Commit graph

237 commits

Author SHA1 Message Date
Ray Bellis
ebb8a64e3c errorhandling.js: use promise db.doShutdown interface 2019-01-31 11:14:27 +00:00
Ray Bellis
96d875b4d1 padurlsanitize.js: rewritten to consume promises 2019-01-23 16:36:28 +00:00
muxator
b699621e5a padurlsanitize.js: invert a condition prior to refactoring
Extracted from Ray's work.
2019-02-09 00:05:21 +01:00
Ray Bellis
d5d28717c4 access controls: promisification
`getPadAccess()` (src/node/padaccess.js) is now "promise only", resolving to
`true` or `false` as appropriate, and throwing an exception if there's an
error.

The two call sites (padreadonly.js and importexport.js) updated to match.
2019-01-23 16:29:36 +00:00
Ray Bellis
23a3a079a6 tests.js: remove use of async.js
Use real `async` instead of async.js where applicable.
The `getPluginTests()` function was never truly async anyway because it only
contains calls to synchronous `fs` modules.
2019-01-23 16:21:40 +00:00
Ray Bellis
0c2d662541 plugins download and search: converted to Promises
Also fixed a bug where the system would make a request to the central server for
the plugin list for every search even if the list was already cached.
2019-01-23 12:24:53 +00:00
muxator
9497ee734f prepare to async: trivial reformatting
This change is only cosmetic. Its aim is do make it easier to understand the
async changes that are going to be merged later on. It was extracted from the
original work from Ray Bellis.

To verify that nothing has changed, you can run the following command on each
file touched by this commit:
  npm install uglify-es
  diff --unified <(uglify-js --beautify bracketize <BEFORE.js>) <(uglify-js --beautify bracketize <AFTER.js>)



This is a complete script that does the same automatically (works from a
mercurial clone):

```bash
#!/usr/bin/env bash

set -eu

REVISION=<THIS_REVISION>

PARENT_REV=$(hg identify --rev "${REVISION}" --template '{p1rev}')
FILE_LIST=$(hg status --no-status --change ${REVISION})
UGLIFYJS="node_modules/uglify-es/bin/uglifyjs"

for FILE_NAME in ${FILE_LIST[@]}; do
  echo "Checking ${FILE_NAME}"
  diff --unified \
    <("${UGLIFYJS}" --beautify bracketize <(hg cat --rev "${PARENT_REV}" "${FILE_NAME}")) \
    <("${UGLIFYJS}" --beautify bracketize <(hg cat --rev "${REVISION}"   "${FILE_NAME}"))
done
```
2019-02-08 23:20:57 +01:00
muxator
d5d428c4ee windows: allow graceful shutdown on Windows, too
Until Etherpad 1.7.5, process.on('SIGTERM') and process.on('SIGINT') were not
hooked up under Windows, because old nodejs versions did not support them.
This excluded the possibility of doing a graceful shutdown of the database
connection under that platform.

According to nodejs 6.x documentation, it is now safe to do so. This allows to
gracefully close the DB connection when hitting CTRL+C under Windows, for
example.

Source: https://nodejs.org/docs/latest-v6.x/api/process.html#process_signal_events

  - SIGTERM is not supported on Windows, it can be listened on.
  - SIGINT from the terminal is supported on all platforms, and can usually be
    generated with <Ctrl>+C (though this may be configurable). It is not
    generated when terminal raw mode is enabled.
2019-02-16 00:14:39 +01:00
muxator
391bd79e03 padurlsanitize: early return, no functional changes 2018-08-29 01:38:55 +02:00
muxator
d19436d044 adminsettings: early return, no functional changes. 2018-08-29 01:34:45 +02:00
muxator
27b3b0ecd2 logs: on the server, use template literals when possible
It's just synctactic sugar, but it is always better than executing string
concatenations in one's mind.

Do not do this with files in src/static, because we want to keep IE 11
compatibility.
2018-08-27 01:29:37 +02:00
muxator
9c990ab08a skins: finalize support for multiple skins
The old "static/custom" directory is replaced by "static/skins/<skinName>",
where <skinName> is taken from settings.json.
When no value is found, a default of "no-skin" is assumed, so that backward
compatibility is maintained.

The most evident security concerns have been addressed.

Closes #3471.
2018-08-26 21:17:04 +02:00
muxator
d1481041c2 specialpages: replace relative paths for sendfile() with absolute ones
This file uses it for robots.txt and favicon.ico.

This makes use of the new stable settings.root introduced with #3466, and will
be modified when introducing support for custom skins.
2018-08-23 23:39:38 +02:00
muxator
9d815c58b8 deprecations: get rid of DEP0005 about Buffer()
Similar code still lives in some dependent libraries.
It will be updated when upgrading the dependencies.

Fixes #3446
2018-08-14 19:45:03 +02:00
Muh Muhten
3cedf474e5 Fix misparse of port when binding Unix socket
The hostname:port of URIs used in Minify are currently bogus and refer
to localhost only for historical reasons; there's no reason to retain
them and omitting them avoids generating an invalid URI when "port" is
not an integer.

Context: settings.port is passed to express's listen; if not numeric, it
is used a filename for a Unix domain socket.
This allows e.g. starting a server to be reverse-proxied on a multi-user
system, using the filesystem to handle access control and avoiding need
to allocate port numbers.

Before this change, etherpad-lite starts without error when configured
to listen on a Unix domain socket in this manner. However, `pad.js` and
`ace2_common.js` are generated incorrecting, causing an error
"Uncaught Error: The module at "ep_etherpad-lite/static/js/rjquery" does not exist."
when loading the editor:

When settings.port is a non-numeric string, e.g. `etherpad.sock`, a URI
of the form `http://localhost:etherpad.sock/static/js/rjquery.js` is
generated and parsed to find the file needed. In this case, the file
searched for is `:etherpad.sock/static/js/rjquery.js`, rather than the
expected `static/js/rjquery.js`. No such file exists, and the required
code is silently omitted from the bundle.

As a workaround, hard-code a (meaningless) hostname which can be parsed
correctly, since the current code makes no use of it anyway.
2018-08-10 01:57:30 +02:00
Olivier Tétard
5b1e1f0c35 Fix typo in apicalls.js which prevents from importing isValidJSONPName. 2018-04-09 20:56:29 +02:00
John McLear
fa83de778c Password check fix 2018-04-07 10:31:47 +01:00
Peter 'Pita' Martischka
6d5dc93dbf merged 2018-04-07 10:23:49 +01:00
thomas
ffe24c3dd9
Update webaccess.js 2018-04-06 22:21:33 +02:00
Peter 'Pita' Martischka
a08c4383b8 check pad exists before importing / exporting 2018-04-04 21:48:32 +01:00
John McLear
f4f032afc0
Merge pull request #3297 from apenwarr/auth-sequence
Call authentication hooks before default basic authentication.
2018-04-03 13:41:51 +01:00
John McLear
18dd90139a
Merge pull request #3115 from noerw/redirect_fix
redirect /admin properly (fix #3114)
2018-04-03 13:10:36 +01:00
John McLear
bb40aa00be
Update express.js 2018-04-03 10:59:10 +01:00
John McLear
50bbcb87bb
Merge pull request #4 from nashe/jsonp_fix
Added a jsonp var checker
2018-04-03 10:29:52 +01:00
John McLear
8767410a36
be more strict on password check 2018-03-23 19:21:52 +00:00
Peter 'Pita' Martischka
dd7894d3c9 Added a jsonp var checker 2018-03-23 11:17:39 +00:00
Man Yue Mo
a2992b3624 fix jsonp checking. 2018-02-07 08:43:07 +00:00
Stefan
b292e137ed Added missing require for is-var-name 2018-02-03 12:33:33 +01:00
Robert Helmer
f56936c936 better sanitize jsonp 2018-01-30 12:52:19 -08:00
Avery Pennarun
e0582797f2 Call authentication hooks before default basic authentication.
This allows authenticators to do any extra session setup for a given user,
even if their username/password happens to match settings.json.
2017-12-31 12:32:50 +00:00
Rainer Rillke
f12debd5c7 Catch SIGTERM for graceful shutdown (#3266)
Shut down database connection and exit the node process
when SIGTERM is encountered. This is especially important
when nodejs is run as PID1, e.g. in a docker container.

Shutting down connections to clients (browsers) is beyond
this patche's scope.

Resolves #3265
2017-11-04 19:59:19 -02:00
Luiza Pagliari
cf686282ef Do not use cookie for pad shortcuts
Users still cannot choose which shortcuts they want to enable/disable,
so it does not make sense (yet) to have a cookie with that preference.

This can be reverted once we create an UI to change shortcuts, but
PLEASE PLEASE PLEASE do not read the cookie every time handleKeyEvent is
called!!!

This is an adjustment to #2891.
2017-05-11 12:26:14 -03:00
Luiza Pagliari
1ebcf0dc47 Merge pull request #2891 from bhldev/padShortcutDisable
Added pad shortcut disabling feature to settings.json
2017-05-11 11:29:25 -03:00
Sjoerd Langkemper
21a6e66e25 Remove deprecated comment
The session key is currently stored in SESSIONKEY.txt, so it is no longer reset
every time the server starts.
2017-01-26 09:59:09 +01:00
noerw
cc69e76200 redirect /admin properly (fix #3114) 2017-01-06 18:19:38 +01:00
Stefan
aefa617797 Merge branch 'develop' into improve_cookies 2016-12-20 21:31:11 +01:00
Nobody Really
97fd1ab2fe Added LibreJS support 2016-09-20 09:30:35 +02:00
Dan Bornstein
879ae7c67d Remove the noDocType argument, which was only ever passed as false. 2016-09-08 09:41:23 -07:00
Stefan
009b61b338 Make express-session cookie scheme dependent 2016-07-10 12:44:45 +02:00
Stefan
6b9711cb70 Fixed path check 2016-06-20 00:22:29 +02:00
John McLear
b3b17c2190 Merge pull request #2991 from LokeshN/deactivate-settings
Issue #2960 - deactivate settings.json
2016-06-13 14:41:30 +08:00
Stefan
4ea9c4f98d Add secure flag to express-session cookies 2016-06-08 21:15:26 +02:00
LokeshN
a8d5dc0693 Issue #2960 - deactivate settings.json
Deactivate settings.json in Admin dashboard
2016-05-22 21:12:21 +05:30
Stefan
835bca7967 Use fs.statSync instead of fs.existsSync (deprecated) 2016-05-16 16:51:12 +02:00
Brian Lim
26aeb7b705 Added pad shortcut disabling feature 2016-01-21 07:38:41 -05:00
Brian Lim
295672f598 Set language cookie on initial load 2016-01-17 21:44:03 -05:00
Chris Birk
d6033de0da Use new exportAvailable() check to include check for SOffice along with Abiword in importexport hook 2015-12-18 00:14:13 -06:00
Stefan
f6cebdad98 Fix decode error if pad name contains special characters and is sanitized 2015-10-08 20:46:15 +02:00
John McLear
818408cf49 other bits required for read only 2015-05-19 16:57:53 +01:00
Simon Gaeremynck
5a7750781b Use the cookie parser middleware 2015-05-07 18:35:21 +01:00