Commit graph

340 commits

Author SHA1 Message Date
Richard Hansen
8b28e00784 restructure: Prefix bin/ and tests/ with src/
This is a follow-up to commit
2ea8ea1275.
2021-02-05 21:52:08 +00:00
John McLear
2ea8ea1275 restructure: move bin/ and tests/ to src/
Also add symlinks from the old `bin/` and `tests/` locations to avoid
breaking scripts and other tools.

Motivations:

  * Scripts and tests no longer have to do dubious things like:

        require('ep_etherpad-lite/node_modules/foo')

    to access packages installed as dependencies in
    `src/package.json`.

  * Plugins can access the backend test helper library in a non-hacky
    way:

        require('ep_etherpad-lite/tests/backend/common')

  * We can delete the top-level `package.json` without breaking our
    ability to lint the files in `bin/` and `tests/`.

    Deleting the top-level `package.json` has downsides: It will cause
    `npm` to print warnings whenever plugins are installed, npm will
    no longer be able to enforce a plugin's peer dependency on
    ep_etherpad-lite, and npm will keep deleting the
    `node_modules/ep_etherpad-lite` symlink that points to `../src`.

    But there are significant upsides to deleting the top-level
    `package.json`: It will drastically speed up plugin installation
    because `npm` doesn't have to recursively walk the dependencies in
    `src/package.json`. Also, deleting the top-level `package.json`
    avoids npm's horrible dependency hoisting behavior (where it moves
    stuff from `src/node_modules/` to the top-level `node_modules/`
    directory). Dependency hoisting causes numerous mysterious
    problems such as silent failures in `npm outdated` and `npm
    update`. Dependency hoisting also breaks plugins that do:

        require('ep_etherpad-lite/node_modules/foo')
2021-02-04 17:15:08 -05:00
Richard Hansen
fdaacc44c8 pluginfw: Replace slide.asyncMap() with Promise.all() 2021-02-04 08:41:00 +00:00
John McLear
0cc8405e9c Bump minimum required Node.js version to 10.17.0
This makes it possible to use fs.promises.
2021-01-30 17:00:40 -05:00
Richard Hansen
877f0c5883 server: Use wtfnode to log reasons why node isn't exiting 2021-01-30 08:05:08 +00:00
Richard Hansen
89bcfa2b4a tests: Stop using nyc
There are some problems with nyc:
  * The coverage numbers aren't useful in our case because most of the
    code is executed outside the test process (the test code is mostly
    API client logic).
  * nyc messes with line numbers, which makes it much harder to debug
    problems.
  * We're seeing frequent SIGABRT crashes while nyc is printing the
    results table. I'm not sure if nyc is the cause of the crashes, or
    if it's making a race condition worse, or if the crashes have
    nothing to do with nyc, but we don't lose much by removing it so
    we might as well see if the crash frequency improves.
2021-01-29 09:17:17 +00:00
Richard Hansen
b02ab430fe Bump eslint-config-etherpad to 1.0.24 2021-01-29 01:10:58 -05:00
John McLear
3a19254f21 stale code: removed excanvas which was ie support for no canvas 2021-01-26 04:05:54 -05:00
John McLear
7768871f8f security: bumping socketio version due to vulnerability 2021-01-26 00:53:04 -05:00
John McLear
81b860bc35 tests: allow for longer timeout 2021-01-25 22:53:11 -05:00
John McLear
ee158b0fe5
bugfix: bump ueberdb to 1.2.5 to resolve #4645 which caused a users color not to be persistent 2021-01-23 13:54:50 +00:00
Richard Hansen
0ba833c632 db: Update ueberdb2 dependency 2021-01-15 22:37:18 +00:00
Richard Hansen
edbe6d5387 Bump ueberDB to get speed improvements 2021-01-11 09:23:08 +00:00
John McLear
04962bfe39
update ueberdb to 1.1.7 (#4633) 2021-01-07 04:16:13 -05:00
John McLear
d9262fccbd bump version 2020-12-23 16:18:28 -05:00
Richard Hansen
794dfb1863 lint: Bump eslint-config-etherpad and install its new deps 2020-12-17 22:18:29 +00:00
Richard Hansen
fc234d0088 lint: Bump eslint and eslint-config-etherpad versions 2020-12-16 22:09:48 +00:00
Richard Hansen
a4e2ea7a8c Add missing dependency on mime-types
mime-types is used by `src/node/utils/Minify.js` since commit
2c944eba34.
2020-12-14 20:31:35 +00:00
webzwo0i
0c7df88f8a
add rehype-minify-whitespace to package.json (#4544) 2020-12-05 12:16:25 +00:00
John McLear
de5e071294 path issue 2020-12-05 07:51:17 +00:00
John McLear
159b6a4ba1 database: bump ueberdb to 056 to ensure correct engine is used 2020-12-05 07:51:17 +00:00
Richard Hansen
2fdac836d0 lint: Bump eslint-config-etherpad to 1.0.13
Also bump eslint to 7.14.0.
2020-11-27 06:25:43 +00:00
Richard Hansen
a78d6605b7 lint: Configure ESLint 2020-11-24 20:06:12 +00:00
Viljami Kuosmanen
c502ca3259 Use isHttpError utility provided by http-errors
This new utility method was introduced in http-errors v1.8.0. Let's use
that instead of instanceof. This also upgrades the http-errors dependency
2020-10-25 10:45:58 +00:00
Richard Hansen
36aceb3aba hooks: Rewrite callAll and aCallAll for consistency
Rewrite the `callAll` and `aCallAll` functions to support all
reasonable hook behaviors and to report errors for unreasonable
behaviors (e.g., calling the callback twice).

Now a hook function like the following works as expected when invoked
by `aCallAll`:

```
exports.myHookFn = (hookName, context, cb) => {
  cb('some value');
  return;
};
```
2020-10-24 16:08:50 +01:00
Richard Hansen
661a89355f socketio: Mimic what Express does to get client IP address
This also makes it easier for plugins to get the client IP address.
2020-10-07 10:40:37 +01:00
Richard Hansen
3ab0f30ac8 cookies: Use js-cookie to read and write cookies
Rather than reinvent the wheel, use a well-tested library to parse and
write cookies. This should also help prevent XSS vulnerabilities
because the library handles special characters such as semicolon.
2020-10-04 08:57:44 +01:00
webzwo0i
ceb09ce99a
security: Support proxy with rate limiting and include CI test coverage for nginx rev proxy (#4373)
Previously Etherpad would not pass the correct client IP address through and this caused the rate limiter to limit users behind reverse proxies.  This change allows Etherpad to use a client IP passed from a reverse proxy.

Note to devs: This header can be spoofed and spoofing the header could be used in an attack.  To mitigate additional *steps should be taken by Etherpad site admins IE doing rate limiting at proxy.*  This only really applies to large scale deployments but it's worth noting.
2020-10-01 10:39:01 +01:00
John McLear
5964055dec
package updates: update deps and resolve some potential security issues (#4369) 2020-09-29 13:21:35 +01:00
Richard Hansen
23131a501c tests: Rewrite import/export tests to use async and supertest 2020-09-26 10:46:16 +01:00
Richard Hansen
0f6baac7b5
Revert "tests: Use wtfnode to determine why mocha isn't exiting" (#4315)
This reverts commit ae1142a799.

According to
https://github.com/ether/etherpad-lite/pull/4304#issuecomment-694833456
wtfnode always seems to exit with 0 even if the tests fail.
2020-09-22 22:47:26 +01:00
Richard Hansen
a000a93dc6 Refactor startup/shutdown for tests
* `src/node/server.js` can now be run as a script (for normal
    operation) or imported as a module (for tests).
  * Move shutdown actions to `src/node/server.js` to be close to the
    startup actions.
  * Put startup and shutdown in functions so that tests can call them.
  * Use `await` instead of callbacks.
  * Block until the HTTP server is listening to avoid races during
    test startup.
  * Add a new `shutdown` hook.
  * Use the `shutdown` hook to:
      * close the HTTP server
      * call `end()` on the stats collection to cancel its timers
      * call `terminate()` on the Threads.Pool to stop the workers
  * Exit with exit code 0 (instead of 1) on SIGTERM.
  * Export the HTTP server so that tests can get the HTTP server's
    port via `server.address().port` when `settings.port` is 0.
2020-09-22 11:07:21 +01:00
Stefan Mueller
299bd962b6 Update version to 1.8.6 and add changelog informations 2020-09-18 21:14:19 +02:00
webzwo0i
85f52a2f23
tests: Plugin backend tests in ci (#4314) 2020-09-18 16:28:42 +01:00
Richard Hansen
ae1142a799 tests: Use wtfnode to determine why mocha isn't exiting
If mocha hangs after running the tests, hit Ctrl-C and wtfnode will
print open files, open sockets, running timers, and running intervals.
Adding an `after` function that closes/stops all of those things will
ensure that mocha exits when it finishes running the tests.
2020-09-15 21:22:52 +01:00
Richard Hansen
9e6d3f3f63 tests: Add authentication, authorization bypass tests 2020-09-15 20:03:30 +01:00
John McLear
9f3cc7aae0 deps: update UeberDB to fix issue with Postgres which was causing 1.8.5 to fail on PG sites. 2020-09-15 13:15:28 +01:00
John McLear
c8361a211a bump ueber 2020-09-09 14:41:03 +01:00
Stefan Mueller
10402c2e2d Update version to 1.8.5 2020-09-08 21:56:20 +02:00
John McLear
7258d75cc5 bumping ueber 2020-09-08 16:03:15 +01:00
John McLear
40014d8230
Rate limit Socket IO communication - WIP (#4036)
Includes settings
    Includes i18n
    Includes a nice notification
    Disconnects on rate limit
    Includes feeding into metrics/stats
    Include console warn to server console.
2020-07-19 22:44:24 +01:00
John McLear
d1330a1e1c
Bugfix: Async bump part 2
Sorry, not sure what happened but having kids jump all over the keyboard while I do this probably didn't help... :|
2020-07-17 10:08:40 +01:00
John McLear
410d20417d
Bumping async (#4171)
Resolves #3940
2020-07-16 17:37:42 +01:00
John McLear
313bba09d6
Update ueberdb big update (#4149) 2020-07-05 11:05:32 +01:00
John McLear
f1e3aff72f stale code: use terser instead of uglify 2020-06-07 20:09:10 +00:00
John McLear
166e1371da socket.io bump to 2.3.0 2020-06-07 19:12:11 +00:00
John McLear
512a51149d Revert "Merge branch 'develop' of github.com:ether/etherpad-lite into develop"
This reverts commit 6fad0210f8, reversing
changes made to 128f3e15eb.
2020-06-07 18:46:41 +00:00
John McLear
564e8fee07 forcing back to last known stable before parent merge 2020-06-07 18:44:01 +00:00
John McLear
49cd270592 including terser, again 2020-06-07 17:09:48 +00:00
John McLear
0ab9e1e8c3 ffs npm how you get so broke 2020-06-07 16:53:49 +00:00