From 5dff12ea701300e1127325d1501b897943ec0f73 Mon Sep 17 00:00:00 2001
From: cupcakearmy <hi@nicco.io>
Date: Sun, 16 May 2021 11:16:25 +0200
Subject: [PATCH] use hash instead of path for key

---
 CHANGELOG.md                                                | 6 ++++++
 client/src/lib/views/Create.svelte                          | 2 +-
 .../src/routes/note/{[id]/[password].svelte => [id].svelte} | 4 +++-
 3 files changed, 10 insertions(+), 2 deletions(-)
 rename client/src/routes/note/{[id]/[password].svelte => [id].svelte} (95%)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 81f8fdc..cdbe541 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.0] - 2021-05-16
+
+### Security
+
+- Using hash `#` instead of path
+
 ## [1.0.11] - 2021-05-08
 
 ### Added
diff --git a/client/src/lib/views/Create.svelte b/client/src/lib/views/Create.svelte
index 6813b46..446b6ed 100644
--- a/client/src/lib/views/Create.svelte
+++ b/client/src/lib/views/Create.svelte
@@ -68,7 +68,7 @@
 		type="text"
 		readonly
 		label="share link"
-		value="{window.location.origin}/note/{result.id}/{result.password}"
+		value="{window.location.origin}/note/{result.id}#{result.password}"
 		copy
 		data-testid="note-share-link"
 	/>
diff --git a/client/src/routes/note/[id]/[password].svelte b/client/src/routes/note/[id].svelte
similarity index 95%
rename from client/src/routes/note/[id]/[password].svelte
rename to client/src/routes/note/[id].svelte
index d3a2808..35a3062 100644
--- a/client/src/routes/note/[id]/[password].svelte
+++ b/client/src/routes/note/[id].svelte
@@ -16,8 +16,8 @@
 	import Button from '$lib/ui/Button.svelte'
 
 	export let id: string
-	export let password: string
 
+	let password: string
 	let note: NotePublic | null = null
 	let exists = false
 
@@ -28,6 +28,8 @@
 		try {
 			loading = true
 			error = null
+			password = window.location.hash.slice(1)
+			console.log(password)
 			await info(id)
 			exists = true
 		} catch {