Commit graph

1233 commits

Author SHA1 Message Date
Chocobozzz
0889a1313d referer: do not send referrer when opening a link
This change augments what was already done in 54e0f2de5b (PR with discussion
at #3636).

For documentation about the meaning of "noopener, noreferrer", see:
https://developer.mozilla.org/en-US/docs/Web/API/Window/open#Window_functionality_features
2020-03-31 10:02:46 +02:00
John McLear
dbab4ad13a dont pass empty author info to edit 2020-04-02 23:29:03 +01:00
Daniel Krol
3e8b426847 ui: initialize color picker with the user's color
Initialize the color picker with user's current color.
Was previously initialized with grey in Farbtastic library.

Fixes #3617
2020-04-01 02:34:56 +02:00
John McLear
25bf460ac6 chat: in addMessage(), be tolerant when userId is missing
For whatever reason (a bug, a database corruption, ...) the userId field in
"msg" can sometimes be missing.

In this case, let's be defensive, use "unknown" as userId and issue a warning
in the console, instead of crashing the client.

Fixes #3731 (really a patch, the underlying issue is still present)
2020-03-30 22:15:51 +02:00
John McLear
85217b55e0 contentcollector: pasting an OL in Chrome inserted an additional line break. Fixed.
This comments out some code that was probably a quirk from ie6 era.
See PR: https://github.com/ether/etherpad-lite/issues/2412

Fixes #2412.
2020-03-30 02:28:08 +02:00
Neil Oosten
7a999ee398 hooks: allow to set the duration of the gritter notification when a new chat message arrives
This is done adding a new "duration" parameter to the chatNewMessage() client
side hook.
2020-03-27 02:39:29 +01:00
John McLear
6fd2bf4472 hooks: introduce goToRevisionEvent(), a new client-side hook
This hook gets fired both on timeslider load (as timeslider shows a new
revision) and when the new revision is showed to a user.
2020-03-24 23:46:17 +01:00
muxator
40d3d400a1 fonts: remove the execution bit from the font files
Monsterrat was added in 8bd8be97b9
Roboto Mono was added in 7029248a76
2020-03-22 00:33:22 +01:00
muxator
840b4a0988 contentcollector: backed out changeset 3292429ab3
That commit (merged recently with PR #3622) was part of an effort to fix #3620,
but introduced a very bad bug that broke the cursor behaviour when pressing
space, making the program unusable.

This commit completes the revert of PR #3622 and fixes #3728.

--HG--
branch : revert-3622
2020-03-19 02:53:41 +01:00
Sebastian Castro
0d61d6bb13 ui: on mobile, move the right toolbar to the bottom and make the top toolbar scrollable
Before this change there was always a single toolbar on the top, with both
Colibris and the legacy skin. When the screen size was reduced:

- the legacy skin would compact the icons in the toolbar (this was fine,
  indeed);
- Colibris would hide some formatting icons. This would hamper the functionality
  for mobile users.

After this change both the skins work in the same way, which is the following:
- when the screen gets smaller the right toolbar (the one with "export",
  "timeslider", and other buttons) goes to the bottom of the screen;
- when there are many icons, the toolbar keeps all of them, and to see them the
  user must drag the toolbar.

This behaviour will probably be changed before release, opting instead to show
a "+" button when there is an overflow, since this appears to be more
discoverable (see the discusison in #3697).

Do not tested with custom toolbar elements (toolbar.left and toolbar.right
configuration items in settings.json).

Fixes #3697.
2020-03-12 18:47:12 +01:00
Tom Briles
3292429ab3 trim text entries upon import. Fixes: #3620 2020-03-15 11:35:08 +00:00
Sebastian Castro
6d4ea36646 skin colibris: Fix table of content with ep_resizable_bar 2020-01-03 15:35:12 -03:00
ahmadine
0a0b90c4d0 referer: change referrer policy. Stop sending referers as much as possible
Pull request with discussion: https://github.com/ether/etherpad-lite/pull/3636

What's already there:
* `meta name=referrer`: already done in 1.6.1:
  https://github.com/ether/etherpad-lite/pull/3044

  https://caniuse.com/#feat=referrer-policy
  https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta
  (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1])

The previous two commits (by @joelpurra) I backported in this batch:
* `<a rel=noreferrer>`: a pull request denied before:
  https://github.com/ether/etherpad-lite/pull/2498

  https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer
  https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types
  (Firefox>=37, I can't find more info about support)

This commit adds the following:
* `<a rel="noopener">`: fixing a not-so-well-known way to extract referer
  https://html.spec.whatwg.org/multipage/links.html#link-type-noopener
  (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge)

* `Referrer-Policy: same-origin`: the last bastion of referrer security
  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
  (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge)

meta name=referrer wasn't enough. I happened to leak a few referrers with my
Firefox browser, though for some browsers it could have been enough.

[1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it
    most probably incompatible (but I may be wrong on that, they may support
    both, but I have no way to test it currently). The next Edge release will be
    based on Chromium, so for that the Chrome version applies.
2019-11-25 00:05:40 +01:00
Joel Purra
f314460b7c referer: HTML5 browsers no longer leak pad through HTTP referer header
Added `rel="noreferrer"` to automatically generated links in the main pad window
as well as the chat window.

`rel="noreferrer"` is part of the HTML5 standard. While browser support isn't
100%, it's better than nothing. Future alternative solutions with wider browser
support, such as intermediary redirect pages, are unaffected by this change.

https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer

This commit was originally part of https://github.com/ether/etherpad-lite/pull/2498
2019-11-25 00:05:40 +01:00
muxator
312c72c364 formatting: bulk remove trailing whitespaces
Do not touch vendorized files (e.g. libraries that were imported from external
projects).

No functional changes.

Command:
    find . -name '*.<EXTENSION>' -type f -print0 | xargs -0 sed -i 's/[[:space:]]*$//'
2019-10-20 02:09:22 +02:00
muxator
24abd9ca07 formatting: dos2unix on admin.css
In preparation for next commit. I was not able to find other non-vendorized
files that were in DOS format and legitimately needed to be converted.

No functional changes.
2019-10-20 02:50:01 +02:00
muxator
5eb60cef01 jQuery: update vendored version (1.9.1 -> 1.12.4)
The vendored jquery version was 1.9.1 from 2013-02-04. Let's replace it with the
most recent one from the 1.x branch (1.12.4 from 2016-05-20).

The modification in rjquery.js is needed because recent jQuery versions changed
their behaviour, and do not set themselves on the global window object.
See: https://github.com/parcel-bundler/parcel/issues/333#issuecomment-357882648

This will be the lastest jQuery 1.x version ever, because 1.x branch is
definitively EOLed (see https://github.com/jquery/jquery.com/issues/162).

This is a stopgap measure to get the latest security fixes. Going forward,
another strategy will be needed.

Closes #3640
2019-09-16 22:55:53 +02:00
cupcakearmy
d88726b58d colibris: the "ok" button was misaligned in Chrome
When visiting Etherpad's home page with Chrome the "ok" button was not on the
same line as the pad name text box. On Firefox & Safari there was no problem.
Tested on Chrome 74.

Fixes #3604.
2019-05-10 09:50:25 +02:00
Tristram Gräbener
357780d573 Display the version in the web interface
In the settings drop-down this adds an “About” section that also shows
the commit if "exposeVersion" is set to true.

Fixes #2968
2019-04-15 23:17:34 +00:00
Tristram Gräbener
8453f07205 Chat bubble: by default hide in CSS
The current behaviour is to show the chat bubble and hide if chat is
disabled.

Because of this, the bubble appears wrongfully for a short time.

With this PR, by default it is hidden and displayed only if chat is
enabled.

Fixes: #3088
2019-04-15 23:14:47 +00:00
muxator
dc7e49f89d Remove trailing whitespaces
Hoping to minimize future diffs. Not touching vendorized libraries.
2019-04-16 00:34:29 +02:00
Ray Bellis
0c2d662541 plugins download and search: converted to Promises
Also fixed a bug where the system would make a request to the central server for
the plugin list for every search even if the list was already cached.
2019-01-23 12:24:53 +00:00
Ray Bellis
a579dfc285 pluginfw/installer.js: use Promise version of hooks.aCallAll() in install(), uninstall()
We cannot use arrow functions in this file, because code in /src/static can end
up being loaded in browsers, and we still support IE11.
2019-01-18 16:10:48 +00:00
Ray Bellis
80b3019154 pluginfw/plugins.js: converted to Promise API 2019-01-18 13:52:37 +00:00
Ray Bellis
8d85ae582e pluginfw/hooks.js: allow returning a Promise in aCallFirst(), aCallAll()
Since this code can end up loaded in browsers when using client side plugins,
avoid use of ES6 syntax features such as arrow functions until MSIE support is
finally dropped.
2019-01-18 13:49:17 +00:00
muxator
9497ee734f prepare to async: trivial reformatting
This change is only cosmetic. Its aim is do make it easier to understand the
async changes that are going to be merged later on. It was extracted from the
original work from Ray Bellis.

To verify that nothing has changed, you can run the following command on each
file touched by this commit:
  npm install uglify-es
  diff --unified <(uglify-js --beautify bracketize <BEFORE.js>) <(uglify-js --beautify bracketize <AFTER.js>)



This is a complete script that does the same automatically (works from a
mercurial clone):

```bash
#!/usr/bin/env bash

set -eu

REVISION=<THIS_REVISION>

PARENT_REV=$(hg identify --rev "${REVISION}" --template '{p1rev}')
FILE_LIST=$(hg status --no-status --change ${REVISION})
UGLIFYJS="node_modules/uglify-es/bin/uglifyjs"

for FILE_NAME in ${FILE_LIST[@]}; do
  echo "Checking ${FILE_NAME}"
  diff --unified \
    <("${UGLIFYJS}" --beautify bracketize <(hg cat --rev "${PARENT_REV}" "${FILE_NAME}")) \
    <("${UGLIFYJS}" --beautify bracketize <(hg cat --rev "${REVISION}"   "${FILE_NAME}"))
done
```
2019-02-08 23:20:57 +01:00
muxator
b34fc2de2b use Date.now() instead of new Date().getTime()
This is documented to be more performant.

The substitution was made on frontend code, too (i.e., the one in /static),
because Date.now() is supported since IE 9, and we are life supporting only
IE 11.

Commands:
  find . -name *.js | xargs sed --in-place "s/new Date().getTime()/Date.now()/g"
  find . -name *.js | xargs sed --in-place "s/(new Date()).getTime()/Date.now()/g"

Not done on jQuery.
2019-02-26 23:25:15 +01:00
Sebastian Castro
9848a600e3 colibris: Fixes #3548 #3549 chat improvements 2019-02-22 19:48:46 +01:00
Sebastian Castro
378dbe8485 skins: Improve clientPluginNames class helper
Moving classes to html tag so it can be used to style other part of template depending on plugins like #users, #chat etc...
Rename plugin class with "plugin-" prefix, because there were conflicts with some plugins using the same .ep_font_color class to apply css rules
2019-02-22 19:48:46 +01:00
Sebastian Castro
401db8fce3 chat: Adds placeholder to input. Translate stick button 2019-02-22 19:48:08 +01:00
muxator
0ad8291ae7 hooks: restore Internet Explorer 11 compatibility.
Compatibility with IE11 regressed in 23eab79946 while working for #3488.
That commit made use of modern js syntax, not supported by IE11.

- Removed arrow functions, replaced with normal functions.
- Removed the spread operator (<...iterable>) and the "new Set()" construct,
  replaced with _.uniq()

At some point IE11 compatibility will be dropped.
Ditching it now, for such a small gain, is not wise.

Fixes #3500.
2018-11-28 20:03:39 +01:00
Sebastian Castro
fc629e49d9 skins:colibris fixes #3514 hide sidediv and "show line number" option on mobile 2018-11-28 15:01:12 +01:00
Sebastian Castro
2ce195747b skins: Fixes #3510 show/hide line numbers 2018-11-15 11:34:32 +01:00
Sebastian Castro
4c7ae65ac4 colibris: use a darker default font and do not use OpenDyslexic 2018-11-08 21:56:41 +01:00
Sebastian Castro
385ca8771b colibris: various improvements, including author_hover, cursortrace plugins 2018-11-08 21:56:40 +01:00
Sebastian Castro
39ad22f78f colibris: style timeslider page 2018-11-08 21:56:39 +01:00
Sebastian Castro
8343afde84 colibris: move ep_embedded_hyperlinks style to plugin itself 2018-11-08 21:56:38 +01:00
Sebastian Castro
948e9e4e10 colibris: responsive layout depending on plugins activated 2018-11-08 21:56:30 +01:00
Sebastian Castro
413f46b085 colibris: minor improvements 2018-11-08 21:56:29 +01:00
Sebastian Castro
e8c229cc65 colibris: add style for ep_embedded_hyperlink plugin 2018-11-08 21:56:29 +01:00
Sebastian Castro
9205b551df colibris: fix plugin ep_comments style 2018-11-08 21:56:28 +01:00
Sebastian Castro
af641c3b3d colibris: minor improvements 2018-11-08 21:56:27 +01:00
Sebastian Castro
8881a2a61f colibris: style plugin ep_tables2 2018-11-08 21:56:26 +01:00
Sebastian Castro
24b46984d4 colibris: Style ep_set_title_on_pad 2018-11-08 21:56:18 +01:00
Sebastian Castro
dad6c217ef colibris: improvements 2018-11-08 21:56:17 +01:00
Sebastian Castro
3f761121b2 colibris: improve colibris responsive 2018-11-08 21:56:15 +01:00
Sebastian Castro
6cc499bcce colibris: add new skin, initial commit
Needs further development: responsive, plugins, configuration...
2018-11-08 21:56:14 +01:00
Sebastian Castro
d3d1fd21bb fonts: add pencil, link and table icon
Preparatory work for introducing colibris skin
2018-11-08 21:56:13 +01:00
Sebastian Castro
e80f9a6f59 pad.css: group togheter three very similar rules.
a) these rules:
  [class^="icon-"]:before
  [class*=" icon-"]:before

b) were the same as this one:
  [data-icon]:before

except the rules in b) had a "content: attr(data-icon)" rule, too.

This commit groups all of them together, and gets rid of the "attr(data-icon)".

The commit that introduced these rules in the first place, and that are now
partially reverted, was 9aea689438 (move tiny bit
of font awesome we actually use into pad.css) from 2014-11-19.

Preparatory work for introducing colibris skin
2018-11-08 21:56:11 +01:00
Sebastian Castro
63ec2d8cc2 font picker: improve the font picker (closes #3451)
Preparatory work for introducing colibris skin
2018-11-08 21:56:10 +01:00