From 02e99277146d8bd912f2f19af1d3e94a6181d90d Mon Sep 17 00:00:00 2001 From: alecdwm Date: Tue, 13 Dec 2016 22:31:35 +0100 Subject: Initial support for LDAP server authentication Limitations as of this commit: - tlsOptions can only be specified in config.json, not as env vars - authentication failures are not yet gracefully handled by the UI - instead the error message is shown on a blank page (/auth/ldap) - no email address is associated with the LDAP user's account - no picture/profile URL is associated with the LDAP user's account - we might have to generate our own access + refresh tokens, because we aren't using oauth. The currently generated tokens are just a placeholder. - 'LDAP Sign in' needs to be translated to each locale --- public/views/index.ejs | 5 +++-- public/views/signin-ldap-modal.ejs | 35 +++++++++++++++++++++++++++++++++++ public/views/signin-modal.ejs | 10 ++++++++-- 3 files changed, 46 insertions(+), 4 deletions(-) create mode 100644 public/views/signin-ldap-modal.ejs (limited to 'public') diff --git a/public/views/index.ejs b/public/views/index.ejs index 2bec7de0..baca1417 100644 --- a/public/views/index.ejs +++ b/public/views/index.ejs @@ -57,7 +57,7 @@ <% if (errorMessage && errorMessage.length > 0) { %>
<%= errorMessage %>
<% } %> - <% if(facebook || twitter || github || gitlab || dropbox || google || email) { %> + <% if(facebook || twitter || github || gitlab || dropbox || google || ldap || email) { %>
<%= __('Sign In') %> @@ -93,7 +93,7 @@
style="display:none;"<% } %>> - <% if(facebook || twitter || github || gitlab || dropbox || google || email) { %> + <% if(facebook || twitter || github || gitlab || dropbox || google || ldap || email) { %> @@ -192,6 +192,7 @@
<%- include signin-modal %> + <%- include signin-ldap-modal %> <% if(useCDN) { %> diff --git a/public/views/signin-ldap-modal.ejs b/public/views/signin-ldap-modal.ejs new file mode 100644 index 00000000..6a665f17 --- /dev/null +++ b/public/views/signin-ldap-modal.ejs @@ -0,0 +1,35 @@ + + diff --git a/public/views/signin-modal.ejs b/public/views/signin-modal.ejs index acbad256..ba6c57ff 100644 --- a/public/views/signin-modal.ejs +++ b/public/views/signin-modal.ejs @@ -38,7 +38,13 @@ <%= __('Sign in via %s', 'Google') %> <% } %> - <% if((facebook || twitter || github || gitlab || dropbox || google) && email) { %> + <% if(ldap) { %> + + <%= __('Sign in via %s', 'LDAP') %> + + <% } %> + + <% if((facebook || twitter || github || gitlab || dropbox || google || ldap) && email) { %>
<% }%> <% if(email) { %> @@ -67,4 +73,4 @@ - \ No newline at end of file + -- cgit v1.3.1 From 72a0e90f7d09d8a4e06a2629dcb9404eb37c64a0 Mon Sep 17 00:00:00 2001 From: alecdwm Date: Wed, 14 Dec 2016 12:42:42 +0100 Subject: LDAP signin form moved to main signin-modal - previously was a separate modal - now is located on main modal, like email auth --- locales/en.json | 3 +-- public/views/index.ejs | 1 - public/views/signin-ldap-modal.ejs | 35 ----------------------------------- public/views/signin-modal.ejs | 27 +++++++++++++++++++++++---- 4 files changed, 24 insertions(+), 42 deletions(-) delete mode 100644 public/views/signin-ldap-modal.ejs (limited to 'public') diff --git a/locales/en.json b/locales/en.json index dda317f1..f1f0d140 100644 --- a/locales/en.json +++ b/locales/en.json @@ -100,6 +100,5 @@ "Select From Available Snippets": "Select From Available Snippets", "OR": "OR", "Export to Snippet": "Export to Snippet", - "Select Visibility Level": "Select Visibility Level", - "LDAP Sign in": "LDAP Sign in" + "Select Visibility Level": "Select Visibility Level" } \ No newline at end of file diff --git a/public/views/index.ejs b/public/views/index.ejs index baca1417..39674b02 100644 --- a/public/views/index.ejs +++ b/public/views/index.ejs @@ -192,7 +192,6 @@ <%- include signin-modal %> - <%- include signin-ldap-modal %> <% if(useCDN) { %> diff --git a/public/views/signin-ldap-modal.ejs b/public/views/signin-ldap-modal.ejs deleted file mode 100644 index 6a665f17..00000000 --- a/public/views/signin-ldap-modal.ejs +++ /dev/null @@ -1,35 +0,0 @@ - - diff --git a/public/views/signin-modal.ejs b/public/views/signin-modal.ejs index ba6c57ff..e71b09c6 100644 --- a/public/views/signin-modal.ejs +++ b/public/views/signin-modal.ejs @@ -38,12 +38,31 @@ <%= __('Sign in via %s', 'Google') %> <% } %> + <% if((facebook || twitter || github || gitlab || dropbox || google) && ldap) { %> +
+ <% }%> <% if(ldap) { %> - - <%= __('Sign in via %s', 'LDAP') %> - +

Via LDAP

+
+
+
+ + +
+
+
+
+ + +
+
+
+
+ +
+
+
<% } %> - <% if((facebook || twitter || github || gitlab || dropbox || google || ldap) && email) { %>
<% }%> -- cgit v1.3.1 From ff545b268871be7b6552638427a59a9a6eac5dd1 Mon Sep 17 00:00:00 2001 From: neopostmodern Date: Mon, 9 Jan 2017 12:49:23 +0100 Subject: Allow displaying LDAP provider name on sign-in modal --- README.md | 1 + lib/config.js | 6 +++++- public/views/signin-modal.ejs | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) (limited to 'public') diff --git a/README.md b/README.md index 7040aeb3..4717ca7c 100644 --- a/README.md +++ b/README.md @@ -148,6 +148,7 @@ Environment variables (will overwrite other server configs) | HMD_LDAP_SEARCHFILTER | (uid={{username}}) | LDAP filter to search with | | HMD_LDAP_SEARCHATTRIBUTES | no example | LDAP attributes to search with | | HMD_LDAP_TLS_CA | no example | Root CA for LDAP TLS in PEM format | +| HMD_LDAP_PROVIDERNAME | My institution | Optional name to be displayed at login form indicating the LDAP provider | | HMD_IMGUR_CLIENTID | no example | Imgur API client id | | HMD_EMAIL | `true` or `false` | set to allow email register and signin | | HMD_IMAGE_UPLOAD_TYPE | `imgur`, `s3` or `filesystem` | Where to upload image. For S3, see our [S3 Image Upload Guide](docs/guides/s3-image-upload.md) | diff --git a/lib/config.js b/lib/config.js index 2f6792b7..6b2ba0b6 100644 --- a/lib/config.js +++ b/lib/config.js @@ -102,7 +102,8 @@ var ldap = config.ldap || ( process.env.HMD_LDAP_TOKENSECRET || process.env.HMD_LDAP_SEARCHBASE || process.env.HMD_LDAP_SEARCHFILTER || - process.env.HMD_LDAP_SEARCHATTRIBUTES + process.env.HMD_LDAP_SEARCHATTRIBUTES || + process.env.HMD_LDAP_PROVIDERNAME ) || false; if (ldap == true) ldap = {}; @@ -126,6 +127,9 @@ if (process.env.HMD_LDAP_TLS_CA) { } ldap.tlsOptions = ldap.tlsOptions ? Object.assign(ldap.tlsOptions, ca) : ca } +if (process.env.HMD_LDAP_PROVIDERNAME) { + ldap.providerName = process.env.HMD_LDAP_PROVIDERNAME; +} var imgur = process.env.HMD_IMGUR_CLIENTID || config.imgur || false; var email = process.env.HMD_EMAIL ? (process.env.HMD_EMAIL === 'true') : !!config.email; diff --git a/public/views/signin-modal.ejs b/public/views/signin-modal.ejs index 7c52e0f3..e9c54b33 100644 --- a/public/views/signin-modal.ejs +++ b/public/views/signin-modal.ejs @@ -42,7 +42,7 @@
<% }%> <% if(ldap) { %> -

Via LDAP

+

Via <% if (ldap.providerName) { %> <%- ldap.providerName %> (LDAP) <% } else { %> LDAP <% } %>

-- cgit v1.3.1 From 89b8ddeabae81fd3a8891ce9d8191fbc9e27c83c Mon Sep 17 00:00:00 2001 From: 蒼時弦也 Date: Tue, 10 Jan 2017 10:02:37 +0800 Subject: Add limited and protected permission --- lib/models/note.js | 6 +++--- lib/realtime.js | 20 ++++++++++---------- lib/response.js | 9 +++++++-- public/js/index.js | 22 +++++++++++++++++++++- public/views/body.ejs | 2 ++ 5 files changed, 43 insertions(+), 16 deletions(-) (limited to 'public') diff --git a/lib/models/note.js b/lib/models/note.js index 132f8b1e..47d9b97a 100644 --- a/lib/models/note.js +++ b/lib/models/note.js @@ -23,7 +23,7 @@ var logger = require("../logger.js"); var ot = require("../ot/index.js"); // permission types -var permissionTypes = ["freely", "editable", "locked", "private"]; +var permissionTypes = ["freely", "editable", "locked", "private", "limited", "protected"]; module.exports = function (sequelize, DataTypes) { var Note = sequelize.define("Note", { @@ -333,7 +333,7 @@ module.exports = function (sequelize, DataTypes) { if (meta.slideOptions && (typeof meta.slideOptions == "object")) _meta.slideOptions = meta.slideOptions; } - return _meta; + return _meta; }, updateAuthorshipByOperation: function (operation, userId, authorships) { var index = 0; @@ -532,4 +532,4 @@ module.exports = function (sequelize, DataTypes) { }); return Note; -}; \ No newline at end of file +}; diff --git a/lib/realtime.js b/lib/realtime.js index a662deeb..b728622f 100644 --- a/lib/realtime.js +++ b/lib/realtime.js @@ -251,13 +251,13 @@ function getStatus(callback) { return logger.error('count user failed: ' + err); }); }).catch(function (err) { - return logger.error('count note failed: ' + err); + return logger.error('count note failed: ' + err); }); } function isReady() { - return realtime.io - && Object.keys(notes).length == 0 && Object.keys(users).length == 0 + return realtime.io + && Object.keys(notes).length == 0 && Object.keys(users).length == 0 && connectionSocketQueue.length == 0 && !isConnectionBusy && disconnectSocketQueue.length == 0 && !isDisconnectBusy; } @@ -420,7 +420,7 @@ function finishConnection(socket, note, user) { function startConnection(socket) { if (isConnectionBusy) return; isConnectionBusy = true; - + var noteId = socket.noteId; if (!noteId) { return failConnection(404, 'note id not found', socket); @@ -521,7 +521,7 @@ function disconnect(socket) { logger.info("SERVER disconnected a client"); logger.info(JSON.stringify(users[socket.id])); } - + if (users[socket.id]) { delete users[socket.id]; } @@ -618,12 +618,12 @@ function ifMayEdit(socket, callback) { case "freely": //not blocking anyone break; - case "editable": + case "editable": case: "limited": //only login user can change if (!socket.request.user || !socket.request.user.logged_in) mayEdit = false; break; - case "locked": case "private": + case "locked": case "private": case "protected": //only owner can change if (!note.owner || note.owner != socket.request.user.id) mayEdit = false; @@ -672,7 +672,7 @@ function operationCallback(socket, operation) { var noteId = note.alias ? note.alias : LZString.compressToBase64(note.id); if (note.server) history.updateHistory(userId, noteId, note.server.document); }, 0); - + } // save authorship note.authorship = models.Note.updateAuthorshipByOperation(operation, userId, note.authorship); @@ -689,10 +689,10 @@ function connection(socket) { } if (isDuplicatedInSocketQueue(socket, connectionSocketQueue)) return; - + // store noteId in this socket session socket.noteId = noteId; - + //initialize user data //random color var color = randomcolor(); diff --git a/lib/response.js b/lib/response.js index a0dc8b1f..4438be24 100755 --- a/lib/response.js +++ b/lib/response.js @@ -122,6 +122,11 @@ function checkViewPermission(req, note) { return false; else return true; + } else if (note.permission == 'limited' || note.permission == 'protected') { + if( !req.isAuthenticated() ) { + return false; + } + return true; } else { return true; } @@ -161,7 +166,7 @@ function showNote(req, res, next) { findNote(req, res, function (note) { // force to use note id var noteId = req.params.noteId; - var id = LZString.compressToBase64(note.id); + var id = LZString.compressToBase64(note.id); if ((note.alias && noteId != note.alias) || (!note.alias && noteId != id)) return res.redirect(config.serverurl + "/" + (note.alias || id)); return responseHackMD(res, note); @@ -413,7 +418,7 @@ function publishSlideActions(req, res, next) { res.redirect(config.serverurl + '/' + (note.alias ? note.alias : LZString.compressToBase64(note.id))); break; default: - res.redirect(config.serverurl + '/p/' + note.shortid); + res.redirect(config.serverurl + '/p/' + note.shortid); break; } }); diff --git a/public/js/index.js b/public/js/index.js index 56766657..5b606242 100644 --- a/public/js/index.js +++ b/public/js/index.js @@ -857,7 +857,9 @@ window.ui = { freely: $(".ui-permission-freely"), editable: $(".ui-permission-editable"), locked: $(".ui-permission-locked"), - private: $(".ui-permission-private") + private: $(".ui-permission-private"), + limited: $(".ui-permission-limited"), + protected: $(".ui-permission-protected") }, delete: $(".ui-delete-note") }, @@ -2247,6 +2249,14 @@ ui.infobar.permission.locked.click(function () { ui.infobar.permission.private.click(function () { emitPermission("private"); }); +//limited +ui.infobar.permission.limited.click(function() { + emitPermission("limited"); +}); +//protected +ui.infobar.permission.protected.click(function() { + emitPermission("protected"); +}); // delete note ui.infobar.delete.click(function () { $('.delete-modal').modal('show'); @@ -2285,6 +2295,14 @@ function updatePermission(newPermission) { label = ' Private'; title = "Only owner can view & edit"; break; + case "limited": + label = ' Limited'; + title = "Signed people can view and edit" + break; + case "protected": + label = ' Protected'; + title = "Signed people can view"; + break; } if (personalInfo.userid && owner && personalInfo.userid == owner) { label += ' '; @@ -2302,6 +2320,7 @@ function havePermission() { bool = true; break; case "editable": + case "limited": if (!personalInfo.login) { bool = false; } else { @@ -2310,6 +2329,7 @@ function havePermission() { break; case "locked": case "private": + case "protected": if (!owner || personalInfo.userid != owner) { bool = false; } else { diff --git a/public/views/body.ejs b/public/views/body.ejs index 83a82fa3..79e36141 100644 --- a/public/views/body.ejs +++ b/public/views/body.ejs @@ -19,6 +19,8 @@
  • Editable - Signed people can edit
  • Locked - Only owner can edit
  • Private - Only owner can view & edit
  • +
  • Limited - Signed people can edit & view
  • +
  • Protected - Only owner can edit
  • Delete this note
  • -- cgit v1.3.1 From 7b02c48d93d05e3ced0a030a13d620559710c9cd Mon Sep 17 00:00:00 2001 From: 蒼時弦也 Date: Tue, 10 Jan 2017 14:13:30 +0800 Subject: Adjust permission order to more clarly --- lib/models/note.js | 2 +- public/js/index.js | 14 +++++++------- public/views/body.ejs | 4 ++-- 3 files changed, 10 insertions(+), 10 deletions(-) (limited to 'public') diff --git a/lib/models/note.js b/lib/models/note.js index 47d9b97a..a6921267 100644 --- a/lib/models/note.js +++ b/lib/models/note.js @@ -23,7 +23,7 @@ var logger = require("../logger.js"); var ot = require("../ot/index.js"); // permission types -var permissionTypes = ["freely", "editable", "locked", "private", "limited", "protected"]; +var permissionTypes = ["freely", "editable", "limited", "private", "protected", "locked"]; module.exports = function (sequelize, DataTypes) { var Note = sequelize.define("Note", { diff --git a/public/js/index.js b/public/js/index.js index 5b606242..4cbc6b93 100644 --- a/public/js/index.js +++ b/public/js/index.js @@ -2287,22 +2287,22 @@ function updatePermission(newPermission) { label = ' Editable'; title = "Signed people can edit"; break; - case "locked": - label = ' Locked'; - title = "Only owner can edit"; + case "limited": + label = ' Limited'; + title = "Signed people can view & edit" break; case "private": label = ' Private'; title = "Only owner can view & edit"; break; - case "limited": - label = ' Limited'; - title = "Signed people can view and edit" - break; case "protected": label = ' Protected'; title = "Signed people can view"; break; + case "locked": + label = ' Locked'; + title = "Only owner can edit"; + break; } if (personalInfo.userid && owner && personalInfo.userid == owner) { label += ' '; diff --git a/public/views/body.ejs b/public/views/body.ejs index 79e36141..988d4f5b 100644 --- a/public/views/body.ejs +++ b/public/views/body.ejs @@ -17,10 +17,10 @@ -- cgit v1.3.1 From 758607d37808b7fee2957bdb33eeda44e02233d4 Mon Sep 17 00:00:00 2001 From: 蒼時弦也 Date: Tue, 10 Jan 2017 15:15:12 +0800 Subject: Add fa-stack style to public/js/index.js --- public/js/index.js | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'public') diff --git a/public/js/index.js b/public/js/index.js index 4cbc6b93..7ddc696a 100644 --- a/public/js/index.js +++ b/public/js/index.js @@ -2288,16 +2288,22 @@ function updatePermission(newPermission) { title = "Signed people can edit"; break; case "limited": - label = ' Limited'; - title = "Signed people can view & edit" + label = ' Limited'; + title = "Signed people can edit & guest can't view" break; case "private": label = ' Private'; title = "Only owner can view & edit"; break; case "protected": - label = ' Protected'; - title = "Signed people can view"; + label = '' + + '' + + '' + + ' Protected'; + title = "Only owner can edit & guest can't view"; break; case "locked": label = ' Locked'; -- cgit v1.3.1 From a9fe43ac3a38f036d4f9baa27c50fc9b5fea8c1f Mon Sep 17 00:00:00 2001 From: 蒼時弦也 Date: Tue, 10 Jan 2017 17:22:57 +0800 Subject: Update limited/protected permission icon --- public/js/index.js | 10 ++-------- public/views/body.ejs | 4 ++-- 2 files changed, 4 insertions(+), 10 deletions(-) (limited to 'public') diff --git a/public/js/index.js b/public/js/index.js index 7ddc696a..057ddd9d 100644 --- a/public/js/index.js +++ b/public/js/index.js @@ -2288,10 +2288,7 @@ function updatePermission(newPermission) { title = "Signed people can edit"; break; case "limited": - label = ' Limited'; + label = ' Limited'; title = "Signed people can edit & guest can't view" break; case "private": @@ -2299,10 +2296,7 @@ function updatePermission(newPermission) { title = "Only owner can view & edit"; break; case "protected": - label = '' + - '' + - '' + - ' Protected'; + label = ' Protected'; title = "Only owner can edit & guest can't view"; break; case "locked": diff --git a/public/views/body.ejs b/public/views/body.ejs index 988d4f5b..6500e607 100644 --- a/public/views/body.ejs +++ b/public/views/body.ejs @@ -17,9 +17,9 @@