summaryrefslogtreecommitdiff
path: root/lib (unfollow)
Commit message (Collapse)AuthorFilesLines
2018-04-10Fix typos for `allowAnonymousEdits`Sheogorath3-4/+4
Looks like we lost some variables during the refactoring of the configs to camel case. This should fix it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-30Fix CSP for disqus and Google AnalyticsSheogorath3-2/+17
This commit should fix existing problems with Disqus and Google Analytics enabled in the meta-yaml section of a note. Before this commit they were blocked by the strict CSP. It's still possible to disable the added directives using `addDisqus` and `addGoogleAnalytics` in the `csp` config section. They are enabled by default to prevent breaking changes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-29Add session data to env varsSheogorath1-0/+2
Currently the session secret can only be set by config.json or docker secrets. This creates a problem on Heroku hosted instances that can not set a session secret. Since we automatically generate them on startup this results in an logout of all users on every config change in Heroku. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-26Fix logical error in legacy config expressionSheogorath1-2/+2
We should check for an undefined and not just for a logical true or false. Example: When `usecdn` was set to false it was impossible to overwrite the new config value because the if statement becomes false. Thanks @davidmehren for pointing me to this issue. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-26Rename forgotten valuesSheogorath1-4/+4
Looks like we forgot something during the migration. This should fix it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-26Automatically generate a session secret if default is usedSheogorath2-0/+10
The session secret is used to sign and authenticate the session cookie and this way very important for the authentication process. By default the session secret is set to `secret` and never changes. This commit will add a generator for a dynamic session secret if it stays unchanged. It prevents session hijacking this way and will warn the user about the missing secret. This also implies that on a restart without configured session secret will log out all users. While it may seems annoying, it's for the users best. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-25Allow embedding of video and audio tagsSheogorath1-0/+1
Adding mediaSrc to CSP so video and audio files can be embedded without problems. From a security perspective it should be fine to load audio and video data without introducing a high security issue. Only from a privacy perspective it allows another way to track users if there are data embedded. But it doesn't introduce any new attack vector as pictures are also allowed from everywhere. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-25Change config to camel case with backwards compatibilitySheogorath25-182/+235
This refactors the configs a bit to now use camel case everywhere. This change should help to clean up the config interface and make it better understandable. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-20Refactoring imageRouter to modularitySheogorath7-132/+190
This should make the imageRouter more modular and easier to extent. Also a lot of code duplication was removed which should simplify maintenance in future. In the new setup we only need to provide a new module file which exports a function called `uploadImage` and takes a filePath and a callback as argument. The callback itself takes an error and an url as parameter. This eliminates the need of a try-catch-block around the statement and re-enabled the optimization in NodeJS. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-18Add check for undefined UUIDSheogorath1-1/+8
This check is needed at there are tons of LDAP implementations out there and none has at least one guaranteed unique field. As we currently check three fields and added an option to select one yourself, it's still not said that any of these fields is set. This will now create an error and fail the authentication instead of letting people may get access to other people's notes which are stored under a this way deterministic wrong userid named `LDAP-undefined`. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-16Add helper function to fix number problemsSheogorath2-3/+10
As minio causes various problem if you configure it using environment variables and leave the port setting out, which will evaluate to NaN, this change should fix this in a clean way for this time and helps to support numbers in general in future. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-15Convert HMD_MINIO_PORT into Number type.vazontang1-1/+1
fix hackmdio/hackmd#763 Signed-off-by: Tang TsungYi <vazontang@gmail.com>
2018-03-14Add config option for report URI in CSPSheogorath3-2/+11
This option is needed as it's currently not possible to add an report URI by the directives array. This option also allows to get CSP reports not only on docker based setup but also on our heroku instances. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-11Fix to log instead of throwing error on parse note idMax Wu1-2/+4
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-03-10Fix parseNoteId order to fix some edge caseMax Wu1-7/+7
that LZString note url could be parsed by base64url note url and thus return wrong note id Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-03-10Improve history migration performanceMax Wu1-11/+5
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-03-09Multiple emails from LDAP are already an ArrayFelix Schäfer1-1/+1
Signed-off-by: Felix Schäfer <felix@thegcat.net>
2018-03-06Add missing migration for permissionsSheogorath1-0/+11
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-03-05Remove unused LDAP option `tokenSecret`Felix Schäfer2-2/+0
hackmdio/hackmd#754 Signed-off-by: Felix Schäfer <felix@thegcat.net>
2018-03-01Introduce ldap.useridFieldDustin Frisch3-1/+6
Signed-off-by: Dustin Frisch <fooker@lab.sh>
2018-02-27Update to use buffer in encode/decode note idMax Wu1-2/+4
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-02-26Add migration for LZString compressed note id in historyMax Wu1-1/+21
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-02-26Remove and replace all note id compression in LZString with base64urlMax Wu3-8/+33
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-02-17Fix to show 500 message when got error in parseNoteIdMax Wu1-1/+2
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-02-09Fix field type to prevent data truncation of authorship (#721)Max Wu3-2/+15
* Fix field type to prevent data truncation of authorship
2018-02-08Fix typo of DB migration scriptTakeaki Matsumoto1-2/+2
Signed-off-by: Takeaki Matsumoto <takeaki.matsumoto@ntt.com>
2018-02-05don't require referer to find note id in socket.io connections (fixes #623)Stefan Bühler1-6/+14
Signed-off-by: Stefan Bühler <buehler@cert.uni-stuttgart.de>
2018-01-30Fix uncaught exception for non-existent userSheogorath1-0/+5
Since we added user management it's possible to get non-existent users which can cause a crash of the Backend server. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-01-27Remove camel case from `imageuploadtype` in configSheogorath4-6/+14
This removes the only camel cased option of the config options **we** added to the config.json. In auth provider's config parts are a lot of camel cased options provided. We shouldn't touch them to keep them as similar as possible to the examples. Fixes #315 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-01-26Fix ldap provider name in templateSheogorath1-0/+2
Before this fix it's impossible to set the provider name in the sign-model since `ldap` is a boolean there and this way not able to have an attribute like `ldap.providerName`. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-01-23Fix broken port configSheogorath1-1/+1
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-01-20Allow more detailed configuration of upload mime typesSheogorath1-0/+20
Fixes #637 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-01-20Add option to enable `freely` permission in closed instanceDario Ernst5-2/+6
Before, closed disallowed guest edits completely, by removing the `freely` permission. This makes it possible to explicitely bring back guest-editing, but not guest-note-creation, to closed instances. Signed-off-by: Dario Ernst <dario@kanojo.de>
2018-01-19Load version from package.jsonSheogorath1-1/+3
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-01-19Fix not passing app key correctly in dropbox configWu Cheng-Han3-3/+6
2018-01-18Release 1.0.0-ceSheogorath1-1/+1
2018-01-18Ignore empty values for revision.Sheogorath1-2/+2
Fixes #420
2018-01-18Allow posting new note with contentDustin Frisch3-1/+13
Signed-off-by: Dustin Frisch <fooker@lab.sh>
2018-01-16Fix minor typosMax Wu1-3/+3
of wrong parameters passing order and wrong user object indexing in for each function
2017-12-22Update index.jsChristoph (Sheogorath) Kern1-1/+1
2017-12-22Simplify loopChristoph (Sheogorath) Kern1-8/+3
2017-12-14Fix file permission, remove useless executablePeter Dave Hello1-0/+0
2017-12-09parse HMD_LDAP_SEARCHATTRIBUTES env var as a comma-separated arrayalecdwm2-5/+12
Signed-off-by: Alec WM <firstcontact@owls.io>
2017-12-09Add setting `ldap.usernameField`Lukas Kalbertodt3-1/+9
This determines which ldap field is used as the username on HackMD. By default, the "id" is used as username, too. The id is taken from the fields `uidNumber`, `uid` or `sAMAccountName`. To give the user more flexibility, they can now choose the field used for the username instead.
2017-12-05fixed sslcapath bugLaysDragon2-2/+10
2017-12-04added guide for SAML settingsNorihito Nakae3-3/+0
2017-11-29added environment variables for SAMLNorihito Nakae1-1/+12
2017-11-29fixed the SAML callback URL to unconfigurable.Norihito Nakae2-2/+1
2017-11-28Initial support for SAML authenticationNorihito Nakae7-0/+129
2017-10-31Fix mattermost breaking notesSheogorath1-0/+1
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-03 16:54:16 +0000