github/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2024-11-25 11:16:31 -05:00
Code Issues Projects Releases Packages Wiki Activity

Disable PDF export due to security issue

Browse source 
As a temporary fix, to keep you and your users save, this patch disables
the PDF export feature. Details of the attack along with a fix for
future versions of CodiMD will be released in future.

I hope you can live with this solution for this release because I'm
super short on time and the alternative would be to ship no fix at all.
This appears to be the better solution for this release.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This commit is contained in:
Sheogorath 2019-08-15 23:05:02 +02:00
parent e574ae7588
commit c178947402
No known key found for this signature in database
GPG key ID: 1F05CC3635CDDFFD
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
lib/config/index.js
View file

@ -189,6 +189,12 @@ switch (config.imageUploadType) {
] ]
} }
// Disable PDF export due to security issue
if (config.allowPDFExport) {
config.allowPDFExport = false
logger.warn('PDF export was disabled for this release to mitigate a critical security issue. This feature will hopefully become available again in future releases.')
}
// generate correct path // generate correct path
config.sslCAPath.forEach(function (capath, i, array) { config.sslCAPath.forEach(function (capath, i, array) {
array[i] = path.resolve(appRootPath, capath) array[i] = path.resolve(appRootPath, capath)