summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Upgrade base64url packageSheogorath2018-05-171-1/+1
| | | | | | | | | There was recently a possible security problem with base64url. Shouldn't really hit us but it doesn't hurt. Details: https://snyk.io/vuln/npm:base64url:20180511 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge pull request #824 from hackmdio/revert-813-fix/googleAPIChristoph (Sheogorath) Kern2018-05-164-4/+10
|\ | | | | Revert "Workaround Google API problems"
| * Revert "Workaround Google API problems"Christoph (Sheogorath) Kern2018-05-164-4/+10
|/
* Merge pull request #813 from SISheogorath/fix/googleAPIChristoph (Sheogorath) Kern2018-05-104-10/+4
|\ | | | | Workaround Google API problems
| * Remove Google Upload from UISheogorath2018-05-011-9/+1
| | | | | | | | | | | | | | | | | | | | This temporarily removes the Upload from the UI as it's broken right now. Needs a refactoring and can be added in again later on by undoing this commit. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
| * Use API key instead of clientSecretSheogorath2018-04-133-1/+3
| | | | | | | | | | | | | | | | | | As recently discovered we send the clientSecret to the webclient which is potentionally dangerous. This patch should fix the problem and replace the clientSecret with the originally intended and correct way to implement it using the API key. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #811 from hackmdio/fix-saml-typoChristoph (Sheogorath) Kern2018-04-281-2/+2
|\ \ | | | | | | Fix typo of "grouptAttribute" in saml auth module
| * | Fix typo of "grouptAttribute" in saml auth moduleMax Wu2018-04-271-2/+2
|/ / | | | | Signed-off-by: Max Wu <jackymaxj@gmail.com>
* | Merge pull request #803 from SISheogorath/fix/letterAvatarCSPChristoph (Sheogorath) Kern2018-04-173-11/+23
|\ \ | | | | | | Move letter-avatars into own request
| * | Move letter-avatars into own requestSheogorath2018-04-173-11/+23
| |/ | | | | | | | | | | | | | | | | | | To prevent further weakening of our CSP policies, moving the Avatars into a non-inline version is the way to go. This implementation probably needs some beautification. But already fixes the bug. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Update yarn.lockSheogorath2018-04-171-1/+1
| | | | | | | | Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #805 from SISheogorath/fix/noFileChristoph (Sheogorath) Kern2018-04-173-2/+7
|\ \ | | | | | | Fix possible file limit errors
| * | Fix possible file limit errorsSheogorath2018-04-163-2/+7
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | As we currently may need higher nofile limits than usual/default on various systems this commit should probide a fix for that an allow to build HackMD without highering these limits and increase security. Inspiration was found in a copy-webpack-plugin-issue[1] and found by @thegcat[2]. Thanks for that! Signed-off-by: Sheogorath <sheogorath@shivering-isles.com> [1]: https://github.com/webpack-contrib/copy-webpack-plugin/issues/59#issuecomment-228563990 [2]: https://github.com/thegcat
* | Add config.json.example to npm testSheogorath2018-04-141-1/+1
| | | | | | | | | | | | | | | | | | | | This commit extends the find command to also match the example config file. This should validate the syntax or this file to prevent syntax errors for future pull request. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Fix example configSheogorath2018-04-141-2/+2
| | | | | | | | | | | | | | | | | | This commit fixes some json fromat issues in our config example that causes errors on setup. This change should fix it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #797 from SISheogorath/fix/LZErrorLogChristoph (Sheogorath) Kern2018-04-111-0/+9
|\ \ | | | | | | Add check for noteId length
| * | Add check for noteId lengthSheogorath2018-04-101-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As we know the length of an UUID we can check if the base64 string of the provided UUID is long enough for a legacy base64 encoded nodeId and stop processing it in legacy mode, if it's not the case. This should make the ugly warning way less common. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | | Merge pull request #799 from SISheogorath/fix/AnonymousEditTyposChristoph (Sheogorath) Kern2018-04-113-4/+4
|\ \ \ | |_|/ |/| | Fix typos for `allowAnonymousEdits`
| * | Fix typos for `allowAnonymousEdits`Sheogorath2018-04-103-4/+4
| |/ | | | | | | | | | | | | | | | | Looks like we lost some variables during the refactoring of the configs to camel case. This should fix it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* / Extend READMESheogorath2018-04-111-0/+4
|/ | | | | | | Add hint about file descriptor limits and add the new translation platform. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Release 1.1.0-ceSheogorath2018-04-061-1/+1
| | | | Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge branch 'feature/releaseNotes1.1.0'Sheogorath2018-04-062-12/+83
|\
| * Minor fixes in relase notesSheogorath2018-04-061-9/+10
| | | | | | | | | | | | | | Fix some spelling and style issues as well as adding the latest changes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
| * Add migration section to README.mdSheogorath2018-04-061-2/+9
| | | | | | | | | | | | | | As it was requested to be more visable, this commit adds a migration section about the introduced config style changes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
| * Update release notesSheogorath2018-03-301-10/+73
| | | | | | | | | | | | Providing release notes for version 1.1.0-ce Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge branch 'docs/features-1.1.0-ce'Sheogorath2018-04-061-3/+8
|\ \
| * | Provide feature changes in 1.1.0-ceSheogorath2018-03-301-3/+8
| |/ | | | | | | | | | | | | Adding some documentation for night mode and upload times. Extend the contact section for community support. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #796 from SISheogorath/feature/addMatrixChristoph (Sheogorath) Kern2018-04-065-5/+7
|\ \ | | | | | | Add matrix.org / Riot link
| * | Add matrix.org / Riot linkSheogorath2018-04-055-5/+7
|/ / | | | | | | | | | | | | | | | | | | | | | | | | As an active part of the community prefers Matrix.org over Gitter, we should link Matrix.org as a place to meet us. As the matrix and gitter channels are interconnected. We don't loose any message if a person decides to go for one or another. We use an more universal way of translation to make it easier to provide a link to various platforms. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #790 from SISheogorath/fix/nightModeCSSChristoph (Sheogorath) Kern2018-04-052-2/+21
|\ \ | | | | | | Fix modal and panel colors in night mode
| * | Fix code blocks color in night modeSheogorath2018-04-051-0/+5
| | | | | | | | | | | | | | | | | | This provides more eye-friendly code boxes when night mode is active. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
| * | Fix modal and panel colors in night modeSheogorath2018-03-291-2/+16
| |/ | | | | | | | | | | | | | | Night mode provides a generally, dark interface. This fix provides the needed CSS to also turn modal and panels into night mode design as well. This mainly effects the help modal. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #791 from SISheogorath/fix/extendedCSPPoliciesChristoph (Sheogorath) Kern2018-04-056-9/+25
|\ \ | | | | | | Fix CSP for disqus and Google Analytics
| * | Fix CSP for disqus and Google AnalyticsSheogorath2018-03-306-9/+25
| |/ | | | | | | | | | | | | | | | | | | | | | | | | This commit should fix existing problems with Disqus and Google Analytics enabled in the meta-yaml section of a note. Before this commit they were blocked by the strict CSP. It's still possible to disable the added directives using `addDisqus` and `addGoogleAnalytics` in the `csp` config section. They are enabled by default to prevent breaking changes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #789 from SISheogorath/fix/sessionSecretEnvChristoph (Sheogorath) Kern2018-03-293-0/+8
|\ \ | |/ |/| Add session data to env vars
| * Add session data to env varsSheogorath2018-03-293-0/+8
|/ | | | | | | | | | | Currently the session secret can only be set by config.json or docker secrets. This creates a problem on Heroku hosted instances that can not set a session secret. Since we automatically generate them on startup this results in an logout of all users on every config change in Heroku. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge pull request #780 from SISheogorath/fix/sessionSecretChristoph (Sheogorath) Kern2018-03-282-0/+10
|\ | | | | Automatically generate a session secret if default is used
| * Automatically generate a session secret if default is usedSheogorath2018-03-262-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The session secret is used to sign and authenticate the session cookie and this way very important for the authentication process. By default the session secret is set to `secret` and never changes. This commit will add a generator for a dynamic session secret if it stays unchanged. It prevents session hijacking this way and will warn the user about the missing secret. This also implies that on a restart without configured session secret will log out all users. While it may seems annoying, it's for the users best. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #786 from SISheogorath/fix/compatiblityConfigChristoph (Sheogorath) Kern2018-03-272-6/+6
|\ \ | | | | | | Fix some issues with legacy config compatiblity
| * | Fix logical error in legacy config expressionSheogorath2018-03-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We should check for an undefined and not just for a logical true or false. Example: When `usecdn` was set to false it was impossible to overwrite the new config value because the if statement becomes false. Thanks @davidmehren for pointing me to this issue. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
| * | Rename forgotten valuesSheogorath2018-03-261-4/+4
| | | | | | | | | | | | | | | | | | Looks like we forgot something during the migration. This should fix it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | | Merge pull request #788 from mcnesium/docs/gitlabChristoph (Sheogorath) Kern2018-03-274-0/+29
|\ \ \ | | | | | | | | Add documentation for setting up authentication with a self-hosted GitLab
| * | | Add documentation for setting up authentication with a self-hosted GitLabmcnesium2018-03-274-0/+29
|/ / / | | | | | | | | | Signed-off-by: mcnesium <git@mcnesium.com>
* | | Merge pull request #779 from SISheogorath/fix/cspForVideoChristoph (Sheogorath) Kern2018-03-261-0/+1
|\ \ \ | |/ / |/| | Allow embedding of video and audio tags
| * | Allow embedding of video and audio tagsSheogorath2018-03-251-0/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | | | Adding mediaSrc to CSP so video and audio files can be embedded without problems. From a security perspective it should be fine to load audio and video data without introducing a high security issue. Only from a privacy perspective it allows another way to track users if there are data embedded. But it doesn't introduce any new attack vector as pictures are also allowed from everywhere. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #778 from SISheogorath/fix/nightModeToggleChristoph (Sheogorath) Kern2018-03-261-0/+1
|\ \ | |/ |/| Fix night mode button after restore
| * Fix night mode button after restoreSheogorath2018-03-251-0/+1
|/ | | | | | | | | | | The night mode toggle doesn't get the right state after restore from local storage. This results in the need to toggle twice to disable night mode. This patch adds the needed class so the toggleNightMode function gets the right state on execution. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge pull request #758 from SISheogorath/cleanup/configChristoph (Sheogorath) Kern2018-03-2529-238/+291
|\ | | | | Change config to camel case with backwards compatibility
| * Change config to camel case with backwards compatibilitySheogorath2018-03-2529-238/+291
| | | | | | | | | | | | | | | | This refactors the configs a bit to now use camel case everywhere. This change should help to clean up the config interface and make it better understandable. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #775 from SISheogorath/feature/nightModeChristoph (Sheogorath) Kern2018-03-241-3/+18
|\ \ | |/ |/| Persist nightmode so we can re-enable it on reload
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-27 06:14:50 +0000