summaryrefslogtreecommitdiff
path: root/lib (unfollow)
Commit message (Collapse)AuthorFilesLines
2019-05-13polyfilling scrypt for node 8.5+Claudius1-4/+13
Signed-off-by: Claudius <opensource@amenthes.de>
2019-05-13asyncified setting and verifying the passwordClaudius2-11/+15
Signed-off-by: Claudius <opensource@amenthes.de>
2019-05-13getting password hashing into a hook where it could be asyncClaudius1-6/+14
Signed-off-by: Claudius <opensource@amenthes.de>
2019-04-10Add lutim supportDylan Dervaux4-3/+40
Signed-off-by: Dylan Dervaux <dylanderv05@gmail.com>
2019-04-06Added a configuration option for passport-saml:Emmanuel Ormancey4-1/+5
disableRequestedAuthnContext: true|false By default only Password authmethod is accepted, this option allows any other method. Issue and option described here: https://github.com/bergie/passport-saml/issues/226 Signed-off-by: Emmanuel Ormancey <emmanuel.ormancey@cern.ch>
2019-04-06Hide port from minio URL for protocol default portThor771-1/+3
Signed-off-by: Thor77 <thor77@thor77.org>
2019-04-05change default mode to "both" when clicking editStéphane Guillou1-2/+2
Add "both" mode to URLs because I assume most people want to straight away see the code when they click the "edit" button in a published note. Fixes https://github.com/codimd/server/issues/27 Not tested, followed instructions from @ccoenen , please do review! :) Signed-off-by: Stéphane Guillou <stephane.guillou@member.fsf.org>
2019-03-27Update links to new repositoriesSheogorath1-1/+1
After a long discussion, it turned out that CodiMD as community project and HackMD as a company, have fundamental different views on the project governance. Due to this, it came to point where the decision for a fork was made. After the fork and move towards an own organisation, this patch updates all links inside the project to the new repositories. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-03-17Use libravatar as drop-in replacement for gravatarSheogorath1-1/+1
Since libravatar got a default fallback to Gravatar and in generell allows federated image hosting for avatars this shouldn't break any existing implementations. The federation functionality is not added yet. This would require to use the libravatar library. Details: https://wiki.libravatar.org/api/ Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-03-09Add required change for Google+ API deprecationSheogorath1-1/+2
Since Google+ is shutting down soon, we need to get the profile data from another URL. Since the library already supports it, all we need to do is adding a single line of code. Details: https://github.com/hackmdio/codimd/issues/1160 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-03-05Fix shown but broken GitLab snippetsSheogorath1-1/+1
To provide a GitLab integration we need the GitLab integration to be configured. Otherwise we shouldn't show the Snippet button. This patch adds the requirement to the variable that decides if the import from snippets button shows up or not. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-03-04Fix wrong value type for HSTS environment variableSheogorath2-2/+2
Seem like also environment variables are affected. This patch fixes that as well. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-03-04Fix empty serverURL did not redirect properlytoshi01231-1/+1
Signed-off-by: toshi0123 <7948737+toshi0123@users.noreply.github.com>
2019-03-03Fix names with spaces in letter-avatarsSheogorath1-0/+1
Seems like there is a possible problem when a name containing a space is passed to this function. using urlencode on the name should fix possible problems here. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-01-25Disable OpenID by defaultSheogorath1-1/+1
We talked about that during a community call. It turned out that not everyone likes to have OpenID on their instance. This patch disables OpenID by default. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-01-24Fix broken PDF export by wrong unlink callSheogorath1-1/+1
We used `fs.unlink()` to remove the pdf file after we send it out to the client. This breaks in Node 10, when no function as second parameter is supplied. This patches changes it to the `fs.unlinkSync` function that doesn't have this requirement and this way doesn't crash. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-12-22Remove blueimp-md5 dependencyDaan Sprenkels1-3/+7
Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>
2018-12-21Update upload provider error messageDaan Sprenkels1-1/+1
Fixes #1107. Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>
2018-12-20Fix broken Gist embeddingSheogorath1-1/+1
Looks like GitHub changed their asset system and our CSP prevented them from getting loaded. This patch should fix the Gist embedding with enabled CSP by replacing the old URL `https://assets-cdn.github.com` with the new `https://github.githubassets.com`. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-12-18Fix usage of new URL APISheogorath1-2/+2
Due to the deprecation of the old `url`-API provided by NodeJS we replaced `url.resolve` with `url.URL.resolve`, which doesn't exist. This patch fixes the local filesystem upload of CodiMD by using the new API correctly. Creating an URL object and using its href. Some more background: https://nodejs.org/api/url.html#url_url_href https://nodejs.org/api/url.html#url_url_resolve_from_to Fixes https://github.com/hackmdio/codimd/issues/1102 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-12-05Fix disqus CSPSheogorath1-1/+1
Disqus loads it's embed config.js from its root domain (https://disqus.com). Our CSPs only allow subdomains (e.g.: https://codimd.disqus.com). This causes the disqus embedding to fail. This patch should fix this problem by adding https://disqus.com to the CSP setting. From a security perspective there is no real change. Since still the same parties are involved. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-12-05Fix CSP for speaker notesSheogorath1-1/+1
Looks like I was wrong in my previous commit to update revealjs.[1] The speaker notes broke again with the CSPs. So this patch updates the hash and this way the speaker notes. [1]: bcebf1e8d285184f8c905f00e0270621790e7b80 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-28Warn on missing serverURLSheogorath1-0/+4
We see some issues that are based on not properly configured `config.serverURL`. This patch adds a warning when `config.serverURL` is an empty value. This should provide users direct feedback about how to improve their configs. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-28Prevent subdirectories in user exportDaan Sprenkels1-9/+11
This commit also refactors the code a bit, and adds a '-' separator between a filename and its duplicate index. This commit fixes #1079. Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>
2018-11-27Fix typoCloudYu2-4/+4
Signed-off-by: CloudYu <cloudyu322@gmail.com>
2018-11-21Switch scrypt library to a successorSheogorath1-1/+1
Since our previous scrypt library is unmaintained since 3 years, it's time to look for an alternative. A refactoring towards another password algorithm was worked on and this is probably still the way to go. But for now the successor of our previous library should already be enough. https://www.npmjs.com/package/scrypt (old library) https://github.com/ml1nk/node-scrypt (new library) Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-19Fix wrong maxAgeSeconds multiplicationSheogorath1-1/+1
It seems like the inital work on the hsts module expected milliseconds. This has either changed or was never true. Either way, it caused that the current defaults resulted in theory in a 1000 year HSTS policy. Luckily helmet was smart enough to not go higher than 1 year. Anyway, this patch fixes the multiplication of the configured size with 1000 by removing this multiplication. Also to simplify the reading of the defaults, we split them into their components, 60 times 60 seconds so we get one hour. 24 of those hours so we get a day and finally 365 days to get our original wanted default of one year. Reference: https://github.com/hackmdio/CodiMD/commit/d69d65ea7434eee85db4b905f0852f4d8fa7ecce Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-17Disallow creation of robots.txt in freeurlDaan Sprenkels3-1/+3
Add a configuration setting to "hard"-disable creation of notes as set by the configuration value. This defaults to `['robots.txt', 'favicon.ico']`, because these files are often accidentally created by bots and browsers. This commit fixes #1052. Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>
2018-11-16Update error message text checksCarles Bruguera8-8/+8
Signed-off-by: Carles Bruguera <carlesba@gmail.com>
2018-11-16Fix streaming for winstonSheogorath1-1/+9
During the upgrade of winston in c3584770f24205d84b9399abd9535cb27dc7b00c a the class extension for streaming was removed. This caused silent crashes. Somehow winston simply called `process.exit(1)` whenever `logger.write()` was called. This is really bad and only easy to debug because of the testing right after upgrading. However, reimplementing the stream interface as it was, didn't work, due to the fact that `logger.write()` is already implemented and causes the mentioned problem. So we extent the object with an `stream` object that implements `write()` for streams and pass that to morgan. So this patch fixes unexpected exiting for streaming towards our logging module. References: https://www.digitalocean.com/community/tutorials/how-to-use-winston-to-log-node-js-applications https://github.com/hackmdio/codimd/commit/c3584770f24205d84b9399abd9535cb27dc7b00c https://stackoverflow.com/a/28824464 Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-14switching to eslint for code checkingClaudius Coenen4-3/+5
most rules degraded to WARN, so we don't go insane. This will change over time. The aim is to conform to a common style Signed-off-by: Claudius Coenen <opensource@amenthes.de>
2018-11-14InternalOAuthError is not part of passport, but of passport-oauth2Claudius Coenen1-4/+4
This fixes part of #1056: an error while obtaining the profile would have `502`-crashed the server. Signed-off-by: Claudius Coenen <opensource@amenthes.de>
2018-11-14Upgrade winstonSheogorath4-16/+20
Our log library got a new major version which should be implemented. That's exactly what this patch does. Implementing the new version of the logging library. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-13Fix logging in ot moduleSheogorath1-5/+5
Seems like there was some debugging going on some day, this patch should make sure the right logging is used. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-12Fix wrong reading from commitSheogorath1-1/+1
Right now we use a substr after reading the commit. That's definitely wrong and leads to wrong commit hashes since the first 5 chars are missing. This patch removes the substr usage here and this way fixes the generated links. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-11Add full version stringSheogorath5-4/+45
Currently we only provide the version from `package.json`. This means that during updates of instances, e.g. the demo instance, which runs latest master instead of a stable release, changes are not reflected to the webclient. This patch adds a fullversion string that contains the current commit and this way makes that clients are notified about changes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-07Fix menu for github and dropboxCédric Couralet1-0/+2
Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
2018-11-03removing global site layout vars from individual routers, putting them into ↵Claudius1-50/+2
app.local Signed-off-by: Claudius <opensource@amenthes.de>
2018-10-31Use OS based tmp dirSheogorath1-1/+3
We should use the official OS temp directory instead of an own one, to not run into conflicts. Also various dependencies already use the OS temp directory, which makes it pointless to use a different for our internal purposes then. This commit provides the changes needed to use the OS tmp directory by default. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-10-27forgot break statementAlex Garcia1-0/+1
Signed-off-by: Alex Garcia <alexsebastian.garcia@gmail.com>
2018-10-27Add download action to published notesAlex Garcia1-0/+2
Signed-off-by: Alex Garcia <alexsebastian.garcia@gmail.com>
2018-10-09Fix #1001: get only project user is member of (and return max of results)Cédric Couralet1-1/+1
Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
2018-10-05Add OpenID to CodiMDSheogorath6-3/+70
With OpenID every OpenID capable provider can provide authentication for users of a CodiMD instance. This means we have federated authentication. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-10-04Make oauth2 provider name accessibleSheogorath2-0/+2
Right now the feature exists but is almost not usable since the only way to configure it is to know that it exists from reading the source code and add it to config.json. This patch provides all needed changes so it can be used by everyone including documentation. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-10-04Add `data:` URL to CSP and upgrade helmetSheogorath1-1/+1
Seems like the old version of helmet had a problem with `data:`. This patch upgrades to the latest version and adds the CSP rule to allow Google Fonts and the offline version of it, to properly include the fonts and no longer throw ugly error messages at us. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-09-28Fix little bug in length limitSheogorath1-1/+1
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-09-27Set default to `v4`Sheogorath1-1/+2
Seems like we didn't fix the problem with the last patch. This should finally fix it. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-09-26removing superfluous config parameters for template filesClaudius4-21/+10
Signed-off-by: Claudius <opensource@amenthes.de>
2018-09-26imageRouter/filesystem: make callback path-independentWilliButz1-1/+2
Images are now properly served when `config.uploadsPath` differs from its default value. Signed-off-by: WilliButz <wbutz@cyberfnord.de>
2018-09-26lib/config: use `path.resolve` instead of `path.join`WilliButz1-14/+14
While paths like `tmpPath` could previously be configured, they were all interpreted relative to `appRootPath` because of `path.join`. Now the configurable paths can be canonical and therefore independent of the `appRootPath`. Signed-off-by: WilliButz <wbutz@cyberfnord.de>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-29 12:01:53 +0000