summaryrefslogtreecommitdiff
path: root/lib (unfollow)
Commit message (Collapse)AuthorFilesLines
2018-07-05Add script src hash for speaker note to CSP directivesMax Wu1-1/+1
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-07-03Fixing content types in status routerSheogorath1-2/+4
As it turns out, expressjs doesn't detect the right mimetype and it seems like I didn't bother to test this enough. So lets fix it for the next release. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-30Update passport-ldapSheogorath1-1/+1
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Final replacementsSheogorath2-2/+2
Looks like I missed a few. This should be complete now. And make us ready for the repo rename and merging. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Do final internal renameingSheogorath3-6/+14
A little minor change, by moving the CodiMD version header in its own middleware. Should simplify to determine the version number of the Backend in future. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Rename HackMD view to CodiMDSheogorath3-3/+3
Even when it looks a bit weird in first place to rename all internals step by step, it makes sense to do so, because we run into confusion afterwards. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Rename environment variables and add legacy support.Sheogorath3-86/+216
As we are no longer HackMD the short tag `HMD` doesn't match anymore. We move it to the matching prefix `CMD` and inform our users about the change. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Rebrand HackMD to CodiMDSheogorath1-1/+1
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Fix breaking regexSheogorath1-1/+1
The image upload regex breaks with the new path for uploads. This commit fixes it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Fix broken images in PDF caused by misconfigred server URLSheogorath1-1/+4
As it turns out, if the serverURL can't be generated correctly, HackMD will use relative paths in image upload. This causes broken links in PDF. With this commit we force absolute links during PDF creation which hopefully fixes the problem. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Fix possible line-ending issues for init noteSheogorath1-1/+3
By uploading a malicous note currently it is possible to prevent this note from being edited. This happens when using Windows line endings. With this commit we remove all `\r` characters from the notes and this way prevent this problem. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-24Move config out of statics pathSheogorath3-0/+19
Since static path is providing with a high expiration data, we provide configs via API. This shouldn't add any noticeable load while making it uncached and this way working again. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-23Allow to disable gravatarSheogorath4-27/+21
Since Gravatar is an external image source and not perfect from a privacy perspective, forbidding it allows to improve privacy. This commit also simplifies and optimizes the avatar code. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-23Fix possible error if HackMD is started with wrong workdirSheogorath3-1/+3
In https://github.com/hackmdio/hackmd/issues/834 is described how starting HackMD crashes when using the wrong working dir. This is caused by a relative path in our upload routine. This change should fix it and prevent future crashes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-05Fix i18n writing locale files in productionSheogorath1-0/+3
This commit should prevent the i18n module from adding missing translations to the local files in setups that are not for development. This way we keep the directory clean and idempotent. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-06-01Fix callback validationAdam Hoka4-4/+7
Signed-off-by: Adam Hoka <hoka.adam@nexogen.hu>
2018-06-01Add Azure Blob Storage supportÁdám Hóka5-3/+49
Signed-off-by: Adam Hoka <hoka.adam@nexogen.hu>
2018-05-26Add note export functionSheogorath1-0/+56
This function is the first step to get out data following GDPR about the transportability of data. Details: https://gdpr-info.eu/art-20-gdpr/ Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-05-25Add token based security featureSheogorath4-12/+52
In the current setup users could be tricked into deleting their data by providing a malicious link like `[click me](/me/delete)`. This commit prevents such an easy attack and need the user's deleteToken to get his data deleted. In case someone requests his deletion by email you can also ask him for this token. We can add a GUI that shows it later on. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-05-25Fix requests for deleted usersSheogorath2-5/+10
When users are requested from the authorship which no longer exist, they shouldn't cause a 500. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-05-25Add delete function for authenticated usersSheogorath1-0/+24
Allow users to delete themselbes. This is require to be GDPR compliant. See: https://gdpr-info.eu/art-17-gdpr/ Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-05-25Use cascaded deletesSheogorath3-4/+12
When we delete a user we should delete all the notes that belong to this user including the revisions of these notes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-05-25Use hard delete instead of soft deleteSheogorath1-1/+1
Right now we only flag notes as deleted. This is no longer allowed under GDPR. Make sure you do regular backups! Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-05-24Add privacy and ToS linksSheogorath1-1/+4
To be GDPR compliant we need to provide privacy statement. These should be linked on the index page. So as soon as a document exist under `public/docs/privacy.md` the link will show up. Since we already add legal links, we also add Terms of Use, which will show up as soon as `public/docs/terms-of-use.md` exists. This should allow everyone to provide the legal documents they need for GDPR and other privacy and business laws. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-05-16Revert "Workaround Google API problems"Christoph (Sheogorath) Kern2-2/+0
2018-04-27Fix typo of "grouptAttribute" in saml auth moduleMax Wu1-2/+2
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-04-17Move letter-avatars into own requestSheogorath3-11/+23
To prevent further weakening of our CSP policies, moving the Avatars into a non-inline version is the way to go. This implementation probably needs some beautification. But already fixes the bug. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-04-13Use API key instead of clientSecretSheogorath2-0/+2
As recently discovered we send the clientSecret to the webclient which is potentionally dangerous. This patch should fix the problem and replace the clientSecret with the originally intended and correct way to implement it using the API key. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-04-10Add check for noteId lengthSheogorath1-0/+9
As we know the length of an UUID we can check if the base64 string of the provided UUID is long enough for a legacy base64 encoded nodeId and stop processing it in legacy mode, if it's not the case. This should make the ugly warning way less common. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-04-10Fix typos for `allowAnonymousEdits`Sheogorath3-4/+4
Looks like we lost some variables during the refactoring of the configs to camel case. This should fix it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-30Fix CSP for disqus and Google AnalyticsSheogorath3-2/+17
This commit should fix existing problems with Disqus and Google Analytics enabled in the meta-yaml section of a note. Before this commit they were blocked by the strict CSP. It's still possible to disable the added directives using `addDisqus` and `addGoogleAnalytics` in the `csp` config section. They are enabled by default to prevent breaking changes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-29Add session data to env varsSheogorath1-0/+2
Currently the session secret can only be set by config.json or docker secrets. This creates a problem on Heroku hosted instances that can not set a session secret. Since we automatically generate them on startup this results in an logout of all users on every config change in Heroku. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-27403: redirect user to login page if not logged inPedro Ferreira1-1/+7
Signed-Off-By: Pedro Ferreira <pedro.ferreira@cern.ch>
2018-03-26Fix logical error in legacy config expressionSheogorath1-2/+2
We should check for an undefined and not just for a logical true or false. Example: When `usecdn` was set to false it was impossible to overwrite the new config value because the if statement becomes false. Thanks @davidmehren for pointing me to this issue. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-26Rename forgotten valuesSheogorath1-4/+4
Looks like we forgot something during the migration. This should fix it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-26Use TEXT instead of STRING for tokensPedro Ferreira2-2/+25
Signed-off-by: Pedro Ferreira <pedro.ferreira@cern.ch>
2018-03-26Add support for generic OAuth2 providersPedro Ferreira6-0/+129
Signed-off-by: Pedro Ferreira <pedro.ferreira@cern.ch>
2018-03-26Automatically generate a session secret if default is usedSheogorath2-0/+10
The session secret is used to sign and authenticate the session cookie and this way very important for the authentication process. By default the session secret is set to `secret` and never changes. This commit will add a generator for a dynamic session secret if it stays unchanged. It prevents session hijacking this way and will warn the user about the missing secret. This also implies that on a restart without configured session secret will log out all users. While it may seems annoying, it's for the users best. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-25Allow embedding of video and audio tagsSheogorath1-0/+1
Adding mediaSrc to CSP so video and audio files can be embedded without problems. From a security perspective it should be fine to load audio and video data without introducing a high security issue. Only from a privacy perspective it allows another way to track users if there are data embedded. But it doesn't introduce any new attack vector as pictures are also allowed from everywhere. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-25Change config to camel case with backwards compatibilitySheogorath25-182/+235
This refactors the configs a bit to now use camel case everywhere. This change should help to clean up the config interface and make it better understandable. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-20Refactoring imageRouter to modularitySheogorath7-132/+190
This should make the imageRouter more modular and easier to extent. Also a lot of code duplication was removed which should simplify maintenance in future. In the new setup we only need to provide a new module file which exports a function called `uploadImage` and takes a filePath and a callback as argument. The callback itself takes an error and an url as parameter. This eliminates the need of a try-catch-block around the statement and re-enabled the optimization in NodeJS. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-18Add check for undefined UUIDSheogorath1-1/+8
This check is needed at there are tons of LDAP implementations out there and none has at least one guaranteed unique field. As we currently check three fields and added an option to select one yourself, it's still not said that any of these fields is set. This will now create an error and fail the authentication instead of letting people may get access to other people's notes which are stored under a this way deterministic wrong userid named `LDAP-undefined`. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-16Add helper function to fix number problemsSheogorath2-3/+10
As minio causes various problem if you configure it using environment variables and leave the port setting out, which will evaluate to NaN, this change should fix this in a clean way for this time and helps to support numbers in general in future. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-15Convert HMD_MINIO_PORT into Number type.vazontang1-1/+1
fix hackmdio/hackmd#763 Signed-off-by: Tang TsungYi <vazontang@gmail.com>
2018-03-14Add config option for report URI in CSPSheogorath3-2/+11
This option is needed as it's currently not possible to add an report URI by the directives array. This option also allows to get CSP reports not only on docker based setup but also on our heroku instances. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-11Fix to log instead of throwing error on parse note idMax Wu1-2/+4
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-03-10Fix parseNoteId order to fix some edge caseMax Wu1-7/+7
that LZString note url could be parsed by base64url note url and thus return wrong note id Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-03-10Improve history migration performanceMax Wu1-11/+5
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-03-09Multiple emails from LDAP are already an ArrayFelix Schäfer1-1/+1
Signed-off-by: Felix Schäfer <felix@thegcat.net>
2018-03-06Add missing migration for permissionsSheogorath1-0/+11
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-01 16:27:11 +0000