Commit graph

1212 commits

Author SHA1 Message Date
David Mehren
58f321ce29 Add dark mode toggle in mobile view
Fixes #2534

Signed-off-by: David Mehren <git@herrmehren.de>
2022-08-22 08:52:49 +02:00
David Mehren
d1f2a028b4
1.9.4 release notes
Signed-off-by: David Mehren <git@herrmehren.de>
2022-07-10 22:02:17 +02:00
Sheogorath
dd539273fb fix(migrations): Remove unexpected shell call
This patch removes the call of `/usr/bin/env` when calling the migration
script in favour of using the processes own nodejs invocation path.

This should drop the requirement for `/usr/bin/env` to exist on a
system/in a container that runs hedgedoc.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2022-05-17 14:04:02 +02:00
David Mehren
d26dcd04a1
Adapt code for eslint-config-standard 17
Signed-off-by: David Mehren <git@herrmehren.de>
2022-05-01 21:19:44 +02:00
David Mehren
e222225866 Drop support for Node.js 12
Signed-off-by: David Mehren <git@herrmehren.de>
2022-05-01 21:03:19 +02:00
David Mehren
680e6917af
Add warning about MariaDB charset changes to changelog
Signed-off-by: David Mehren <git@herrmehren.de>
2022-04-10 21:49:35 +02:00
David Mehren
5154598557
Update changelog for 1.9.3
Signed-off-by: David Mehren <git@herrmehren.de>
2022-04-10 21:49:23 +02:00
Erik Michelson
c99d30931d Remove duplicated jQuery selectors
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2022-04-10 21:24:30 +02:00
Erik Michelson
0093aa4783 Fix GitLab snippet export
The snippet export broke due to two reasons.
First of all, the request to GitLab fail in the
default configuration due to the CSP not being
set properly. This commit adds the configured
GitLab base url to the connect-src directives.
The second problem is a change in the GitLab API
spec. Instead of `code` and `file_name` the
GitLab API now requires an `files` array with
`content` and `file_path` entries per snippet.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2022-04-10 21:24:30 +02:00
David Mehren
e0021036ae
Fix missing inline authorship colors
The hex2rgb function seems to previously have been available globally.
It probably got lost in the great Webpack refactoring and nobody noticed
 that.

 This copies the function into its own file (to make importing it easy)
 and adds an import in index.js.

 Fixes https://github.com/hedgedoc/hedgedoc/issues/2248

Signed-off-by: David Mehren <git@herrmehren.de>
2022-04-08 12:13:37 +02:00
Tilman Vatteroth
61e092e8af Force change of aria-hidden when modal shows or hides
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2022-04-03 22:52:53 +02:00
Tilman Vatteroth
bb4acb02bc Improve aria tags for view mode labels
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2022-04-03 22:40:07 +02:00
David Mehren
101bedaecd bin/manage_users: Always treat pass argument as string
Fixes #1945

Signed-off-by: David Mehren <git@herrmehren.de>
2022-04-03 22:14:27 +02:00
Moritz Schlarb
e6fc9f01a3 Allow SAML authentication provider to be named
Using `CMD_SAML_PROVIDERNAME` and the respective auth provider objects
in the configuration structures.

Signed-off-by: Moritz Schlarb <schlarbm@uni-mainz.de>
2022-03-20 19:59:53 +01:00
Tilman Vatteroth
cc0c469c2d
Add error message to log if database cannot be reached
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2022-02-04 11:49:51 +01:00
Erik Michelson
8705c4abd1
Update tests and changelog
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2022-01-07 18:21:33 +01:00
David Mehren
a72f2455ca
Add release notes for 1.9.2
Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-03 20:31:17 +01:00
David Mehren
1baf7db914
Add changelog entry
Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-03 10:35:01 +01:00
Yannick Bungers
d676008ff7
Merge pull request #1855 from hedgedoc/release/1.9.1 2021-12-02 22:18:49 +01:00
Tilman Vatteroth
22ecc7bb0d
Add release notes for 1.9.1
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-02 22:14:31 +01:00
David Mehren
381d360d58
Fix mermaid import
Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-02 19:11:39 +01:00
David Mehren
489f785992
Set global timeout for Ajax operations
`ajaxSetup()` sets the default values for future Ajax operations.

See also
https://api.jquery.com/jQuery.ajaxSetup/
https://api.jquery.com/jquery.ajax/

Signed-off-by: David Mehren <git@herrmehren.de>
2021-11-04 20:49:53 +01:00
Tilman Vatteroth
d7986b1920
Refactor existing code to add the configured domain to connect-src
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2021-09-16 19:43:20 +02:00
David Mehren
ebc58a71cf
Add translators to release notes
Signed-off-by: David Mehren <git@herrmehren.de>
2021-09-13 22:11:33 +02:00
David Mehren
07d447757a
Update release notes for 1.9.0
Signed-off-by: David Mehren <git@herrmehren.de>
2021-09-13 22:11:33 +02:00
David Mehren
30722503c5
Update release notes for 1.9.0-rc1
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-29 17:55:19 +02:00
David Mehren
c2691210af
Update FAQ link in features page
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-26 20:12:09 +02:00
David Mehren
f2cce60761
Remove embedding from feature page
We discourage allowing HedgeDoc to be embedded into other pages in the
FAQ.
Therefore, we should not advertise this feature, especially as it needs
a non-standard config.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-26 20:11:46 +02:00
David Mehren
7729cc49a7
Drop support for MS SQL Server
Sequelize generates invalid SQL for the 'fix-enum' migration from 2018.
Since nobody has complained about this issue since then, we can just
drop support for SQL Server.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-23 17:45:45 +02:00
Erik Michelson
2c180517fd
Add changelog snippet
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2021-08-18 22:59:13 +02:00
Erik Michelson
d641954c73
Ignore local installed fonts
There were several reports of HedgeDoc not looking correctly when having some variants of fonts locally installed which HedgeDoc uses. The only way to fix this for the users was to remove the locally installed font or update them to another variant.
As we use woff font files which aren't very heavy in terms of file-size, it seems reasonable to fetch them always from the server (or the local browser cache).

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2021-08-18 22:47:22 +02:00
David Mehren
957d7d553e
Merge pull request #1394 from hedgedoc/remove-cdn 2021-08-15 20:11:26 +02:00
David Mehren
a865ed0822
Merge pull request #1538 from hedgedoc/fix/secure_cookies 2021-08-15 00:42:52 +02:00
David Mehren
8973e85ba6
Hardcode YouTube and Vimeo URLs to HTTPS
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:31 +02:00
David Mehren
d56ff5bdf3
Fix slideshare CSP error by always using HTTPS
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:31 +02:00
David Mehren
832f3522b3
Add new CSP config options to release notes
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:22:31 +02:00
David Mehren
4526542944
Replace Cloudflare links in exported HTML
Emoji images are now converted to data URLs

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:09:53 +02:00
David Mehren
515fed3db0
Remove unused Google Fonts import
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:09:53 +02:00
David Mehren
3b00601872
Inline CSS & JS into HTML export template
Previously, the HTML export template `html.hbs` included CDN links
for the HTML and CSS resources.

This commit enables Webpack to create a new `htmlexport.html` at
build-time, which includes all resources inline.
That template is then used as before by the frontend to be populated
with the rendered note content.

The tradeoff is that each exported .html file is about 5.6 MB in size,
as we need to inline all fonts (icons & emojis).

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:09:53 +02:00
Tilman Vatteroth
9498ee6bfe
Remove cdn support
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2021-08-15 00:09:53 +02:00
David Mehren
7b00a59661
Set secure flag for non-session cookies
This adds the secure flag to all cookies that are set
in the frontend for storing various settings.
If `SameSite=none` is set (like when embedding the instance is allowed),
 the `secure` flag is necessary to set any cookie.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-15 00:08:31 +02:00
David Mehren
b8c3703c2f
Fix endless loop on shutdown when DB can't be reached
The shutdown handler calls `checkAllNotesRevision` on a 100 ms
interval. If the database connection is broken, this will return
an error. Previously, this error was effectively ignored and resulted
in an endless loop printing out the error message every 100 ms.

This improves the error handling by terminating the process with a
nonzero exit code when an error was encountered 30 times. The loop
interval is also increased to 200 ms, giving the database 6 seconds
total time to recover in case of intermittent issues.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-14 23:47:26 +02:00
David Mehren
4ad5c705c4
Add changelog entry for DB auto-reconnect
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-14 22:23:26 +02:00
David Mehren
b719ce79db
Fix crash while getting current git commit
HedgeDoc crashed with
`uncaughtException: ENOENT: no such file or directory`
on startup, when `.git/ref/heads` did not contain
a file for the current branch. This seems to happen
regularly with current Git versions.

This fixes the crash by first trying to use the `git` executable for
getting the current commit SHA (before running our own parsing code)
and introducing a separate check to prevent accessing a nonexistent
file in `.git/ref/heads`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-14 16:08:55 +02:00
Tilman Vatteroth
c767bad386
Make anchor links base uri independent
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2021-07-26 22:29:33 +02:00
David Mehren
7ff685933e
Lazy-load highlight.js
This commit moves the import of highlight.js into a `require.ensure`
block, that is only executed when a code-block is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

The call to `hljs.listLanguages()` in `index.js` is also replaced
by a static list. This is important, as `index.js` would otherwise
need to import highlight.js, which would cause the quite big
library to be included into nearly every entrypoint, needlessly
increasing the transferred code size.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:27 +02:00
David Mehren
5b8b76135b
Lazy-load viz.js
This commit moves the import of viz.js into a `require.ensure` block,
that is only executed when a graphviz diagram is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

To ensure that graphviz code-blocks are not treated as normal
code-blocks while the chunk is loading, a corresponding check is added
to `finishView`.

The library is also removed from the Webpack config file, as it only
is used at one place in extra.js, which is handled by Webpack
without any extra config.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:26 +02:00
David Mehren
1c023e7881
Lazy-load abcjs
This commit moves the import of abcjs into a `require.ensure` block,
that is only executed when a abc diagram is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

To ensure that abc code-blocks are not treated as normal
code-blocks while the chunk is loading, a corresponding check is added
to `finishView`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:26 +02:00
David Mehren
938afbddc3
Replace handlebars with string.replace
The html.hbs template does not contain any logic,
so we can replace the lib with good old string.replace calls.
This significantly reduces the bundle size, as we don't have to ship
a full template engine to the client.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:29:26 +02:00
David Mehren
b45b8b9c0d
Lazy-load mermaid
This commit moves the import of mermaid into a `require.ensure` block,
that is only executed when a mermaid diagram is actually present
in a note. Webpack automatically splits the library into a separate
chunk and loads that on demand.

To ensure that mermaid code-blocks are not treated as normal
code-blocks while the chunk is loading, a corresponding check is added
to `finishView`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-11 09:26:03 +02:00
David Mehren
960f5c1b22
Merge pull request #1375 from hedgedoc/feature/yeet_google_analytics 2021-06-08 14:54:03 +02:00
David Mehren
0c6482abc5
Add release notes for CSP changes
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 22:57:12 +02:00
David Mehren
fa1ed66088
Load abcjs from npm package
This also loads abcjs without script-loader.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
fddd97391b
Load gist-embed without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
1150c72fa7
Load handlebars without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
a98d184f2c
Load mermaid without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
bd62e79f7d
Load ot without script-loader
The ot library is tricky to load with Webpack, as it writes
it's functions into a global `ot` object and does not export anything.
I got it working using `exports-loader` to put the `ot` object
into a CommonJS export and then forcing Webpack to only
load using CommonJS.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
4f4a4cb747
Load jquery-textcomplete without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:37 +02:00
David Mehren
2515ad962b
Load inline-attachment without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:35 +02:00
David Mehren
cf867daf99
Load Idle.js without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:23 +02:00
David Mehren
0e7a9df97d
Load jquery-ui resizable from npm package
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:23 +02:00
David Mehren
e17cc6440f
Load codemirror and codemirror-spell-checker without script-loader
Signed-off-by: David Mehren <git@herrmehren.de>
2021-06-07 20:59:20 +02:00
Tilman Vatteroth
41b9ab956c
Replace vimeo meta data api
Vimeo deprecated the v2 api and recommends to
use https://developer.vimeo.com/api/oembed/videos

Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
2021-05-15 21:25:03 +02:00
David Mehren
81d73b2db9
Add release notes for 1.8.2
Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-11 21:28:10 +02:00
David Mehren
4a0216096a
Escape custom Open Graph tags
HedgeDoc allows to specify custom Open Graph tags using the
`opengraph` key in the YAML metadata of a note.

These are rendered into the HTML delivered to clients using `ejs` and
its `<%-` tag. This outputs the variable unescaped into the template
and therefore allows to inject arbitrary strings,
including `<script>` tags.

This commit changes the template to use ejs's `<%=` tag instead,
which automatically escapes the variables content,
thereby mitigating the XSS vector.

See also https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gjg7-4j2h-94fq

Co-authored-by: Christoph (Sheogorath) Kern <sheogorath@shivering-isles.com>
Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-09 19:21:27 +02:00
David Mehren
3e836d815b
Fix typo in release notes
Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-06 22:37:47 +02:00
David Mehren
1b1b328d49
Add release notes for 1.8.1
Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-06 22:24:02 +02:00
David Mehren
2c12feb127
Fix 1.8.0 changelog
CVE-2021-29475 has been fixed since
HedgeDoc 1.5.0, instead of 1.6.0

Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-06 21:34:30 +02:00
David Mehren
dc1f621eb8
Merge pull request #1233 from hedgedoc/fix/insertOnStartOfLines
Fix insertOnStartOfLines behaviour
2021-05-06 21:16:22 +02:00
Erik Michelson
7f8be22e97
Fix click handler for numbered task lists
The regex for tasklists in 1.x didn't include upper-case x/X letters nor ordered lists (1. [ ] abc).
This commit changes the regex to allow both.

Signed-off-by: Erik Michelson <opensource@erik.michelson.eu>
2021-05-05 23:34:03 +02:00
David Mehren
e4b2b6ff73
Fix insertOnStartOfLines behaviour
A bug in insertOnStartOfLines lead to duplicated text,
if the cursor was not at the start of a line.

This fixes the behaviour of insertOnStartOfLines to always use
the complete first and last line of the selection,
even if they were only partially selected.

Fixes #1231

Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-05 22:57:49 +02:00
David Mehren
30a91b6fd7
Add release notes for 1.8.0
Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-03 22:26:08 +02:00
Erik Michelson
0d943d1284
Extract list of supported languages in separate file
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2021-04-26 21:45:31 +02:00
David Mehren
0bf97f30c4
Add changelog for 1.8.0-rc1
Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-26 21:45:31 +02:00
David Mehren
837cf59ef9
Add support for freshly imported languages
New languages: bg, fa, gl, he, hu, oc, pt-br

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-26 21:42:06 +02:00
David Mehren
e4c8f869f0
Add translators to the list of contributors for 1.8.0-rc1
Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-26 21:42:06 +02:00
David Mehren
2faf5b6974
Merge pull request #1150 from hedgedoc/feature/prometheus_metrics 2021-04-25 20:34:03 +02:00
David Mehren
c8e2117452
Merge pull request #1167 from hedgedoc/maintenance/master/remove_node_10 2021-04-25 20:10:46 +02:00
David Mehren
cbe7b03b59
Document new Prometheus endpoint
Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-25 20:06:56 +02:00
David Mehren
e1df30bd5c
Raise minimum required Node.js version to 12
As Node 10 will be EOL at April 30th, we should stop supporting
and/or promoting the usage of that version.

See also https://endoflife.date/nodejs

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-22 22:52:38 +02:00
Philip Molares
049ac32cc9 Changelog: Mention removal of node-imgur
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-22 22:51:41 +02:00
Philip Molares
82aa36177f Features.md: Change tag explanation
Explain tags in the features.md with yaml metadata, instead of the
heading syntax.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-28 19:02:30 +02:00
David Mehren
2ea40bb98d
Merge pull request #1022 from hedgedoc/fix/translate
[1.x] Templates: Remove lang and add translation parameter
2021-03-18 21:36:24 +01:00
Philip Molares
8e6aab0145 Templates: Remove lang and add translation parameter
Since the interface is not always in english, we mostly removed the lang attribute from all html tags. Since the error messages in error.ejs are not translated, but always in english, there the global lang="en" should be kept.
Also in the slide and editor template the div, which contains the user generated text, has the attribute translate="no" now, to avoid unwanted translations.
Since on the publish view (pretty.ejs) only the user generated content is shown, we set the lang to the language defined in yaml (or 'en') as a default, but that was also moved to the corresponding markdown div instead of html.

Fixes #881
See also #437

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-16 10:48:44 +01:00
David Mehren
73a83f3ed6
Add release notes entry for #969
Signed-off-by: David Mehren <git@herrmehren.de>
2021-03-06 10:35:34 +01:00
David Mehren
0f7f11e4f3
Fix HTML clipboard import
jQuery's .html() method escapes contained text (e.g. '<' becomes
'&lt;'). This confuses the turndown parser, which then only performs
unescaping, but does not convert to markdown.
By using .text() instead, the unescaped content is returned and turndown
can correctly generate markdown.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-16 22:06:45 +01:00
Philip Molares
136d895d15 Linter: Fix all lint errors
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-02-15 12:15:14 +01:00
Yannick Bungers
b01421c470
Merge pull request #841 from hedgedoc/renovate/master-ejs-3.x 2021-02-13 20:03:45 +01:00
David Mehren
788e7d460a
Update webpack config and JS import for spin.js v4
Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-12 23:47:58 +01:00
David Mehren
b468fb623b
Switch to ejs 3 compliant imports
Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-09 20:27:39 +01:00
Tilman Vatteroth
9f59a73049
Fix wrong acces to slide options
If the slide options in the frontmatter are empty
or not present, then slideOptions object in the
parsed JSON is undefined. This triggers an
exception when the sanitized slide options object
is built.

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>
2021-02-02 13:27:37 +01:00
Erik Michelson
40d30baa03
Improved CSS in night-mode
A general invert-filter is applied to all pre elements in night mode. As diagrams are embedded inside pre tags, they're inverted as well. For sequence-diagrams and flow-charts this looks well, if we wouldn't additionally set the stroke and text color to white in night-mode. These additional white rules invert the already inverted diagram again and make it not good visible. The graphviz and abc embeddings aren't really optimized to be inverted, therefore they're now excluded from invertion and stay in day mode.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2021-01-28 12:30:47 +01:00
Tilman Vatteroth
3eb64cff55
Delete slide options that are not defined
Reveal.js doesn't set the default value of an option in the provided config object
if the key is set with "undefined" as value. This leads to a broken slide mode,
because some critical settings are missing.

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>
2021-01-15 21:18:23 +01:00
David Mehren
e9d4587344
Bump version to 1.7.2
Signed-off-by: David Mehren <git@herrmehren.de>
2021-01-15 20:37:30 +01:00
David Mehren
2b8aac289a
Merge pull request #727 from hedgedoc/fix/slideOptionsSanitation 2021-01-14 21:57:07 +01:00
Philip Molares
8e611e42ee added theme to the sanitization of slideOptions
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-01-14 16:42:53 +01:00
Philip Molares
a52982c7d2 fixed a problem that the last line of code becomes covered by status bar and can't be moved without changing the note.
Thanks to @mhdrone for reporting this and suggesting the fix

fixes #724

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-01-14 11:51:32 +01:00
Philip Molares
1546786c63 changed the SCRIPT_END_PLACEHOLDER regex to case insensitive
this was suggested by @TobiasHoll in https://github.com/hackmdio/codimd/issues/1648

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-01-14 11:35:17 +01:00
Philip Molares
35b0d39a12 added sanitation to the slideMode in frontmatter
This should prevent the issue mentioned in https://github.com/hackmdio/codimd/issues/1648

Specifically left out are
- dependency (user can't really include anything anyway, because CSP forbids most domains)
- autoSlideMethod (nothing our users should be able to change as they won't write JS to be affected by this)
- keyboard (this let's users write arbitrary code and seems therefore to problematic)

See:
https://github.com/hakimel/reveal.js/blob/3.9.2/README.md#configuration
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-01-14 11:18:09 +01:00
David Mehren
5b3d62e494
Fix typo in release notes
Signed-off-by: David Mehren <git@herrmehren.de>
2020-12-27 21:21:12 +01:00