Commit graph

376 commits

Author SHA1 Message Date
John McLear
b480416375 toolbar: the "star" button no longer disappears when visiting a read-only pad
Before this patch, visiting the read-only URL for a random pad would remove
the "Save Revision" (the "star" icon) from all the other RW pads. The only way
to make it appear again was to restart the server.

This change does not fix the underlying bug: after visiting a read only link
the "star" button would still disapper, but it is explictly reinserted via an
ad-hoc condition.

Fixes #3702
2020-03-19 22:42:22 +01:00
John McLear
467fc11b72 fix 2020-03-14 21:58:26 +01:00
ahmadine
0a0b90c4d0 referer: change referrer policy. Stop sending referers as much as possible
Pull request with discussion: https://github.com/ether/etherpad-lite/pull/3636

What's already there:
* `meta name=referrer`: already done in 1.6.1:
  https://github.com/ether/etherpad-lite/pull/3044

  https://caniuse.com/#feat=referrer-policy
  https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta
  (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1])

The previous two commits (by @joelpurra) I backported in this batch:
* `<a rel=noreferrer>`: a pull request denied before:
  https://github.com/ether/etherpad-lite/pull/2498

  https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer
  https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types
  (Firefox>=37, I can't find more info about support)

This commit adds the following:
* `<a rel="noopener">`: fixing a not-so-well-known way to extract referer
  https://html.spec.whatwg.org/multipage/links.html#link-type-noopener
  (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge)

* `Referrer-Policy: same-origin`: the last bastion of referrer security
  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
  (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge)

meta name=referrer wasn't enough. I happened to leak a few referrers with my
Firefox browser, though for some browsers it could have been enough.

[1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it
    most probably incompatible (but I may be wrong on that, they may support
    both, but I have no way to test it currently). The next Edge release will be
    based on Chromium, so for that the Chrome version applies.
2019-11-25 00:05:40 +01:00
Joel Purra
2a44c83250 referer: exported html pads no longer leak URL/location through referer header
Exported HTML can, when loaded from disk or an online server, also leak the
location. Applying the `rel="noreferrer"` HTML5 standard mitigate the problem
for compatible browsers.

https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer

This commit was originally part of https://github.com/ether/etherpad-lite/pull/2498
2019-11-25 00:05:40 +01:00
muxator
28a3bba4c1 settings: fix incorrect implementation of conditional user creation.
The change that implemented #3648 (7c099fef5e) was incorrect, and resulted
in disabling every user at startup.

The problem was twofold:
1. _.filter() on an object returns an array of the object's enumerable values
   and strips out the keys, see: https://stackoverflow.com/questions/11697702/how-to-use-underscore-js-filter-with-an-object
   To filter an object, the function that needs to be used is _.pick();

2. The logic condition on userProperties.password was plain wrong (it should
   have been an AND instead of an OR).

This change corrects 1) and 2), and writes more specific logs when something
goes wrong.

Closes #3661.
2019-11-02 22:57:52 +01:00
muxator
c4564fba4b settings: rename a parameter. No functional changes.
Please note that the logic of this functionality is incorrect: this change is in
preparation of the next commit, which fixes it.
2019-11-02 23:12:35 +01:00
muxator
7c099fef5e settings: do not create a user if he has no password field, or if his password is null.
This will be used by the settings.json in the default Dockerfile to eschew
creating an admin user when no password is set.

Closes #3648.
2019-10-19 00:54:56 +02:00
Moritz Jordan
0a8e32563b Fix Unicode bug in HTML export 2019-08-12 00:41:17 +02:00
Tristram Gräbener
357780d573 Display the version in the web interface
In the settings drop-down this adds an “About” section that also shows
the commit if "exposeVersion" is set to true.

Fixes #2968
2019-04-15 23:17:34 +00:00
Tristram Gräbener
28a6f505c5 Parameters: the version is exposed in http header only when configured
Currently the version is exposed in a 'Server' http headers.

This commit allows to parameterize it in the settings. By defaults it is
not exposed.

Fixes #3423
2019-04-15 23:17:34 +00:00
muxator
75a0f339e1 Settings.js, express.js: trivial reformatting
Future commits by Tristram Gräbener will modify them.
2019-04-16 00:17:56 +02:00
muxator
dc7e49f89d Remove trailing whitespaces
Hoping to minimize future diffs. Not touching vendorized libraries.
2019-04-16 00:34:29 +02:00
muxator
c2d8ca212b utils/Minify.js: always call statFile() with an explicit value for "dirStatLimit"
In this way the only external call to statFile() provides an explicit value for
"dirStatLimit", and thus the initial check on "undefined" at the start of the
function could be removed (just added a comment for now).
2019-03-27 18:29:12 +01:00
muxator
cdd4978973 utils/Minify.js: removed unused parameter "next" in minify()
Found by the Typescript compiler when doing an experimental conversion.
2019-03-27 18:29:12 +01:00
muxator
5d067406b1 utils/Minify.js: removed unused parameter "redirectCount" in requestURI()
Found by the Typescript compiler when doing an experimental conversion.
2019-03-27 18:29:12 +01:00
muxator
2955740a6e Settings.js: support syntax for default values
+---------------------------+---------------+------------------+
| Configuration string in   | Value of      | Resulting confi- |
| settings.json             | ENV_VAR       | guration value   |
|---------------------------|---------------|------------------|
| "${ENV_VAR}"              | "some_string" | "some_string"    |
| "${ENV_VAR}"              | "9001"        | 9001             |
| "${ENV_VAR}"              | undefined     | null             |
| "${ENV_VAR:some_default}" | "some_string" | "some_string"    |
| "${ENV_VAR:some_default}" | undefined     | "some_default"   |
+---------------------------+---------------+------------------+

Mention this briefly in the main README.md, also.

Closes #3578.
2019-03-21 23:32:08 +01:00
muxator
c3bca6506e Settings.js: extracted into coerceValue() the logic for string -> number|bool conversion
This will be user in a later commit for implementing support for default values
2019-03-21 23:32:08 +01:00
muxator
59b1eed4a8 Settings.js: rephrased a log message 2019-03-21 23:32:08 +01:00
muxator
21ac37170e doc: rephrase settings.json.template and Settings.js
Better document current behaviour.
In this revision, ENV_VAR are supported, default values are not.
2019-03-21 23:32:08 +01:00
muxator
6d400050a3 Settings.js: support configuration via environment variables.
All the configuration values can be read from environment variables using the
syntax "${ENV_VAR_NAME}".
This is useful, for example, when running in a Docker container.

EXAMPLE:
   "port":     "${PORT}"
   "minify":   "${MINIFY}"
   "skinName": "${SKIN_NAME}"

Would read the configuration values for those items from the environment
variables PORT, MINIFY and SKIN_NAME.

REMARKS:
Please note that a variable substitution always needs to be quoted.
   "port":   9001,          <-- Literal values. When not using substitution,
   "minify": false              only strings must be quoted: booleans and
   "skin":   "colibris"         numbers must not.

   "port":   ${PORT}        <-- ERROR: this is not valid json
   "minify": ${MINIFY}
   "skin":   ${SKIN_NAME}

   "port":   "${PORT}"      <-- CORRECT: if you want to use a variable
   "minify": "${MINIFY}"        substitution, put quotes around its name,
   "skin":   "${SKIN_NAME}"     even if the required value is a number or a
                                boolean.
                                Etherpad will take care of rewriting it to
                                the proper type if necessary.

Resolves #3543
2019-03-11 08:11:30 +01:00
muxator
f96e139b17 Settings.js: factored out parseSettings()
No functional changes.
2019-03-11 08:11:30 +01:00
muxator
6353768256 Settings.js: factored out storeSettings()
Grouped copied & pasted code into a single function.
2019-03-11 08:11:30 +01:00
muxator
ab57edef33 Settings.js: exit gracefully if an invalid credentials.json is passed.
Before this commit, when passed a malformed credentials.json the application
crashed with a stack dump. Now we catch the error and fail in a controlled way
(like already done for settings.json).

Example of exception we no longer throw:
  MALFORMEDJSON
  ^

  SyntaxError: Unexpected token M in JSON at position 0
      at JSON.parse (<anonymous>)
      at Object.reloadSettings (<BASEDIR>/src/node/utils/Settings.js:390:24)
      at Object.<anonymous> (<BASEDIR>/src/node/utils/Settings.js:543:9)
      at Module._compile (module.js:635:30)
      at Object.Module._extensions..js (module.js:646:10)
      at Module.load (module.js:554:32)
      at tryModuleLoad (module.js:497:12)
      at Function.Module._load (module.js:489:3)
      at Module.require (module.js:579:17)
      at require (internal/module.js:11:18)
2019-03-11 08:11:30 +01:00
muxator
8fa52659f5 Settings.js: trivial rewording of abiword and soffice (libreoffice) error messages 2019-03-11 08:11:30 +01:00
muxator
d526c5ccca Settings.js: trivial reformatting 2019-03-11 08:11:30 +01:00
Ray Bellis
ccb49dcdc1 padDiff.js: convert to Promises/async 2019-01-31 14:38:56 +00:00
Ray Bellis
4622309dc2 TidyHtml.js: convert to promises
test case uses "nodeify" to convert the calls to TidyHtml back
into nodeback because it integrates better with the test framework
2019-01-31 13:42:41 +00:00
Ray Bellis
62345ac8f7 import/export: conversion to Promises/async
NB1: needs additional review and testing - no abiword available on my test bed
NB2: in ImportHandler.js, directly delete the file, and handle the eventual
     error later: checking before for existence is prone to race conditions,
     and does not handle any errors anyway.
2019-01-31 08:55:36 +00:00
Ray Bellis
5ef4a2d1d5 more thenify in node/utils/* 2019-01-22 17:30:33 +00:00
Ray Bellis
5d7162ac9a utils/ImportHtml.js: migrate to thenify 2019-01-22 14:58:25 +00:00
muxator
9497ee734f prepare to async: trivial reformatting
This change is only cosmetic. Its aim is do make it easier to understand the
async changes that are going to be merged later on. It was extracted from the
original work from Ray Bellis.

To verify that nothing has changed, you can run the following command on each
file touched by this commit:
  npm install uglify-es
  diff --unified <(uglify-js --beautify bracketize <BEFORE.js>) <(uglify-js --beautify bracketize <AFTER.js>)



This is a complete script that does the same automatically (works from a
mercurial clone):

```bash
#!/usr/bin/env bash

set -eu

REVISION=<THIS_REVISION>

PARENT_REV=$(hg identify --rev "${REVISION}" --template '{p1rev}')
FILE_LIST=$(hg status --no-status --change ${REVISION})
UGLIFYJS="node_modules/uglify-es/bin/uglifyjs"

for FILE_NAME in ${FILE_LIST[@]}; do
  echo "Checking ${FILE_NAME}"
  diff --unified \
    <("${UGLIFYJS}" --beautify bracketize <(hg cat --rev "${PARENT_REV}" "${FILE_NAME}")) \
    <("${UGLIFYJS}" --beautify bracketize <(hg cat --rev "${REVISION}"   "${FILE_NAME}"))
done
```
2019-02-08 23:20:57 +01:00
muxator
b34fc2de2b use Date.now() instead of new Date().getTime()
This is documented to be more performant.

The substitution was made on frontend code, too (i.e., the one in /static),
because Date.now() is supported since IE 9, and we are life supporting only
IE 11.

Commands:
  find . -name *.js | xargs sed --in-place "s/new Date().getTime()/Date.now()/g"
  find . -name *.js | xargs sed --in-place "s/(new Date()).getTime()/Date.now()/g"

Not done on jQuery.
2019-02-26 23:25:15 +01:00
muxator
46fdeb8dc4 ExportTxt.js: getPadTXT() does not need to be exported
This function is used only inside this module, and does not belong to its
external interface.
2019-02-22 23:32:10 +01:00
muxator
9d9b7c9faf NodeVersion.js: do not use callbacks, simplify calling style in server.js 2019-02-19 00:46:37 +01:00
muxator
631b23f7a2 utils/AbsolutePaths.js: do not break when running as a Windows manual install
A Windows manual install has the same directory layout of a normal Unix one
(e.g. the nice symlink node_modules/ep_etherpad-lite -> ../src).
Only when running from the pre-built Windows package the directory layout is
different (e.g. src is physically copied into node_modules/ep_etherpad-lite).
The previous version of the code wrongly assumed that all Windows installs would
be run from the pre-built pakage.

In this version the path search is the same on all platform. If it fails, and we
are on Windows, there is a fallback for the specific case of the pre-built
package.

Fixes #3550
2019-02-11 03:28:02 +01:00
muxator
78c057af31 NodeVersion.js: factor out require('semver') 2019-02-08 19:10:49 +01:00
muxator
5b88882e34 LibreOffice: add debugging log statements 2018-11-01 00:22:27 +01:00
muxator
4b8a0ff4ac LibreOffice: rename variables (conversion is generic and not PDF-specific) 2018-11-01 00:18:26 +01:00
muxator
73d09f1c6c LibreOffice: rephrase comments (conversion is generic and not PDF-specific) 2018-10-31 22:34:11 +01:00
muxator
fb1f8dd239 toolbar: missing var declaration
Without this, Etherpad would fail to start in strict mode:
  "ReferenceError: SelectButton is not defined"
2018-08-27 01:34:01 +02:00
muxator
27b3b0ecd2 logs: on the server, use template literals when possible
It's just synctactic sugar, but it is always better than executing string
concatenations in one's mind.

Do not do this with files in src/static, because we want to keep IE 11
compatibility.
2018-08-27 01:29:37 +02:00
muxator
0e972aaecf settings: reword some log messages 2018-08-27 01:56:33 +02:00
muxator
e34c74b24d skins: the settings class understands skinName. Send skinName value to the client
skinName must be a single string (no directory separators in it) pointing to an
existing directory under /src/static/skins.
In case these conditions are not met, its value is rewritten to "no-skin".

Also, the value of skinName if sent to the client via clientVars for allowing
its use it in the browser.
2018-08-26 21:17:04 +02:00
Luc Didry
2cc32d7fe9 Add --writer option to soffice convert command
If you edit `src/templates/export_html.html` to remove the
`<meta name="changedby" content="Etherpad">` tag[1], PDF export with
soffice has a bug: the first word of the pad is deleted and a blank page
is inserted as first page (the pad's text begins on the second page).
The `--writer` soffice option avoids that bug.

[1] you may want to delete that tag since it is inserted as a comment in
.doc or .odt soffice export.
2018-08-24 18:26:51 +02:00
muxator
9db5fd7884 AbsolutePaths: introduced isSubdir()
It can be used to check whether a user input or a configuration settings tries
to traverse the directory hierarchy, going out of its allowed bounds.

source: https://stackoverflow.com/questions/37521893/determine-if-a-path-is-subdirectory-of-another-in-node-js#45242825
2018-08-23 07:20:17 +02:00
muxator
ce14a99606 settings, APIHandler: use makeAbsolute() for locating APIKEY and SESSIONKEY 2018-08-23 07:02:45 +02:00
muxator
8247d5eef3 settings: use makeAbsolute() for locating settings.json and credentials.json
This should look to consistent locations when looking for relative paths,
without depending on current working directory.
For absolute paths, nothing changes.
2018-08-23 07:02:45 +02:00
muxator
435b2a4edf settings: the dirtyDb file path is interpreted using makeAbsolute()
Otherwise its position depended on process.cwd
2018-08-23 07:02:45 +02:00
muxator
5406472d65 AbsolutePaths: makeAbsolute() computes an absolute path from a relative one
The base is assumed to be exports.findEtherpadRoot(), without depending on
process.cwd.
2018-08-23 07:02:45 +02:00
muxator
1b938a7a40 settings: compute exports.root via AbsolutePaths.findEtherpadRoot()
First steps for fixing #3466.
2018-08-23 07:02:45 +02:00