Linter: Fix all lint errors

Signed-off-by: Philip Molares <philip.molares@udo.edu>

33 files changed, 464 insertions, 425 deletions

diff --git a/lib/config/index.js b/lib/config/index.js
index 1657ba7a..17c13f5f 100644
--- a/lib/config/index.js
+++ b/lib/config/index.js
@@ -58,14 +58,14 @@ if (!['strict', 'lax', 'none'].includes(config.cookiePolicy)) {
 
 // load LDAP CA
 if (config.ldap.tlsca) {
-  let ca = config.ldap.tlsca.split(',')
-  let caContent = []
-  for (let i of ca) {
+  const ca = config.ldap.tlsca.split(',')
+  const caContent = []
+  for (const i of ca) {
     if (fs.existsSync(i)) {
       caContent.push(fs.readFileSync(i, 'utf8'))
     }
   }
-  let tlsOptions = {
+  const tlsOptions = {
     ca: caContent
   }
   config.ldap.tlsOptions = config.ldap.tlsOptions ? Object.assign(config.ldap.tlsOptions, tlsOptions) : tlsOptions
@@ -90,9 +90,9 @@ config.isStandardHTTPPort = (function isStandardHTTPPort () {
 
 // cache serverURL
 config.serverURL = (function getserverurl () {
-  var url = ''
+  let url = ''
   if (config.domain) {
-    var protocol = config.protocolUseSSL ? 'https://' : 'http://'
+    const protocol = config.protocolUseSSL ? 'https://' : 'http://'
     url = protocol + config.domain
     if (config.urlAddPort) {
       if (!config.isStandardHTTPPort || !config.isStandardHTTPsPort) {
@@ -138,10 +138,10 @@ config.isGitlabSnippetsEnable = (!config.gitlab.scope || config.gitlab.scope ===
 config.updateI18nFiles = (env === Environment.development)
 
 // merge legacy values
-let keys = Object.keys(config)
+const keys = Object.keys(config)
 const uppercase = /[A-Z]/
 for (let i = keys.length; i--;) {
-  let lowercaseKey = keys[i].toLowerCase()
+  const lowercaseKey = keys[i].toLowerCase()
   // if the config contains uppercase letters
   // and a lowercase version of this setting exists
   // and the config with uppercase is not set
diff --git a/lib/csp.js b/lib/csp.js
index 24399436..a5f0a4fc 100644
--- a/lib/csp.js
+++ b/lib/csp.js
@@ -1,9 +1,9 @@
-var config = require('./config')
-var uuid = require('uuid')
+const config = require('./config')
+const uuid = require('uuid')
 
-var CspStrategy = {}
+const CspStrategy = {}
 
-var defaultDirectives = {
+const defaultDirectives = {
   defaultSrc: ['\'self\''],
   scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', 'https://query.yahooapis.com', '\'unsafe-eval\''],
   // ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/codimd/issues/594
@@ -16,28 +16,28 @@ var defaultDirectives = {
   connectSrc: ['*']
 }
 
-var cdnDirectives = {
+const cdnDirectives = {
   scriptSrc: ['https://cdnjs.cloudflare.com', 'https://cdn.mathjax.org'],
   styleSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.googleapis.com'],
   fontSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.gstatic.com']
 }
 
-var disqusDirectives = {
+const disqusDirectives = {
   scriptSrc: ['https://disqus.com', 'https://*.disqus.com', 'https://*.disquscdn.com'],
   styleSrc: ['https://*.disquscdn.com'],
   fontSrc: ['https://*.disquscdn.com']
 }
 
-var googleAnalyticsDirectives = {
+const googleAnalyticsDirectives = {
   scriptSrc: ['https://www.google-analytics.com']
 }
 
-var dropboxDirectives = {
+const dropboxDirectives = {
   scriptSrc: ['https://www.dropbox.com', '\'unsafe-inline\'']
 }
 
 CspStrategy.computeDirectives = function () {
-  var directives = {}
+  const directives = {}
   mergeDirectives(directives, config.csp.directives)
   mergeDirectivesIf(config.csp.addDefaults, directives, defaultDirectives)
   mergeDirectivesIf(config.useCDN, directives, cdnDirectives)
@@ -53,10 +53,10 @@ CspStrategy.computeDirectives = function () {
 }
 
 function mergeDirectives (existingDirectives, newDirectives) {
-  for (var propertyName in newDirectives) {
-    var newDirective = newDirectives[propertyName]
+  for (const propertyName in newDirectives) {
+    const newDirective = newDirectives[propertyName]
     if (newDirective) {
-      var existingDirective = existingDirectives[propertyName] || []
+      const existingDirective = existingDirectives[propertyName] || []
       existingDirectives[propertyName] = existingDirective.concat(newDirective)
     }
   }
diff --git a/lib/history.js b/lib/history.js
index 3ebf77fd..e4ce9221 100644
--- a/lib/history.js
+++ b/lib/history.js
@@ -1,15 +1,15 @@
 'use strict'
 // history
 // external modules
-var LZString = require('lz-string')
+const LZString = require('lz-string')
 
 // core
-var logger = require('./logger')
-var models = require('./models')
+const logger = require('./logger')
+const models = require('./models')
 const errors = require('./errors')
 
 // public
-var History = {
+const History = {
   historyGet: historyGet,
   historyPost: historyPost,
   historyDelete: historyDelete,
@@ -25,7 +25,7 @@ function getHistory (userid, callback) {
     if (!user) {
       return callback(null, null)
     }
-    var history = {}
+    let history = {}
     if (user.history) {
       history = JSON.parse(user.history)
       // migrate LZString encoded note id to base64url encoded note id
@@ -40,7 +40,7 @@ function getHistory (userid, callback) {
           continue
         }
         try {
-          let id = LZString.decompressFromBase64(history[i].id)
+          const id = LZString.decompressFromBase64(history[i].id)
           if (id && models.Note.checkNoteIdValid(id)) {
             history[i].id = models.Note.encodeNoteId(id)
           }
@@ -85,8 +85,8 @@ function updateHistory (userid, noteId, document, time) {
       if (!history[noteId]) {
         history[noteId] = {}
       }
-      var noteHistory = history[noteId]
-      var noteInfo = models.Note.parseNoteInfo(document)
+      const noteHistory = history[noteId]
+      const noteInfo = models.Note.parseNoteInfo(document)
       noteHistory.id = noteId
       noteHistory.text = noteInfo.title
       noteHistory.time = time || Date.now()
@@ -101,18 +101,18 @@ function updateHistory (userid, noteId, document, time) {
 }
 
 function parseHistoryToArray (history) {
-  var _history = []
+  const _history = []
   Object.keys(history).forEach(function (key) {
-    var item = history[key]
+    const item = history[key]
     _history.push(item)
   })
   return _history
 }
 
 function parseHistoryToObject (history) {
-  var _history = {}
-  for (var i = 0, l = history.length; i < l; i++) {
-    var item = history[i]
+  const _history = {}
+  for (let i = 0, l = history.length; i < l; i++) {
+    const item = history[i]
     _history[item.id] = item
   }
   return _history
@@ -134,25 +134,25 @@ function historyGet (req, res) {
 
 function historyPost (req, res) {
   if (req.isAuthenticated()) {
-    var noteId = req.params.noteId
+    const noteId = req.params.noteId
     if (!noteId) {
-      if (typeof req.body['history'] === 'undefined') return errors.errorBadRequest(res)
+      if (typeof req.body.history === 'undefined') return errors.errorBadRequest(res)
       logger.debug(`SERVER received history from [${req.user.id}]: ${req.body.history}`)
       try {
-        var history = JSON.parse(req.body.history)
+        const history = JSON.parse(req.body.history)
+        if (Array.isArray(history)) {
+          setHistory(req.user.id, history, function (err, count) {
+            if (err) return errors.errorInternalError(res)
+            res.end()
+          })
+        } else {
+          return errors.errorBadRequest(res)
+        }
       } catch (err) {
         return errors.errorBadRequest(res)
       }
-      if (Array.isArray(history)) {
-        setHistory(req.user.id, history, function (err, count) {
-          if (err) return errors.errorInternalError(res)
-          res.end()
-        })
-      } else {
-        return errors.errorBadRequest(res)
-      }
     } else {
-      if (typeof req.body['pinned'] === 'undefined') return errors.errorBadRequest(res)
+      if (typeof req.body.pinned === 'undefined') return errors.errorBadRequest(res)
       getHistory(req.user.id, function (err, history) {
         if (err) return errors.errorInternalError(res)
         if (!history) return errors.errorNotFound(res)
@@ -175,7 +175,7 @@ function historyPost (req, res) {
 
 function historyDelete (req, res) {
   if (req.isAuthenticated()) {
-    var noteId = req.params.noteId
+    const noteId = req.params.noteId
     if (!noteId) {
       setHistory(req.user.id, [], function (err, count) {
         if (err) return errors.errorInternalError(res)
diff --git a/lib/letter-avatars.js b/lib/letter-avatars.js
index 6fb1888a..bb7a9fe8 100644
--- a/lib/letter-avatars.js
+++ b/lib/letter-avatars.js
@@ -32,9 +32,9 @@ exports.generateAvatarURL = function (name, email = '', big = true) {
   }
   name = encodeURIComponent(name)
 
-  let hash = crypto.createHash('md5')
+  const hash = crypto.createHash('md5')
   hash.update(email.toLowerCase())
-  let hexDigest = hash.digest('hex')
+  const hexDigest = hash.digest('hex')
 
   if (email !== '' && config.allowGravatar) {
     photo = 'https://cdn.libravatar.org/avatar/' + hexDigest
diff --git a/lib/models/author.js b/lib/models/author.js
index e65791cb..4c995745 100644
--- a/lib/models/author.js
+++ b/lib/models/author.js
@@ -1,9 +1,9 @@
 'use strict'
 // external modules
-var Sequelize = require('sequelize')
+const Sequelize = require('sequelize')
 
 module.exports = function (sequelize, DataTypes) {
-  var Author = sequelize.define('Author', {
+  const Author = sequelize.define('Author', {
     id: {
       type: Sequelize.INTEGER,
       primaryKey: true,
diff --git a/lib/models/index.js b/lib/models/index.js
index 88c1b168..e752a993 100644
--- a/lib/models/index.js
+++ b/lib/models/index.js
@@ -1,20 +1,22 @@
 'use strict'
 // external modules
-var fs = require('fs')
-var path = require('path')
-var Sequelize = require('sequelize')
+const fs = require('fs')
+const path = require('path')
+const Sequelize = require('sequelize')
 const { cloneDeep } = require('lodash')
 
 // core
-var config = require('../config')
-var logger = require('../logger')
+const config = require('../config')
+const logger = require('../logger')
 
-var dbconfig = cloneDeep(config.db)
-dbconfig.logging = config.debug ? (data) => {
-  logger.info(data)
-} : false
+const dbconfig = cloneDeep(config.db)
+dbconfig.logging = config.debug
+  ? (data) => {
+      logger.info(data)
+    }
+  : false
 
-var sequelize = null
+let sequelize = null
 
 // Heroku specific
 if (config.dbURL) {
@@ -38,14 +40,14 @@ function processData (data, _default, process) {
 }
 sequelize.processData = processData
 
-var db = {}
+const db = {}
 
 fs.readdirSync(__dirname)
   .filter(function (file) {
     return (file.indexOf('.') !== 0) && (file !== 'index.js')
   })
   .forEach(function (file) {
-    var model = sequelize.import(path.join(__dirname, file))
+    const model = sequelize.import(path.join(__dirname, file))
     db[model.name] = model
   })
 
diff --git a/lib/models/note.js b/lib/models/note.js
index 7418c47e..7b8b6783 100644
--- a/lib/models/note.js
+++ b/lib/models/note.js
@@ -1,32 +1,32 @@
 'use strict'
 // external modules
-var fs = require('fs')
-var path = require('path')
-var LZString = require('lz-string')
-var base64url = require('base64url')
-var md = require('markdown-it')()
-var metaMarked = require('meta-marked')
-var cheerio = require('cheerio')
-var shortId = require('shortid')
-var Sequelize = require('sequelize')
-var async = require('async')
-var moment = require('moment')
-var DiffMatchPatch = require('diff-match-patch')
-var dmp = new DiffMatchPatch()
-var S = require('string')
+const fs = require('fs')
+const path = require('path')
+const LZString = require('lz-string')
+const base64url = require('base64url')
+const md = require('markdown-it')()
+const metaMarked = require('meta-marked')
+const cheerio = require('cheerio')
+const shortId = require('shortid')
+const Sequelize = require('sequelize')
+const async = require('async')
+const moment = require('moment')
+const DiffMatchPatch = require('diff-match-patch')
+const dmp = new DiffMatchPatch()
+const S = require('string')
 
 // core
-var config = require('../config')
-var logger = require('../logger')
+const config = require('../config')
+const logger = require('../logger')
 
 // ot
-var ot = require('../ot')
+const ot = require('../ot')
 
 // permission types
-var permissionTypes = ['freely', 'editable', 'limited', 'locked', 'protected', 'private']
+const permissionTypes = ['freely', 'editable', 'limited', 'locked', 'protected', 'private']
 
 module.exports = function (sequelize, DataTypes) {
-  var Note = sequelize.define('Note', {
+  const Note = sequelize.define('Note', {
     id: {
       type: DataTypes.UUID,
       primaryKey: true,
@@ -91,7 +91,7 @@ module.exports = function (sequelize, DataTypes) {
         return new Promise(function (resolve, reject) {
           // if no content specified then use default note
           if (!note.content) {
-            var body = null
+            let body = null
             let filePath = null
             if (note.alias) {
               filePath = path.join(config.docsPath, note.alias + '.md')
@@ -100,7 +100,7 @@ module.exports = function (sequelize, DataTypes) {
               filePath = config.defaultNotePath
             }
             if (Note.checkFileExist(filePath)) {
-              var fsCreatedTime = moment(fs.statSync(filePath).ctime)
+              const fsCreatedTime = moment(fs.statSync(filePath).ctime)
               body = fs.readFileSync(filePath, 'utf8')
               note.title = Note.parseNoteTitle(body)
               note.content = body
@@ -165,15 +165,15 @@ module.exports = function (sequelize, DataTypes) {
   }
   Note.encodeNoteId = function (id) {
     // remove dashes in UUID and encode in url-safe base64
-    let str = id.replace(/-/g, '')
-    let hexStr = Buffer.from(str, 'hex')
+    const str = id.replace(/-/g, '')
+    const hexStr = Buffer.from(str, 'hex')
     return base64url.encode(hexStr)
   }
   Note.decodeNoteId = function (encodedId) {
     // decode from url-safe base64
-    let id = base64url.toBuffer(encodedId).toString('hex')
+    const id = base64url.toBuffer(encodedId).toString('hex')
     // add dashes between the UUID string parts
-    let idParts = []
+    const idParts = []
     idParts.push(id.substr(0, 8))
     idParts.push(id.substr(8, 4))
     idParts.push(id.substr(12, 4))
@@ -182,8 +182,8 @@ module.exports = function (sequelize, DataTypes) {
     return idParts.join('-')
   }
   Note.checkNoteIdValid = function (id) {
-    var uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-    var result = id.match(uuidRegex)
+    const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+    const result = id.match(uuidRegex)
     if (result && result.length === 1) { return true } else { return false }
   }
   Note.parseNoteId = function (noteId, callback) {
@@ -196,15 +196,15 @@ module.exports = function (sequelize, DataTypes) {
           }
         }).then(function (note) {
           if (note) {
-            let filePath = path.join(config.docsPath, noteId + '.md')
+            const filePath = path.join(config.docsPath, noteId + '.md')
             if (Note.checkFileExist(filePath)) {
               // if doc in filesystem have newer modified time than last change time
               // then will update the doc in db
-              var fsModifiedTime = moment(fs.statSync(filePath).mtime)
-              var dbModifiedTime = moment(note.lastchangeAt || note.createdAt)
-              var body = fs.readFileSync(filePath, 'utf8')
-              var contentLength = body.length
-              var title = Note.parseNoteTitle(body)
+              const fsModifiedTime = moment(fs.statSync(filePath).mtime)
+              const dbModifiedTime = moment(note.lastchangeAt || note.createdAt)
+              const body = fs.readFileSync(filePath, 'utf8')
+              const contentLength = body.length
+              const title = Note.parseNoteTitle(body)
               if (fsModifiedTime.isAfter(dbModifiedTime) && note.content !== body) {
                 note.update({
                   title: title,
@@ -214,9 +214,9 @@ module.exports = function (sequelize, DataTypes) {
                   sequelize.models.Revision.saveNoteRevision(note, function (err, revision) {
                     if (err) return _callback(err, null)
                     // update authorship on after making revision of docs
-                    var patch = dmp.patch_fromText(revision.patch)
-                    var operations = Note.transformPatchToOperations(patch, contentLength)
-                    var authorship = note.authorship
+                    const patch = dmp.patch_fromText(revision.patch)
+                    const operations = Note.transformPatchToOperations(patch, contentLength)
+                    let authorship = note.authorship
                     for (let i = 0; i < operations.length; i++) {
                       authorship = Note.updateAuthorshipByOperation(operations[i], null, authorship)
                     }
@@ -238,7 +238,7 @@ module.exports = function (sequelize, DataTypes) {
               return callback(null, note.id)
             }
           } else {
-            var filePath = path.join(config.docsPath, noteId + '.md')
+            const filePath = path.join(config.docsPath, noteId + '.md')
             if (Note.checkFileExist(filePath)) {
               Note.create({
                 alias: noteId,
@@ -270,7 +270,7 @@ module.exports = function (sequelize, DataTypes) {
         }
         // try to parse note id by LZString Base64
         try {
-          var id = LZString.decompressFromBase64(noteId)
+          const id = LZString.decompressFromBase64(noteId)
           if (id && Note.checkNoteIdValid(id)) { return callback(null, id) } else { return _callback(null, null) }
         } catch (err) {
           if (err.message === 'Cannot read property \'charAt\' of undefined') {
@@ -284,7 +284,7 @@ module.exports = function (sequelize, DataTypes) {
       parseNoteIdByBase64Url: function (_callback) {
         // try to parse note id by base64url
         try {
-          var id = Note.decodeNoteId(noteId)
+          const id = Note.decodeNoteId(noteId)
           if (id && Note.checkNoteIdValid(id)) { return callback(null, id) } else { return _callback(null, null) }
         } catch (err) {
           logger.error(err)
@@ -321,24 +321,24 @@ module.exports = function (sequelize, DataTypes) {
     })
   }
   Note.parseNoteInfo = function (body) {
-    var parsed = Note.extractMeta(body)
-    var $ = cheerio.load(md.render(parsed.markdown))
+    const parsed = Note.extractMeta(body)
+    const $ = cheerio.load(md.render(parsed.markdown))
     return {
       title: Note.extractNoteTitle(parsed.meta, $),
       tags: Note.extractNoteTags(parsed.meta, $)
     }
   }
   Note.parseNoteTitle = function (body) {
-    var parsed = Note.extractMeta(body)
-    var $ = cheerio.load(md.render(parsed.markdown))
+    const parsed = Note.extractMeta(body)
+    const $ = cheerio.load(md.render(parsed.markdown))
     return Note.extractNoteTitle(parsed.meta, $)
   }
   Note.extractNoteTitle = function (meta, $) {
-    var title = ''
+    let title = ''
     if (meta.title && (typeof meta.title === 'string' || typeof meta.title === 'number')) {
       title = meta.title
     } else {
-      var h1s = $('h1')
+      const h1s = $('h1')
       if (h1s.length > 0 && h1s.first().text().split('\n').length === 1) { title = S(h1s.first().text()).stripTags().s }
     }
     if (!title) title = 'Untitled'
@@ -355,28 +355,28 @@ module.exports = function (sequelize, DataTypes) {
     return title
   }
   Note.extractNoteTags = function (meta, $) {
-    var tags = []
-    var rawtags = []
+    const tags = []
+    const rawtags = []
     if (meta.tags && (typeof meta.tags === 'string' || typeof meta.tags === 'number')) {
-      var metaTags = ('' + meta.tags).split(',')
+      const metaTags = ('' + meta.tags).split(',')
       for (let i = 0; i < metaTags.length; i++) {
-        var text = metaTags[i].trim()
+        const text = metaTags[i].trim()
         if (text) rawtags.push(text)
       }
     } else {
-      var h6s = $('h6')
+      const h6s = $('h6')
       h6s.each(function (key, value) {
         if (/^tags/gmi.test($(value).text())) {
-          var codes = $(value).find('code')
+          const codes = $(value).find('code')
           for (let i = 0; i < codes.length; i++) {
-            var text = S($(codes[i]).text().trim()).stripTags().s
+            const text = S($(codes[i]).text().trim()).stripTags().s
             if (text) rawtags.push(text)
           }
         }
       })
     }
     for (let i = 0; i < rawtags.length; i++) {
-      var found = false
+      let found = false
       for (let j = 0; j < tags.length; j++) {
         if (tags[j] === rawtags[i]) {
           found = true
@@ -388,7 +388,7 @@ module.exports = function (sequelize, DataTypes) {
     return tags
   }
   Note.extractMeta = function (content) {
-    var obj = null
+    let obj = null
     try {
       obj = metaMarked(content)
       if (!obj.markdown) obj.markdown = ''
@@ -402,7 +402,7 @@ module.exports = function (sequelize, DataTypes) {
     return obj
   }
   Note.parseMeta = function (meta) {
-    var _meta = {}
+    const _meta = {}
     if (meta) {
       if (meta.title && (typeof meta.title === 'string' || typeof meta.title === 'number')) { _meta.title = meta.title }
       if (meta.description && (typeof meta.description === 'string' || typeof meta.description === 'number')) { _meta.description = meta.description }
@@ -416,7 +416,7 @@ module.exports = function (sequelize, DataTypes) {
     return _meta
   }
   Note.parseOpengraph = function (meta, title) {
-    var _ogdata = {}
+    let _ogdata = {}
     if (meta.opengraph) { _ogdata = meta.opengraph }
     if (!(_ogdata.title && (typeof _ogdata.title === 'string' || typeof _ogdata.title === 'number'))) { _ogdata.title = title }
     if (!(_ogdata.description && (typeof _ogdata.description === 'string' || typeof _ogdata.description === 'number'))) { _ogdata.description = meta.description || '' }
@@ -424,27 +424,27 @@ module.exports = function (sequelize, DataTypes) {
     return _ogdata
   }
   Note.updateAuthorshipByOperation = function (operation, userId, authorships) {
-    var index = 0
-    var timestamp = Date.now()
+    let index = 0
+    const timestamp = Date.now()
     for (let i = 0; i < operation.length; i++) {
-      var op = operation[i]
+      const op = operation[i]
       if (ot.TextOperation.isRetain(op)) {
         index += op
       } else if (ot.TextOperation.isInsert(op)) {
-        let opStart = index
-        let opEnd = index + op.length
-        var inserted = false
+        const opStart = index
+        const opEnd = index + op.length
+        let inserted = false
         // authorship format: [userId, startPos, endPos, createdAt, updatedAt]
         if (authorships.length <= 0) authorships.push([userId, opStart, opEnd, timestamp, timestamp])
         else {
           for (let j = 0; j < authorships.length; j++) {
-            let authorship = authorships[j]
+            const authorship = authorships[j]
             if (!inserted) {
-              let nextAuthorship = authorships[j + 1] || -1
+              const nextAuthorship = authorships[j + 1] || -1
               if ((nextAuthorship !== -1 && nextAuthorship[1] >= opEnd) || j >= authorships.length - 1) {
                 if (authorship[1] < opStart && authorship[2] > opStart) {
                   // divide
-                  let postLength = authorship[2] - opStart
+                  const postLength = authorship[2] - opStart
                   authorship[2] = opStart
                   authorship[4] = timestamp
                   authorships.splice(j + 1, 0, [userId, opStart, opEnd, timestamp, timestamp])
@@ -470,13 +470,13 @@ module.exports = function (sequelize, DataTypes) {
         }
         index += op.length
       } else if (ot.TextOperation.isDelete(op)) {
-        let opStart = index
-        let opEnd = index - op
+        const opStart = index
+        const opEnd = index - op
         if (operation.length === 1) {
           authorships = []
         } else if (authorships.length > 0) {
           for (let j = 0; j < authorships.length; j++) {
-            let authorship = authorships[j]
+            const authorship = authorships[j]
             if (authorship[1] >= opStart && authorship[1] <= opEnd && authorship[2] >= opStart && authorship[2] <= opEnd) {
               authorships.splice(j, 1)
               j -= 1
@@ -501,12 +501,12 @@ module.exports = function (sequelize, DataTypes) {
     }
     // merge
     for (let j = 0; j < authorships.length; j++) {
-      let authorship = authorships[j]
+      const authorship = authorships[j]
       for (let k = j + 1; k < authorships.length; k++) {
-        let nextAuthorship = authorships[k]
+        const nextAuthorship = authorships[k]
         if (nextAuthorship && authorship[0] === nextAuthorship[0] && authorship[2] === nextAuthorship[1]) {
-          let minTimestamp = Math.min(authorship[3], nextAuthorship[3])
-          let maxTimestamp = Math.max(authorship[3], nextAuthorship[3])
+          const minTimestamp = Math.min(authorship[3], nextAuthorship[3])
+          const maxTimestamp = Math.max(authorship[3], nextAuthorship[3])
           authorships.splice(j, 1, [authorship[0], authorship[1], nextAuthorship[2], minTimestamp, maxTimestamp])
           authorships.splice(k, 1)
           j -= 1
@@ -516,7 +516,7 @@ module.exports = function (sequelize, DataTypes) {
     }
     // clear
     for (let j = 0; j < authorships.length; j++) {
-      let authorship = authorships[j]
+      const authorship = authorships[j]
       if (!authorship[0]) {
         authorships.splice(j, 1)
         j -= 1
@@ -525,13 +525,13 @@ module.exports = function (sequelize, DataTypes) {
     return authorships
   }
   Note.transformPatchToOperations = function (patch, contentLength) {
-    var operations = []
+    const operations = []
     if (patch.length > 0) {
       // calculate original content length
       for (let j = patch.length - 1; j >= 0; j--) {
-        var p = patch[j]
+        const p = patch[j]
         for (let i = 0; i < p.diffs.length; i++) {
-          var diff = p.diffs[i]
+          const diff = p.diffs[i]
           switch (diff[0]) {
             case 1: // insert
               contentLength -= diff[1].length
@@ -543,15 +543,15 @@ module.exports = function (sequelize, DataTypes) {
         }
       }
       // generate operations
-      var bias = 0
-      var lengthBias = 0
+      let bias = 0
+      let lengthBias = 0
       for (let j = 0; j < patch.length; j++) {
-        var operation = []
-        let p = patch[j]
-        var currIndex = p.start1
-        var currLength = contentLength - bias
+        const operation = []
+        const p = patch[j]
+        let currIndex = p.start1
+        const currLength = contentLength - bias
         for (let i = 0; i < p.diffs.length; i++) {
-          let diff = p.diffs[i]
+          const diff = p.diffs[i]
           switch (diff[0]) {
             case 0: // retain
               if (i === 0) {
diff --git a/lib/models/revision.js b/lib/models/revision.js
index dbd76e4e..80136c68 100644
--- a/lib/models/revision.js
+++ b/lib/models/revision.js
@@ -1,22 +1,22 @@
 'use strict'
 // external modules
-var Sequelize = require('sequelize')
-var async = require('async')
-var moment = require('moment')
-var childProcess = require('child_process')
-var shortId = require('shortid')
-var path = require('path')
+const Sequelize = require('sequelize')
+const async = require('async')
+const moment = require('moment')
+const childProcess = require('child_process')
+const shortId = require('shortid')
+const path = require('path')
 
-var Op = Sequelize.Op
+const Op = Sequelize.Op
 
 // core
-var logger = require('../logger')
+const logger = require('../logger')
 
-var dmpWorker = createDmpWorker()
-var dmpCallbackCache = {}
+let dmpWorker = createDmpWorker()
+const dmpCallbackCache = {}
 
 function createDmpWorker () {
-  var worker = childProcess.fork(path.resolve(__dirname, '../workers/dmpWorker.js'), {
+  const worker = childProcess.fork(path.resolve(__dirname, '../workers/dmpWorker.js'), {
     stdio: 'ignore'
   })
   logger.debug('dmp worker process started')
@@ -24,7 +24,7 @@ function createDmpWorker () {
     if (!data || !data.msg || !data.cacheKey) {
       return logger.error('dmp worker error: not enough data on message')
     }
-    var cacheKey = data.cacheKey
+    const cacheKey = data.cacheKey
     switch (data.msg) {
       case 'error':
         dmpCallbackCache[cacheKey](data.error, null)
@@ -44,7 +44,7 @@ function createDmpWorker () {
 
 function sendDmpWorker (data, callback) {
   if (!dmpWorker) dmpWorker = createDmpWorker()
-  var cacheKey = Date.now() + '_' + shortId.generate()
+  const cacheKey = Date.now() + '_' + shortId.generate()
   dmpCallbackCache[cacheKey] = callback
   data = Object.assign(data, {
     cacheKey: cacheKey
@@ -53,7 +53,7 @@ function sendDmpWorker (data, callback) {
 }
 
 module.exports = function (sequelize, DataTypes) {
-  var Revision = sequelize.define('Revision', {
+  const Revision = sequelize.define('Revision', {
     id: {
       type: DataTypes.UUID,
       primaryKey: true,
@@ -116,9 +116,9 @@ module.exports = function (sequelize, DataTypes) {
       },
       order: [['createdAt', 'DESC']]
     }).then(function (revisions) {
-      var data = []
-      for (var i = 0, l = revisions.length; i < l; i++) {
-        var revision = revisions[i]
+      const data = []
+      for (let i = 0, l = revisions.length; i < l; i++) {
+        const revision = revisions[i]
         data.push({
           time: moment(revision.createdAt).valueOf(),
           length: revision.length
@@ -199,12 +199,12 @@ module.exports = function (sequelize, DataTypes) {
       }
     }).then(function (notes) {
       if (notes.length <= 0) return callback(null, notes)
-      var savedNotes = []
+      const savedNotes = []
       async.each(notes, function (note, _callback) {
         // revision saving policy: note not been modified for 5 mins or not save for 10 mins
         if (note.lastchangeAt && note.savedAt) {
-          var lastchangeAt = moment(note.lastchangeAt)
-          var savedAt = moment(note.savedAt)
+          const lastchangeAt = moment(note.lastchangeAt)
+          const savedAt = moment(note.savedAt)
           if (moment().isAfter(lastchangeAt.add(5, 'minutes'))) {
             savedNotes.push(note)
             Revision.saveNoteRevision(note, _callback)
@@ -223,7 +223,7 @@ module.exports = function (sequelize, DataTypes) {
           return callback(err, null)
         }
         // return null when no notes need saving at this moment but have delayed tasks to be done
-        var result = ((savedNotes.length === 0) && (notes.length > savedNotes.length)) ? null : savedNotes
+        const result = ((savedNotes.length === 0) && (notes.length > savedNotes.length)) ? null : savedNotes
         return callback(null, result)
       })
     }).catch(function (err) {
@@ -250,9 +250,9 @@ module.exports = function (sequelize, DataTypes) {
           return callback(err, null)
         })
       } else {
-        var latestRevision = revisions[0]
-        var lastContent = latestRevision.content || latestRevision.lastContent
-        var content = note.content
+        const latestRevision = revisions[0]
+        const lastContent = latestRevision.content || latestRevision.lastContent
+        const content = note.content
         sendDmpWorker({
           msg: 'create patch',
           lastDoc: lastContent,
diff --git a/lib/models/temp.js b/lib/models/temp.js
index 2ad23fb5..dee6c573 100644
--- a/lib/models/temp.js
+++ b/lib/models/temp.js
@@ -1,9 +1,9 @@
 'use strict'
 // external modules
-var shortId = require('shortid')
+const shortId = require('shortid')
 
 module.exports = function (sequelize, DataTypes) {
-  var Temp = sequelize.define('Temp', {
+  const Temp = sequelize.define('Temp', {
     id: {
       type: DataTypes.STRING,
       primaryKey: true,
diff --git a/lib/models/user.js b/lib/models/user.js
index 50c78108..26a557a7 100644
--- a/lib/models/user.js
+++ b/lib/models/user.js
@@ -17,7 +17,7 @@ const logger = require('../logger')
 const { generateAvatarURL } = require('../letter-avatars')
 
 module.exports = function (sequelize, DataTypes) {
-  var User = sequelize.define('User', {
+  const User = sequelize.define('User', {
     id: {
       type: DataTypes.UUID,
       primaryKey: true,
@@ -91,7 +91,7 @@ module.exports = function (sequelize, DataTypes) {
     return profile
   }
   User.parsePhotoByProfile = function (profile, bigger) {
-    var photo = null
+    let photo = null
     switch (profile.provider) {
       case 'facebook':
         photo = 'https://graph.facebook.com/' + profile.id + '/picture'
diff --git a/lib/realtime.js b/lib/realtime.js
index ec99707e..abea7165 100644
--- a/lib/realtime.js
+++ b/lib/realtime.js
@@ -1,25 +1,25 @@
 'use strict'
 // realtime
 // external modules
-var cookie = require('cookie')
-var cookieParser = require('cookie-parser')
-var async = require('async')
-var randomcolor = require('randomcolor')
-var Chance = require('chance')
-var chance = new Chance()
-var moment = require('moment')
+const cookie = require('cookie')
+const cookieParser = require('cookie-parser')
+const async = require('async')
+const randomcolor = require('randomcolor')
+const Chance = require('chance')
+const chance = new Chance()
+const moment = require('moment')
 
 // core
-var config = require('./config')
-var logger = require('./logger')
-var history = require('./history')
-var models = require('./models')
+const config = require('./config')
+const logger = require('./logger')
+const history = require('./history')
+const models = require('./models')
 
 // ot
-var ot = require('./ot')
+const ot = require('./ot')
 
 // public
-var realtime = {
+const realtime = {
   io: null,
   onAuthorizeSuccess: onAuthorizeSuccess,
   onAuthorizeFail: onAuthorizeFail,
@@ -41,7 +41,7 @@ function onAuthorizeFail (data, message, error, accept) {
 // secure the origin by the cookie
 function secure (socket, next) {
   try {
-    var handshakeData = socket.request
+    const handshakeData = socket.request
     if (handshakeData.headers.cookie) {
       handshakeData.cookie = cookie.parse(handshakeData.headers.cookie)
       handshakeData.sessionID = cookieParser.signedCookie(handshakeData.cookie[config.sessionName], config.sessionSecret)
@@ -62,7 +62,7 @@ function secure (socket, next) {
 }
 
 function emitCheck (note) {
-  var out = {
+  const out = {
     title: note.title,
     updatetime: note.updatetime,
     lastchangeuser: note.lastchangeuser,
@@ -74,12 +74,12 @@ function emitCheck (note) {
 }
 
 // actions
-var users = {}
-var notes = {}
+const users = {}
+const notes = {}
 // update when the note is dirty
 setInterval(function () {
   async.each(Object.keys(notes), function (key, callback) {
-    var note = notes[key]
+    const note = notes[key]
     if (note.server.isDirty) {
       logger.debug(`updater found dirty note: ${key}`)
       note.server.isDirty = false
@@ -93,8 +93,8 @@ setInterval(function () {
           logger.error('note not found: ', note.id)
         }
         if (err || !_note) {
-          for (var i = 0, l = note.socks.length; i < l; i++) {
-            var sock = note.socks[i]
+          for (let i = 0, l = note.socks.length; i < l; i++) {
+            const sock = note.socks[i]
             if (typeof sock !== 'undefined' && sock) {
               setTimeout(function () {
                 sock.disconnect(true)
@@ -123,7 +123,7 @@ function updateNote (note, callback) {
   }).then(function (_note) {
     if (!_note) return callback(null, null)
     // update user note history
-    var tempUsers = Object.assign({}, note.tempUsers)
+    const tempUsers = Object.assign({}, note.tempUsers)
     note.tempUsers = {}
     Object.keys(tempUsers).forEach(function (key) {
       updateHistory(key, note, tempUsers[key])
@@ -157,9 +157,9 @@ function updateNote (note, callback) {
 
 function finishUpdateNote (note, _note, callback) {
   if (!note || !note.server) return callback(null, null)
-  var body = note.server.document
-  var title = note.title = models.Note.parseNoteTitle(body)
-  var values = {
+  const body = note.server.document
+  const title = note.title = models.Note.parseNoteTitle(body)
+  const values = {
     title: title,
     content: body,
     authorship: note.authorship,
@@ -178,7 +178,7 @@ function finishUpdateNote (note, _note, callback) {
 // clean when user not in any rooms or user not in connected list
 setInterval(function () {
   async.each(Object.keys(users), function (key, callback) {
-    var socket = realtime.io.sockets.connected[key]
+    let socket = realtime.io.sockets.connected[key]
     if ((!socket && users[key]) ||
       (socket && (!socket.rooms || socket.rooms.length <= 0))) {
       logger.debug(`cleaner found redundant user: ${key}`)
@@ -196,7 +196,7 @@ setInterval(function () {
   })
 }, 60000)
 
-var saverSleep = false
+let saverSleep = false
 // save note revision in interval
 setInterval(function () {
   if (saverSleep) return
@@ -210,11 +210,11 @@ setInterval(function () {
 
 function getStatus (callback) {
   models.Note.count().then(function (notecount) {
-    var distinctaddresses = []
-    var regaddresses = []
-    var distinctregaddresses = []
+    const distinctaddresses = []
+    const regaddresses = []
+    const distinctregaddresses = []
     Object.keys(users).forEach(function (key) {
-      var user = users[key]
+      const user = users[key]
       if (!user) return
       let found = false
       for (let i = 0; i < distinctaddresses.length; i++) {
@@ -241,20 +241,22 @@ function getStatus (callback) {
       }
     })
     models.User.count().then(function (regcount) {
-      // eslint-disable-next-line standard/no-callback-literal
-      return callback ? callback({
-        onlineNotes: Object.keys(notes).length,
-        onlineUsers: Object.keys(users).length,
-        distinctOnlineUsers: distinctaddresses.length,
-        notesCount: notecount,
-        registeredUsers: regcount,
-        onlineRegisteredUsers: regaddresses.length,
-        distinctOnlineRegisteredUsers: distinctregaddresses.length,
-        isConnectionBusy: isConnectionBusy,
-        connectionSocketQueueLength: connectionSocketQueue.length,
-        isDisconnectBusy: isDisconnectBusy,
-        disconnectSocketQueueLength: disconnectSocketQueue.length
-      }) : null
+      return callback
+        // eslint-disable-next-line node/no-callback-literal
+        ? callback({
+          onlineNotes: Object.keys(notes).length,
+          onlineUsers: Object.keys(users).length,
+          distinctOnlineUsers: distinctaddresses.length,
+          notesCount: notecount,
+          registeredUsers: regcount,
+          onlineRegisteredUsers: regaddresses.length,
+          distinctOnlineRegisteredUsers: distinctregaddresses.length,
+          isConnectionBusy: isConnectionBusy,
+          connectionSocketQueueLength: connectionSocketQueue.length,
+          isDisconnectBusy: isDisconnectBusy,
+          disconnectSocketQueueLength: disconnectSocketQueue.length
+        })
+        : null
     }).catch(function (err) {
       return logger.error('count user failed: ' + err)
     })
@@ -282,7 +284,7 @@ function extractNoteIdFromSocket (socket) {
 }
 
 function parseNoteIdFromSocket (socket, callback) {
-  var noteId = extractNoteIdFromSocket(socket)
+  const noteId = extractNoteIdFromSocket(socket)
   if (!noteId) {
     return callback(null, null)
   }
@@ -293,32 +295,32 @@ function parseNoteIdFromSocket (socket, callback) {
 }
 
 function emitOnlineUsers (socket) {
-  var noteId = socket.noteId
+  const noteId = socket.noteId
   if (!noteId || !notes[noteId]) return
-  var users = []
+  const users = []
   Object.keys(notes[noteId].users).forEach(function (key) {
-    var user = notes[noteId].users[key]
+    const user = notes[noteId].users[key]
     if (user) { users.push(buildUserOutData(user)) }
   })
-  var out = {
+  const out = {
     users: users
   }
   realtime.io.to(noteId).emit('online users', out)
 }
 
 function emitUserStatus (socket) {
-  var noteId = socket.noteId
-  var user = users[socket.id]
+  const noteId = socket.noteId
+  const user = users[socket.id]
   if (!noteId || !notes[noteId] || !user) return
-  var out = buildUserOutData(user)
+  const out = buildUserOutData(user)
   socket.broadcast.to(noteId).emit('user status', out)
 }
 
 function emitRefresh (socket) {
-  var noteId = socket.noteId
+  const noteId = socket.noteId
   if (!noteId || !notes[noteId]) return
-  var note = notes[noteId]
-  var out = {
+  const note = notes[noteId]
+  const out = {
     title: note.title,
     docmaxlength: config.documentMaxLength,
     owner: note.owner,
@@ -335,7 +337,7 @@ function emitRefresh (socket) {
 }
 
 function isDuplicatedInSocketQueue (queue, socket) {
-  for (var i = 0; i < queue.length; i++) {
+  for (let i = 0; i < queue.length; i++) {
     if (queue[i] && queue[i].id === socket.id) {
       return true
     }
@@ -344,7 +346,7 @@ function isDuplicatedInSocketQueue (queue, socket) {
 }
 
 function clearSocketQueue (queue, socket) {
-  for (var i = 0; i < queue.length; i++) {
+  for (let i = 0; i < queue.length; i++) {
     if (!queue[i] || queue[i].id === socket.id) {
       queue.splice(i, 1)
       i--
@@ -378,10 +380,10 @@ function checkViewPermission (req, note) {
   }
 }
 
-var isConnectionBusy = false
-var connectionSocketQueue = []
-var isDisconnectBusy = false
-var disconnectSocketQueue = []
+let isConnectionBusy = false
+const connectionSocketQueue = []
+let isDisconnectBusy = false
+const disconnectSocketQueue = []
 
 function finishConnection (socket, noteId, socketId) {
   // if no valid info provided will drop the client
@@ -393,8 +395,8 @@ function finishConnection (socket, noteId, socketId) {
     interruptConnection(socket, noteId, socketId)
     return failConnection(403, 'connection forbidden', socket)
   }
-  let note = notes[noteId]
-  let user = users[socketId]
+  const note = notes[noteId]
+  const user = users[socketId]
   // update user color to author color
   if (note.authors[user.userid]) {
     user.color = users[socket.id].color = note.authors[user.userid].color
@@ -417,7 +419,7 @@ function finishConnection (socket, noteId, socketId) {
   connectNextSocket()
 
   if (config.debug) {
-    let noteId = socket.noteId
+    const noteId = socket.noteId
     logger.debug(`SERVER connected a client to [${noteId}]:`)
     logger.debug(JSON.stringify(user))
     logger.debug(notes)
@@ -431,13 +433,13 @@ function startConnection (socket) {
   if (isConnectionBusy) return
   isConnectionBusy = true
 
-  var noteId = socket.noteId
+  const noteId = socket.noteId
   if (!noteId) {
     return failConnection(404, 'note id not found', socket)
   }
 
   if (!notes[noteId]) {
-    var include = [{
+    const include = [{
       model: models.User,
       as: 'owner'
     }, {
@@ -461,21 +463,21 @@ function startConnection (socket) {
       if (!note) {
         return failConnection(404, 'note not found', socket)
       }
-      var owner = note.ownerId
-      var ownerprofile = note.owner ? models.User.getProfile(note.owner) : null
+      const owner = note.ownerId
+      const ownerprofile = note.owner ? models.User.getProfile(note.owner) : null
 
-      var lastchangeuser = note.lastchangeuserId
-      var lastchangeuserprofile = note.lastchangeuser ? models.User.getProfile(note.lastchangeuser) : null
+      const lastchangeuser = note.lastchangeuserId
+      const lastchangeuserprofile = note.lastchangeuser ? models.User.getProfile(note.lastchangeuser) : null
 
-      var body = note.content
-      var createtime = note.createdAt
-      var updatetime = note.lastchangeAt
-      var server = new ot.EditorSocketIOServer(body, [], noteId, ifMayEdit, operationCallback)
+      const body = note.content
+      const createtime = note.createdAt
+      const updatetime = note.lastchangeAt
+      const server = new ot.EditorSocketIOServer(body, [], noteId, ifMayEdit, operationCallback)
 
-      var authors = {}
-      for (var i = 0; i < note.authors.length; i++) {
-        var author = note.authors[i]
-        var profile = models.User.getProfile(author.user)
+      const authors = {}
+      for (let i = 0; i < note.authors.length; i++) {
+        const author = note.authors[i]
+        const profile = models.User.getProfile(author.user)
         if (profile) {
           authors[author.userId] = {
             userid: author.userId,
@@ -536,16 +538,17 @@ function disconnect (socket) {
   if (users[socket.id]) {
     delete users[socket.id]
   }
-  var noteId = socket.noteId
-  var note = notes[noteId]
+  const noteId = socket.noteId
+  const note = notes[noteId]
   if (note) {
     // delete user in users
     if (note.users[socket.id]) {
       delete note.users[socket.id]
     }
     // remove sockets in the note socks
+    let index
     do {
-      var index = note.socks.indexOf(socket)
+      index = note.socks.indexOf(socket)
       if (index !== -1) {
         note.socks.splice(index, 1)
       }
@@ -590,7 +593,7 @@ function disconnect (socket) {
 }
 
 function buildUserOutData (user) {
-  var out = {
+  const out = {
     id: user.id,
     login: user.login,
     userid: user.userid,
@@ -607,7 +610,7 @@ function buildUserOutData (user) {
 function updateUserData (socket, user) {
   // retrieve user data from passport
   if (socket.request.user && socket.request.user.logged_in) {
-    var profile = models.User.getProfile(socket.request.user)
+    const profile = models.User.getProfile(socket.request.user)
     user.photo = profile.photo
     user.name = profile.name
     user.userid = socket.request.user.id
@@ -620,10 +623,10 @@ function updateUserData (socket, user) {
 }
 
 function ifMayEdit (socket, callback) {
-  var noteId = socket.noteId
+  const noteId = socket.noteId
   if (!noteId || !notes[noteId]) return
-  var note = notes[noteId]
-  var mayEdit = true
+  const note = notes[noteId]
+  let mayEdit = true
   switch (note.permission) {
     case 'freely':
       // not blocking anyone
@@ -650,13 +653,13 @@ function ifMayEdit (socket, callback) {
 }
 
 function operationCallback (socket, operation) {
-  var noteId = socket.noteId
+  const noteId = socket.noteId
   if (!noteId || !notes[noteId]) return
-  var note = notes[noteId]
-  var userId = null
+  const note = notes[noteId]
+  let userId = null
   // save authors
   if (socket.request.user && socket.request.user.logged_in) {
-    var user = users[socket.id]
+    const user = users[socket.id]
     if (!user) return
     userId = socket.request.user.id
     if (!note.authors[userId]) {
@@ -692,7 +695,7 @@ function operationCallback (socket, operation) {
 }
 
 function updateHistory (userId, note, time) {
-  var noteId = note.alias ? note.alias : models.Note.encodeNoteId(note.id)
+  const noteId = note.alias ? note.alias : models.Note.encodeNoteId(note.id)
   if (note.server) history.updateHistory(userId, noteId, note.server.document, time)
 }
 
@@ -713,12 +716,12 @@ function connection (socket) {
 
     // initialize user data
     // random color
-    var color = randomcolor()
+    let color = randomcolor()
     // make sure color not duplicated or reach max random count
     if (notes[noteId]) {
-      var randomcount = 0
-      var maxrandomcount = 10
-      var found = false
+      let randomcount = 0
+      const maxrandomcount = 10
+      let found = false
       do {
         Object.keys(notes[noteId].users).forEach(function (userId) {
           if (notes[noteId].users[userId].color === color) {
@@ -758,8 +761,8 @@ function connection (socket) {
 
   // received user status
   socket.on('user status', function (data) {
-    var noteId = socket.noteId
-    var user = users[socket.id]
+    const noteId = socket.noteId
+    const user = users[socket.id]
     if (!noteId || !notes[noteId] || !user) return
     logger.debug(`SERVER received [${noteId}] user status from [${socket.id}]: ${JSON.stringify(data)}`)
     if (data) {
@@ -773,9 +776,9 @@ function connection (socket) {
   socket.on('permission', function (permission) {
     // need login to do more actions
     if (socket.request.user && socket.request.user.logged_in) {
-      var noteId = socket.noteId
+      const noteId = socket.noteId
       if (!noteId || !notes[noteId]) return
-      var note = notes[noteId]
+      const note = notes[noteId]
       // Only owner can change permission
       if (note.owner && note.owner === socket.request.user.id) {
         if (permission === 'freely' && !config.allowAnonymous && !config.allowAnonymousEdits) return
@@ -790,12 +793,12 @@ function connection (socket) {
           if (!count) {
             return
           }
-          var out = {
+          const out = {
             permission: permission
           }
           realtime.io.to(note.id).emit('permission', out)
-          for (var i = 0, l = note.socks.length; i < l; i++) {
-            var sock = note.socks[i]
+          for (let i = 0, l = note.socks.length; i < l; i++) {
+            const sock = note.socks[i]
             if (typeof sock !== 'undefined' && sock) {
               // check view permission
               if (!checkViewPermission(sock.request, note)) {
@@ -819,9 +822,9 @@ function connection (socket) {
   socket.on('delete', function () {
     // need login to do more actions
     if (socket.request.user && socket.request.user.logged_in) {
-      var noteId = socket.noteId
+      const noteId = socket.noteId
       if (!noteId || !notes[noteId]) return
-      var note = notes[noteId]
+      const note = notes[noteId]
       // Only owner can delete note
       if (note.owner && note.owner === socket.request.user.id) {
         models.Note.destroy({
@@ -830,8 +833,8 @@ function connection (socket) {
           }
         }).then(function (count) {
           if (!count) return
-          for (var i = 0, l = note.socks.length; i < l; i++) {
-            var sock = note.socks[i]
+          for (let i = 0, l = note.socks.length; i < l; i++) {
+            const sock = note.socks[i]
             if (typeof sock !== 'undefined' && sock) {
               sock.emit('delete')
               setTimeout(function () {
@@ -849,9 +852,9 @@ function connection (socket) {
   // reveiced when user logout or changed
   socket.on('user changed', function () {
     logger.info('user changed')
-    var noteId = socket.noteId
+    const noteId = socket.noteId
     if (!noteId || !notes[noteId]) return
-    var user = notes[noteId].users[socket.id]
+    const user = notes[noteId].users[socket.id]
     if (!user) return
     updateUserData(socket, user)
     emitOnlineUsers(socket)
@@ -859,14 +862,14 @@ function connection (socket) {
 
   // received sync of online users request
   socket.on('online users', function () {
-    var noteId = socket.noteId
+    const noteId = socket.noteId
     if (!noteId || !notes[noteId]) return
-    var users = []
+    const users = []
     Object.keys(notes[noteId].users).forEach(function (key) {
-      var user = notes[noteId].users[key]
+      const user = notes[noteId].users[key]
       if (user) { users.push(buildUserOutData(user)) }
     })
-    var out = {
+    const out = {
       users: users
     }
     socket.emit('online users', out)
@@ -882,31 +885,31 @@ function connection (socket) {
 
   // received cursor focus
   socket.on('cursor focus', function (data) {
-    var noteId = socket.noteId
-    var user = users[socket.id]
+    const noteId = socket.noteId
+    const user = users[socket.id]
     if (!noteId || !notes[noteId] || !user) return
     user.cursor = data
-    var out = buildUserOutData(user)
+    const out = buildUserOutData(user)
     socket.broadcast.to(noteId).emit('cursor focus', out)
   })
 
   // received cursor activity
   socket.on('cursor activity', function (data) {
-    var noteId = socket.noteId
-    var user = users[socket.id]
+    const noteId = socket.noteId
+    const user = users[socket.id]
     if (!noteId || !notes[noteId] || !user) return
     user.cursor = data
-    var out = buildUserOutData(user)
+    const out = buildUserOutData(user)
     socket.broadcast.to(noteId).emit('cursor activity', out)
   })
 
   // received cursor blur
   socket.on('cursor blur', function () {
-    var noteId = socket.noteId
-    var user = users[socket.id]
+    const noteId = socket.noteId
+    const user = users[socket.id]
     if (!noteId || !notes[noteId] || !user) return
     user.cursor = null
-    var out = {
+    const out = {
       id: socket.id
     }
     socket.broadcast.to(noteId).emit('cursor blur', out)
diff --git a/lib/response.js b/lib/response.js
index a56273a2..10ecd035 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -1,28 +1,28 @@
 'use strict'
 // response
 // external modules
-var fs = require('fs')
-var path = require('path')
-var request = require('request')
+const fs = require('fs')
+const path = require('path')
+const request = require('request')
 // core
-var config = require('./config')
-var logger = require('./logger')
-var models = require('./models')
+const config = require('./config')
+const logger = require('./logger')
+const models = require('./models')
 const noteUtil = require('./web/note/util')
 const errors = require('./errors')
 
 // public
-var response = {
+const response = {
   showIndex: showIndex,
   githubActions: githubActions,
   gitlabActions: gitlabActions
 }
 
 function showIndex (req, res, next) {
-  var authStatus = req.isAuthenticated()
-  var deleteToken = ''
+  const authStatus = req.isAuthenticated()
+  const deleteToken = ''
 
-  var data = {
+  const data = {
     signin: authStatus,
     infoMessage: req.flash('info'),
     errorMessage: req.flash('error'),
@@ -49,9 +49,9 @@ function showIndex (req, res, next) {
 }
 
 function githubActions (req, res, next) {
-  var noteId = req.params.noteId
+  const noteId = req.params.noteId
   noteUtil.findNote(req, res, function (note) {
-    var action = req.params.action
+    const action = req.params.action
     switch (action) {
       case 'gist':
         githubActionGist(req, res, note)
@@ -64,41 +64,41 @@ function githubActions (req, res, next) {
 }
 
 function githubActionGist (req, res, note) {
-  var code = req.query.code
-  var state = req.query.state
+  const code = req.query.code
+  const state = req.query.state
   if (!code || !state) {
     return errors.errorForbidden(res)
   } else {
-    var data = {
+    const data = {
       client_id: config.github.clientID,
       client_secret: config.github.clientSecret,
       code: code,
       state: state
     }
-    var authUrl = 'https://github.com/login/oauth/access_token'
+    const authUrl = 'https://github.com/login/oauth/access_token'
     request({
       url: authUrl,
       method: 'POST',
       json: data
     }, function (error, httpResponse, body) {
       if (!error && httpResponse.statusCode === 200) {
-        var accessToken = body.access_token
+        const accessToken = body.access_token
         if (accessToken) {
-          var content = note.content
-          var title = models.Note.decodeTitle(note.title)
-          var filename = title.replace('/', ' ') + '.md'
-          var gist = {
-            'files': {}
+          const content = note.content
+          const title = models.Note.decodeTitle(note.title)
+          const filename = title.replace('/', ' ') + '.md'
+          const gist = {
+            files: {}
           }
           gist.files[filename] = {
-            'content': content
+            content: content
           }
-          var gistUrl = 'https://api.github.com/gists'
+          const gistUrl = 'https://api.github.com/gists'
           request({
             url: gistUrl,
             headers: {
               'User-Agent': 'HedgeDoc',
-              'Authorization': 'token ' + accessToken
+              Authorization: 'token ' + accessToken
             },
             method: 'POST',
             json: gist
@@ -121,9 +121,9 @@ function githubActionGist (req, res, note) {
 }
 
 function gitlabActions (req, res, next) {
-  var noteId = req.params.noteId
+  const noteId = req.params.noteId
   noteUtil.findNote(req, res, function (note) {
-    var action = req.params.action
+    const action = req.params.action
     switch (action) {
       case 'projects':
         gitlabActionProjects(req, res, note)
@@ -143,7 +143,7 @@ function gitlabActionProjects (req, res, note) {
       }
     }).then(function (user) {
       if (!user) { return errors.errorNotFound(res) }
-      var ret = { baseURL: config.gitlab.baseURL, version: config.gitlab.version }
+      const ret = { baseURL: config.gitlab.baseURL, version: config.gitlab.version }
       ret.accesstoken = user.accessToken
       ret.profileid = user.profileid
       request(
diff --git a/lib/utils.js b/lib/utils.js
index 23873ffc..44ff8892 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -5,7 +5,7 @@ exports.isSQLite = function isSQLite (sequelize) {
 }
 
 exports.getImageMimeType = function getImageMimeType (imagePath) {
-  var fileExtension = /[^.]+$/.exec(imagePath)
+  const fileExtension = /[^.]+$/.exec(imagePath)
 
   switch (fileExtension[0].toLowerCase()) {
     case 'bmp':
diff --git a/lib/web/auth/dropbox/index.js b/lib/web/auth/dropbox/index.js
index aef011cb..c35f04e3 100644
--- a/lib/web/auth/dropbox/index.js
+++ b/lib/web/auth/dropbox/index.js
@@ -6,7 +6,7 @@ const DropboxStrategy = require('passport-dropbox-oauth2').Strategy
 const config = require('../../../config')
 const { passportGeneralCallback } = require('../utils')
 
-let dropboxAuth = module.exports = Router()
+const dropboxAuth = module.exports = Router()
 
 passport.use(new DropboxStrategy({
   apiVersion: '2',
diff --git a/lib/web/auth/email/index.js b/lib/web/auth/email/index.js
index 78ca933b..74922966 100644
--- a/lib/web/auth/email/index.js
+++ b/lib/web/auth/email/index.js
@@ -10,7 +10,7 @@ const logger = require('../../../logger')
 const { urlencodedParser } = require('../../utils')
 const errors = require('../../../errors')
 
-let emailAuth = module.exports = Router()
+const emailAuth = module.exports = Router()
 
 passport.use(new LocalStrategy({
   usernameField: 'email'
diff --git a/lib/web/auth/facebook/index.js b/lib/web/auth/facebook/index.js
index 0ba948bb..acf566eb 100644
--- a/lib/web/auth/facebook/index.js
+++ b/lib/web/auth/facebook/index.js
@@ -7,7 +7,7 @@ const FacebookStrategy = require('passport-facebook').Strategy
 const config = require('../../../config')
 const { passportGeneralCallback } = require('../utils')
 
-let facebookAuth = module.exports = Router()
+const facebookAuth = module.exports = Router()
 
 passport.use(new FacebookStrategy({
   clientID: config.facebook.clientID,
diff --git a/lib/web/auth/github/index.js b/lib/web/auth/github/index.js
index 3a3a84c6..c7f7e5d1 100644
--- a/lib/web/auth/github/index.js
+++ b/lib/web/auth/github/index.js
@@ -7,7 +7,7 @@ const config = require('../../../config')
 const response = require('../../../response')
 const { passportGeneralCallback } = require('../utils')
 
-let githubAuth = module.exports = Router()
+const githubAuth = module.exports = Router()
 
 passport.use(new GithubStrategy({
   clientID: config.github.clientID,
diff --git a/lib/web/auth/gitlab/index.js b/lib/web/auth/gitlab/index.js
index 1b628e81..11579bd1 100644
--- a/lib/web/auth/gitlab/index.js
+++ b/lib/web/auth/gitlab/index.js
@@ -7,7 +7,7 @@ const config = require('../../../config')
 const response = require('../../../response')
 const { passportGeneralCallback } = require('../utils')
 
-let gitlabAuth = module.exports = Router()
+const gitlabAuth = module.exports = Router()
 
 passport.use(new GitlabStrategy({
   baseURL: config.gitlab.baseURL,
diff --git a/lib/web/auth/google/index.js b/lib/web/auth/google/index.js
index 6edf07a9..0262dedf 100644
--- a/lib/web/auth/google/index.js
+++ b/lib/web/auth/google/index.js
@@ -2,11 +2,11 @@
 
 const Router = require('express').Router
 const passport = require('passport')
-var GoogleStrategy = require('passport-google-oauth20').Strategy
+const GoogleStrategy = require('passport-google-oauth20').Strategy
 const config = require('../../../config')
 const { passportGeneralCallback } = require('../utils')
 
-let googleAuth = module.exports = Router()
+const googleAuth = module.exports = Router()
 
 passport.use(new GoogleStrategy({
   clientID: config.google.clientID,
diff --git a/lib/web/auth/ldap/index.js b/lib/web/auth/ldap/index.js
index b501106d..4142194f 100644
--- a/lib/web/auth/ldap/index.js
+++ b/lib/web/auth/ldap/index.js
@@ -9,7 +9,7 @@ const logger = require('../../../logger')
 const { urlencodedParser } = require('../../utils')
 const errors = require('../../../errors')
 
-let ldapAuth = module.exports = Router()
+const ldapAuth = module.exports = Router()
 
 passport.use(new LDAPStrategy({
   server: {
@@ -22,7 +22,7 @@ passport.use(new LDAPStrategy({
     tlsOptions: config.ldap.tlsOptions || null
   }
 }, function (user, done) {
-  var uuid = user.uidNumber || user.uid || user.sAMAccountName || undefined
+  let uuid = user.uidNumber || user.uid || user.sAMAccountName || undefined
   if (config.ldap.useridField && user[config.ldap.useridField]) {
     uuid = user[config.ldap.useridField]
   }
@@ -34,12 +34,12 @@ passport.use(new LDAPStrategy({
     '"useridField" option in ldap settings.')
   }
 
-  var username = uuid
+  let username = uuid
   if (config.ldap.usernameField && user[config.ldap.usernameField]) {
     username = user[config.ldap.usernameField]
   }
 
-  var profile = {
+  const profile = {
     id: 'LDAP-' + uuid,
     username: username,
     displayName: user.displayName,
@@ -48,7 +48,7 @@ passport.use(new LDAPStrategy({
     profileUrl: null,
     provider: 'ldap'
   }
-  var stringifiedProfile = JSON.stringify(profile)
+  const stringifiedProfile = JSON.stringify(profile)
   models.User.findOrCreate({
     where: {
       profileid: profile.id.toString()
@@ -58,7 +58,7 @@ passport.use(new LDAPStrategy({
     }
   }).spread(function (user, created) {
     if (user) {
-      var needSave = false
+      let needSave = false
       if (user.profile !== stringifiedProfile) {
         user.profile = stringifiedProfile
         needSave = true
diff --git a/lib/web/auth/mattermost/index.js b/lib/web/auth/mattermost/index.js
index 78eca2af..2f15c812 100644
--- a/lib/web/auth/mattermost/index.js
+++ b/lib/web/auth/mattermost/index.js
@@ -9,9 +9,9 @@ const { passportGeneralCallback } = require('../utils')
 
 const mattermost = new Mattermost.Client()
 
-let mattermostAuth = module.exports = Router()
+const mattermostAuth = module.exports = Router()
 
-let mattermostStrategy = new OAuthStrategy({
+const mattermostStrategy = new OAuthStrategy({
   authorizationURL: config.mattermost.baseURL + '/oauth/authorize',
   tokenURL: config.mattermost.baseURL + '/oauth/access_token',
   clientID: config.mattermost.clientID,
diff --git a/lib/web/auth/oauth2/index.js b/lib/web/auth/oauth2/index.js
index 9cb17f26..e9032e0b 100644
--- a/lib/web/auth/oauth2/index.js
+++ b/lib/web/auth/oauth2/index.js
@@ -7,7 +7,7 @@ const config = require('../../../config')
 const logger = require('../../../logger')
 const { passportGeneralCallback } = require('../utils')
 
-let oauth2Auth = module.exports = Router()
+const oauth2Auth = module.exports = Router()
 
 class OAuth2CustomStrategy extends Strategy {
   constructor (options, verify) {
@@ -20,7 +20,7 @@ class OAuth2CustomStrategy extends Strategy {
 
   userProfile (accessToken, done) {
     this._oauth2.get(this._userProfileURL, accessToken, function (err, body, res) {
-      var json
+      let json
 
       if (err) {
         return done(new InternalOAuthError('Failed to fetch user profile', err))
@@ -33,7 +33,7 @@ class OAuth2CustomStrategy extends Strategy {
       }
 
       checkAuthorization(json, done)
-      let profile = parseProfile(json)
+      const profile = parseProfile(json)
       profile.provider = 'oauth2'
 
       done(null, profile)
@@ -91,7 +91,7 @@ function checkAuthorization (data, done) {
 
 OAuth2CustomStrategy.prototype.userProfile = function (accessToken, done) {
   this._oauth2.get(this._userProfileURL, accessToken, function (err, body, res) {
-    var json
+    let json
 
     if (err) {
       return done(new InternalOAuthError('Failed to fetch user profile', err))
@@ -104,7 +104,7 @@ OAuth2CustomStrategy.prototype.userProfile = function (accessToken, done) {
     }
 
     checkAuthorization(json, done)
-    let profile = parseProfile(json)
+    const profile = parseProfile(json)
     profile.provider = 'oauth2'
 
     done(null, profile)
diff --git a/lib/web/auth/openid/index.js b/lib/web/auth/openid/index.js
index 28e164f5..84d0970c 100644
--- a/lib/web/auth/openid/index.js
+++ b/lib/web/auth/openid/index.js
@@ -8,14 +8,14 @@ const models = require('../../../models')
 const logger = require('../../../logger')
 const { urlencodedParser } = require('../../utils')
 
-let openIDAuth = module.exports = Router()
+const openIDAuth = module.exports = Router()
 
 passport.use(new OpenIDStrategy({
   returnURL: config.serverURL + '/auth/openid/callback',
   realm: config.serverURL,
   profile: true
 }, function (openid, profile, done) {
-  var stringifiedProfile = JSON.stringify(profile)
+  const stringifiedProfile = JSON.stringify(profile)
   models.User.findOrCreate({
     where: {
       profileid: openid
@@ -25,7 +25,7 @@ passport.use(new OpenIDStrategy({
     }
   }).spread(function (user, created) {
     if (user) {
-      var needSave = false
+      let needSave = false
       if (user.profile !== stringifiedProfile) {
         user.profile = stringifiedProfile
         needSave = true
diff --git a/lib/web/auth/saml/index.js b/lib/web/auth/saml/index.js
index c48b93e2..deb04007 100644
--- a/lib/web/auth/saml/index.js
+++ b/lib/web/auth/saml/index.js
@@ -10,19 +10,21 @@ const { urlencodedParser } = require('../../utils')
 const fs = require('fs')
 const intersection = function (array1, array2) { return array1.filter((n) => array2.includes(n)) }
 
-let samlAuth = module.exports = Router()
+const samlAuth = module.exports = Router()
 
 passport.use(new SamlStrategy({
   callbackUrl: config.serverURL + '/auth/saml/callback',
   entryPoint: config.saml.idpSsoUrl,
   issuer: config.saml.issuer || config.serverURL,
-  privateCert: config.saml.clientCert === undefined ? undefined : (function () {
-    try {
-      return fs.readFileSync(config.saml.clientCert, 'utf-8')
-    } catch (e) {
-      logger.error(`SAML client certificate: ${e.message}`)
-    }
-  }()),
+  privateCert: config.saml.clientCert === undefined
+    ? undefined
+    : (function () {
+        try {
+          return fs.readFileSync(config.saml.clientCert, 'utf-8')
+        } catch (e) {
+          logger.error(`SAML client certificate: ${e.message}`)
+        }
+      }()),
   cert: (function () {
     try {
       return fs.readFileSync(config.saml.idpCert, 'utf-8')
@@ -36,7 +38,7 @@ passport.use(new SamlStrategy({
 }, function (user, done) {
   // check authorization if needed
   if (config.saml.externalGroups && config.saml.groupAttribute) {
-    var externalGroups = intersection(config.saml.externalGroups, user[config.saml.groupAttribute])
+    const externalGroups = intersection(config.saml.externalGroups, user[config.saml.groupAttribute])
     if (externalGroups.length > 0) {
       logger.error('saml permission denied: ' + externalGroups.join(', '))
       return done('Permission denied', null)
@@ -49,8 +51,8 @@ passport.use(new SamlStrategy({
     }
   }
   // user creation
-  var uuid = user[config.saml.attribute.id] || user.nameID
-  var profile = {
+  const uuid = user[config.saml.attribute.id] || user.nameID
+  const profile = {
     provider: 'saml',
     id: 'SAML-' + uuid,
     username: user[config.saml.attribute.username] || user.nameID,
@@ -59,7 +61,7 @@ passport.use(new SamlStrategy({
   if (profile.emails.length === 0 && config.saml.identifierFormat === 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress') {
     profile.emails.push(user.nameID)
   }
-  var stringifiedProfile = JSON.stringify(profile)
+  const stringifiedProfile = JSON.stringify(profile)
   models.User.findOrCreate({
     where: {
       profileid: profile.id.toString()
@@ -69,7 +71,7 @@ passport.use(new SamlStrategy({
     }
   }).spread(function (user, created) {
     if (user) {
-      var needSave = false
+      let needSave = false
       if (user.profile !== stringifiedProfile) {
         user.profile = stringifiedProfile
         needSave = true
diff --git a/lib/web/auth/twitter/index.js b/lib/web/auth/twitter/index.js
index 56389f84..76744e09 100644
--- a/lib/web/auth/twitter/index.js
+++ b/lib/web/auth/twitter/index.js
@@ -7,7 +7,7 @@ const TwitterStrategy = require('passport-twitter').Strategy
 const config = require('../../../config')
 const { passportGeneralCallback } = require('../utils')
 
-let twitterAuth = module.exports = Router()
+const twitterAuth = module.exports = Router()
 
 passport.use(new TwitterStrategy({
   consumerKey: config.twitter.consumerKey,
diff --git a/lib/web/auth/utils.js b/lib/web/auth/utils.js
index fb69f08c..bb69f15f 100644
--- a/lib/web/auth/utils.js
+++ b/lib/web/auth/utils.js
@@ -4,7 +4,7 @@ const models = require('../../models')
 const logger = require('../../logger')
 
 exports.passportGeneralCallback = function callback (accessToken, refreshToken, profile, done) {
-  var stringifiedProfile = JSON.stringify(profile)
+  const stringifiedProfile = JSON.stringify(profile)
   models.User.findOrCreate({
     where: {
       profileid: profile.id.toString()
@@ -16,7 +16,7 @@ exports.passportGeneralCallback = function callback (accessToken, refreshToken,
     }
   }).spread(function (user, created) {
     if (user) {
-      var needSave = false
+      let needSave = false
       if (user.profile !== stringifiedProfile) {
         user.profile = stringifiedProfile
         needSave = true
diff --git a/lib/web/imageRouter/azure.js b/lib/web/imageRouter/azure.js
index 22ee5585..c56ac860 100644
--- a/lib/web/imageRouter/azure.js
+++ b/lib/web/imageRouter/azure.js
@@ -17,7 +17,7 @@ exports.uploadImage = function (imagePath, callback) {
     return
   }
 
-  var azureBlobService = azure.createBlobService(config.azure.connectionString)
+  const azureBlobService = azure.createBlobService(config.azure.connectionString)
 
   azureBlobService.createContainerIfNotExists(config.azure.container, { publicAccessLevel: 'blob' }, function (err, result, response) {
     if (err) {
diff --git a/lib/web/imageRouter/index.js b/lib/web/imageRouter/index.js
index afa9bbf6..0a72c65c 100644
--- a/lib/web/imageRouter/index.js
+++ b/lib/web/imageRouter/index.js
@@ -12,20 +12,28 @@ const config = require('../../config')
 const logger = require('../../logger')
 const errors = require('../../errors')
 
-const imageRouter = module.exports = Router()
+const imageRouter = (module.exports = Router())
 
 async function checkUploadType (filePath) {
   const typeFromMagic = await FileType.fromFile(filePath)
   if (typeFromMagic === undefined) {
-    logger.error(`Image upload error: Could not determine MIME-type`)
+    logger.error('Image upload error: Could not determine MIME-type')
     return false
   }
   if (path.extname(filePath) !== '.' + typeFromMagic.ext) {
-    logger.error(`Image upload error: Provided file extension does not match MIME-type`)
+    logger.error(
+      'Image upload error: Provided file extension does not match MIME-type'
+    )
     return false
   }
   if (!config.allowedUploadMimeTypes.includes(typeFromMagic.mime)) {
-    logger.error(`Image upload error: MIME-type "${typeFromMagic.mime}" of uploaded file not allowed, only "${config.allowedUploadMimeTypes.join(', ')}" are allowed`)
+    logger.error(
+      `Image upload error: MIME-type "${
+        typeFromMagic.mime
+      }" of uploaded file not allowed, only "${config.allowedUploadMimeTypes.join(
+        ', '
+      )}" are allowed`
+    )
     return false
   }
   return true
@@ -33,12 +41,18 @@ async function checkUploadType (filePath) {
 
 // upload image
 imageRouter.post('/uploadimage', function (req, res) {
-  if (!req.isAuthenticated() && !config.allowAnonymous && !config.allowAnonymousEdits) {
-    logger.error(`Image upload error: Anonymous edits and therefore uploads are not allowed)`)
+  if (
+    !req.isAuthenticated() &&
+    !config.allowAnonymous &&
+    !config.allowAnonymousEdits
+  ) {
+    logger.error(
+      'Image upload error: Anonymous edits and therefore uploads are not allowed'
+    )
     return errors.errorForbidden(res)
   }
 
-  var form = new formidable.IncomingForm()
+  const form = new formidable.IncomingForm()
   form.keepExtensions = true
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hedgedoc-'))
   form.uploadDir = tmpDir
@@ -49,17 +63,21 @@ imageRouter.post('/uploadimage', function (req, res) {
       rimraf(tmpDir)
       return errors.errorForbidden(res)
     } else if (!files.image || !files.image.path) {
-      logger.error(`Image upload error: Upload didn't contain file)`)
+      logger.error("Image upload error: Upload didn't contain file)")
       rimraf.sync(tmpDir)
       return errors.errorBadRequest(res)
-    } else if (!await checkUploadType(files.image.path)) {
+    } else if (!(await checkUploadType(files.image.path))) {
       rimraf.sync(tmpDir)
       return errors.errorBadRequest(res)
     } else {
-      logger.debug(`SERVER received uploadimage: ${JSON.stringify(files.image)}`)
+      logger.debug(
+        `SERVER received uploadimage: ${JSON.stringify(files.image)}`
+      )
 
       const uploadProvider = require('./' + config.imageUploadType)
-      logger.debug(`imageRouter: Uploading ${files.image.path} using ${config.imageUploadType}`)
+      logger.debug(
+        `imageRouter: Uploading ${files.image.path} using ${config.imageUploadType}`
+      )
       uploadProvider.uploadImage(files.image.path, function (err, url) {
         rimraf.sync(tmpDir)
         if (err !== null) {
diff --git a/lib/web/imageRouter/minio.js b/lib/web/imageRouter/minio.js
index 91de5ff1..3ced94e2 100644
--- a/lib/web/imageRouter/minio.js
+++ b/lib/web/imageRouter/minio.js
@@ -32,16 +32,16 @@ exports.uploadImage = function (imagePath, callback) {
       return
     }
 
-    let key = path.join('uploads', path.basename(imagePath))
-    let protocol = config.minio.secure ? 'https' : 'http'
+    const key = path.join('uploads', path.basename(imagePath))
+    const protocol = config.minio.secure ? 'https' : 'http'
 
     minioClient.putObject(config.s3bucket, key, buffer, buffer.size, getImageMimeType(imagePath), function (err, data) {
       if (err) {
         callback(new Error(err), null)
         return
       }
-      let hidePort = [80, 443].includes(config.minio.port)
-      let urlPort = hidePort ? '' : `:${config.minio.port}`
+      const hidePort = [80, 443].includes(config.minio.port)
+      const urlPort = hidePort ? '' : `:${config.minio.port}`
       callback(null, `${protocol}://${config.minio.endPoint}${urlPort}/${config.s3bucket}/${key}`)
     })
   })
diff --git a/lib/web/imageRouter/s3.js b/lib/web/imageRouter/s3.js
index 2bf08cc7..5bb8e160 100644
--- a/lib/web/imageRouter/s3.js
+++ b/lib/web/imageRouter/s3.js
@@ -26,7 +26,7 @@ exports.uploadImage = function (imagePath, callback) {
       callback(new Error(err), null)
       return
     }
-    let params = {
+    const params = {
       Bucket: config.s3bucket,
       Key: path.join('uploads', path.basename(imagePath)),
       Body: buffer
diff --git a/lib/web/statusRouter.js b/lib/web/statusRouter.js
index febe2df3..d939a3fe 100644
--- a/lib/web/statusRouter.js
+++ b/lib/web/statusRouter.js
@@ -25,11 +25,11 @@ statusRouter.get('/status', function (req, res, next) {
 })
 // get status
 statusRouter.get('/temp', function (req, res) {
-  var host = req.get('host')
+  const host = req.get('host')
   if (config.allowOrigin.indexOf(host) === -1) {
     errors.errorForbidden(res)
   } else {
-    var tempid = req.query.tempid
+    const tempid = req.query.tempid
     if (!tempid) {
       errors.errorForbidden(res)
     } else {
@@ -60,11 +60,11 @@ statusRouter.get('/temp', function (req, res) {
 })
 // post status
 statusRouter.post('/temp', urlencodedParser, function (req, res) {
-  var host = req.get('host')
+  const host = req.get('host')
   if (config.allowOrigin.indexOf(host) === -1) {
     errors.errorForbidden(res)
   } else {
-    var data = req.body.data
+    const data = req.body.data
     if (!data) {
       errors.errorForbidden(res)
     } else {
@@ -90,7 +90,7 @@ statusRouter.post('/temp', urlencodedParser, function (req, res) {
 })
 
 statusRouter.get('/config', function (req, res) {
-  var data = {
+  const data = {
     domain: config.domain,
     urlpath: config.urlPath,
     debug: config.debug,
diff --git a/lib/web/userRouter.js b/lib/web/userRouter.js
index f1f999f1..117668fa 100644
--- a/lib/web/userRouter.js
+++ b/lib/web/userRouter.js
@@ -21,7 +21,7 @@ UserRouter.get('/me', function (req, res) {
       }
     }).then(function (user) {
       if (!user) { return errors.errorNotFound(res) }
-      var profile = models.User.getProfile(user)
+      const profile = models.User.getProfile(user)
       res.send({
         status: 'ok',
         id: req.user.id,
@@ -70,7 +70,7 @@ UserRouter.get('/me/delete/:token?', function (req, res) {
 UserRouter.get('/me/export', function (req, res) {
   if (req.isAuthenticated()) {
     // let output = fs.createWriteStream(__dirname + '/example.zip');
-    let archive = archiver('zip', {
+    const archive = archiver('zip', {
       zlib: { level: 3 } // Sets the compression level.
     })
     res.setHeader('Content-Type', 'application/zip')
@@ -90,13 +90,13 @@ UserRouter.get('/me/export', function (req, res) {
           ownerId: user.id
         }
       }).then(function (notes) {
-        let filenames = {}
+        const filenames = {}
         async.each(notes, function (note, callback) {
-          let basename = note.title.replace(/\//g, '-') // Prevent subdirectories
+          const basename = note.title.replace(/\//g, '-') // Prevent subdirectories
           let filename
           let suffix = ''
           do {
-            let seperator = typeof suffix === 'number' ? '-' : ''
+            const seperator = typeof suffix === 'number' ? '-' : ''
             filename = basename + seperator + suffix + '.md'
             suffix++
           } while (filenames[filename])
diff --git a/lib/workers/dmpWorker.js b/lib/workers/dmpWorker.js
index ca68b4ab..7b5439c7 100644
--- a/lib/workers/dmpWorker.js
+++ b/lib/workers/dmpWorker.js
@@ -1,10 +1,10 @@
 'use strict'
 // external modules
-var DiffMatchPatch = require('diff-match-patch')
-var dmp = new DiffMatchPatch()
+const DiffMatchPatch = require('diff-match-patch')
+const dmp = new DiffMatchPatch()
 
 // core
-var logger = require('../logger')
+const logger = require('../logger')
 
 process.on('message', function (data) {
   if (!data || !data.msg || !data.cacheKey) {
@@ -12,11 +12,16 @@ process.on('message', function (data) {
   }
   switch (data.msg) {
     case 'create patch':
-      if (!data.hasOwnProperty('lastDoc') || !data.hasOwnProperty('currDoc')) {
-        return logger.error('dmp worker error: not enough data on create patch')
+      if (
+        !Object.prototype.hasOwnProperty.call(data, 'lastDoc') ||
+        !Object.prototype.hasOwnProperty.call(data, 'currDoc')
+      ) {
+        return logger.error(
+          'dmp worker error: not enough data on create patch'
+        )
       }
       try {
-        var patch = createPatch(data.lastDoc, data.currDoc)
+        const patch = createPatch(data.lastDoc, data.currDoc)
         process.send({
           msg: 'check',
           result: patch,
@@ -32,11 +37,16 @@ process.on('message', function (data) {
       }
       break
     case 'get revision':
-      if (!data.hasOwnProperty('revisions') || !data.hasOwnProperty('count')) {
-        return logger.error('dmp worker error: not enough data on get revision')
+      if (
+        !Object.prototype.hasOwnProperty.call(data, 'revisions') ||
+        !Object.prototype.hasOwnProperty.call(data, 'count')
+      ) {
+        return logger.error(
+          'dmp worker error: not enough data on get revision'
+        )
       }
       try {
-        var result = getRevision(data.revisions, data.count)
+        const result = getRevision(data.revisions, data.count)
         process.send({
           msg: 'check',
           result: result,
@@ -55,31 +65,31 @@ process.on('message', function (data) {
 })
 
 function createPatch (lastDoc, currDoc) {
-  var msStart = (new Date()).getTime()
-  var diff = dmp.diff_main(lastDoc, currDoc)
-  var patch = dmp.patch_make(lastDoc, diff)
+  const msStart = new Date().getTime()
+  const diff = dmp.diff_main(lastDoc, currDoc)
+  let patch = dmp.patch_make(lastDoc, diff)
   patch = dmp.patch_toText(patch)
-  var msEnd = (new Date()).getTime()
+  const msEnd = new Date().getTime()
   logger.debug(patch)
-  logger.debug((msEnd - msStart) + 'ms')
+  logger.debug(msEnd - msStart + 'ms')
   return patch
 }
 
 function getRevision (revisions, count) {
-  var msStart = (new Date()).getTime()
-  var startContent = null
-  var lastPatch = []
-  var applyPatches = []
-  var authorship = []
+  const msStart = new Date().getTime()
+  let startContent = null
+  let lastPatch = []
+  let applyPatches = []
+  let authorship = []
   if (count <= Math.round(revisions.length / 2)) {
     // start from top to target
     for (let i = 0; i < count; i++) {
-      let revision = revisions[i]
+      const revision = revisions[i]
       if (i === 0) {
         startContent = revision.content || revision.lastContent
       }
       if (i !== count - 1) {
-        let patch = dmp.patch_fromText(revision.patch)
+        const patch = dmp.patch_fromText(revision.patch)
         applyPatches = applyPatches.concat(patch)
       }
       lastPatch = revision.patch
@@ -88,21 +98,25 @@ function getRevision (revisions, count) {
     // swap DIFF_INSERT and DIFF_DELETE to achieve unpatching
     for (let i = 0, l = applyPatches.length; i < l; i++) {
       for (let j = 0, m = applyPatches[i].diffs.length; j < m; j++) {
-        var diff = applyPatches[i].diffs[j]
-        if (diff[0] === DiffMatchPatch.DIFF_INSERT) { diff[0] = DiffMatchPatch.DIFF_DELETE } else if (diff[0] === DiffMatchPatch.DIFF_DELETE) { diff[0] = DiffMatchPatch.DIFF_INSERT }
+        const diff = applyPatches[i].diffs[j]
+        if (diff[0] === DiffMatchPatch.DIFF_INSERT) {
+          diff[0] = DiffMatchPatch.DIFF_DELETE
+        } else if (diff[0] === DiffMatchPatch.DIFF_DELETE) {
+          diff[0] = DiffMatchPatch.DIFF_INSERT
+        }
       }
     }
   } else {
     // start from bottom to target
-    var l = revisions.length - 1
-    for (var i = l; i >= count - 1; i--) {
-      let revision = revisions[i]
+    const l = revisions.length - 1
+    for (let i = l; i >= count - 1; i--) {
+      const revision = revisions[i]
       if (i === l) {
         startContent = revision.lastContent
         authorship = revision.authorship
       }
       if (revision.patch) {
-        let patch = dmp.patch_fromText(revision.patch)
+        const patch = dmp.patch_fromText(revision.patch)
         applyPatches = applyPatches.concat(patch)
       }
       lastPatch = revision.patch
@@ -110,18 +124,18 @@ function getRevision (revisions, count) {
     }
   }
   try {
-    var finalContent = dmp.patch_apply(applyPatches, startContent)[0]
+    const finalContent = dmp.patch_apply(applyPatches, startContent)[0]
+    const data = {
+      content: finalContent,
+      patch: dmp.patch_fromText(lastPatch),
+      authorship: authorship
+    }
+    const msEnd = new Date().getTime()
+    logger.debug(msEnd - msStart + 'ms')
+    return data
   } catch (err) {
     throw new Error(err)
   }
-  var data = {
-    content: finalContent,
-    patch: dmp.patch_fromText(lastPatch),
-    authorship: authorship
-  }
-  var msEnd = (new Date()).getTime()
-  logger.debug((msEnd - msStart) + 'ms')
-  return data
 }
 
 // log uncaught exception