summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Remove note about HackMDSheogorath2020-07-291-4/+0
| | | | | | | | The projects are going into completely different directions these days. Therefore I think it's no longer appropriated to have this note around. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge pull request #236 from quite/featuresDavid Mehren2020-07-121-4/+4
|\ | | | | Adjust features.md slightly after #232
| * Adjust features.md slightly after #232Daniel Lublin2020-07-121-4/+4
|/ | | | Signed-off-by: Daniel Lublin <daniel@lublin.se>
* Merge pull request #350 from n0emis/saml-client-certDavid Mehren2020-07-1118-14/+144
|\
| * saml: make logger print actual error messageSimeon Keske2020-07-111-2/+2
| | | | | | | | | | Signed-off-by: Simeon Keske <git@n0emis.eu> Signed-off-by: Leo Maroni <git@em0lar.de>
| * add error handling to saml-certsSimeon Keske2020-07-111-2/+15
| | | | | | | | | | Signed-off-by: Simeon Keske <git@n0emis.eu> Signed-off-by: Leo Maroni <git@em0lar.de>
| * Fixed Image Sources in saml-keycloak guideLeo Maroni2020-07-111-11/+11
| | | | | | | | Signed-off-by: Leo Maroni <git@em0lar.de>
| * Create Keycloak SAML guideLeo Maroni2020-07-1114-1/+114
| | | | | | | | | | | | Co-authored-by: Simeon Keske <git@n0emis.eu> Signed-off-by: Simeon Keske <git@n0emis.eu> Signed-off-by: Leo Maroni <git@em0lar.de>
| * allow to set a saml client certificateSimeon Keske2020-07-114-12/+16
|/ | | | Signed-off-by: Simeon Keske <git@n0emis.eu>
* Merge pull request #410 from oupala/feature/markdown-lintingDavid Mehren2020-07-1042-1379/+2690
|\
| * chore: update yarn.lockoupala2020-07-101-11/+1195
| | | | | | | | Signed-off-by: oupala <oupala@users.noreply.github.com>
| * style: linting markdown filesoupala2020-07-1038-1368/+1478
| | | | | | | | | | | | | | | | Linting markdown files according to default remark-lint configuration. Files inside the `public` directory were not linted. Signed-off-by: oupala <oupala@users.noreply.github.com>
| * fix: override markdown linting presetoupala2020-07-101-1/+5
| | | | | | | | | | | | Override markdown linting preset to disable a rule that seems useless and to change the default setting of 2 other rules. Signed-off-by: oupala <oupala@users.noreply.github.com>
| * chore: add markdown linter in travis CIoupala2020-07-021-0/+5
| | | | | | | | Signed-off-by: oupala <oupala@users.noreply.github.com>
| * feat: add remark-lint dependencies and scriptoupala2020-07-021-0/+3
| | | | | | | | | | | | Add remark-lint dependencies as dev dependencies, and an npm script alias to launch markdown linting with `npm run markdownlint`. Signed-off-by: oupala <oupala@users.noreply.github.com>
| * doc: add a markdown linting configuration fileoupala2020-07-021-0/+5
| | | | | | | | | | | | Add a markdown linting configuration file. The configuration file is using [remark-preset-lint-markdown-style-guide](https://github.com/remarkjs/remark-lint/tree/master/packages/remark-preset-lint-markdown-style-guide). This preset configure `remark-lint` with settings that the [Markdown Style Guide](http://www.cirosantilli.com/markdown-style-guide/) recommends. Signed-off-by: oupala <oupala@users.noreply.github.com>
* | Merge pull request #431 from ericgaspar/yunohost-setupDavid Mehren2020-07-101-0/+8
|\ \ | | | | | | Create yunohost.md
| * | Create yunohost.mdericgaspar2020-07-021-0/+8
| |/ | | | | | | | | | | Signed-off-by: ericgaspar <junk.eg@free.fr> Add setup doc about deploying CodiMD with YunoHost.
* | Merge pull request #437 from codimd/enhancement/lang-attr-publishedDavid Mehren2020-07-103-1/+3
|\ \
| * | Fixed meta parsing of lang-attribute for using it in the published-viewErik Michelson2020-07-042-1/+2
| | | | | | | | | | | | Signed-off-by: Erik Michelson <github@erik.michelson.eu>
| * | Added dynamic lang-attr to pretty.ejsErik Michelson2020-07-032-1/+2
| |/ | | | | | | | | | | CodiMD currently only uses the 'lang' attribute in YAML-metadata of a note for setting certain js-elements of the markdown-renderer. This commit adds the chosen lang into the published version of a note. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
* | Merge pull request #439 from codimd/snyk-fix-8abe8148a4aed9acdfa517dfcae7bbd1David Mehren2020-07-102-1/+6
|\ \ | | | | | | [Snyk] Security upgrade lodash from 4.17.15 to 4.17.16
| * | fix: package.json & yarn.lock to reduce vulnerabilitiessnyk-bot2020-07-102-1/+6
|/ / | | | | | | | | The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-LODASH-567746
* | Merge pull request #432 from codimd/docs/fix-yamlDavid Mehren2020-07-021-1/+1
|\ \ | |/ |/| Fix yaml-metadata docs example for lang
| * Fixed yaml-metadata docsErik Michelson2020-07-021-1/+1
|/ | | | | | In the yaml-metadata docs, the example for the 'lang' attribute had an invalid key 'langs'. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
* Upgrade LDAP-auth to fix RCE in ldapauth dependencySheogorath2020-06-271-40/+69
| | | | | | | | | | | | | | | Synk reported an Remote Code Execution vulnerability for the passport-ldapauth dependency `bunyan`. This RCE is due to wrong command sanitizing but doesn't only affects the executable the libary provides. It has no impact on CodiMD. This patch just updates passport-ldapauth since it's long overdue anyway and to silence annoying security scanners that pretend this is rather critical for us. Reference: https://github.com/trentm/node-bunyan/commit/ea21d75f548373f29bb772b15faeb83e87089746 https://app.snyk.io/vuln/SNYK-JS-BUNYAN-573166
* Merge pull request #423 from codimd/SuperSandro2000-patch-1Sheogorath2020-06-261-6/+6
|\ | | | | Fix browser logo links
| * Fix browser logo linksSandro2020-06-261-6/+6
|/ | | | Signed-off-by: Sandro Jäckel <sandro.jaeckel@gmail.com>
* Merge pull request #419 from vberger/masterSheogorath2020-06-235-5/+10
|\ | | | | Backport of #278 for 1.6.1
| * Backport of #278 for 1.6.1Victor Berger2020-06-205-5/+10
|/ | | | | | | This is a backport of #278 with the default value of `scope` changed to `undefined`. This is thus a fully backward-compatible change. Signed-off-by: Victor Berger <victor.berger@m4x.org>
* Merge pull request #398 from gramakri/patch-1Sheogorath2020-06-201-1/+6
|\ | | | | Update Cloudron docs
| * Update Cloudron docsGirish Ramakrishnan2020-06-121-1/+6
| | | | | | | | | | | | Added a link to the demo and source code repo Signed-off-by: Girish Ramakrishnan <girish@cloudron.io>
* | Merge pull request #416 from oupala/patch-2Sheogorath2020-06-201-7/+6
|\ \ | | | | | | fix: outdated internal links in documentation
| * | fix: outdated internal links in documentationoupala2020-06-201-7/+6
|/ / | | | | | | Signed-off-by: oupala <oupala@users.noreply.github.com>
* | Merge pull request #414 from dalcde/configSheogorath2020-06-191-4/+4
|\ \ | | | | | | Fix docs/configuration formatting
| * | Fix docs/configuration formattingDexter Chua2020-06-191-4/+4
|/ / | | | | | | Signed-off-by: Dexter Chua <dalcde@yahoo.com.hk>
* | Merge pull request #404 from oupala/masterSheogorath2020-06-184-456/+268
|\ \ | | | | | | improve documentation about configuration
| * | refactor: move some documentationoupala2020-06-171-4/+4
| | | | | | | | | | | | Signed-off-by: oupala <oupala@users.noreply.github.com>
| * | fix: document CMD_S3_ENDPOINT ENV variableoupala2020-06-171-0/+1
| | | | | | | | | | | | | | | | | | fix #349 Signed-off-by: oupala <oupala@users.noreply.github.com>
| * | refactor: lint markdownoupala2020-06-171-24/+1
| | | | | | | | | | | | Signed-off-by: oupala <oupala@users.noreply.github.com>
| * | doc: merge configuration-config-file.md and configuration-env-vars.md to ↵oupala2020-06-174-456/+290
|/ / | | | | | | | | | | configuration.md Signed-off-by: oupala <oupala@users.noreply.github.com>
* | Merge pull request #400 from david-sawatzke/fix-anonymous-edits-docuSheogorath2020-06-132-2/+2
|\ \ | |/ |/| Fix allow anonymous edit documentation
| * Fix allow anonymous edit documentationDavid Sawatzke2020-06-122-2/+2
|/ | | | | | The default is false and the option only matters if allowAnonymous is true Signed-off-by: David Sawatzke <d-git@sawatzke.dev>
* Relax cookie restrictions to 'lax' to allow frontend to workSheogorath2020-06-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Our frontend requests the `/me` pathname in order to determine whether it's logged in or not. Due to the fact that the sameSite attribute of the session cookie was set to `strict` in a previous commit, the session token was no longer sent along with HTTP calls initiated by JS. This is due to the RFCs definition of "safe" HTTP calls in RFC7231. The bug triggers the UI to show up like an unauthenticated user, even after a successful login. In order to debug it a look into the send cookies to the `/me` turned out to be very enlightening. The fix this patch implements is rather simple, it replaces the sameSite attribute to `lax` which enables the cookies for those requests again. Some older and mobile clients were unaffected by this due to the lack of implementations of sameSite policies. References: https://tools.ietf.org/html/rfc7231#section-4.2.1 https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-05#section-5.3.7.1 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite https://github.com/codimd/server/commit/e77e7b165ac4920290015ec4b95e651730009edc Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Fix broken cookie handling due to missing proxy awarenessSheogorath2020-06-101-0/+7
| | | | | | | | | | | | | | | | | | | We enabled the `secure` flag for various cookies in previous commits. This caused setups behind reverse proxies to drop cookies as the nodejs instance wasn't aware of the fact that it was able to hand out secure commits using an insecure connection (between the codimd instance and the reverse proxy). This patch makes express, the webserver framework we use, aware of proxies and this way re-enabled the handing out of cookies. Not only the cookie monster will enjoy, but also functionality like authentication and real-time editing will return as intended. References: https://www.npmjs.com/package/express-session#cookiesecure https://github.com/codimd/server/commit/383d791a50919bb9890a3f3f797ecc95125ab8bf Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Upgrade pg to fix node version 14 compatibilitySheogorath2020-06-092-23/+23
| | | | | | | | | | | | | | | | As @davidmehren figured out, the problem that NodeJS version 14 gets stuck while CodiMD is starting, was due to the outdated postgres dependency. The old pg version doesn't work with node version 14 due to an undocumented API change in the `readyState` in the socket API. This patch updates the required dependency and this way resolves the issue. Reference: https://github.com/sequelize/sequelize/issues/12158 https://github.com/brianc/node-postgres/commit/149f48232445da0fb3022044e4f1c53509040ad3 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge branch 'fix/sessionCookies'Sheogorath2020-06-081-1/+2
|\
| * Remove unused socket.io cookieSheogorath2020-06-081-1/+1
| | | | | | | | | | | | | | | | | | The socket.io cookie doesn't really have any purpose as it's no longer user in modern socket.io versions. This patch disables it. References: https://github.com/socketio/socket.io/issues/2276 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
| * Ensure session cookies are secureSheogorath2020-06-081-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While HSTS should take care of most of this, setting cookies to be secure, and only applied on same site helps to improve situations where for whatever reason, downgrade attacks are still a thing. This patch adds the `sameSite` and `secure` to the session cookie and this way prevent all accidents where a browser may doesn't support HSTS or HSTS is intentionally dropped. Reference: https://www.npmjs.com/package/express-session#cookiesecure Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge branch 'pr-upstream-389'Sheogorath2020-06-085-14/+27
|\ \ | |/ |/|
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-27 06:12:25 +0000