summaryrefslogtreecommitdiff
path: root/lib/config/default.js (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add config option for cookie SameSite policyErik Michelson2020-08-271-0/+1
| | | | Signed-off-by: Erik Michelson <github@erik.michelson.eu>
* allow to set a saml client certificateSimeon Keske2020-07-111-0/+1
| | | | Signed-off-by: Simeon Keske <git@n0emis.eu>
* Backport of #278 for 1.6.1Victor Berger2020-06-201-1/+2
| | | | | | | This is a backport of #278 with the default value of `scope` changed to `undefined`. This is thus a fully backward-compatible change. Signed-off-by: Victor Berger <victor.berger@m4x.org>
* Update CDN defaultsSheogorath2020-02-091-1/+1
| | | | | | | | | | | | | | | | | | As we noticed in our poll about CDN usage, that most people intentionally turn it off, but very little intetionally turn it on or leave it on. [1] There is also strong indicators that CDNs don't really provide any benefits in loading time and due to the small deployments of CodiMD, there is no big savings due to CDNs either. [2] Therefore this patch changes the CDN default settings to off in order to reduce the exposed user data. [1]: https://community.codimd.org/t/poll-on-cdn-usage/28 [2]: https://csswizardry.com/2019/05/self-host-your-static-assets/ Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Add Google oauth variable: hostedDomainike2020-02-081-1/+2
| | | | | | | | Which is part of `passport-google-oauth2`. It could be used as whitelist to a domain supported by google oauth. Ref: https://github.com/jaredhanson/passport-google-oauth2/issues/3 Signed-off-by: ike <developer@ikewat.com>
* document `linkifyHeaderStyle` in default.jshoijui2019-10-301-0/+13
| | | | Signed-off-by: hoijui <hoijui.quaero@gmail.com>
* Allow to generate lower case header references through the confighoijui2019-10-221-1/+2
| | | | | | | | | | | | | This makes the references consistent/compatible with GitHub, GitLab, Pandoc and many other tools. This behavior can be enabled in config.json with: ``` "linkifyHeaderStyle": "gfm" ``` Signed-off-by: hoijui <hoijui.quaero@gmail.com>
* Updated forbiddenNoteIDsErik Michelson2019-09-181-1/+1
| | | | Signed-off-by: Erik Michelson <erik@liltv.de>
* Add config for toobusy middlewareSheogorath2019-05-251-0/+2
| | | | | | | | | | With very low CPU frequency or bad IO situation, as well as not-loaded JS CodiMD happens to present unneeded "I'm busy"-messages to users. This patch allows to configure the lag. The default is taken from the libray but set in our own default configs. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Add lutim supportDylan Dervaux2019-04-101-1/+4
| | | | Signed-off-by: Dylan Dervaux <dylanderv05@gmail.com>
* Added a configuration option for passport-saml:Emmanuel Ormancey2019-04-061-0/+1
| | | | | | | | | | | disableRequestedAuthnContext: true|false By default only Password authmethod is accepted, this option allows any other method. Issue and option described here: https://github.com/bergie/passport-saml/issues/226 Signed-off-by: Emmanuel Ormancey <emmanuel.ormancey@cern.ch>
* Disable OpenID by defaultSheogorath2019-01-251-1/+1
| | | | | | | | | We talked about that during a community call. It turned out that not everyone likes to have OpenID on their instance. This patch disables OpenID by default. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Fix wrong maxAgeSeconds multiplicationSheogorath2018-11-191-1/+1
| | | | | | | | | | | | | | | | | | | It seems like the inital work on the hsts module expected milliseconds. This has either changed or was never true. Either way, it caused that the current defaults resulted in theory in a 1000 year HSTS policy. Luckily helmet was smart enough to not go higher than 1 year. Anyway, this patch fixes the multiplication of the configured size with 1000 by removing this multiplication. Also to simplify the reading of the defaults, we split them into their components, 60 times 60 seconds so we get one hour. 24 of those hours so we get a day and finally 365 days to get our original wanted default of one year. Reference: https://github.com/hackmdio/CodiMD/commit/d69d65ea7434eee85db4b905f0852f4d8fa7ecce Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge pull request #1053 from dsprenkels/robots.txtChristoph (Sheogorath) Kern2018-11-171-0/+1
|\ | | | | Disallow creation of robots.txt in freeurl
| * Disallow creation of robots.txt in freeurlDaan Sprenkels2018-11-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | Add a configuration setting to "hard"-disable creation of notes as set by the configuration value. This defaults to `['robots.txt', 'favicon.ico']`, because these files are often accidentally created by bots and browsers. This commit fixes #1052. Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>
* | Upgrade winstonSheogorath2018-11-141-0/+1
|/ | | | | | | | | Our log library got a new major version which should be implemented. That's exactly what this patch does. Implementing the new version of the logging library. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Use OS based tmp dirSheogorath2018-10-311-1/+3
| | | | | | | | | | We should use the official OS temp directory instead of an own one, to not run into conflicts. Also various dependencies already use the OS temp directory, which makes it pointless to use a different for our internal purposes then. This commit provides the changes needed to use the OS tmp directory by default. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge pull request #990 from SISheogorath/fix/oauthProviderNameChristoph (Sheogorath) Kern2018-10-091-0/+1
|\ | | | | Make oauth2 provider name accessible
| * Make oauth2 provider name accessibleSheogorath2018-10-041-0/+1
| | | | | | | | | | | | | | | | | | Right now the feature exists but is almost not usable since the only way to configure it is to know that it exists from reading the source code and add it to config.json. This patch provides all needed changes so it can be used by everyone including documentation. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Add OpenID to CodiMDSheogorath2018-10-051-1/+2
| | | | | | | | | | | | | | | | With OpenID every OpenID capable provider can provide authentication for users of a CodiMD instance. This means we have federated authentication. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Merge pull request #940 from WilliButz/fix-configurable-pathsChristoph (Sheogorath) Kern2018-10-051-6/+1
|\ \ | |/ |/| enhance configurabiltiy of paths & make execution path-independent
| * removing superfluous config parameters for template filesClaudius2018-09-261-6/+1
| | | | | | | | Signed-off-by: Claudius <opensource@amenthes.de>
* | Set default to `v4`Sheogorath2018-09-271-1/+2
|/ | | | | | | Seems like we didn't fix the problem with the last patch. This should finally fix it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Support 'host' & 'path' config optionsMiranda Kastemaa2018-07-271-0/+1
| | | | Signed-off-by: Miranda Kastemaa <miranda@foldplop.com>
* Rename HackMD view to CodiMDSheogorath2018-06-241-1/+1
| | | | | | | | Even when it looks a bit weird in first place to rename all internals step by step, it makes sense to do so, because we run into confusion afterwards. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge pull request #854 from hackmdio/feature/disableGravatarChristoph (Sheogorath) Kern2018-06-241-0/+1
|\ | | | | Allow to disable gravatar
| * Allow to disable gravatarSheogorath2018-06-231-0/+1
| | | | | | | | | | | | | | | | | | Since Gravatar is an external image source and not perfect from a privacy perspective, forbidding it allows to improve privacy. This commit also simplifies and optimizes the avatar code. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Move config out of statics pathSheogorath2018-06-241-0/+1
|/ | | | | | | | Since static path is providing with a high expiration data, we provide configs via API. This shouldn't add any noticeable load while making it uncached and this way working again. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Fix possible error if HackMD is started with wrong workdirSheogorath2018-06-231-0/+1
| | | | | | | | | | In https://github.com/hackmdio/hackmd/issues/834 is described how starting HackMD crashes when using the wrong working dir. This is caused by a relative path in our upload routine. This change should fix it and prevent future crashes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge pull request #784 from pferreir/add-oauth2-supportChristoph (Sheogorath) Kern2018-06-041-0/+6
|\ | | | | Add "generic" OAuth2 support
| * Add support for generic OAuth2 providersPedro Ferreira2018-03-261-0/+6
| | | | | | | | Signed-off-by: Pedro Ferreira <pedro.ferreira@cern.ch>
* | Add Azure Blob Storage supportÁdám Hóka2018-06-011-1/+5
| | | | | | | | Signed-off-by: Adam Hoka <hoka.adam@nexogen.hu>
* | Revert "Workaround Google API problems"Christoph (Sheogorath) Kern2018-05-161-1/+0
| |
* | Use API key instead of clientSecretSheogorath2018-04-131-0/+1
| | | | | | | | | | | | | | | | | | As recently discovered we send the clientSecret to the webclient which is potentionally dangerous. This patch should fix the problem and replace the clientSecret with the originally intended and correct way to implement it using the API key. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Fix CSP for disqus and Google AnalyticsSheogorath2018-03-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | This commit should fix existing problems with Disqus and Google Analytics enabled in the meta-yaml section of a note. Before this commit they were blocked by the strict CSP. It's still possible to disable the added directives using `addDisqus` and `addGoogleAnalytics` in the `csp` config section. They are enabled by default to prevent breaking changes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* | Automatically generate a session secret if default is usedSheogorath2018-03-261-0/+1
|/ | | | | | | | | | | | | | | | | | The session secret is used to sign and authenticate the session cookie and this way very important for the authentication process. By default the session secret is set to `secret` and never changes. This commit will add a generator for a dynamic session secret if it stays unchanged. It prevents session hijacking this way and will warn the user about the missing secret. This also implies that on a restart without configured session secret will log out all users. While it may seems annoying, it's for the users best. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Change config to camel case with backwards compatibilitySheogorath2018-03-251-35/+33
| | | | | | | | This refactors the configs a bit to now use camel case everywhere. This change should help to clean up the config interface and make it better understandable. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Add config option for report URI in CSPSheogorath2018-03-141-1/+2
| | | | | | | | This option is needed as it's currently not possible to add an report URI by the directives array. This option also allows to get CSP reports not only on docker based setup but also on our heroku instances. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Remove unused LDAP option `tokenSecret`Felix Schäfer2018-03-051-1/+0
| | | | | | hackmdio/hackmd#754 Signed-off-by: Felix Schäfer <felix@thegcat.net>
* Introduce ldap.useridFieldDustin Frisch2018-03-011-0/+1
| | | | Signed-off-by: Dustin Frisch <fooker@lab.sh>
* Remove camel case from `imageuploadtype` in configSheogorath2018-01-271-1/+3
| | | | | | | | | | | | | This removes the only camel cased option of the config options **we** added to the config.json. In auth provider's config parts are a lot of camel cased options provided. We shouldn't touch them to keep them as similar as possible to the examples. Fixes #315 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
* Merge pull request #506 from erasys/minioChristoph (Sheogorath) Kern2018-01-231-0/+7
|\ | | | | Add support for minio
| * Add support for minioMarc Deop2017-08-301-0/+7
| |
* | Merge pull request #598 from xxyy/feature/cspChristoph (Sheogorath) Kern2018-01-221-0/+7
|\ \ | | | | | | Implement basic CSP support
| * | Change CSP config format to be more intuitiveLiterallie2017-10-221-9/+1
| | |
| * | CSP: Allow more content typesLiterallie2017-10-221-3/+7
| | |
| * | CSP: Upgrade insecure requests if possibleLiterallie2017-10-221-2/+3
| | | | | | | | | | | | Config option; default is to only upgrade if usessl
| * | Add basic CSP supportLiterallie2017-10-221-0/+10
| | |
* | | Add option to enable `freely` permission in closed instanceDario Ernst2018-01-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Before, closed disallowed guest edits completely, by removing the `freely` permission. This makes it possible to explicitely bring back guest-editing, but not guest-note-creation, to closed instances. Signed-off-by: Dario Ernst <dario@kanojo.de>
* | | Fix not passing app key correctly in dropbox configWu Cheng-Han2018-01-191-1/+2
| | |
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-16 22:57:26 +0000