUA[i]) !== -1) {
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        /**
+         * checks whether this is an unsupported browser, via feature detection
+         *
+         * @private
+         * @name   Check.isOldBrowser
+         * @function
+         * @return {bool}
+         */
+        function isOldBrowser() {
+            // webcrypto support
+            if (!(
+                'crypto' in window &&
+                'getRandomValues' in window.crypto &&
+                'subtle' in window.crypto &&
+                'encrypt' in window.crypto.subtle &&
+                'decrypt' in window.crypto.subtle &&
+                'Uint8Array' in window &&
+                'Uint32Array' in window
+            )) {
+                return true;
+            }
+
+            // async & ES6 support
+            try {
+                eval('async () => {}');
+            } catch (e) {
+                if (e instanceof SyntaxError) {
+                    return true;
+                } else {
+                    throw e; // throws CSP error
+                }
+            }
+
+            return false;
+        }
+
+        /**
+         * shows an error message
+         *
+         * @private
+         * @name   Check.showError
+         * @param  {string} message
+         * @function
+         */
+        function showError(message)
+        {
+            var element = document.getElementById('errormessage');
+            if (message.indexOf('<a') === -1) {
+                element.appendChild(
+                    document.createTextNode(message)
+                );
+            } else {
+                element.innerHTML = message;
+            }
+            removeHiddenFromId('errormessage');
+        }
+
+        /**
+         * removes "hidden" CSS class from element with given ID
+         *
+         * @private
+         * @name   Check.removeHiddenFromId
+         * @param  {string} id
+         * @function
+         */
+        function removeHiddenFromId(id)
+        {
+            var element = document.getElementById(id);
+            if (element) {
+                element.className = element.className.replace(/\bhidden\b/g, '');
+            }
+        }
+
+        /**
+         * returns if the check has concluded
+         *
+         * @name   Check.getInit
+         * @function
+         * @return {bool}
+         */
+        me.getInit = function()
+        {
+            return init;
+        };
+        
+        /**
+         * returns the current status of the check
+         *
+         * @name   Check.getStatus
+         * @function
+         * @return {bool}
+         */
+        me.getStatus = function()
+        {
+            return status;
+        };
+        
+        /**
+         * init on application start, returns an all-clear signal
+         *
+         * @name   Check.init
+         * @function
+         */
+        me.init = function()
+        {
+            // prevent bots from viewing a paste and potentially deleting data
+            // when burn-after-reading is set
+            if (isBadBot()) {
+                showError('I love you too, bot…');
+                init = true;
+                return;
+            }
+
+            if (isOldBrowser()) {
+                // some browsers (Chrome based ones) would have webcrypto support if using HTTPS
+                if (!isSecureContext()) {
+                    removeHiddenFromId('insecurecontextnotice');
+                }
+                removeHiddenFromId('oldnotice');
+                init = true;
+                return;
+            }
+
+            if (!isSecureContext()) {
+                removeHiddenFromId('httpnotice');
+            }
+            init = true;
+
+            // only if everything passed, we set the status to true
+            status = true;
+        };
+
+        return me;
+    })();
+
+    // main application start, called when DOM is fully loaded
+    if (document.readyState === 'complete' || (!document.attachEvent && document.readyState === 'interactive')) {
+        Check.init();
+    } else {
+        if (document.addEventListener) {
+            // first choice is DOMContentLoaded event
+            document.addEventListener('DOMContentLoaded', Check.init, false);
+            // backup is window load event
+            window.addEventListener('load', Check.init, false);
+        } else {
+            // must be IE
+            document.attachEvent('onreadystatechange', Check.init);
+            window.attachEvent('onload', Check.init);
+        }
+    }
+
+    this.Legacy = {
+        Check: Check
+    };
+}).call(this);
@@ -1,6 +1,6 @@
 {
  "name": "privatebin",
-  "version": "1.3",
+  "version": "1.3.0",
  "description": "PrivateBin is a minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bit AES in Galois Counter mode (GCM).",
  "main": "privatebin.js",
  "directories": {
@@ -6,21 +6,34 @@
 * @see       {@link https://github.com/PrivateBin/PrivateBin}
 * @copyright 2012 Sébastien SAUVAGE ({@link http://sebsauvage.net})
 * @license   {@link https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License}
- * @version   1.3
+ * @version   1.3.1
 * @name      PrivateBin
 * @namespace
 */

-/** global: Base64 */
-/** global: DOMPurify */
-/** global: FileReader */
-/** global: RawDeflate */
-/** global: history */
-/** global: navigator */
-/** global: prettyPrint */
-/** global: prettyPrintOne */
-/** global: showdown */
-/** global: kjua */
+// global Base64, DOMPurify, FileReader, RawDeflate, history, navigator, prettyPrint, prettyPrintOne, showdown, kjua
+
+jQuery.fn.draghover = function() {
+    'use strict';
+    return this.each(function() {
+        let collection = $(),
+            self = $(this);
+  
+        self.on('dragenter', function(e) {
+            if (collection.length === 0) {
+                self.trigger('draghoverstart');
+            }
+            collection = collection.add(e.target);
+        });
+  
+        self.on('dragleave drop', function(e) {
+            collection = collection.not(e.target);
+            if (collection.length === 0) {
+                self.trigger('draghoverend');
+            }
+        });
+    });
+};

 // main application start, called when DOM is fully loaded
 jQuery(document).ready(function() {
@@ -420,7 +433,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
         * @prop   {string[]}
         * @readonly
         */
-        const supportedLanguages = ['cs', 'de', 'es', 'fr', 'it', 'hu', 'no', 'nl', 'pl', 'pt', 'oc', 'ru', 'sl', 'zh'];
+        const supportedLanguages = ['bg', 'cs', 'de', 'es', 'fr', 'it', 'hu', 'no', 'nl', 'pl', 'pt', 'oc', 'ru', 'sl', 'zh'];

        /**
         * built in language
@@ -506,8 +519,6 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                    // handle the error by attaching the language loaded event
                    let orgArguments = arguments;
                    $(document).on(languageLoadedEvent, function () {
-                        // log to show that the previous error could be mitigated
-                        console.warn('Fix missing translation of \'' + messageId + '\' with now loaded language ' + language);
                        // re-execute this function
                        me.translate.apply(this, orgArguments);
                    });
@@ -547,12 +558,11 @@ jQuery.PrivateBin = (function($, RawDeflate) {

            // if $element is given, apply text to element
            if ($element !== null) {
-                // get last text node of element
-                let content = $element.contents();
-                if (content.length > 1) {
-                    content[content.length - 1].nodeValue = ' ' + output;
-                } else {
+                // avoid HTML entity encoding if translation contains link
+                if (output.indexOf('<a') === -1) {
                    $element.text(output);
+                } else {
+                    $element.html(output);
                }
            }

@@ -583,7 +593,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                    return n % 10 === 1 && n % 100 !== 11 ? 0 : (n % 10 >= 2 && n % 10 <= 4 && (n % 100 < 10 || n % 100 >= 20) ? 1 : 2);
                case 'sl':
                    return n % 100 === 1 ? 1 : (n % 100 === 2 ? 2 : (n % 100 === 3 || n % 100 === 4 ? 3 : 0));
-                // de, en, es, hu, it, nl, no, pt
+                // bg, de, en, es, hu, it, nl, no, pt
                default:
                    return n !== 1 ? 1 : 0;
            }
@@ -762,15 +772,20 @@ jQuery.PrivateBin = (function($, RawDeflate) {
         * @private
         * @param  {string} message
         * @param  {string} mode
+         * @param  {object} zlib
+         * @throws {string}
         * @return {ArrayBuffer} data
         */
-        async function compress(message, mode)
+        async function compress(message, mode, zlib)
        {
            message = stringToArraybuffer(
                utf16To8(message)
            );
            if (mode === 'zlib') {
-                return z.deflate(message).buffer;
+                if (typeof zlib === 'undefined') {
+                    throw 'Error compressing paste, due to missing WebAssembly support.'
+                }
+                return zlib.deflate(message).buffer;
            }
            return message;
        }
@@ -784,13 +799,18 @@ jQuery.PrivateBin = (function($, RawDeflate) {
         * @private
         * @param  {ArrayBuffer} data
         * @param  {string} mode
+         * @param  {object} zlib
+         * @throws {string}
         * @return {string} message
         */
-        async function decompress(data, mode)
+        async function decompress(data, mode, zlib)
        {
            if (mode === 'zlib' || mode === 'none') {
                if (mode === 'zlib') {
-                    data = z.inflate(
+                    if (typeof zlib === 'undefined') {
+                        throw 'Error decompressing paste, due to missing WebAssembly support.'
+                    }
+                    data = zlib.inflate(
                        new Uint8Array(data)
                    ).buffer;
                }
@@ -864,7 +884,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                        stringToArraybuffer(
                            utf16To8(password)
                        )
-                    );
+                    ).catch(Alert.showError);
                    password = Array.prototype.map.call(
                        new Uint8Array(passwordBuffer),
                        x => ('00' + x.toString(16)).slice(-2)
@@ -884,7 +904,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                {name: 'PBKDF2'}, // we use PBKDF2 for key derivation
                false, // the key may not be exported
                ['deriveKey'] // we may only use it for key derivation
-            );
+            ).catch(Alert.showError);

            // derive a stronger key for use with AES
            return window.crypto.subtle.deriveKey(
@@ -901,7 +921,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                },
                false, // the key may not be exported
                ['encrypt', 'decrypt'] // we may only use it for en- and decryption
-            );
+            ).catch(Alert.showError);
        }

        /**
@@ -938,9 +958,15 @@ jQuery.PrivateBin = (function($, RawDeflate) {
         */
        me.cipher = async function(key, password, message, adata)
        {
+            let zlib = (await z);
            // AES in Galois Counter Mode, keysize 256 bit,
            // authentication tag 128 bit, 10000 iterations in key derivation
-            const spec = [
+            const compression = (
+                    typeof zlib === 'undefined' ?
+                    'none' : // client lacks support for WASM
+                    ($('body').data('compression') || 'zlib')
+                ),
+                spec = [
                    getRandomBytes(16), // initialization vector
                    getRandomBytes(8),  // salt
                    100000,             // iterations
@@ -948,7 +974,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                    128,                // tag size
                    'aes',              // algorithm
                    'gcm',              // algorithm mode
-                $('body').data('compression') || 'zlib' // compression
+                    compression         // compression
                ], encodedSpec = [];
            for (let i = 0; i < spec.length; ++i) {
                encodedSpec[i] = i < 2 ? btoa(spec[i]) : spec[i];
@@ -968,8 +994,8 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                        await window.crypto.subtle.encrypt(
                            cryptoSettings(JSON.stringify(adata), spec),
                            await deriveKey(key, password, spec),
-                            await compress(message, spec[7])
-                        )
+                            await compress(message, compression, zlib)
+                        ).catch(Alert.showError)
                    )
                ),
                adata
@@ -989,7 +1015,8 @@ jQuery.PrivateBin = (function($, RawDeflate) {
         */
        me.decipher = async function(key, password, data)
        {
-            let adataString, spec, cipherMessage;
+            let adataString, spec, cipherMessage, plaintext;
+            let zlib = (await z);
            if (data instanceof Array) {
                // version 2
                adataString = JSON.stringify(data[1]);
@@ -1016,20 +1043,29 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            }
            spec[0] = atob(spec[0]);
            spec[1] = atob(spec[1]);
+            if (spec[7] === 'zlib') {
+                if (typeof zlib === 'undefined') {
+                    throw 'Error decompressing paste, due to missing WebAssembly support.'
+                }
+            }
            try {
-                return await decompress(
-                    await window.crypto.subtle.decrypt(
+                plaintext = await window.crypto.subtle.decrypt(
                    cryptoSettings(adataString, spec),
                    await deriveKey(key, password, spec),
                    stringToArraybuffer(
                        atob(cipherMessage)
                    )
-                    ),
-                    spec[7]
                );
            } catch(err) {
+                console.error(err);
                return '';
            }
+            try {
+                return await decompress(plaintext, spec[7], zlib);
+            } catch(err) {
+                Alert.showError(err);
+                return err;
+            }
        };

        /**
@@ -1175,7 +1211,6 @@ jQuery.PrivateBin = (function($, RawDeflate) {
        me.getPasteId = function()
        {
            const idRegEx = /^[a-z0-9]{16}$/;
-            const idRegExFind = /[a-z0-9]{16}/;

            // return cached value
            if (id !== null) {
@@ -1464,7 +1499,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
        const alertType = [
            'loading', // not in bootstrap CSS, but using a plausible value here
            'info',    // status icon
-            'warning', // not used yet
+            'warning', // warning icon
            'danger'   // error icon
        ];

@@ -1508,13 +1543,19 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                    icon = null; // icons not supported in this case
                }
            }
+            let $translationTarget = $element;
+
+            // handle icon, if template uses one
+            const $glyphIcon = $element.find(':first');
+            if ($glyphIcon.length) {
+                // if there is an icon, we need to provide an inner element
+                // to translate the message into, instead of the parent
+                $translationTarget = $('<span>');
+                $element.html(' ').prepend($glyphIcon).append($translationTarget);

-            // handle icon
                if (icon !== null && // icon was passed
                    icon !== currentIcon[id] // and it differs from current icon
                ) {
-                let $glyphIcon = $element.find(':first');
-
                    // remove (previous) icon
                    $glyphIcon.removeClass(currentIcon[id]);

@@ -1525,11 +1566,12 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                        $glyphIcon.addClass(currentIcon[id]);
                    }
                }
+            }

            // show text
            if (args !== null) {
                // add jQuery object to it as first parameter
-                args.unshift($element);
+                args.unshift($translationTarget);
                // pass it to I18n
                I18n._.apply(this, args);
            }
@@ -1554,6 +1596,25 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            handleNotification(1, $statusMessage, message, icon);
        };

+        /**
+         * display a warning message
+         *
+         * This automatically passes the text to I18n for translation.
+         *
+         * @name   Alert.showWarning
+         * @function
+         * @param  {string|array} message     string, use an array for %s/%d options
+         * @param  {string|null}  icon        optional, the icon to show, default:
+         *                                    leave previous icon
+         */
+        me.showWarning = function(message, icon)
+        {
+            $errorMessage.find(':first')
+                         .removeClass(currentIcon[3])
+                         .addClass(currentIcon[2]);
+            handleNotification(2, $errorMessage, message, icon);
+        };
+
        /**
         * display an error message
         *
@@ -1680,7 +1741,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            currentIcon = [
                'glyphicon-time', // loading icon
                'glyphicon-info-sign', // status icon
-                '', // reserved for warning, not used yet
+                'glyphicon-warning-sign', // warning icon
                'glyphicon-alert' // error icon
            ];
        };
@@ -1711,8 +1772,58 @@ jQuery.PrivateBin = (function($, RawDeflate) {
         */
        function sendToShortener()
        {
-            window.location.href = $shortenButton.data('shortener') +
-                                   encodeURIComponent($pasteUrl.attr('href'));
+            if ($shortenButton.hasClass('buttondisabled')) {
+                return;
+            }
+            $.ajax({
+                type: 'GET',
+                url: `${$shortenButton.data('shortener')}${encodeURIComponent($pasteUrl.attr('href'))}`,
+                headers: {'Accept': 'text/html, application/xhtml+xml, application/xml, application/json'},
+                processData: false,
+                timeout: 10000,
+                xhrFields: {
+                    withCredentials: false
+                },
+                success: function(response) {
+                    let responseString = response;
+                    if (typeof responseString === 'object') {
+                        responseString = JSON.stringify(responseString);
+                    }
+                    if (typeof responseString === 'string' && responseString.length > 0) {
+                        const shortUrlMatcher = /https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)/g;
+                        const shortUrl = (responseString.match(shortUrlMatcher) || []).sort(function(a, b) {
+                            return a.length - b.length;
+                        })[0];
+                        if (typeof shortUrl === 'string' && shortUrl.length > 0) {
+                            $('#pastelink').html(
+                                I18n._(
+                                    'Your paste is <a id="pasteurl" href="%s">%s</a> <span id="copyhint">(Hit [Ctrl]+[c] to copy)</span>',
+                                    shortUrl, shortUrl
+                                )
+                            );
+                            // we disable the button to avoid calling shortener again
+                            $shortenButton.addClass('buttondisabled');
+                            // save newly created element
+                            $pasteUrl = $('#pasteurl');
+                            // we pre-select the link so that the user only has to [Ctrl]+[c] the link
+                            Helper.selectText($pasteUrl[0]);
+                            return;
+                        }
+                    }
+                    Alert.showError('Cannot parse response from URL shortener.');
+                }
+            })
+            .fail(function(data, textStatus, errorThrown) {
+                console.error(textStatus, errorThrown);
+                // we don't know why it failed, could be CORS of the external
+                // server not setup properly, in which case we follow old
+                // behavior to open it in new tab
+                window.open(
+                    `${$shortenButton.data('shortener')}${encodeURIComponent($pasteUrl.attr('href'))}`,
+                    '_blank',
+                    'noopener, noreferrer'
+                )
+            });
        }

        /**
@@ -1754,9 +1865,12 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            // and add click event
            $pasteUrl.click(pasteLinkClick);

-            // shorten button
+            // delete link
            $('#deletelink').html('<a href="' + deleteUrl + '">' + I18n._('Delete data') + '</a>');

+            // enable shortener button
+            $shortenButton.removeClass('buttondisabled');
+
            // show result
            $pasteSuccess.removeClass('hidden');
            // we pre-select the link so that the user only has to [Ctrl]+[c] the link
@@ -1780,10 +1894,6 @@ jQuery.PrivateBin = (function($, RawDeflate) {

                Alert.showRemaining('FOR YOUR EYES ONLY. Don\'t close this window, this message can\'t be displayed again.');
                $remainingTime.addClass('foryoureyesonly');
-
-                // discourage cloning (it cannot really be prevented)
-                TopNav.hideCloneButton();
-
            } else if (paste.getTimeToLive() > 0) {
                // display paste expiration
                let expiration = Helper.secondsToHuman(paste.getTimeToLive()),
@@ -2439,7 +2549,8 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            file,
            $fileInput,
            $dragAndDropFileName,
-            attachmentHasPreview = false;
+            attachmentHasPreview = false,
+            $dropzone;

        /**
         * sets the attachment but does not yet show it
@@ -2525,6 +2636,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            $attachmentLink.removeAttr('download');
            $attachmentLink.off('click');
            $attachmentPreview.html('');
+            $dragAndDropFileName.text('');

            AttachmentViewer.removeAttachmentData();
        };
@@ -2661,7 +2773,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                // revert loading status…
                me.hideAttachment();
                me.hideAttachmentPreview();
-                Alert.showError('Your browser does not support uploading encrypted files. Please use a newer browser.');
+                Alert.showWarning('Your browser does not support uploading encrypted files. Please use a newer browser.');
                return;
            }

@@ -2673,18 +2785,23 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                $dragAndDropFileName.text(loadedFile.name);
            }

+            if (typeof loadedFile !== 'undefined') {
                file = loadedFile;
-
                fileReader.onload = function (event) {
                    const dataURL = event.target.result;
                    attachmentData = dataURL;

                    if (Editor.isPreview()) {
-                    me.setAttachment(dataURL, loadedFile.name || '');
+                        me.handleAttachmentPreview($attachmentPreview, dataURL);
                        $attachmentPreview.removeClass('hidden');
                    }
+
+                    TopNav.highlightFileupload();
                };
                fileReader.readAsDataURL(loadedFile);
+            } else {
+                me.removeAttachmentData();
+            }
        }

        /**
@@ -2728,7 +2845,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                    );
                } else if (mimeType.match(/\/pdf/i)) {
                    // Fallback for browsers, that don't support the vh unit
-                    var clientHeight = $(window).height();
+                    const clientHeight = $(window).height();

                    $targetElement.html(
                        $(document.createElement('embed'))
@@ -2755,16 +2872,21 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                return;
            }

-            const ignoreDragDrop = function(event) {
+            const handleDragEnterOrOver = function(event) {
                event.stopPropagation();
                event.preventDefault();
+                return false;
            };

-            const drop = function(event) {
+            const handleDrop = function(event) {
                const evt = event.originalEvent;
                evt.stopPropagation();
                evt.preventDefault();

+                if (TopNav.isAttachmentReadonly()) {
+                    return false;
+                }
+
                if ($fileInput) {
                    const file = evt.dataTransfer.files[0];
                    //Clear the file input:
@@ -2777,9 +2899,24 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                }
            };

-            $(document).on('drop', drop);
-            $(document).on('dragenter', ignoreDragDrop);
-            $(document).on('dragover', ignoreDragDrop);
+            $(document).draghover().on({
+                'draghoverstart': function(e) {
+                    if (TopNav.isAttachmentReadonly()) {
+                        e.stopPropagation();
+                        e.preventDefault();
+                        return false;
+                    }
+                    // show dropzone to indicate drop support
+                    $dropzone.removeClass('hidden');
+                },
+                'draghoverend': function() {
+                    $dropzone.addClass('hidden');
+                }
+            });
+
+            $(document).on('drop', handleDrop);
+            $(document).on('dragenter dragover', handleDragEnterOrOver);
+
            $fileInput.on('change', function () {
                readFileData();
            });
@@ -2794,6 +2931,11 @@ jQuery.PrivateBin = (function($, RawDeflate) {
         */
        function addClipboardEventHandler() {
            $(document).on('paste', function (event) {
+                if (TopNav.isAttachmentReadonly()) {
+                    event.stopPropagation();
+                    event.preventDefault();
+                    return false;
+                }
                const items = (event.clipboardData || event.originalEvent.clipboardData).items;
                for (let i = 0; i < items.length; ++i) {
                    if (items[i].kind === 'file') {
@@ -2863,10 +3005,11 @@ jQuery.PrivateBin = (function($, RawDeflate) {
        me.init = function()
        {
            $attachment = $('#attachment');
+            $dragAndDropFileName = $('#dragAndDropFileName');
+            $dropzone = $('#dropzone');
            if($attachment.length) {
                $attachmentLink = $('#attachment a');
                $attachmentPreview = $('#attachmentPreview');
-                $dragAndDropFileName = $('#dragAndDropFileName');

                $fileInput = $('#file');
                addDragDropHandler();
@@ -3215,7 +3358,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
        }

        /**
-         * set the format on bootstrap templates in dropdown
+         * set the format on bootstrap templates in dropdown from user interaction
         *
         * @name   TopNav.updateFormat
         * @private
@@ -3577,6 +3720,18 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            $customAttachment.removeClass('hidden');
        };

+        /**
+         * hides the custom attachment
+         * 
+         * @name  TopNav.hideCustomAttachment
+         * @function
+         */
+        me.hideCustomAttachment = function()
+        {
+            $customAttachment.addClass('hidden');
+            $fileWrap.removeClass('hidden');
+        };
+
        /**
         * collapses the navigation bar, only if expanded
         *
@@ -3688,6 +3843,48 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            retryButtonCallback = callback;
        }

+        /**
+         * Highlight file upload
+         * 
+         * @name  TopNav.highlightFileupload
+         * @function
+         */
+        me.highlightFileupload = function()
+        {
+            // visually indicate file uploaded
+            const $attachDropdownToggle = $attach.children('.dropdown-toggle');
+            if ($attachDropdownToggle.attr('aria-expanded') === 'false') {
+                $attachDropdownToggle.click();
+            }
+            $fileWrap.addClass('highlight');
+            setTimeout(function () {
+                $fileWrap.removeClass('highlight');
+            }, 300);
+        }
+
+        /**
+         * set the format on bootstrap templates in dropdown programmatically
+         * 
+         * @name    TopNav.setFormat
+         * @function
+         */
+        me.setFormat = function(format)
+        {
+            $formatter.parent().find(`a[data-format="${format}"]`).click();
+        }
+
+        /**
+         * returns if attachment dropdown is readonly, not editable
+         * 
+         * @name   TopNav.isAttachmentReadonly
+         * @function
+         * @return {bool}
+         */
+        me.isAttachmentReadonly = function()
+        {
+            return $attach.hasClass('hidden');
+        }
+
        /**
         * init navigation manager
         *
@@ -4037,8 +4234,6 @@ jQuery.PrivateBin = (function($, RawDeflate) {
    const PasteEncrypter = (function () {
        const me = {};

-        let requirementsChecked = false;
-
        /**
         * called after successful paste upload
         *
@@ -4237,6 +4432,50 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                let attachment = AttachmentViewer.getAttachment();
                cipherMessage['attachment'] = attachment[0];
                cipherMessage['attachment_name'] = attachment[1];
+
+                // we need to retrieve data from blob if browser already parsed it in memory
+                if (typeof attachment[0] === 'string' && attachment[0].startsWith('blob:')) {
+                    Alert.showStatus(
+                        [
+                            'Retrieving cloned file \'%s\' from memory...',
+                            attachment[1]
+                        ],
+                        'copy'
+                    );
+                    try {
+                        const blobData = await $.ajax({
+                            type: 'GET',
+                            url: `${attachment[0]}`,
+                            processData: false,
+                            timeout: 10000,
+                            xhrFields: {
+                                withCredentials: false,
+                                responseType: 'blob'
+                            }
+                        });
+                        if (blobData instanceof window.Blob) {
+                            const fileReading = new Promise(function(resolve, reject) {
+                                const fileReader = new FileReader();
+                                fileReader.onload = function (event) {
+                                    resolve(event.target.result);
+                                };
+                                fileReader.onerror = function (error) {
+                                    reject(error);
+                                }
+                                fileReader.readAsDataURL(blobData);
+                            });
+                            cipherMessage['attachment'] = await fileReading;
+                        } else {
+                            const error = 'Cannot process attachment data.';
+                            Alert.showError(error);
+                            throw new TypeError(error);
+                        }
+                    } catch (error) {
+                        console.error(error);
+                        Alert.showError('Cannot retrieve attachment.');
+                        throw error;
+                    }
+                }
            }

            // encrypt message
@@ -4290,7 +4529,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {

            // if all tries failed, we can only return an error
            if (plaindata.length === 0) {
-                throw 'failed to decipher data';
+                return false;
            }

            return plaindata;
@@ -4319,13 +4558,14 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                if (password.length === 0) {
                    throw 'waiting on user to provide a password';
                } else {
-                    displayDecryptionError('failed to decipher paste text: Incorrect password?');
-                    throw 'waiting on user to provide correct password';
+                    Alert.hideLoading();
+                    // reset password, so it can be re-entered
+                    Prompt.reset();
+                    TopNav.showRetryButton();
+                    throw 'Could not decrypt data. Did you enter a wrong password? Retry with the button at the top.';
                }
            }

-            let format = '',
-                text   = '';
            if (paste.v > 1) {
                // version 2 paste
                const pasteMessage = JSON.parse(pastePlain);
@@ -4412,27 +4652,6 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            });
        }

-        /**
-         * displays and logs decryption errors
-         *
-         * @name   PasteDecrypter.displayDecryptionError
-         * @private
-         * @function
-         * @param  {string} message
-         */
-        function displayDecryptionError(message)
-        {
-            Alert.hideLoading();
-
-            // log detailed error, but display generic translation
-            console.error(message);
-            Alert.showError('Could not decrypt data. Did you enter a wrong password? Retry with the button at the top.');
-
-            // reset password, so it can be re-entered
-            Prompt.reset();
-            TopNav.showRetryButton();
-        }
-
        /**
         * show decrypted text in the display area, including discussion (if open)
         *
@@ -4475,174 +4694,22 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                .then(() => {
                    Alert.hideLoading();
                    TopNav.showViewButtons();
+
+                    // discourage cloning (it cannot really be prevented)
+                    if (paste.isBurnAfterReadingEnabled()) {
+                        TopNav.hideCloneButton();
+                    }
                })
                .catch((err) => {
                    // wait for the user to type in the password,
                    // then PasteDecrypter.run will be called again
-                    console.error(err);
+                    Alert.showError(err);
                });
        };

        return me;
    })();

-
-    /**
-     * initial (security) check
-     *
-     * @name   InitialCheck
-     * @param  {object} window
-     * @param  {object} document
-     * @class
-     */
-    var InitialCheck = (function () {
-        var me = {};
-
-        /**
-         * blacklist of UserAgents (parts) known to belong to a bot
-         *
-         * @private
-         * @enum   {Array}
-         * @readonly
-         */
-        const badBotUA = [
-            'Bot',
-            'bot'
-        ];
-
-        /**
-         * check if the connection is insecure
-         *
-         * @private
-         * @name   InitialCheck.isInsecureConnection
-         * @function
-         * @return {bool}
-         */
-        function isInsecureConnection()
-        {
-            // use .isSecureContext if available
-            if (window.isSecureContext === true || window.isSecureContext === false) {
-                return !window.isSecureContext;
-            }
-
-            const url = new URL(window.location);
-
-            // HTTP is obviously insecure
-            if (url.protocol !== 'http:') {
-                return false;
-            }
-
-            // filter out actually secure connections over HTTP
-            for (const tld of ['.onion', '.i2p']) {
-                if (url.hostname.endsWith(tld)) {
-                    return false;
-                }
-            }
-
-            // whitelist localhost for development
-            for (const hostname of ['localhost', '127.0.0.1', '[::1]']) {
-                if (url.hostname === hostname) {
-                    return false;
-                }
-            }
-
-            // totally INSECURE http protocol!
-            return true;
-        }
-
-        /**
-         * checks whether this is a bot we dislike
-         *
-         * @private
-         * @name   InitialCheck.isBadBot
-         * @function
-         * @return {bool}
-         */
-        function isBadBot() {
-            // check whether a bot user agent part can be found in the current
-            // user agent
-            for (const UAfragment of badBotUA) {
-                if (navigator.userAgent.indexOf(UAfragment) >= 0) {
-                    return true;
-                }
-            }
-            return false;
-        }
-
-        /**
-         * checks whether this is an unsupported browser, via feature detection
-         *
-         * @private
-         * @name   InitialCheck.isOldBrowser
-         * @function
-         * @return {bool}
-         */
-        function isOldBrowser() {
-            // webcrypto support
-            if (typeof window.crypto !== 'object') {
-                return true;
-            }
-
-            if (typeof WebAssembly !== 'object' && typeof WebAssembly.instantiate !== 'function') {
-                return true;
-            }
-            try {
-                // [\0, 'a', 's', 'm', (uint_32) 1] - smallest valid wasm module
-                const module = new WebAssembly.Module(Uint8Array.of(0x0, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00));
-                if (
-                    !(
-                        module instanceof WebAssembly.Module &&
-                        new WebAssembly.Instance(module) instanceof WebAssembly.Instance
-                    )
-                ) {
-                    return true;
-                }
-            } catch (e) {
-                return true;
-            }
-
-             // not checking for async/await, ES6, Promise or Uint8Array support,
-             // as most browsers introduced these earlier then webassembly and webcrypto:
-             // https://github.com/PrivateBin/PrivateBin/pull/431#issuecomment-493129359
-
-            return false;
-        }
-
-        /**
-         * init on application start, returns an all-clear signal
-         *
-         * @name   InitialCheck.init
-         * @function
-         * @return {bool}
-         */
-        me.init = function()
-        {
-            // prevent bots from viewing a paste and potentially deleting data
-            // when burn-after-reading is set
-            if (isBadBot()) {
-                Alert.showError('I love you too, bot…');
-                return false;
-            }
-
-            if (isOldBrowser()) {
-                // some browsers (Chrome based ones) would have webcrypto support if using HTTPS
-                if (isInsecureConnection()) {
-                    Alert.showError(['Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href="%s">switching to HTTPS</a>.', 'https' + window.location.href.slice(4)]);
-                }
-                $('#oldnotice').removeClass('hidden');
-                return false;
-            }
-
-            if (isInsecureConnection()) {
-                $('#httpnotice').removeClass('hidden');
-            }
-
-            return true;
-        }
-
-        return me;
-    })();
-
    /**
     * (controller) main PrivateBin logic
     *
@@ -4687,7 +4754,17 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            AttachmentViewer.removeAttachment();

            TopNav.showCreateButtons();
+
+            // newPaste could be called when user is on paste clone editing view
+            TopNav.hideCustomAttachment();
+            AttachmentViewer.clearDragAndDrop();
+            AttachmentViewer.removeAttachmentData();
+
            Alert.hideLoading();
+            history.pushState({type: 'create'}, document.title, Helper.baseUri());
+
+            // clear discussion
+            DiscussionViewer.prepareNewDiscussion();
        };

        /**
@@ -4796,19 +4873,40 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            }

            Editor.setText(PasteViewer.getText());
+            // also clone the format
+            TopNav.setFormat(PasteViewer.getFormat());
            PasteViewer.hide();
            Editor.show();

            TopNav.showCreateButtons();
+
+            // clear discussion
+            DiscussionViewer.prepareNewDiscussion();
        };

+        /**
+         * try initializing zlib or display a warning if it fails,
+         * extracted from main init to allow unit testing
+         *
+         * @name   Controller.initZ
+         * @function
+         */
+        me.initZ = function()
+        {
+            z = zlib.catch(function () {
+                if ($('body').data('compression') !== 'none') {
+                    Alert.showWarning('Your browser doesn\'t support WebAssembly, used for zlib compression. You can create uncompressed documents, but can\'t read compressed ones.');
+                }
+            });
+        }
+
        /**
         * application start
         *
         * @name   Controller.init
         * @function
         */
-        me.init = async function()
+        me.init = function()
        {
            // first load translations
            I18n.loadTranslations();
@@ -4826,11 +4924,18 @@ jQuery.PrivateBin = (function($, RawDeflate) {
            Prompt.init();
            TopNav.init();
            UiHelper.init();
-            z = (await zlib);
-            if (!InitialCheck.init()) {
+
+            // check for legacy browsers before going any further
+            if (!Legacy.Check.getInit()) {
+                // Legacy check didn't complete, wait and try again
+                setTimeout(init, 500);
+                return;
+            }
+            if (!Legacy.Check.getStatus()) {
                // something major is wrong, stop right away
                return;
            }
+            me.initZ();

            // check whether existing paste needs to be shown
            try {
@@ -4870,7 +4975,6 @@ jQuery.PrivateBin = (function($, RawDeflate) {
        ServerInteraction: ServerInteraction,
        PasteEncrypter: PasteEncrypter,
        PasteDecrypter: PasteDecrypter,
-        InitialCheck: InitialCheck,
        Controller: Controller
    };
 })(jQuery, RawDeflate);
@@ -4,16 +4,55 @@ var common = require('../common');
 describe('Alert', function () {
    describe('showStatus', function () {
        jsc.property(
-            'shows a status message',
+            'shows a status message (basic)',
            jsc.array(common.jscAlnumString()),
            jsc.array(common.jscAlnumString()),
            function (icon, message) {
                icon = icon.join('');
                message = message.join('');
-                var expected = '<div id="status" role="alert" ' +
+                const expected = '<div id="status">' + message + '</div>';
+                $('body').html(
+                    '<div id="status"></div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showStatus(message, icon);
+                const result = $('body').html();
+                return expected === result;
+            }
+        );
+
+        jsc.property(
+            'shows a status message (bootstrap)',
+            jsc.array(common.jscAlnumString()),
+            function (message) {
+                message = message.join('');
+                const expected = '<div id="status" role="alert" ' +
+                    'class="statusmessage alert alert-info"><span ' +
+                    'class="glyphicon glyphicon-info-sign" ' +
+                    'aria-hidden="true"></span> <span>' + message + '</span></div>';
+                $('body').html(
+                    '<div id="status" role="alert" class="statusmessage ' +
+                    'alert alert-info hidden"><span class="glyphicon ' +
+                    'glyphicon-info-sign" aria-hidden="true"></span> </div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showStatus(message);
+                const result = $('body').html();
+                return expected === result;
+            }
+        );
+
+        jsc.property(
+            'shows a status message (bootstrap, custom icon)',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (icon, message) {
+                icon = icon.join('');
+                message = message.join('');
+                const expected = '<div id="status" role="alert" ' +
                    'class="statusmessage alert alert-info"><span ' +
                    'class="glyphicon glyphicon-' + icon +
-                    '" aria-hidden="true"></span> ' + message + '</div>';
+                    '" aria-hidden="true"></span> <span>' + message + '</span></div>';
                $('body').html(
                    '<div id="status" role="alert" class="statusmessage ' +
                    'alert alert-info hidden"><span class="glyphicon ' +
@@ -21,7 +60,76 @@ describe('Alert', function () {
                );
                $.PrivateBin.Alert.init();
                $.PrivateBin.Alert.showStatus(message, icon);
-                var result = $('body').html();
+                const result = $('body').html();
+                return expected === result;
+            }
+        );
+    });
+
+    describe('showWarning', function () {
+        before(function () {
+            cleanup();
+        });
+
+        jsc.property(
+            'shows a warning message (basic)',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (icon, message) {
+                icon = icon.join('');
+                message = message.join('');
+                const expected = '<div id="errormessage">' + message + '</div>';
+                $('body').html(
+                    '<div id="errormessage"></div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showWarning(message, icon);
+                const result = $('body').html();
+                return expected === result;
+            }
+        );
+
+        jsc.property(
+            'shows a warning message (bootstrap)',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (message) {
+                message = message.join('');
+                const expected = '<div id="errormessage" role="alert" ' +
+                    'class="statusmessage alert alert-danger"><span ' +
+                    'class="glyphicon glyphicon-warning-sign" ' +
+                    'aria-hidden="true"></span> <span>' + message + '</span></div>';
+                $('body').html(
+                    '<div id="errormessage" role="alert" class="statusmessage ' +
+                    'alert alert-danger hidden"><span class="glyphicon ' +
+                    'glyphicon-alert" aria-hidden="true"></span> </div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showWarning(message);
+                const result = $('body').html();
+                return expected === result;
+            }
+        );
+
+        jsc.property(
+            'shows a warning message (bootstrap, custom icon)',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (icon, message) {
+                icon = icon.join('');
+                message = message.join('');
+                const expected = '<div id="errormessage" role="alert" ' +
+                    'class="statusmessage alert alert-danger"><span ' +
+                    'class="glyphicon glyphicon-' + icon +
+                    '" aria-hidden="true"></span> <span>' + message + '</span></div>';
+                $('body').html(
+                    '<div id="errormessage" role="alert" class="statusmessage ' +
+                    'alert alert-danger hidden"><span class="glyphicon ' +
+                    'glyphicon-alert" aria-hidden="true"></span> </div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showWarning(message, icon);
+                const result = $('body').html();
                return expected === result;
            }
        );
@@ -33,16 +141,56 @@ describe('Alert', function () {
        });

        jsc.property(
-            'shows an error message',
+            'shows an error message (basic)',
            jsc.array(common.jscAlnumString()),
            jsc.array(common.jscAlnumString()),
            function (icon, message) {
                icon = icon.join('');
                message = message.join('');
-                var expected = '<div id="errormessage" role="alert" ' +
+                const expected = '<div id="errormessage">' + message + '</div>';
+                $('body').html(
+                    '<div id="errormessage"></div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showError(message, icon);
+                const result = $('body').html();
+                return expected === result;
+            }
+        );
+
+        jsc.property(
+            'shows an error message (bootstrap)',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (icon, message) {
+                message = message.join('');
+                const expected = '<div id="errormessage" role="alert" ' +
+                    'class="statusmessage alert alert-danger"><span ' +
+                    'class="glyphicon glyphicon-alert" ' +
+                    'aria-hidden="true"></span> <span>' + message + '</span></div>';
+                $('body').html(
+                    '<div id="errormessage" role="alert" class="statusmessage ' +
+                    'alert alert-danger hidden"><span class="glyphicon ' +
+                    'glyphicon-alert" aria-hidden="true"></span> </div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showError(message);
+                const result = $('body').html();
+                return expected === result;
+            }
+        );
+
+        jsc.property(
+            'shows an error message (bootstrap, custom icon)',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (icon, message) {
+                icon = icon.join('');
+                message = message.join('');
+                const expected = '<div id="errormessage" role="alert" ' +
                    'class="statusmessage alert alert-danger"><span ' +
                    'class="glyphicon glyphicon-' + icon +
-                    '" aria-hidden="true"></span> ' + message + '</div>';
+                    '" aria-hidden="true"></span> <span>' + message + '</span></div>';
                $('body').html(
                    '<div id="errormessage" role="alert" class="statusmessage ' +
                    'alert alert-danger hidden"><span class="glyphicon ' +
@@ -50,7 +198,7 @@ describe('Alert', function () {
                );
                $.PrivateBin.Alert.init();
                $.PrivateBin.Alert.showError(message, icon);
-                var result = $('body').html();
+                const result = $('body').html();
                return expected === result;
            }
        );
@@ -62,17 +210,36 @@ describe('Alert', function () {
        });

        jsc.property(
-            'shows remaining time',
+            'shows remaining time (basic)',
            jsc.array(common.jscAlnumString()),
            jsc.array(common.jscAlnumString()),
            'integer',
            function (message, string, number) {
                message = message.join('');
                string = string.join('');
-                var expected = '<div id="remainingtime" role="alert" ' +
+                const expected = '<div id="remainingtime" class="">' + string + message + number + '</div>';
+                $('body').html(
+                    '<div id="remainingtime" class="hidden"></div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showRemaining(['%s' + message + '%d', string, number]);
+                const result = $('body').html();
+                return expected === result;
+            }
+        );
+
+        jsc.property(
+            'shows remaining time (bootstrap)',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            'integer',
+            function (message, string, number) {
+                message = message.join('');
+                string = string.join('');
+                const expected = '<div id="remainingtime" role="alert" ' +
                    'class="alert alert-info"><span ' +
                    'class="glyphicon glyphicon-fire" aria-hidden="true">' +
-                    '</span> ' + string + message + number + '</div>';
+                    '</span> <span>' + string + message + number + '</span></div>';
                $('body').html(
                    '<div id="remainingtime" role="alert" class="hidden ' +
                    'alert alert-info"><span class="glyphicon ' +
@@ -80,7 +247,7 @@ describe('Alert', function () {
                );
                $.PrivateBin.Alert.init();
                $.PrivateBin.Alert.showRemaining(['%s' + message + '%d', string, number]);
-                var result = $('body').html();
+                const result = $('body').html();
                return expected === result;
            }
        );
@@ -92,20 +259,42 @@ describe('Alert', function () {
        });

        jsc.property(
-            'shows a loading message',
+            'shows a loading message (basic)',
            jsc.array(common.jscAlnumString()),
            jsc.array(common.jscAlnumString()),
            function (message, icon) {
                message = message.join('');
                icon = icon.join('');
-                var defaultMessage = 'Loading…';
+                const defaultMessage = 'Loading…';
                if (message.length === 0) {
                    message = defaultMessage;
                }
-                var expected = '<ul class="nav navbar-nav"><li ' +
+                const expected = '<div id="loadingindicator" class="">' + message + '</div>';
+                $('body').html(
+                    '<div id="loadingindicator" class="hidden">' + defaultMessage + '</div>'
+                );
+                $.PrivateBin.Alert.init();
+                $.PrivateBin.Alert.showLoading(message, icon);
+                const result = $('body').html();
+                return expected === result;
+            }
+        );
+
+        jsc.property(
+            'shows a loading message (bootstrap)',
+            jsc.array(common.jscAlnumString()),
+            jsc.array(common.jscAlnumString()),
+            function (message, icon) {
+                message = message.join('');
+                icon = icon.join('');
+                const defaultMessage = 'Loading…';
+                if (message.length === 0) {
+                    message = defaultMessage;
+                }
+                const expected = '<ul class="nav navbar-nav"><li ' +
                    'id="loadingindicator" class="navbar-text"><span ' +
                    'class="glyphicon glyphicon-' + icon +
-                    '" aria-hidden="true"></span> ' + message + '</li></ul>';
+                    '" aria-hidden="true"></span> <span>' + message + '</span></li></ul>';
                $('body').html(
                    '<ul class="nav navbar-nav"><li id="loadingindicator" ' +
                    'class="navbar-text hidden"><span class="glyphicon ' +
@@ -114,7 +303,7 @@ describe('Alert', function () {
                );
                $.PrivateBin.Alert.init();
                $.PrivateBin.Alert.showLoading(message, icon);
-                var result = $('body').html();
+                const result = $('body').html();
                return expected === result;
            }
        );
@@ -182,7 +371,7 @@ describe('Alert', function () {
            jsc.array(common.jscAlnumString()),
            function (trigger, message) {
                message = message.join('');
-                var handlerCalled = false,
+                let handlerCalled = false,
                    defaultMessage = 'Loading…',
                    functions = [
                        $.PrivateBin.Alert.showStatus,
@@ -0,0 +1,83 @@
+'use strict';
+var common = require('../common');
+/* global Legacy, WebCrypto */
+
+describe('Check', function () {
+    describe('init', function () {
+        this.timeout(30000);
+        before(function () {
+            cleanup();
+        });
+
+        it('returns false and shows error, if a bot UA is detected', function () {
+            jsc.assert(jsc.forall(
+                'string',
+                jsc.elements(['Bot', 'bot']),
+                'string',
+                function (prefix, botBit, suffix) {
+                    const clean = jsdom(
+                        '<html><body><div id="errormessage" class="hidden"></div>' +
+                        '</body></html>', {
+                            'userAgent': prefix + botBit + suffix
+                        }
+                    );
+                    Legacy.Check.init();
+                    const result1 = Legacy.Check.getInit() && !Legacy.Check.getStatus(),
+                          result2 = (document.getElementById('errormessage').className !== 'hidden');
+                    clean();
+                    return result1 && result2;
+                }
+            ),
+            {tests: 10});
+        });
+
+        jsc.property(
+            'shows error, if no webcrypto is detected',
+            'bool',
+            jsc.elements(['localhost', '127.0.0.1', '[::1]', '']),
+            jsc.nearray(common.jscA2zString()),
+            jsc.elements(['.onion', '.i2p', '']),
+            function (secureProtocol, localhost, domain, tld) {
+                const isDomain = localhost === '',
+                      isSecureContext = secureProtocol || !isDomain || tld.length > 0,
+                      clean = jsdom(
+                          '<html><body><div id="errormessage" class="hidden"></div>' +
+                          '<div id="oldnotice" class="hidden"></div>' +
+                          '<div id="insecurecontextnotice" class="hidden"></div></body></html>',
+                          {
+                              'url': (secureProtocol ? 'https' : 'http' ) + '://' +
+                                     (isDomain ? domain.join('') + tld : localhost) + '/'
+                          }
+                      );
+                Legacy.Check.init();
+                const result1 = Legacy.Check.getInit() && !Legacy.Check.getStatus(),
+                      result2 = isSecureContext === (document.getElementById('insecurecontextnotice').className === 'hidden'),
+                      result3 = (document.getElementById('oldnotice').className !== 'hidden');
+                clean();
+                return result1 && result2 && result3;
+            }
+        );
+
+        jsc.property(
+            'shows error, if HTTP only site is detected',
+            'bool',
+            jsc.nearray(common.jscA2zString()),
+            function (secureProtocol, domain) {
+                const clean = jsdom(
+                          '<html><body><div id="httpnotice" class="hidden"></div>' +
+                          '</body></html>',
+                          {
+                              'url': (secureProtocol ? 'https' : 'http' ) + '://' + domain.join('') + '/'
+                          }
+                      );
+                window.crypto = new WebCrypto();
+                Legacy.Check.init();
+                const result1 = Legacy.Check.getInit() && Legacy.Check.getStatus(),
+                      result2 = secureProtocol === (document.getElementById('httpnotice').className === 'hidden');
+                clean();
+                return result1 && result2;
+            }
+        );
+    });
+});
+
@@ -18,6 +18,8 @@ describe('CryptTool', function () {
                    // pause to let async functions conclude
                    await new Promise(resolve => setTimeout(resolve, 300));
                    let clean = jsdom();
+                    // ensure zlib is getting loaded
+                    $.PrivateBin.Controller.initZ();
                    window.crypto = new WebCrypto();
                    message = message.trim();
                    let cipherMessage = await $.PrivateBin.CryptTool.cipher(
@@ -179,6 +181,8 @@ describe('CryptTool', function () {
            let message = fs.readFileSync('test/compression-sample.txt', 'utf8'),
                clean = jsdom();
            window.crypto = new WebCrypto();
+            // ensure zlib is getting loaded
+            $.PrivateBin.Controller.initZ();
            let cipherMessage = await $.PrivateBin.CryptTool.cipher(
                    'foo', 'bar', message, []
                ),
@@ -222,6 +226,8 @@ isWhile : interp (while expr sBody) (MemElem mem) =
 conseq_or_bottom inv (interp (nth_iterate sBody n) (MemElem mem))
 `;
                    let clean = jsdom();
+                    // ensure zlib is getting loaded
+                    $.PrivateBin.Controller.initZ();
                    window.crypto = new WebCrypto();
                    let cipherMessage = await $.PrivateBin.CryptTool.cipher(
                            key, password, message, []
@@ -183,9 +183,9 @@ describe('Helper', function () {
            'string',
            'string',
            function (prefix, uint, middle, string, postfix) {
-                prefix  =  prefix.replace(/%(s|d)/g, '%%');
-                middle  =  middle.replace(/%(s|d)/g, '%%');
-                postfix = postfix.replace(/%(s|d)/g, '%%');
+                prefix  =  prefix.replace(/%(s|d)/g, '');
+                middle  =  middle.replace(/%(s|d)/g, '');
+                postfix = postfix.replace(/%(s|d)/g, '');
                var params = [prefix + '%d' + middle + '%s' + postfix, uint, string],
                    result = prefix + uint + middle + string + postfix;
                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
@@ -199,9 +199,9 @@ describe('Helper', function () {
            'string',
            'string',
            function (prefix, uint, middle, string, postfix) {
-                prefix  =  prefix.replace(/%(s|d)/g, '%%');
-                middle  =  middle.replace(/%(s|d)/g, '%%');
-                postfix = postfix.replace(/%(s|d)/g, '%%');
+                prefix  =  prefix.replace(/%(s|d)/g, '');
+                middle  =  middle.replace(/%(s|d)/g, '');
+                postfix = postfix.replace(/%(s|d)/g, '');
                var params = [prefix + '%s' + middle + '%d' + postfix, string, uint],
                    result = prefix + string + middle + uint + postfix;
                return result === $.PrivateBin.Helper.sprintf.apply(this, params);
@@ -1,88 +0,0 @@
-'use strict';
-var common = require('../common');
-
-describe('InitialCheck', function () {
-    describe('init', function () {
-        this.timeout(30000);
-        before(function () {
-            cleanup();
-        });
-
-        it('returns false and shows error, if a bot UA is detected', function () {
-            jsc.assert(jsc.forall(
-                'string',
-                jsc.elements(['Bot', 'bot']),
-                'string',
-                function (prefix, botBit, suffix) {
-                    const clean = jsdom('', {
-                        'userAgent': prefix + botBit + suffix
-                    });
-                    $('body').html(
-                        '<html><body><div id="errormessage" class="hidden"></div>' +
-                        '</body></html>'
-                    );
-                    $.PrivateBin.Alert.init();
-                    window.crypto = null;
-                    const result1 = !$.PrivateBin.InitialCheck.init(),
-                          result2 = !$('#errormessage').hasClass('hidden');
-                    clean();
-                    return result1 && result2;
-                }
-            ),
-            {tests: 10});
-        });
-
-        jsc.property(
-            'shows error, if no webcrypto is detected',
-            'bool',
-            jsc.elements(['localhost', '127.0.0.1', '[::1]', '']),
-            jsc.nearray(common.jscA2zString()),
-            jsc.elements(['.onion', '.i2p', '']),
-            function (secureProtocol, localhost, domain, tld) {
-                const isDomain = localhost === '',
-                      isSecureContext = secureProtocol || !isDomain || tld.length > 0,
-                      clean = jsdom('', {
-                          'url': (secureProtocol ? 'https' : 'http' ) + '://' +
-                                 (isDomain ? domain.join('') + tld : localhost) + '/'
-                      });
-                $('body').html(
-                    '<html><body><div id="errormessage" class="hidden"></div>'+
-                    '<div id="oldnotice" class="hidden"></div></body></html>'
-                );
-                $.PrivateBin.Alert.init();
-                const result1 = !$.PrivateBin.InitialCheck.init(),
-                      result2 = isSecureContext === $('#errormessage').hasClass('hidden'),
-                      result3 = !$('#oldnotice').hasClass('hidden');
-                clean();
-                return result1 && result2 && result3;
-            }
-        );
-
-        jsc.property(
-            'shows error, if HTTP only site is detected',
-            'bool',
-            jsc.elements(['localhost', '127.0.0.1', '[::1]', '']),
-            jsc.nearray(common.jscA2zString()),
-            jsc.elements(['.onion', '.i2p', '']),
-            function (secureProtocol, localhost, domain, tld) {
-                const isDomain = localhost === '',
-                      isSecureContext = secureProtocol || !isDomain || tld.length > 0,
-                      clean = jsdom('', {
-                          'url': (secureProtocol ? 'https' : 'http' ) + '://' +
-                               (isDomain ? domain.join('') + tld : localhost) + '/'
-                      });
-                $('body').html(
-                    '<html><body><div id="httpnotice" class="hidden"></div>'+
-                    '</body></html>'
-                );
-                $.PrivateBin.Alert.init();
-                window.crypto = null;
-                const result1 = $.PrivateBin.InitialCheck.init(),
-                      result2 = isSecureContext === $('#httpnotice').hasClass('hidden');
-                clean();
-                return result1 && result2;
-            }
-        );
-    });
-});
-
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin;
@@ -45,7 +45,7 @@ class Configuration
            'burnafterreadingselected' => false,
            'defaultformatter'         => 'plaintext',
            'syntaxhighlightingtheme'  => null,
-            'sizelimit'                => 2097152,
+            'sizelimit'                => 10485760,
            'template'                 => 'bootstrap',
            'notice'                   => '',
            'languageselection'        => false,
@@ -53,7 +53,7 @@ class Configuration
            'urlshortener'             => '',
            'qrcode'                   => true,
            'icon'                     => 'identicon',
-            'cspheader'                => 'default-src \'none\'; manifest-src \'self\'; connect-src *; script-src \'self\' \'unsafe-eval\'; style-src \'self\'; font-src \'self\'; img-src \'self\' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals',
+            'cspheader'                => 'default-src \'none\'; manifest-src \'self\'; connect-src * blob:; script-src \'self\' \'unsafe-eval\'; style-src \'self\'; font-src \'self\'; img-src \'self\' data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-popups allow-modals',
            'zerobincompatibility'     => false,
            'httpwarning'              => true,
            'compression'              => 'zlib',
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin;
@@ -28,7 +28,7 @@ class Controller
     *
     * @const string
     */
-    const VERSION = '1.3';
+    const VERSION = '1.3.1';

    /**
     * minimal required PHP version
@@ -388,6 +388,7 @@ class Controller
        $page->assign('URLSHORTENER', $this->_conf->getKey('urlshortener'));
        $page->assign('QRCODE', $this->_conf->getKey('qrcode'));
        $page->assign('HTTPWARNING', $this->_conf->getKey('httpwarning'));
+        $page->assign('HTTPSLINK', 'https://' . $this->_request->getHost() . $this->_request->getRequestUri());
        $page->assign('COMPRESSION', $this->_conf->getKey('compression'));
        $page->draw($this->_conf->getKey('template'));
    }
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Data;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Data;
@@ -597,6 +597,8 @@ class Database extends AbstractData
    /**
     * get the data type, depending on the database driver
     *
+     * PostgreSQL uses a different API for BLOBs then SQL, hence we use TEXT
+     *
     * @access private
     * @static
     * @return string
@@ -609,6 +611,8 @@ class Database extends AbstractData
    /**
     * get the attachment type, depending on the database driver
     *
+     * PostgreSQL uses a different API for BLOBs then SQL, hence we use TEXT
+     *
     * @access private
     * @static
     * @return string
@@ -628,16 +632,17 @@ class Database extends AbstractData
    {
        list($main_key, $after_key) = self::_getPrimaryKeyClauses();
        $dataType                   = self::_getDataType();
+        $attachmentType             = self::_getAttachmentType();
        self::$_db->exec(
            'CREATE TABLE ' . self::_sanitizeIdentifier('paste') . ' ( ' .
            "dataid CHAR(16) NOT NULL$main_key, " .
-            "data $dataType, " .
+            "data $attachmentType, " .
            'postdate INT, ' .
            'expiredate INT, ' .
            'opendiscussion INT, ' .
            'burnafterreading INT, ' .
            'meta TEXT, ' .
-            'attachment ' . self::_getAttachmentType() . ', ' .
+            "attachment $attachmentType, " .
            "attachmentname $dataType$after_key );"
        );
    }
@@ -711,6 +716,7 @@ class Database extends AbstractData
    private static function _upgradeDatabase($oldversion)
    {
        $dataType       = self::_getDataType();
+        $attachmentType = self::_getAttachmentType();
        switch ($oldversion) {
            case '0.21':
                // create the meta column if necessary (pre 0.21 change)
@@ -722,7 +728,7 @@ class Database extends AbstractData
                // SQLite only allows one ALTER statement at a time...
                self::$_db->exec(
                    'ALTER TABLE ' . self::_sanitizeIdentifier('paste') .
-                    ' ADD COLUMN attachment ' . self::_getAttachmentType() . ';'
+                    " ADD COLUMN attachment $attachmentType;"
                );
                self::$_db->exec(
                    'ALTER TABLE ' . self::_sanitizeIdentifier('paste') . " ADD COLUMN attachmentname $dataType;"
@@ -732,7 +738,7 @@ class Database extends AbstractData
                if (self::$_type !== 'sqlite') {
                    self::$_db->exec(
                        'ALTER TABLE ' . self::_sanitizeIdentifier('paste') .
-                        ' ADD PRIMARY KEY (dataid), MODIFY COLUMN data $dataType;'
+                        " ADD PRIMARY KEY (dataid), MODIFY COLUMN data $dataType;"
                    );
                    self::$_db->exec(
                        'ALTER TABLE ' . self::_sanitizeIdentifier('comment') .
@@ -754,6 +760,17 @@ class Database extends AbstractData
                    self::_sanitizeIdentifier('comment') . '(pasteid);'
                );
                // no break, continue with updates for 0.22 and later
+            case '1.3':
+                // SQLite doesn't support MODIFY, but it allows TEXT of similar
+                // size as BLOB and PostgreSQL uses TEXT, so there is no need
+                // to change it there
+                if (self::$_type !== 'sqlite' && self::$_type !== 'pgsql') {
+                    self::$_db->exec(
+                        'ALTER TABLE ' . self::_sanitizeIdentifier('paste') .
+                        " MODIFY COLUMN data $attachmentType;"
+                    );
+                }
+                // no break, continue with updates for 1.3.1 and later
            default:
                self::_exec(
                    'UPDATE ' . self::_sanitizeIdentifier('config') .
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Data;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin;
@@ -306,7 +306,7 @@ class I18n
                return $n % 10 == 1 && $n % 100 != 11 ? 0 : ($n % 10 >= 2 && $n % 10 <= 4 && ($n % 100 < 10 || $n % 100 >= 20) ? 1 : 2);
            case 'sl':
                return $n % 100 == 1 ? 1 : ($n % 100 == 2 ? 2 : ($n % 100 == 3 || $n % 100 == 4 ? 3 : 0));
-            // de, en, es, hu, it, nl, no, pt
+            // bg, de, en, es, hu, it, nl, no, pt
            default:
                return $n != 1 ? 1 : 0;
        }
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Model;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Model;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Model;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Persistence;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Persistence;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Persistence;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin\Persistence;
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin;
@@ -193,6 +193,19 @@ class Request
            $this->_params[$param] : $default;
    }

+    /**
+     * Get host as requested by the client
+     *
+     * @access public
+     * @return string
+     */
+    public function getHost()
+    {
+        return array_key_exists('HTTP_HOST', $_SERVER) ?
+            htmlspecialchars($_SERVER['HTTP_HOST']) :
+            'localhost';
+    }
+
    /**
     * Get request URI
     *
@@ -7,7 +7,7 @@
 * @link      https://github.com/PrivateBin/PrivateBin
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   http://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   1.3
+ * @version   1.3.1
 */

 namespace PrivateBin;
@@ -8,7 +8,7 @@
 * @link      http://sebsauvage.net/wiki/doku.php?id=php:vizhash_gd
 * @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
 * @license   https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
- * @version   0.0.5 beta PrivateBin 1.3
+ * @version   0.0.5 beta PrivateBin 1.3.1
 */

 namespace PrivateBin;
@@ -5,5 +5,4 @@
 # directory.

 User-agent: *
-Allow: /index.php
 Disallow: /
@@ -66,15 +66,13 @@ if ($SYNTAXHIGHLIGHTING):
 endif;
 if ($MARKDOWN):
 ?>
-		<script type="text/javascript" data-cfasync="false" src="js/showdown-1.9.0.js" integrity="sha512-Kv8oAge9h2QmRyzb52jUomyXAvSMrpE9kWF3QRMFajo1a/TXjtY8u71vUA6t4+LE7huz4TSVH8VLJBEmcZiPRA==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/showdown-1.9.1.js" integrity="sha512-VeINC2WUWLyxgeQ56SsYFjQ5+d7RLvLPYOEYDFtEDd3AyVsgIsHYsWZ6WwgALwB6YR6qrVEM3IH4Bck96IfbMw==" crossorigin="anonymous"></script>
 <?php
 endif;
 ?>
-		<script type="text/javascript" data-cfasync="false" src="js/purify-1.0.11.js" integrity="sha512-p7UyJuyBkhMcMgE4mDsgK0Lz70OvetLefua1oXs1OujWv9gOxh4xy8InFux7bZ4/DAZsTmO4rgVwZW9BHKaTaw==" crossorigin="anonymous"></script>
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-dNBKGlXagUZhkKcI+HhEH0otOswA5g2QnJV8BxYxNK/piW9jJWZvADCbzDJNRjt6A6QgMwBM8+lH7K3lgsOuQw==" crossorigin="anonymous"></script>
-		<!--[if IE]>
-		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;}</style>
-		<![endif]-->
+		<script type="text/javascript" data-cfasync="false" src="js/purify-2.0.1.js" integrity="sha512-ddI36MdUoXp/o7yhQtr9/qj4G3oFwCRga4jCGaoUYtORg0PPmFKVKG4Ess3fIknYzxwwKMlrIL9o4NwuPTCc1Q==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-iZeao0p5riUgentjlrI2cY7Y8KRLTO42bQ4VGy6ky5FS0UjqXW4UkEJQcvR01SxbUFUz7h5AwzC8CVnUHDwRUg==" crossorigin="anonymous"></script>
 		<link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" />
 		<link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" />
 		<link rel="icon" type="image/png" href="img/favicon-16x16.png?<?php echo rawurlencode($VERSION); ?>" sizes="16x16" />
@@ -397,20 +395,6 @@ if (strlen($LANGUAGESELECTION)):
 <?php
 endif;
 ?>
-					<li>
-<?php
-if ($isPage):
-?>
-						<button id="newbutton" type="button" class="reloadlink hidden btn btn-<?php echo $isDark ? 'warning' : 'default'; ?> navbar-btn">
-							<span class="glyphicon glyphicon-file" aria-hidden="true"></span> <?php echo I18n::_('New'), PHP_EOL;
-else:
-?>
-						<button id="sendbutton" type="button" class="hidden btn btn-<?php echo $isDark ? 'warning' : 'primary'; ?> navbar-btn">
-							<span class="glyphicon glyphicon-upload" aria-hidden="true"></span> <?php echo I18n::_('Send'), PHP_EOL;
-endif;
-?>
-						</button>
-					</li>
 				</ul>
 			</div>
 		<?php
@@ -460,10 +444,6 @@ endif;
 				<div id="oldnotice" role="alert" class="hidden alert alert-danger">
 					<span class="glyphicon glyphicon-alert" aria-hidden="true"></span>
 					<?php echo I18n::_('%s requires a modern browser to work.', I18n::_($NAME)), PHP_EOL; ?>
-				</div>
-				<div id="ienotice" role="alert" class="hidden alert alert-danger">
-					<span class="glyphicon glyphicon-question-sign" aria-hidden="true"></span>
-					<?php echo I18n::_('Still using Internet Explorer? Do yourself a favor, switch to a modern browser:'), PHP_EOL; ?>
 					<a href="https://www.mozilla.org/firefox/">Firefox</a>,
 					<a href="https://www.opera.com/">Opera</a>,
 					<a href="https://www.google.com/chrome">Chrome</a>…
@@ -476,19 +456,31 @@ if ($HTTPWARNING):
 					<?php echo I18n::_('This website is using an insecure connection! Please only use it for testing.'), PHP_EOL; ?><br />
 					<span class="small"><?php echo I18n::_('For more information <a href="%s">see this FAQ entry</a>.', 'https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-it-show-me-an-error-about-an-insecure-connection'); ?></span>
 				</div>
+				<div id="insecurecontextnotice" role="alert" class="hidden alert alert-danger">
+					<span class="glyphicon glyphicon-alert" aria-hidden="true"></span>
+					<?php echo I18n::_('Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href="%s">switching to HTTPS</a>.', $HTTPSLINK); ?>
+				</div>
 <?php
 endif;
 ?>
-				<div id="pastesuccess" role="alert" class="hidden alert alert-success">
+				<div id="pastesuccess" class="hidden">
+					<div role="alert" class="alert alert-success">
 						<span class="glyphicon glyphicon-ok" aria-hidden="true"></span>
 						<div id="deletelink"></div>
 						<div id="pastelink"></div>
+					</div>
 <?php
 if (strlen($URLSHORTENER)):
 ?>
-					<button id="shortenbutton" data-shortener="<?php echo htmlspecialchars($URLSHORTENER); ?>" type="button" class="btn btn-<?php echo $isDark ? 'warning' : 'primary'; ?>">
+					<p>
+						<button id="shortenbutton" data-shortener="<?php echo htmlspecialchars($URLSHORTENER); ?>" type="button" class="btn btn-<?php echo $isDark ? 'warning' : 'primary'; ?> btn-block">
 						<span class="glyphicon glyphicon-send" aria-hidden="true"></span> <?php echo I18n::_('Shorten URL'), PHP_EOL; ?>
 					</button>
+					</p>
+					<div role="alert" class="alert alert-danger">
+						<span class="glyphicon glyphicon-exclamation-sign" aria-hidden="true"></span>
+						<?php echo I18n::_('URL shortener may expose your decrypt key in URL.'), PHP_EOL; ?>
+					</div>
 <?php
 endif;
 ?>
@@ -496,6 +488,20 @@ endif;
 				<ul id="editorTabs" class="nav nav-tabs hidden">
 					<li role="presentation" class="active"><a id="messageedit" href="#"><?php echo I18n::_('Editor'); ?></a></li>
 					<li role="presentation"><a id="messagepreview" href="#"><?php echo I18n::_('Preview'); ?></a></li>
+					<li role="presentation" class="pull-right">
+<?php
+if ($isPage):
+?>
+						<button id="newbutton" type="button" class="reloadlink hidden btn btn-<?php echo $isDark ? 'warning' : 'default'; ?>">
+							<span class="glyphicon glyphicon-file" aria-hidden="true"></span> <?php echo I18n::_('New'), PHP_EOL;
+else:
+?>
+						<button id="sendbutton" type="button" class="hidden btn btn-<?php echo $isDark ? 'warning' : 'primary'; ?>">
+							<span class="glyphicon glyphicon-upload" aria-hidden="true"></span> <?php echo I18n::_('Send'), PHP_EOL;
+endif;
+?>
+						</button>
+					</li>
 				</ul>
 			</section>
 			<section class="container">
@@ -544,6 +550,13 @@ if ($DISCUSSION):
 		</div>
 <?php
 endif;
+?>
+<?php
+if ($FILEUPLOAD):
+?>
+		<div id="dropzone" class="hidden" tabindex="-1" aria-hidden="true"></div>
+<?php
+endif;
 ?>
 	</body>
 </html>
@@ -44,15 +44,13 @@ if ($SYNTAXHIGHLIGHTING):
 endif;
 if ($MARKDOWN):
 ?>
-		<script type="text/javascript" data-cfasync="false" src="js/showdown-1.9.0.js" integrity="sha512-Kv8oAge9h2QmRyzb52jUomyXAvSMrpE9kWF3QRMFajo1a/TXjtY8u71vUA6t4+LE7huz4TSVH8VLJBEmcZiPRA==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/showdown-1.9.1.js" integrity="sha512-VeINC2WUWLyxgeQ56SsYFjQ5+d7RLvLPYOEYDFtEDd3AyVsgIsHYsWZ6WwgALwB6YR6qrVEM3IH4Bck96IfbMw==" crossorigin="anonymous"></script>
 <?php
 endif;
 ?>
-		<script type="text/javascript" data-cfasync="false" src="js/purify-1.0.11.js" integrity="sha512-p7UyJuyBkhMcMgE4mDsgK0Lz70OvetLefua1oXs1OujWv9gOxh4xy8InFux7bZ4/DAZsTmO4rgVwZW9BHKaTaw==" crossorigin="anonymous"></script>
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-dNBKGlXagUZhkKcI+HhEH0otOswA5g2QnJV8BxYxNK/piW9jJWZvADCbzDJNRjt6A6QgMwBM8+lH7K3lgsOuQw==" crossorigin="anonymous"></script>
-		<!--[if IE]>
-		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;}</style>
-		<![endif]-->
+		<script type="text/javascript" data-cfasync="false" src="js/purify-2.0.1.js" integrity="sha512-ddI36MdUoXp/o7yhQtr9/qj4G3oFwCRga4jCGaoUYtORg0PPmFKVKG4Ess3fIknYzxwwKMlrIL9o4NwuPTCc1Q==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-iZeao0p5riUgentjlrI2cY7Y8KRLTO42bQ4VGy6ky5FS0UjqXW4UkEJQcvR01SxbUFUz7h5AwzC8CVnUHDwRUg==" crossorigin="anonymous"></script>
 		<link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" />
 		<link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" />
 		<link rel="icon" type="image/png" href="img/favicon-16x16.png?<?php echo rawurlencode($VERSION); ?>" sizes="16x16" />
@@ -77,8 +75,7 @@ endif;
 			<h2 class="title"><?php echo I18n::_('Because ignorance is bliss'); ?></h2><br />
 			<h3 class="title"><?php echo $VERSION; ?></h3>
 			<noscript><div id="noscript" class="nonworking"><?php echo I18n::_('JavaScript is required for %s to work.<br />Sorry for the inconvenience.', I18n::_($NAME)); ?></div></noscript>
-			<div id="oldnotice" class="nonworking"><?php echo I18n::_('%s requires a modern browser to work.', I18n::_($NAME)); ?></div>
-			<div id="ienotice" class="nonworking"><?php echo I18n::_('Still using Internet Explorer? Do yourself a favor, switch to a modern browser:'), PHP_EOL; ?>
+			<div id="oldnotice" class="nonworking hidden"><?php echo I18n::_('%s requires a modern browser to work.', I18n::_($NAME)), PHP_EOL; ?>
 				<a href="https://www.mozilla.org/firefox/">Firefox</a>,
 				<a href="https://www.opera.com/">Opera</a>,
 				<a href="https://www.google.com/chrome">Chrome</a>…
@@ -86,10 +83,13 @@ endif;
 <?php
 if ($HTTPWARNING):
 ?>
-			<div id="httpnotice" class="errorMessage">
+			<div id="httpnotice" class="errorMessage hidden">
 				<?php echo I18n::_('This website is using an insecure connection! Please only use it for testing.'); ?>
 				<span class="small"><?php echo I18n::_('For more information <a href="%s">see this FAQ entry</a>.', 'https://github.com/PrivateBin/PrivateBin/wiki/FAQ#why-does-it-show-me-an-error-about-an-insecure-connection'); ?></span>
 			</div>
+			<div id="insecurecontextnotice" class="errorMessage hidden">
+				<?php echo I18n::_('Your browser may require an HTTPS connection to support the WebCrypto API. Try <a href="%s">switching to HTTPS</a>.', $HTTPSLINK); ?>
+			</div>
 <?php
 endif;
 ?>
@@ -254,6 +254,13 @@ if ($DISCUSSION):
 		</div>
 <?php
 endif;
+?>
+<?php
+if ($FILEUPLOAD):
+?>
+		<div id="dropzone" class="hidden" tabindex="-1" aria-hidden="true"></div>
+<?php
+endif;
 ?>
 		<section class="container">
 			<div id="noscript" role="alert" class="nonworking alert alert-info noscript-hide"><span class="glyphicon glyphicon-exclamation-sign" aria-hidden="true">
@@ -56,6 +56,7 @@ class ViewTest extends PHPUnit_Framework_TestCase
        $page->assign('URLSHORTENER', '');
        $page->assign('QRCODE', true);
        $page->assign('HTTPWARNING', true);
+        $page->assign('HTTPSLINK', 'https://example.com/');
        $page->assign('COMPRESSION', 'zlib');

        $dir = dir(PATH . 'tpl');
Author	SHA1	Message	Date
El RIDO	71797d1dd4	changes required for jsdoc, adding legacy.js to code coverage	2019-09-22 21:18:19 +02:00
El RIDO	476b9c90e2	updating PHP dependencies (they remain unchanged), committing lock for github dependency graph support	2019-09-22 19:52:25 +02:00
El RIDO	2d4edfe401	incrementing version number in preparation of release	2019-09-22 19:42:04 +02:00
El RIDO	ced5f30280	Merge branch 'cryptomilk-master-htaccess'	2019-09-20 07:06:38 +02:00
El RIDO	d5aeba60ca	increase default size limit to 10 MiB, documenting change	2019-09-20 07:04:26 +02:00
El RIDO	5c0012cf51	adding database migration to increase data to MEDIUMBLOB on MySQL by default	2019-09-20 06:57:54 +02:00
El RIDO	091dc14074	Merge branch 'master-htaccess' of https://github.com/cryptomilk/PrivateBin into cryptomilk-master-htaccess	2019-09-20 06:28:07 +02:00
El RIDO	a3f793fec7	documenting changes	2019-09-20 06:27:07 +02:00
El RIDO	b496ae42fd	Merge branch 'better-feature-detection'	2019-09-20 06:18:10 +02:00
El RIDO	e9eeeacdf0	addressing jsverifyRngState 0f5ea3f961827b0c4d	2019-09-19 20:48:05 +02:00
El RIDO	8da382f7c6	Merge branch 'master' into better-feature-detection	2019-09-19 20:19:35 +02:00
El RIDO	28d70a1b18	upgrading DOMpurify, fixes #520	2019-09-19 20:13:47 +02:00
El RIDO	c1f6e5663b	Merge branch 'master' into better-feature-detection	2019-09-19 20:02:00 +02:00
El RIDO	bf0be09f09	removing old IE warning, as it is ignored by IE. The modern warning does get displayed, so let's use this more generic warning instead.	2019-09-19 20:01:10 +02:00
El RIDO	955317d924	make codacy a bit happier	2019-09-19 19:47:19 +02:00
El RIDO	8e27dbff15	clarify the use of 'unsafe-eval' and what the impact removing it has - Firefox users may not care and disable it to improve security	2019-09-19 19:24:28 +02:00
El RIDO	7c61f59dcd	removing untranslated string for non-human entities, moving insecure notice to template, so it can remains translated	2019-09-19 19:14:48 +02:00
El RIDO	70c38db81d	adding ES6 and async feature detection to correctly flag old chromes and operas with the modern browser error	2019-09-18 07:47:26 +02:00
El RIDO	4332d0edb0	making legacy.js work even on IE 6 by avoiding jQuery	2019-09-18 07:31:32 +02:00
El RIDO	5810f17c31	fixing HTTP only error detection in Chrome and Android by ensuring all logic is contained in legacy.js	2019-09-17 21:41:25 +02:00
El RIDO	15b3d67ba7	adding browserstack badge in order to be elegible for their OpenSource program (https://www.browserstack.com/open-source?ref=pricing )	2019-09-16 20:51:49 +02:00
El RIDO	1a42158dd1	address Codacy's concern about missing semicolons	2019-09-14 09:53:22 +02:00
El RIDO	713ce148a4	address Codacy's concern that i is already defined	2019-09-14 09:50:47 +02:00
El RIDO	63426d6f8b	splitting out PrivateBin.InitialCheck class into Legacy.Check and working on making it compatible with IE 11	2019-09-14 09:41:52 +02:00
El RIDO	a363b2ff95	eslint env cleanup	2019-09-08 09:12:56 +02:00
El RIDO	c2962af4f8	trying different approach to convince codacy about false positive	2019-09-08 09:08:21 +02:00
El RIDO	ae11d168ce	trying to convince codacy about the eslint changes	2019-09-08 09:02:15 +02:00
El RIDO	7b029d3657	trying to convince codacy about the eslint changes	2019-09-08 08:55:19 +02:00
El RIDO	b1c9ca65fa	trying to address eslint false positives	2019-09-08 08:39:28 +02:00
El RIDO	5471757fa7	making webassembly optional, ensuring retry button works when wrong password is provided Tested configurations: - browser with WASM support (Firefox 68.0.2) - creates paste with zlib compression, no password - creates paste with zlib compression, with password - reads paste with zlib compression, no password - reads paste with zlib compression, with password + retry button works - reads paste without compression, no password - reads paste without compression, with password + retry button works - browser without WASM support (Chromium 76.0.3809.100, started via `chromium-browser --js-flags=--noexpose_wasm`) - creates paste without compression, no password, but shows WASM warning - creates paste without compression, with password, but shows WASM warning - fails to read paste with zlib compression, no password + shows WASM error - fails to read paste with zlib compression, with password + shows WASM error - reads paste without compression, no password - reads paste without compression, with password + retry button works	2019-09-08 08:21:54 +02:00
El RIDO	7a85900b7c	Merge branch 'master' into better-feature-detection	2019-09-07 11:25:50 +02:00
El RIDO	269def8300	Merge branch 'idarlund-patch-6'	2019-09-07 11:23:20 +02:00
Idar Lund	c992d10833	Update no.json updated new lines to Norwegian	2019-09-04 12:21:04 +02:00
El RIDO	813e72d871	don't encode HTML entities in translations if they contain links	2019-08-28 20:37:14 +02:00
El RIDO	50881a75e6	ensure bots are prohibited completely from indexing	2019-08-28 20:36:26 +02:00
El RIDO	c56d777c11	fixing logic when there are no icons and warning icons, add more test cases	2019-08-28 20:29:23 +02:00
El RIDO	7f65fe9218	fixing conflicting icons when using error message div for warnings in bootstrap template	2019-08-28 19:25:11 +02:00
El RIDO	ad570c391a	extend Alert class unit testing	2019-08-28 19:23:58 +02:00
El RIDO	a6aef109cc	making feature detection work as intended in chrome	2019-08-27 23:16:06 +02:00
El RIDO	6fcd82fb85	making the feature detection more robust, let users with no WASM create uncompressed pastes, remove dead & duplicate code	2019-08-27 07:38:27 +02:00
El RIDO	ff68043c9f	Merge branch 'Haocen-505-patch'	2019-08-25 18:16:17 +02:00
Haocen Xu	5877111ccb	Update SRI	2019-08-25 12:03:37 -04:00
Haocen Xu	00b886c492	Refactor attachment editable logic to avoid undesired assumption	2019-08-25 12:00:59 -04:00
El RIDO	e242d87427	Merge branch 'Haocen-489,491,493,494'	2019-08-25 17:30:20 +02:00
El RIDO	271d4b680a	updating changelog	2019-08-25 17:29:52 +02:00
El RIDO	ad096b80a1	refactoring logic, to make intention more clear and reduce complexity	2019-08-25 17:24:22 +02:00
Haocen Xu	b912c07cd1	Update SRI	2019-08-25 02:17:29 -04:00
Haocen Xu	ab75b183fb	Fix click on new paste on clone paste editing view not removing custom attachment Fix cloning paste with attachment Update CSP in sample and default configuration Ensure clone paste also clone format Fix clone button hiding logic when paste is burn after read Remove attachment name when new paste clicked on Enable file operation only when editing	2019-08-25 02:16:58 -04:00
El RIDO	121b1e75d2	remove debug statement, fixes #462	2019-08-24 08:42:33 +02:00
El RIDO	c77726b917	Merge branch 'Haocen-495', fixes #495	2019-08-23 07:02:54 +02:00
Haocen Xu	649c7aaa78	Fix bootstrap 3 support for modern high res monitors	2019-08-22 14:04:42 -04:00
Haocen Xu	6a79519641	Allow textarea to be resized vertically only	2019-08-22 13:55:52 -04:00
El RIDO	e4a0a8e82c	Merge branch 'Haocen-317'	2019-08-21 19:04:16 +02:00
El RIDO	72565e48ff	Merge branch '317' of https://github.com/Haocen/PrivateBin-Contribute into Haocen-317	2019-08-21 19:03:54 +02:00
Haocen Xu	ffac1adad6	Dropzone should be fixed to viewport, instead of fixed to sibling element	2019-08-21 02:24:56 -04:00
El RIDO	d317cfbcc0	update SRI hashes	2019-08-21 07:17:24 +02:00
El RIDO	388655fdd1	Merge branch 'Haocen-317', fixes #317 , fixes #487	2019-08-21 07:15:09 +02:00
El RIDO	b7b7aa3a47	credit were credit is due	2019-08-21 07:14:46 +02:00
Haocen Xu	2eed7a8a1c	Update SRI Remove dejavu	2019-08-17 15:39:13 -04:00
Haocen Xu	078b8d8fd6	Clear attachment if user cancel file select	2019-08-17 15:14:40 -04:00
Haocen Xu	3a9730f883	Improve file upload UX Fix incorrect highlight logic Fix transition on fileupload highlight Handle drag leave Fix draghover Minor style improvements	2019-08-17 15:13:58 -04:00
El RIDO	30ddcacca6	fixing unit tests	2019-08-17 10:20:46 +02:00
El RIDO	1de315619b	Merge branch 'macropin', fixes #485	2019-08-17 10:07:16 +02:00
El RIDO	e7fab8439d	documenting showdown fix and incrementing library version to circumvent browser caching	2019-08-17 10:04:54 +02:00
El RIDO	f22449ffd1	Merge branch 'fix-showdown' of https://github.com/macropin/PrivateBin into macropin	2019-08-17 09:59:44 +02:00
El RIDO	962df90b24	Merge branch 'Haocen-479'	2019-08-17 09:40:43 +02:00
El RIDO	d351c7b734	documenting changes, fixes #354 , fixes #479 , fixes #484	2019-08-17 09:40:23 +02:00
El RIDO	84827e19c3	Merge branch '479' of https://github.com/Haocen/PrivateBin-Contribute into Haocen-479	2019-08-17 08:42:25 +02:00
El RIDO	b8196ee63c	documented mobile UI change, fixes #477	2019-08-17 08:39:15 +02:00
El RIDO	e6e4facde0	Merge branch 'Haocen-477'	2019-08-17 08:31:07 +02:00
Haocen Xu	6ac425d468	Fix incorrect style on button	2019-08-15 14:58:27 -04:00
Andrew Cutler	49b358b1ee	patch showdown.js to allow 100 nested spans. Ref https://github.com/PrivateBin/PrivateBin/issues/485	2019-08-15 13:41:41 +10:00
Haocen Xu	71931b0f18	Clear discussion if new/clone paste clicked	2019-08-14 20:40:50 -04:00
Haocen Xu	1af7b536a5	Fix an edge case where we cannot find any shortUrl	2019-08-14 00:06:51 -04:00
Haocen Xu	a5cd8696e6	Ensure shortener button re-enable after creating new paste	2019-08-13 21:55:35 -04:00
Haocen Xu	cd5ede5670	Enhance URL shortener integration, clear address bar when create new paste from existing paste	2019-08-13 21:44:53 -04:00
Haocen Xu	cb877e4494	447, Rework UX to address obscured send button and hard to click shortener button	2019-08-13 19:21:26 -04:00
El RIDO	c66bff9d1b	fixing travis CI builds for php 5.5, which require trusty	2019-07-27 08:19:01 +02:00
El RIDO	d63a0d10d3	fixing npm package version number	2019-07-27 08:11:29 +02:00
El RIDO	847c9e7355	better looking check mark	2019-07-27 07:47:03 +02:00
El RIDO	d33c89666d	Merge branch 'security-md'	2019-07-27 07:43:41 +02:00
El RIDO	c8a9038f27	Merge branch 'master' into security-md	2019-07-27 07:43:16 +02:00
El RIDO	b65303dd71	update wording as suggested and version to latest release	2019-07-27 07:42:54 +02:00
El RIDO	8d323c1da4	document the applicability of RFC 1855 / Netiquette	2019-07-27 07:31:34 +02:00
Andreas Schneider	5c5de860e2	INSTALL: Creata a mediumblob for data in a paste This allows to upload bigger pastes and pastes with attachments in the v2 paste format. Fixes #456	2019-07-12 10:07:22 +02:00
Andreas Schneider	da576baab9	Allow to upload bigger files Signed-off-by: Andreas Schneider <asn@cryptomilk.org>	2019-07-12 09:03:14 +02:00
El RIDO	78225165ca	Merge branch 'BigWax-patch-1'	2019-07-11 16:50:51 +02:00
El RIDO	b0d1a3949e	add bulgarian to the supported languages	2019-07-11 16:50:32 +02:00
BigWax	1469d0c062	Create bg.json Bulgarian translation	2019-07-10 16:06:55 +01:00
R4SAS	a1704b2dd9	[i18n] update russian translation	2019-07-10 02:43:00 +03:00
El RIDO	a270cd818a	create security.md for new Github security feature	2019-05-23 17:06:33 +02:00