summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--README.md2
-rw-r--r--app.json4
-rw-r--r--config.json.example4
-rw-r--r--lib/config/default.js2
-rw-r--r--lib/config/environment.js2
-rw-r--r--lib/csp.js14
-rw-r--r--lib/response.js3
-rw-r--r--locales/de.json2
-rw-r--r--locales/en.json2
-rw-r--r--locales/zh-CN.json2
-rw-r--r--locales/zh-TW.json2
-rw-r--r--public/css/index.css18
-rw-r--r--public/css/markdown.css5
-rw-r--r--public/docs/features.md11
-rw-r--r--public/views/shared/disqus.ejs5
-rw-r--r--public/views/shared/ga.ejs6
-rw-r--r--public/views/shared/help-modal.ejs4
17 files changed, 69 insertions, 19 deletions
diff --git a/README.md b/README.md
index ed0cc029..33dd1160 100644
--- a/README.md
+++ b/README.md
@@ -158,6 +158,8 @@ There are some config settings you need to change in the files below.
| `HMD_ALLOW_FREEURL` | `true` or `false` | set to allow new note creation by accessing a nonexistent note URL |
| `HMD_DEFAULT_PERMISSION` | `freely`, `editable`, `limited`, `locked` or `private` | set notes default permission (only applied on signed users) |
| `HMD_DB_URL` | `mysql://localhost:3306/database` | set the database URL |
+| `HMD_SESSION_SECRET` | no example | Secret used to sign the session cookie. If non is set, one will randomly generated on startup |
+| `HMD_SESSION_LIFE` | `1209600000` | Session life time. (milliseconds) |
| `HMD_FACEBOOK_CLIENTID` | no example | Facebook API client id |
| `HMD_FACEBOOK_CLIENTSECRET` | no example | Facebook API client secret |
| `HMD_TWITTER_CONSUMERKEY` | no example | Twitter API consumer key |
diff --git a/app.json b/app.json
index b2116eb6..54ce160e 100644
--- a/app.json
+++ b/app.json
@@ -23,6 +23,10 @@
"description": "Specify database type. See sequelize available databases. Default using postgres",
"value": "postgres"
},
+ "HMD_SESSION_SECRET": {
+ "description": "Secret used to secure session cookies.",
+ "required": false
+ },
"HMD_HSTS_ENABLE": {
"description": "whether to also use HSTS if HTTPS is enabled",
"required": false
diff --git a/config.json.example b/config.json.example
index 8d1b6abd..2d9b7714 100644
--- a/config.json.example
+++ b/config.json.example
@@ -27,7 +27,9 @@
"directives": {
},
"upgradeInsecureRequests": "auto"
- "addDefaults": true
+ "addDefaults": true,
+ "addDisqus": true,
+ "addGoogleAnalytics": true
},
"db": {
"username": "",
diff --git a/lib/config/default.js b/lib/config/default.js
index b6f1af17..68849d36 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -18,6 +18,8 @@ module.exports = {
directives: {
},
addDefaults: true,
+ addDisqus: true,
+ addGoogleAnalytics: true,
upgradeInsecureRequests: 'auto',
reportURI: undefined
},
diff --git a/lib/config/environment.js b/lib/config/environment.js
index cab3bc3e..3dde4786 100644
--- a/lib/config/environment.js
+++ b/lib/config/environment.js
@@ -26,6 +26,8 @@ module.exports = {
allowFreeURL: toBooleanConfig(process.env.HMD_ALLOW_FREEURL),
defaultPermission: process.env.HMD_DEFAULT_PERMISSION,
dbURL: process.env.HMD_DB_URL,
+ sessionSecret: process.env.HMD_SESSION_SECRET,
+ sessionLife: toIntegerConfig(process.env.HMD_SESSION_LIFE),
imageUploadType: process.env.HMD_IMAGE_UPLOAD_TYPE,
imgur: {
clientID: process.env.HMD_IMGUR_CLIENTID
diff --git a/lib/csp.js b/lib/csp.js
index 8a4aa088..d0f906a3 100644
--- a/lib/csp.js
+++ b/lib/csp.js
@@ -5,7 +5,7 @@ var CspStrategy = {}
var defaultDirectives = {
defaultSrc: ['\'self\''],
- scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', 'https://query.yahooapis.com', 'https://*.disqus.com', '\'unsafe-eval\''],
+ scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', 'https://query.yahooapis.com', '\'unsafe-eval\''],
// ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/hackmd/issues/594
imgSrc: ['*'],
styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://assets-cdn.github.com'], // unsafe-inline is required for some libs, plus used in views
@@ -22,11 +22,23 @@ var cdnDirectives = {
fontSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.gstatic.com']
}
+var disqusDirectives = {
+ scriptSrc: ['https://*.disqus.com', 'https://*.disquscdn.com'],
+ styleSrc: ['https://*.disquscdn.com'],
+ fontSrc: ['https://*.disquscdn.com']
+}
+
+var googleAnalyticsDirectives = {
+ scriptSrc: ['https://www.google-analytics.com']
+}
+
CspStrategy.computeDirectives = function () {
var directives = {}
mergeDirectives(directives, config.csp.directives)
mergeDirectivesIf(config.csp.addDefaults, directives, defaultDirectives)
mergeDirectivesIf(config.useCDN, directives, cdnDirectives)
+ mergeDirectivesIf(config.csp.addDisqus, directives, disqusDirectives)
+ mergeDirectivesIf(config.csp.addGoogleAnalytics, directives, googleAnalyticsDirectives)
if (!areAllInlineScriptsAllowed(directives)) {
addInlineScriptExceptions(directives)
}
diff --git a/lib/response.js b/lib/response.js
index b18fd7a3..d5c685ca 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -226,7 +226,8 @@ function showPublishNote (req, res, next) {
lastchangeuserprofile: note.lastchangeuser ? models.User.getProfile(note.lastchangeuser) : null,
robots: meta.robots || false, // default allow robots
GA: meta.GA,
- disqus: meta.disqus
+ disqus: meta.disqus,
+ cspNonce: res.locals.nonce
}
return renderPublish(data, res)
}).catch(function (err) {
diff --git a/locales/de.json b/locales/de.json
index c416a684..b2539108 100644
--- a/locales/de.json
+++ b/locales/de.json
@@ -62,7 +62,7 @@
"Refresh": "Neu laden",
"Contacts": "Kontakte",
"Report an issue": "Fehlerbericht senden",
- "Meet us on Gitter": "Triff uns auf Gitter",
+ "Meet us on %s": "Triff uns auf %s",
"Send us email": "Kontakt",
"Documents": "Dokumente",
"Features": "Funktionen",
diff --git a/locales/en.json b/locales/en.json
index 0b44732d..1aef3f6d 100644
--- a/locales/en.json
+++ b/locales/en.json
@@ -62,7 +62,7 @@
"Refresh": "Refresh",
"Contacts": "Contacts",
"Report an issue": "Report an issue",
- "Meet us on Gitter": "Meet us on Gitter",
+ "Meet us on %s": "Meet us on %s",
"Send us email": "Send us email",
"Documents": "Documents",
"Features": "Features",
diff --git a/locales/zh-CN.json b/locales/zh-CN.json
index 6e0c11e9..87907189 100644
--- a/locales/zh-CN.json
+++ b/locales/zh-CN.json
@@ -60,7 +60,7 @@
"Refresh": "重新整理",
"Contacts": "联络方式",
"Report an issue": "报告问题",
- "Meet us on Gitter": "在 Gitter 上联系我们",
+ "Meet us on %s": "在 %s 上联系我们",
"Send us email": "寄信给我们",
"Documents": "文件",
"Features": "功能简介",
diff --git a/locales/zh-TW.json b/locales/zh-TW.json
index da50f66a..090af9c0 100644
--- a/locales/zh-TW.json
+++ b/locales/zh-TW.json
@@ -60,7 +60,7 @@
"Refresh": "重新整理",
"Contacts": "聯絡方式",
"Report an issue": "回報問題",
- "Meet us on Gitter": "透過 Gitter 聯絡我們",
+ "Meet us on %s": "透過 %s 聯絡我們",
"Send us email": "寄信給我們",
"Documents": "文件",
"Features": "功能簡介",
diff --git a/public/css/index.css b/public/css/index.css
index b00eba41..3f391e27 100644
--- a/public/css/index.css
+++ b/public/css/index.css
@@ -156,6 +156,10 @@ body.night{
left: 50%;
transform: translate(-50%, -50%);
}
+.night .ui-edit-area .ui-sync-toggle {
+ box-shadow: 2px 0px 2px #353535;
+}
+
.ui-edit-area .ui-sync-toggle:active {
box-shadow: inset 0 3px 5px rgba(0,0,0,.125), 2px 0px 2px #e7e7e7;
}
@@ -292,6 +296,13 @@ body.night{
background: #222;
}
+.night .modal-content,
+.night .panel,
+.night .panel-heading {
+ color: #eee;
+ background-color: #333;
+}
+
.dropdown-menu.CodeMirror-other-cursor {
transition: none;
}
@@ -340,7 +351,8 @@ div[contenteditable]:empty:not(:focus):before{
background: inherit;
}
-.night .navbar .btn-default{
+.night .navbar .btn-default,
+.night .close {
background-color: #333;
border-color: #565656;
color: #eee;
@@ -372,8 +384,10 @@ div[contenteditable]:empty:not(:focus):before{
.night .btn.focus,
.night .btn:focus,
-.night .btn:hover{
+.night .btn:hover,
+.night .close {
color: #fff;
+ background-color: #333;
}
.info-label {
diff --git a/public/css/markdown.css b/public/css/markdown.css
index eaa9ab5c..85a4c594 100644
--- a/public/css/markdown.css
+++ b/public/css/markdown.css
@@ -13,6 +13,10 @@
border: inherit !important;
}
+.night .markdown-body pre {
+ filter: invert(100%);
+}
+
.markdown-body code {
color: inherit !important;
}
@@ -78,6 +82,7 @@
.markdown-body code[data-gist-id] {
background: none;
padding: 0;
+ filter: invert(100%);
}
.markdown-body code[data-gist-id]:before {
diff --git a/public/docs/features.md b/public/docs/features.md
index 01340fd7..dc6ddafa 100644
--- a/public/docs/features.md
+++ b/public/docs/features.md
@@ -8,7 +8,7 @@ This means that you can write notes with other people on your **desktop**, **tab
You can sign-in via multiple auth providers like **Facebook**, **Twitter**, **GitHub** and many more on the [_homepage_](/).
If you experience any _issues_, feel free to report it on [**GitHub**](https://github.com/hackmdio/hackmd/issues).
-Or meet us on [**Gitter**](https://gitter.im/hackmdio/hackmd) for dev-talk and interactive help.
+Or meet us on [**Matrix.org**](https://riot.im/app/#/room/#hackmd:matrix.org) or [**Gitter**](https://gitter.im/hackmdio/hackmd) for dev-talk and interactive help.
**Thank you very much!**
Workspace
@@ -25,11 +25,16 @@ Workspace
<i class="fa fa-toggle-on fa-fw"></i> View: See only the result.
<i class="fa fa-toggle-off fa-fw"></i> Edit: See only the editor.
+## Night Mode:
+When you are tired of a white screen and like a night mode, click on the little moon <i class="fa fa-moon-o"></i> and turn on the night view of HackMD.
+
+The editor view, which is in night mode by default, can also be toggled between night and day view using the the little sun<i class="fa fa-sun-o fa-fw"></i>.
+
## Image Upload:
You can upload an image simply by clicking on the camera button <i class="fa fa-camera"></i>.
Alternatively, you can **drag-n-drop** an image into the editor. Even **pasting** images is possible!
-This will automatically upload the image to **[imgur](http://imgur.com)**, nothing to worry. :tada:
-![](https://i.imgur.com/9cgQVqD.png)
+This will automatically upload the image to **[imgur](http://imgur.com)**, **[Amazon S3](https://aws.amazon.com/s3/)**, **[Minio](https://minio.io)** or **local filesystem**, nothing to worry about. :tada:
+![imgur](https://i.imgur.com/9cgQVqD.png)
## Share Notes:
If you want to share an **editable** note, just copy the URL.
diff --git a/public/views/shared/disqus.ejs b/public/views/shared/disqus.ejs
index cceaa85c..840d1e38 100644
--- a/public/views/shared/disqus.ejs
+++ b/public/views/shared/disqus.ejs
@@ -1,14 +1,13 @@
<div id="disqus_thread"></div>
-<script>
+<script nonce="<%= cspNonce %>">
var disqus_config = function () {
this.page.identifier = window.location.pathname.split('/').slice(-1)[0];
};
(function() {
var d = document, s = d.createElement('script');
- s.src = '//<%= disqus %>.disqus.com/embed.js';
+ s.src = 'https://<%= disqus %>.disqus.com/embed.js';
s.setAttribute('data-timestamp', +new Date());
(d.head || d.body).appendChild(s);
})();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
- \ No newline at end of file
diff --git a/public/views/shared/ga.ejs b/public/views/shared/ga.ejs
index 66d4acd9..27abb742 100644
--- a/public/views/shared/ga.ejs
+++ b/public/views/shared/ga.ejs
@@ -1,5 +1,5 @@
<% if(typeof GA !== 'undefined' && GA) { %>
-<script>
+<script nonce="<%= cspNonce %>">
(function (i, s, o, g, r, a, m) {
i['GoogleAnalyticsObject'] = r;
i[r] = i[r] || function () {
@@ -10,9 +10,9 @@
a.async = 1;
a.src = g;
m.parentNode.insertBefore(a, m)
-})(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga');
+})(window, document, 'script', 'https://www.google-analytics.com/analytics.js', 'ga');
ga('create', '<%= GA %>', 'auto');
ga('send', 'pageview');
</script>
-<% } %> \ No newline at end of file
+<% } %>
diff --git a/public/views/shared/help-modal.ejs b/public/views/shared/help-modal.ejs
index f5dc55c2..6bcf637e 100644
--- a/public/views/shared/help-modal.ejs
+++ b/public/views/shared/help-modal.ejs
@@ -17,7 +17,9 @@
<div class="panel-body">
<a href="https://github.com/hackmdio/hackmd/issues" target="_blank"><i class="fa fa-tag fa-fw"></i> <%= __('Report an issue') %></a>
<br>
- <a href="https://gitter.im/hackmdio/hackmd" target="_blank"><i class="fa fa-comments fa-fw"></i> <%= __('Meet us on Gitter') %></a>
+ <a href="https://riot.im/app/#/room/#hackmd:matrix.org" target="_blank"><i class="fa fa-hashtag fa-fw"></i> <%= __('Meet us on %s', 'Matrix') %></a>
+ <br>
+ <a href="https://gitter.im/hackmdio/hackmd" target="_blank"><i class="fa fa-comments fa-fw"></i> <%= __('Meet us on %s', 'Gitter') %></a>
</div>
</div>
<div class="panel panel-default">
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-23 08:59:39 +0000