Commit graph

12 commits

Author SHA1 Message Date
John McLear
666dd7abd1 lint: src/node/padaccess.js 2021-01-25 22:53:11 -05:00
Richard Hansen
8e5fd19db2 lint: Run eslint --fix on src/ 2020-11-24 20:06:12 +00:00
John McLear
66df0a572f
Security: FEATURE REMOVAL: Remove all plain text password logic and ui (#4178)
This will be a breaking change for some people.  

We removed all internal password control logic.  If this affects you, you have two options:

1. Use a plugin for authentication and use session based pad access (recommended).
1. Use a plugin for password setting.

The reasoning for removing this feature is to reduce the overall security footprint of Etherpad.  It is unnecessary and cumbersome to keep this feature and with the thousands of available authentication methods available in the world our focus should be on supporting those and allowing more granual access based on their implementations (instead of half assed baking our own).
2020-10-07 13:43:54 +01:00
Richard Hansen
f9087fabd6 security: Check authentication in SecurityManager checkAccess
In addition to providing defense in depth, this change makes it easier
to implement future enhancements such as support for read-only users.
2020-09-15 10:43:23 +01:00
Ray Bellis
d5d28717c4 access controls: promisification
`getPadAccess()` (src/node/padaccess.js) is now "promise only", resolving to
`true` or `false` as appropriate, and throwing an exception if there's an
error.

The two call sites (padreadonly.js and importexport.js) updated to match.
2019-01-23 16:29:36 +00:00
muxator
11453d544c prepare to async: stricter checks
This change is in preparation of the future async refactoring by Ray. It tries
to extract as many changes in boolean conditions as possible, in order to make
more evident identifying eventual logic bugs in the future work.

This proved already useful in at least one case.

BEWARE: this commit exposes an incoherency in the DB API, in which, depending
on the driver used, some functions can return null or undefined. This condition
will be externally fixed by the final commit in this series ("db/DB.js: prevent
DB layer from returning undefined"). Until that commit, the code base may have
some bugs.
2019-03-01 09:43:41 +01:00
muxator
9497ee734f prepare to async: trivial reformatting
This change is only cosmetic. Its aim is do make it easier to understand the
async changes that are going to be merged later on. It was extracted from the
original work from Ray Bellis.

To verify that nothing has changed, you can run the following command on each
file touched by this commit:
  npm install uglify-es
  diff --unified <(uglify-js --beautify bracketize <BEFORE.js>) <(uglify-js --beautify bracketize <AFTER.js>)



This is a complete script that does the same automatically (works from a
mercurial clone):

```bash
#!/usr/bin/env bash

set -eu

REVISION=<THIS_REVISION>

PARENT_REV=$(hg identify --rev "${REVISION}" --template '{p1rev}')
FILE_LIST=$(hg status --no-status --change ${REVISION})
UGLIFYJS="node_modules/uglify-es/bin/uglifyjs"

for FILE_NAME in ${FILE_LIST[@]}; do
  echo "Checking ${FILE_NAME}"
  diff --unified \
    <("${UGLIFYJS}" --beautify bracketize <(hg cat --rev "${PARENT_REV}" "${FILE_NAME}")) \
    <("${UGLIFYJS}" --beautify bracketize <(hg cat --rev "${REVISION}"   "${FILE_NAME}"))
done
```
2019-02-08 23:20:57 +01:00
Simon Gaeremynck
5a7750781b Use the cookie parser middleware 2015-05-07 18:35:21 +01:00
Tom Hunkapiller
fd1d285a77 fix the rest of the deprecation warnings 2015-04-10 14:18:30 -05:00
Marcel Klehr
a39faf9368 Fix #1115 correctly reference session cookie 2012-11-17 14:19:09 +01:00
Marcel Klehr
71579d1478 Fix res.send (migrate to express v3) 2012-09-22 13:51:39 +02:00
Egil Moeller
1239ce7f28 The Big Renaming - etherpad is now an NPM module 2012-02-26 13:07:51 +01:00
Renamed from node/padaccess.js (Browse further)