summaryrefslogtreecommitdiff
path: root/app.js (unfollow)
Commit message (Collapse)AuthorFilesLines
2020-11-14Replace CodiMD with HedgeDocErik Michelson1-2/+2
Signed-off-by: Erik Michelson <github@erik.michelson.eu> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: References in public/views Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Update links in README Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Update links in SECURITY.md Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Update links in LICENSE Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Update links in docs/configuration.md Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Update links in bin/setup Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: References in docs/guides Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: References in docs/dev Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: References in docs/guides/auth Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: References in docs/setup Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Update various links in code to the new GitHub org. Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: codiMDVersion.js is now hedgeDocVersion.js Signed-off-by: David Mehren <git@herrmehren.de> Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: References in docs/setup/yunohost Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rebrand to HedgeDoc: Add banner and logo Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Update links in docs/guides/migrate-etherpad Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Remove note in docs/guides/auth/github Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Replace links in public/docs/features Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Add todo placeholder in docs/history Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Replace github link in public/views/index/body Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Replace github link in README Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Add logo to README Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Rename to HedgeDoc: Add note about the renaming to the front page Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de> Removed Travis from README.md and change CodiMD to HedgeDoc in some places Signed-off-by: Yannick Bungers <git@innay.de> Some more renaming to HedgeDoc - Fixed capitalization of HedgeDoc - Added renaming for etherpad migration doc Signed-off-by: Yannick Bungers <git@innay.de> Changed Repo name to hedgedoc Signed-off-by: Yannick Bungers <git@innay.de>
2020-11-11Fix deprecation warning of "includeSubDomains"Tilman Vatteroth1-1/+1
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>
2020-09-09Add Malayalam translationSheogorath1-1/+1
This patch adds the Malayalam translation to CodiMD. Do by our awesome translation supporters civic john, Sooraj Kenoth, Nithin Prabhakaran and Jothish. Thank you very much! Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-08-27Add config option for cookie SameSite policyErik Michelson1-1/+1
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2020-06-10Relax cookie restrictions to 'lax' to allow frontend to workSheogorath1-1/+1
Our frontend requests the `/me` pathname in order to determine whether it's logged in or not. Due to the fact that the sameSite attribute of the session cookie was set to `strict` in a previous commit, the session token was no longer sent along with HTTP calls initiated by JS. This is due to the RFCs definition of "safe" HTTP calls in RFC7231. The bug triggers the UI to show up like an unauthenticated user, even after a successful login. In order to debug it a look into the send cookies to the `/me` turned out to be very enlightening. The fix this patch implements is rather simple, it replaces the sameSite attribute to `lax` which enables the cookies for those requests again. Some older and mobile clients were unaffected by this due to the lack of implementations of sameSite policies. References: https://tools.ietf.org/html/rfc7231#section-4.2.1 https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-05#section-5.3.7.1 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite https://github.com/codimd/server/commit/e77e7b165ac4920290015ec4b95e651730009edc Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-06-10Fix broken cookie handling due to missing proxy awarenessSheogorath1-0/+7
We enabled the `secure` flag for various cookies in previous commits. This caused setups behind reverse proxies to drop cookies as the nodejs instance wasn't aware of the fact that it was able to hand out secure commits using an insecure connection (between the codimd instance and the reverse proxy). This patch makes express, the webserver framework we use, aware of proxies and this way re-enabled the handing out of cookies. Not only the cookie monster will enjoy, but also functionality like authentication and real-time editing will return as intended. References: https://www.npmjs.com/package/express-session#cookiesecure https://github.com/codimd/server/commit/383d791a50919bb9890a3f3f797ecc95125ab8bf Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-06-08Remove unused socket.io cookieSheogorath1-1/+1
The socket.io cookie doesn't really have any purpose as it's no longer user in modern socket.io versions. This patch disables it. References: https://github.com/socketio/socket.io/issues/2276 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-06-08Ensure session cookies are secureSheogorath1-1/+3
While HSTS should take care of most of this, setting cookies to be secure, and only applied on same site helps to improve situations where for whatever reason, downgrade attacks are still a thing. This patch adds the `sameSite` and `secure` to the session cookie and this way prevent all accidents where a browser may doesn't support HSTS or HSTS is intentionally dropped. Reference: https://www.npmjs.com/package/express-session#cookiesecure Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-06-08Disable unneeded 'io' cookie.David Mehren1-1/+1
According to https://github.com/socketio/socket.io/issues/2276 this cookie is not used for anything. To avoid browser warnings about the sameSite attribute, we disable it here. Signed-off-by: David Mehren <dmehren1@gmail.com>
2020-06-08Set all cookies with sameSite: strictDavid Mehren1-1/+2
Modern browsers do not support (or will stop supporting) sameSite: none (or no sameSite attribute) without the Secure flag. As we don't want everyone to be able to make requests with our cookies anyway, this commit sets sameSite to strict. See https://developer.mozilla.org/de/docs/Web/HTTP/Headers/Set-Cookie/SameSite Signed-off-by: David Mehren <dmehren1@gmail.com>
2019-10-27Move note actions to their own file.David Mehren1-3/+3
Because of circular import problems, this commit also moves the error messages from response.js to errors.js Signed-off-by: David Mehren <dmehren1@gmail.com>
2019-10-05Slovak localeMartin Turoci1-1/+1
Signed-off-by: Martin Turoci <martinturoci@gmail.com>
2019-10-03Added Czech translationPetrTodorov1-1/+1
Signed-off-by: PetrTodorov <info@petrtodorov.cz>
2019-09-18Fixed #179 (redirect loop with a trailing slash)Erik Michelson1-3/+3
Signed-off-by: Erik Michelson <erik@liltv.de>
2019-08-15Add arabian translationSheogorath1-1/+1
Thanks to our great translators that made it to translate the major parts of CodiMD into Arabic! Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-05-26Add vietnamese languageSheogorath1-1/+1
There was some awesome work by Hồng in the recent days who translated CodiMD completely into Vietnamese language! This patch provides this awesome contributions. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-04-16fix unix socket not removed on shutdown (#50)naimo1-0/+3
* fix unix socket not removed on shutdown Signed-off-by: naimo <nicolas@aimon.fr>
2019-04-04specifying the locale jsons to be in the exact style of poeditor should cut ↵Claudius1-0/+1
down on unneccessary changes ('churn') Signed-off-by: Claudius <opensource@amenthes.de>
2019-03-04Add serbian languageSheogorath1-1/+1
Thanks for the work of the translator Vladan we got a serbian translation added! Those few changes will add serbian language support for future CodiMD releases. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-19Fix wrong maxAgeSeconds multiplicationSheogorath1-1/+1
It seems like the inital work on the hsts module expected milliseconds. This has either changed or was never true. Either way, it caused that the current defaults resulted in theory in a 1000 year HSTS policy. Luckily helmet was smart enough to not go higher than 1 year. Anyway, this patch fixes the multiplication of the configured size with 1000 by removing this multiplication. Also to simplify the reading of the defaults, we split them into their components, 60 times 60 seconds so we get one hour. 24 of those hours so we get a day and finally 365 days to get our original wanted default of one year. Reference: https://github.com/hackmdio/CodiMD/commit/d69d65ea7434eee85db4b905f0852f4d8fa7ecce Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-16Fix streaming for winstonSheogorath1-1/+1
During the upgrade of winston in c3584770f24205d84b9399abd9535cb27dc7b00c a the class extension for streaming was removed. This caused silent crashes. Somehow winston simply called `process.exit(1)` whenever `logger.write()` was called. This is really bad and only easy to debug because of the testing right after upgrading. However, reimplementing the stream interface as it was, didn't work, due to the fact that `logger.write()` is already implemented and causes the mentioned problem. So we extent the object with an `stream` object that implements `write()` for streams and pass that to morgan. So this patch fixes unexpected exiting for streaming towards our logging module. References: https://www.digitalocean.com/community/tutorials/how-to-use-winston-to-log-node-js-applications https://github.com/hackmdio/codimd/commit/c3584770f24205d84b9399abd9535cb27dc7b00c https://stackoverflow.com/a/28824464 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-12Enforce disabled index for static assetsSheogorath1-1/+1
ExpressJS still does allow serving index.html files. This change disables that permanently. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-11Add full version stringSheogorath1-0/+1
Currently we only provide the version from `package.json`. This means that during updates of instances, e.g. the demo instance, which runs latest master instead of a stable release, changes are not reflected to the webclient. This patch adds a fullversion string that contains the current commit and this way makes that clients are notified about changes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-07Fix menu for github and dropboxCédric Couralet1-1/+5
Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
2018-11-07Fix menu when gitlab is enabledCédric Couralet1-0/+1
Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
2018-11-03removing global site layout vars from individual routers, putting them into ↵Claudius1-0/+23
app.local Signed-off-by: Claudius <opensource@amenthes.de>
2018-09-26removing superfluous config parameters for template filesClaudius1-1/+1
Signed-off-by: Claudius <opensource@amenthes.de>
2018-09-26app.js: add missing routes for configurable pathsWilliButz1-0/+3
Signed-off-by: WilliButz <wbutz@cyberfnord.de>
2018-09-23Add indonesian language to CodiMDSheogorath1-1/+1
Big thanks @filosofikode for the translation work! Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-09-18Replace `uws` with `ws` packageSheogorath1-1/+1
`uws` was deprecated by its maintainer and starts to cause more and more problems and issue reports. So it's time to replace it and use a maintained project instead. Lucky us, `uws` and `ws` can be used in an identical way, without problems. To provide better performance, we install the optional packages as well. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-07-27Support 'host' & 'path' config optionsMiranda Kastemaa1-3/+13
Signed-off-by: Miranda Kastemaa <miranda@foldplop.com>
2018-06-24Do final internal renameingSheogorath1-0/+1
A little minor change, by moving the CodiMD version header in its own middleware. Should simplify to determine the version number of the Backend in future. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Rebrand HackMD to CodiMDSheogorath1-1/+1
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Move config out of statics pathSheogorath1-16/+0
Since static path is providing with a high expiration data, we provide configs via API. This shouldn't add any noticeable load while making it uncached and this way working again. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-23Remove unused zh.json from repoSheogorath1-1/+1
Since the original idea of using a symlink didn't work anyway, we should remove the zh.json symlink from the repo. It doesn't provide any benefit but alters the repo on start of HackMD. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-07Add korean translationSheogorath1-1/+1
This translation was contributed via POEditor by the user Basix. Thanks a lot for your work! Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-05Fix i18n writing locale files in productionSheogorath1-1/+2
This commit should prevent the i18n module from adding missing translations to the local files in setups that are not for development. This way we keep the directory clean and idempotent. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-05-16Removing google drive integrationSheogorath1-2/+0
It's sad but it's not working. For multiple releases this should be already broken which shows how often it's used. As there is also a security issue related to that, it's better to remove the feature completely. Whoever wants to rewrite it, feel free to go. This commit removes the Google Drive integration from HackMD's Frontend editor and this way removes the need to provide any API key and Client ID in the frontend. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-05-16Revert "Workaround Google API problems"Christoph (Sheogorath) Kern1-1/+1
2018-04-13Use API key instead of clientSecretSheogorath1-1/+1
As recently discovered we send the clientSecret to the webclient which is potentionally dangerous. This patch should fix the problem and replace the clientSecret with the originally intended and correct way to implement it using the API key. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-25Change config to camel case with backwards compatibilitySheogorath1-17/+17
This refactors the configs a bit to now use camel case everywhere. This change should help to clean up the config interface and make it better understandable. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-02-12Add referrer policySheogorath1-0/+7
This commit adds a referrer policy to all requests. The usage of `same-origin` allows HackMD to still interpret all requests and this way not break anything. But it prevents 3rd party scripts, pictures and more to get informations that may lead to not secured note. It has to be mentioned that this maybe breaks some features of the Google Analytics embedding. This has to be tested. Fixes #724 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-01-20Allow more detailed configuration of upload mime typesSheogorath1-1/+2
Fixes #637 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-01-19Fix not passing app key correctly in dropbox configWu Cheng-Han1-1/+1
2017-10-23support Simplified Chinese and rename original zh to Traditional ChineseRwing1-1/+1
2017-10-22Move CSP logic to new file, Fix boolean config examplesLiterallie1-73/+4
Not sure why I was quoting these in the first place
2017-10-22Add dirty workaround for speakers view inline scriptLiterallie1-0/+4
2017-10-22Allow any connect-src in CSPLiterallie1-1/+1
Managing these for all the integrations seems like a lot of effort
2017-10-22Don't add nonce to CSP if unsafe-inline is onLiterallie1-1/+3
Browsers ignore unsafe-inline if a nonce is sent
2017-10-22Change CSP config format to be more intuitiveLiterallie1-5/+35
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-29 11:14:59 +0000