summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorDaan Sprenkels2018-11-13 00:14:25 +0100
committerDaan Sprenkels2018-11-17 13:23:03 +0100
commit4bd8d7eb91524cc936bc607f8291804689de35ea (patch)
tree8f3137af224c4af7507a2cfb200b2bd1298086f7 /lib
parent54d3d930cf39c2a3bec422d858cbac20ad8118eb (diff)
Disallow creation of robots.txt in freeurl
Add a configuration setting to "hard"-disable creation of notes as set by the configuration value. This defaults to `['robots.txt', 'favicon.ico']`, because these files are often accidentally created by bots and browsers. This commit fixes #1052. Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>
Diffstat (limited to '')
-rw-r--r--lib/config/default.js1
-rw-r--r--lib/config/environment.js1
-rw-r--r--lib/response.js2
3 files changed, 3 insertions, 1 deletions
diff --git a/lib/config/default.js b/lib/config/default.js
index 15f11aaa..c04bda3c 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -31,6 +31,7 @@ module.exports = {
allowAnonymous: true,
allowAnonymousEdits: false,
allowFreeURL: false,
+ forbiddenNoteIDs: ['robots.txt', 'favicon.ico', 'api'],
defaultPermission: 'editable',
dbURL: '',
db: {},
diff --git a/lib/config/environment.js b/lib/config/environment.js
index 0c7c9a4f..8526e3ee 100644
--- a/lib/config/environment.js
+++ b/lib/config/environment.js
@@ -27,6 +27,7 @@ module.exports = {
allowAnonymous: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS),
allowAnonymousEdits: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS_EDITS),
allowFreeURL: toBooleanConfig(process.env.CMD_ALLOW_FREEURL),
+ forbiddenNoteIDs: toArrayConfig(process.env.CMD_FORBIDDEN_NOTE_IDS),
defaultPermission: process.env.CMD_DEFAULT_PERMISSION,
dbURL: process.env.CMD_DB_URL,
sessionSecret: process.env.CMD_SESSION_SECRET,
diff --git a/lib/response.js b/lib/response.js
index 671aa120..b94f473a 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -157,7 +157,7 @@ function findNote (req, res, callback, include) {
include: include || null
}).then(function (note) {
if (!note) {
- if (config.allowFreeURL && noteId) {
+ if (config.allowFreeURL && noteId && !config.forbiddenNoteIDs.includes(noteId)) {
req.alias = noteId
return newNote(req, res)
} else {