| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
| |
We see some issues that are based on not properly configured
`config.serverURL`.
This patch adds a warning when `config.serverURL` is an empty value.
This should provide users direct feedback about how to improve their
configs.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|
|
|
|
|
|
|
|
| |
This commit also refactors the code a bit, and adds a '-' separator
between a filename and its duplicate index.
This commit fixes #1079.
Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Since our previous scrypt library is unmaintained since 3 years, it's
time to look for an alternative.
A refactoring towards another password algorithm was worked on and this
is probably still the way to go. But for now the successor of our
previous library should already be enough.
https://www.npmjs.com/package/scrypt (old library)
https://github.com/ml1nk/node-scrypt (new library)
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It seems like the inital work on the hsts module expected milliseconds.
This has either changed or was never true. Either way, it caused that
the current defaults resulted in theory in a 1000 year HSTS policy.
Luckily helmet was smart enough to not go higher than 1 year.
Anyway, this patch fixes the multiplication of the configured size with
1000 by removing this multiplication.
Also to simplify the reading of the defaults, we split them into their
components, 60 times 60 seconds so we get one hour. 24 of those hours so
we get a day and finally 365 days to get our original wanted default of
one year.
Reference:
https://github.com/hackmdio/CodiMD/commit/d69d65ea7434eee85db4b905f0852f4d8fa7ecce
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|\
| |
| | |
Disallow creation of robots.txt in freeurl
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Add a configuration setting to "hard"-disable creation of notes as
set by the configuration value. This defaults to `['robots.txt',
'favicon.ico']`, because these files are often accidentally created
by bots and browsers.
This commit fixes #1052.
Signed-off-by: Daan Sprenkels <hello@dsprenkels.com>
|
|\ \
| | |
| | | |
Fix migration failure due to change on error messages
|
| | |
| | |
| | |
| | | |
Signed-off-by: Carles Bruguera <carlesba@gmail.com>
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
During the upgrade of winston in
c3584770f24205d84b9399abd9535cb27dc7b00c a the class extension for
streaming was removed.
This caused silent crashes. Somehow winston simply called
`process.exit(1)` whenever `logger.write()` was called. This is really
bad and only easy to debug because of the testing right after upgrading.
However, reimplementing the stream interface as it was, didn't work, due
to the fact that `logger.write()` is already implemented and causes the
mentioned problem. So we extent the object with an `stream` object that
implements `write()` for streams and pass that to morgan.
So this patch fixes unexpected exiting for streaming towards our logging
module.
References:
https://www.digitalocean.com/community/tutorials/how-to-use-winston-to-log-node-js-applications
https://github.com/hackmdio/codimd/commit/c3584770f24205d84b9399abd9535cb27dc7b00c
https://stackoverflow.com/a/28824464
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|\ \ \
| | | |
| | | | |
InternalOAuthError is not part of passport, but of passport-oauth2 #1056
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
This fixes part of #1056: an error while obtaining the profile
would have `502`-crashed the server.
Signed-off-by: Claudius Coenen <opensource@amenthes.de>
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
most rules degraded to WARN, so we don't go insane. This will
change over time. The aim is to conform to a common style
Signed-off-by: Claudius Coenen <opensource@amenthes.de>
|
|\ \ \ \
| |/ / /
|/| | | |
Upgrade winston / refactor logging
|
| | |/
| |/|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Our log library got a new major version which should be implemented.
That's exactly what this patch does. Implementing the new version of the
logging library.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|/ /
| |
| |
| |
| |
| |
| | |
Seems like there was some debugging going on some day, this patch should
make sure the right logging is used.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|\ \
| | |
| | | |
Add download action to published notes
|
| | |
| | |
| | |
| | | |
Signed-off-by: Alex Garcia <alexsebastian.garcia@gmail.com>
|
| | |
| | |
| | |
| | | |
Signed-off-by: Alex Garcia <alexsebastian.garcia@gmail.com>
|
|\ \ \
| | | |
| | | | |
Fix wrong reading from commit
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Right now we use a substr after reading the commit. That's definitely
wrong and leads to wrong commit hashes since the first 5 chars are
missing.
This patch removes the substr usage here and this way fixes the
generated links.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|\ \ \ \
| |/ / /
|/| | | |
Use OS based tmp dir
|
| |/ /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
We should use the official OS temp directory instead of an own one, to
not run into conflicts. Also various dependencies already use the OS
temp directory, which makes it pointless to use a different for our
internal purposes then. This commit provides the changes needed to use
the OS tmp directory by default.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Currently we only provide the version from `package.json`. This means
that during updates of instances, e.g. the demo instance, which runs
latest master instead of a stable release, changes are not reflected to
the webclient.
This patch adds a fullversion string that contains the current commit
and this way makes that clients are notified about changes.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
| |/
|/|
| |
| | |
Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
|
|/
|
|
|
|
| |
app.local
Signed-off-by: Claudius <opensource@amenthes.de>
|
|\
| |
| | |
Add `data:` URL to CSP and upgrade helmet
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Seems like the old version of helmet had a problem with `data:`. This
patch upgrades to the latest version and adds the CSP rule to allow
Google Fonts and the offline version of it, to properly include the
fonts and no longer throw ugly error messages at us.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|\ \
| | |
| | | |
Make oauth2 provider name accessible
|
| |/
| |
| |
| |
| |
| |
| |
| |
| | |
Right now the feature exists but is almost not usable since the only way
to configure it is to know that it exists from reading the source code
and add it to config.json. This patch provides all needed changes so it
can be used by everyone including documentation.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
| |
| |
| |
| | |
Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
|
| |
| |
| |
| |
| |
| |
| |
| | |
With OpenID every OpenID capable provider can provide authentication for
users of a CodiMD instance. This means we have federated
authentication.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|\ \
| |/
|/| |
enhance configurabiltiy of paths & make execution path-independent
|
| |
| |
| |
| | |
Signed-off-by: Claudius <opensource@amenthes.de>
|
| |
| |
| |
| |
| |
| |
| | |
Images are now properly served when `config.uploadsPath`
differs from its default value.
Signed-off-by: WilliButz <wbutz@cyberfnord.de>
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
While paths like `tmpPath` could previously be configured,
they were all interpreted relative to `appRootPath` because
of `path.join`.
Now the configurable paths can be canonical and therefore
independent of the `appRootPath`.
Signed-off-by: WilliButz <wbutz@cyberfnord.de>
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Previously it was assumed that `config.json` would be placed in
the same directory as the rest of CodiMD without any optional override.
This allows to override the path to the `config.json` by setting
`CMD_CONFIG_FILE` to the canonical path of the desired config file.
Signed-off-by: WilliButz <wbutz@cyberfnord.de>
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Previously calling `app.js` from another directory than
the base directory of CodiMD would result in an error being
thrown because `lib/workers/dmpWorker.js` could not be found.
This change makes the function call independent of the path CodiMD
is started from.
Signed-off-by: WilliButz <wbutz@cyberfnord.de>
|
| |
| |
| |
| | |
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|\ \
| | |
| | | |
Set default to `v4`
|
| |/
| |
| |
| |
| |
| |
| | |
Seems like we didn't fix the problem with the last patch. This should
finally fix it.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|/
|
|
|
|
|
|
|
| |
We recently introduced a new way to create notes using a post requeest
to the `/new` endpoint. This is not limited in size, other than pasting
a note in the editor. This patch should enforce this limit also on this
way.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|
|
|
|
|
|
| |
This patch should fix the unneeded warning of the wrong API version,
when gitlab isn't configured at all.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|
|
|
|
|
|
|
|
| |
`markdown-pdf` seems to fail to provide the PDFs on tmpfs. This leads
crashing codimd which expects the file to be there. This patch should
add some proper error handling when expectation and reality don't fit
together.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|
|
|
|
|
|
|
|
|
| |
The current error handling seems to conflict with some sequelize
versions. So we add a second version of it in our excemptions.
I'm not happy about it, but when it helps to prevent further migration
breaking, it's worth it.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
|\
| |
| | |
Fix possible weird objects as email
|
| |
| |
| |
| |
| |
| |
| | |
It seems like some providers return strange types for emails which cause
problems. We default to something that is definitely a string.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
|
| |
| |
| |
| | |
Signed-off-by: Alexander Hesse <alexander.hesse@sandstorm-media.de>
|
|\ \
| | |
| | | |
Add possibility to choose between version v3 or v4 for the gitlab api.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Apart from the uri versioning, one big change is the snippet visibility post data (visibility_level -> visibility)
Default gitlab api version to v4
Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
|
|\ \ \
| |/ /
|/| | |
Add missing catch blocks for migration from 1.1.1 to 1.2.0
|