087 — Public paste software with matching form fields
Reviewed September 5, 2026, 20:25 UTC.

Finding
A PHP-constrained Sourcegraph query for code2 in files also containing parent_pid returned four matches in two files of lordelph/pastebin. Direct GitHub blob retrieval confirms an older Pastebin implementation sharing the editor name and code2,parent_pid,poster field convention observed on the Ubuntu site. This is a source-code family comparison, not identification of the deployed Ubuntu version or its operator.
Primary public repository: https://github.com/lordelph/pastebin .

Observed input path
public_html/pastebin.php conditionally applies a stripslashes callback to GET/POST/cookie values when get_magic_quotes_gpc() is enabled. The condition is explicit. This is not an unconditional URL decode or evidence that the deployed site strips all backslashes.
lib/pastebin/pastebin.class.php checks code2, assigns it directly to a code variable, checks a spam filter, and passes the variable to db->addPost. No explicit urldecode call occurs in the inspected three files. Database, framework and deployment behavior are not exhaustively reconstructed here.
public_html/layout.php declares the editor form and matching fields. Its inspected form does not declare the multipart enctype found in the current Ubuntu homepage, and it has an onkeydown textarea handler absent from that homepage. These differences are concrete reasons not to call it the exact installed source.

Implication for xinzhai
The field convention is longstanding generic paste software, not an uploader-specific signature. The inspected upstream does not supply a plus-to-space application-code explanation. Malformed URL-encoded client input, extra decoding elsewhere, historical modifications or already-space-containing input remain possibilities from085. No server version, exact bug or original client has been proven.
The visible site's Base64 JavaScript helper is not evidence that it Base64-encodes submitted records;085 inspected its unrelated decoding/helper functions. Do not merge the host implementation and the unknown xinzhai client into one software attribution.

Search scope and provenance
The initial unconstrained code2/parent_pid query hit a30-result limit in unrelated large files. It was narrowed to PHP; the follow-up returned4matches from1repository with terminal done and no skipped warnings. Both raw streams and exact queries are in087-private; scripts087-paste-server-search.py and087-php-search.py reproduce them.
GitHub's recursive master tree returned tree SHA3111e014df57272a39cf75152a7b109f8f37ffac,truncated=false. Three exact blob objects were retrieved for pastebin.php,layout.php andpastebin.class.php. Source paths, immutable blob hashes, request URLs and SHA-256 checksums are saved in087-private/upstream-metadata.json; raw decoded source is private. Tree identity is a tree hash, not an asserted commit hash.
All actions were public read-only retrieval and source inspection. No service submission, admin access, vulnerability probe, key search, code execution or deployment occurred.