Modern browsers do not support (or will stop supporting) sameSite: none (or no sameSite attribute) without the Secure flag. As we don't want everyone to be able to make requests with our cookies anyway, this commit sets sameSite to strict. See https://developer.mozilla.org/de/docs/Web/HTTP/Headers/Set-Cookie/SameSite
Signed-off-by: David Mehren <dmehren1@gmail.com>
Adding translations for permissions for a possible 1.6.1 release doesn't
hurt but might helps some usecases of running CodiMD and we'll need the
translations in the new frontend anyway.
This patch adds the translations as well as the english local file.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
The revision view had a bug that clicking on a list entry would redirect
the user back to the index page instead of providing the revision diff.
This was cased by the baseurl which is now used as reference for hrefs.
Therefore when clicking on the `href="#"` this was actually pointing at
`<baseurl>#` which is usually the index page.
This patch simply removes the href from the list items and therefore the
link functionality. This fixes the whole problem by removing 9
characters from our source code.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Webpack now uses relative paths for resources linked from by static
snippets. A templated <base> tag has been introduced in headers
so app.js can set the base URL at runtime.
Signed-off-by: Enrico Guiraud <enrico.guiraud@cern.ch>
Because sandbox is whitelist attribute, attacker will be able to create iframe that has more permission than default.
Signed-off-by: RyotaK <49341894+ry0tak@users.noreply.github.com>
This makes the references consistent/compatible with GitHub,
GitLab, Pandoc and many other tools.
This behavior can be enabled in config.json with:
```
"linkifyHeaderStyle": "gfm"
```
Signed-off-by: hoijui <hoijui.quaero@gmail.com>
- image and URL properties are only included if
the server url is set, because opengraph
protocol does not support relative links
Signed-off-by: Erik Michelson <erik@liltv.de>
Thanks to our great translators that made it to translate the major
parts of CodiMD into Arabic!
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Do Not Track (DNT) is an old web standard in order to notify pages that
the user doesn't want to be tracked. Even while a lot of pages either
ignore this header or even worse, use it for tracking purposes, the
orignal intention of this header is good and should be adopted.
This patch implements a respect of the DNT header by no longer including
the optional Google Analytics and disqus integrations when sending a DNT
header. This should reduce outside resource usage and help to stay more
private.
This should later-on extended towards other document content (i.e.
iframe based content).
The reason to not change the CDN handling is that CDNs will be
deprecated with next release and removed in long term.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Since we are about to release it's time to finally fix our linting. This
patch basically runs eslint --fix and does some further manual fixes.
Also it sets up eslint to fail on every warning on order to make
warnings visable in the CI process.
There should no functional change be introduced.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
In order to have a better experience when linking to headlines based on
their ID, a patch[1] introduced a new CSS construct to add some space in
front of HTML tags with an id field. Therefore they would no longer be
hidden by a visible navbar.
This cause a regression bug by moving the rendered mathjax out of its
visible area. This patch fixes the problem by restricting the previous
change to headlines only.
[1]: commit c9af13cf34
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
As we are about to announce the community forum, we should provide a
link to it in the footer. This patch adds Discouse between Riot, GitHub
and Mastodon as platform to follow our progress.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
There was some awesome work by Hồng in the recent days who translated
CodiMD completely into Vietnamese language! This patch provides this
awesome contributions.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
As it may happens that the codemirror content flows underneath the
status bar, this patch should help to avoid it. It adds the size of the
status bar as margin-bottom so the codemirror window itself is forced
above the statusbar.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
When people link a section or use the ToC to scroll to it upwards, it
happens that those become hidden behind the navbar.
This patch adds a little hack from StackOverflow[1] in order to fix this
problem. By adding a pseudo element in front of any field that contains
an id, it's possible to add the needed space.
There was no negative impact found except of marking around the header
areas in the rendered view requires a bit preciser work. This needs some
more detailed testing.
[1]: https://stackoverflow.com/a/24298427
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
js-url is outdated and wurl is it's successor. This will fix some
vulnerabilities in the dependencies and also optimize the build process
by removing the external library toward internal tooling.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
We have a community forum and want to use it for users support and to
bring developers and end-users together. In order to achieve this, it
would be helpful to inform users about its existence.
This patch adds the community forum as resource to the help section and
aligns it along the Matrix channel and GitHub issue tracker.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
The old screenshot is quite dated since it's from the earlier days of
HackMD.
But we developed a lot in the recent years. Changed the name, added a
toolbar, moved buttons, and so on.
This patch should represent those changes in the front page.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
When introducing night mode the rule for the background of the view
switches seems to be generated from the view button.
This patch should change the introduced rule to fix for all default
buttons.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
After a long discussion, it turned out that CodiMD as community project
and HackMD as a company, have fundamental different views on the project
governance.
Due to this, it came to point where the decision for a fork was made.
After the fork and move towards an own organisation, this patch updates
all links inside the project to the new repositories.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Currently we have the odd situation to have two toolbars. One inside the
header and one in the editor.
Since we only show the image upload button when the editor is visible we
should move the upload button into the editor toolbar.
This patch does this by adding the image upload button besides the image
tag button.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Vladan[1] gave a hint about some minor problems with the capitalization
of language names.
This patch should fix most of them. and removes some "language" prefix
and suffixes which are not needed to make clear what people are
selecting here.
[1]: https://github.com/cvladan
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Since not all languages use the same word oder and we run into potential
issues, where the translation of powered by need to add something after
the CodiMD link, this should give us the needed flexiblity.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
HTML export was broken due to missing alt-attribute for emojis.
This patch adds the old alt-element style and restores the exportability
this way.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Thanks for the work of the translator Vladan we got a serbian
translation added! Those few changes will add serbian language support
for future CodiMD releases.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
The current speakerdeck implementation is broken. An alternative
implementation using oembed doesn't work due to CORS, which could be
solved by proxying the speakerdeck API, but we decided to not do this.
This patch provides the link to the speakerdeck presentation instead,
and this way doesn't break existing notes. This is right now the best
solution we could come up with.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Our socket.io version is 2.0.4 while the current socket.io version is
2.1.1.
This patch updates socket.io to version 2.1.1 and takes care of the CDN
client version.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
There are some places in our code that made it to be not translated.
This patch fixes some small translation problems and adds some static
strings in templates to translation.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
There is a new reveal.js version out. As we try to keep up with
upstream, time to integreate it.
This patch updates reveal.js in for CDN-using instances as well as the
ones using the libraries.
Checked that speaker view in slide mode still works, so no CSP change
needed.
https://github.com/hakimel/reveal.js/releases/tag/3.7.02d241b9300/lib/csp.js (L72-L74)
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
While experimenting with the ToC changes, it became obvious that anchors
for those unnamed headers don't work.
This patch fixes those links by running the autolinkify twice and make
sure linkify only adds links to non-empty ids.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Right now, the ToC has an undefined variable i that was an index in the
original ToC code. Since the major rewrite in
4fe0620853 it's a recursive function
without this index. The variable `i` was wrongly copied into its current
place from the old code.
This patch replaces the variable `i` with the index of the header
element. Fix the undefined variable problem.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Seems like ids in Firefox are case sensitive. So linking in the current
way fails.
This patch fixes the links by using the exact matching version of the
titles on the features page.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
most rules degraded to WARN, so we don't go insane. This will
change over time. The aim is to conform to a common style
Signed-off-by: Claudius Coenen <opensource@amenthes.de>
Since it's a very useful feature, we should mention it in multiple
locations.
So we mention it in the slide mode section of the features page.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
The yaml-metadata documentation should mention the type field. This is
also open for future extension.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
We have this awesome editing mode for slide shows. We just don't enable
it or tell anyone that it exists. Maybe we should do this.
This patch sets the type for the slide example.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Currently we only provide the version from `package.json`. This means
that during updates of instances, e.g. the demo instance, which runs
latest master instead of a stable release, changes are not reflected to
the webclient.
This patch adds a fullversion string that contains the current commit
and this way makes that clients are notified about changes.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
We can load the xss functions directly from the library instead of
loading them through the expose loader of webpack, this should simplify
the setup and maybe even improve speed a bit.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
The Regex introduced in the last commit[1], was already working quite
good. But still resulted in false positives for all URL that contained a
second `:`.
To fix this once and for all, we craft a simple, but long regex based on
all emoji names and use this to match them.
We could probably optimize it, but that should also be something the
regex engine itself can and should do.
[1]: 7e45533c75 (in this source tree)
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
The old regex, adapted from the other plugins, was a bit too open for
matching. This leads to matching something like: `This is a sentence:
[And something with a: in it.]()` which doesn't become a link anymore.
Because the match is: ` [And something with a`.
This patch provides a fix for the regex to only match non-space string
within the `:`'s.
References:
- Introducing commit:
2063eb8bdf
- Inspirational source of the original RegEx:
2063eb8bdf/public/js/extra.js (L1095)
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Codemirror provides various modes via keymapping. These are already
available by a menu in the interface. But they aren't mentioned
anywhere.
This patch provides some documentation about the editor modes and their
implications. Since they are a feature, the documentation is done on the
features page.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
We no longer use Gitter for development talk and similar. So we might
want to remove it?
This patch removes Gitter from README, help page and features page. And
replaces it in the help modal with POEditor, our translation platform.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Octicon no longer provides its CSS classes and this way is useless in
CodiMD. Replacing all used classes in the UI and remove it from build
system.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Currently we have some emojis that are autocompleted but won't show up
in the resulting document.
This patch adds all emojis that are pushed to Codemirror and applies
them to the markdown rendering process, so they become usable.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Right now we support code highlighting for rust, but it doesn't appear
in autocomplete of codemirror, because codemirror is not aware of it.
This patch lets highlightjs simply tell codemirror, what it supports and
adds this to the autocomplete list.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
The printing instructions seem to not be really clear. Linking the
reveal.js offical docs should help.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
With OpenID every OpenID capable provider can provide authentication for
users of a CodiMD instance. This means we have federated
authentication.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This patch replaces font-awesome with its fork called fork-awesome.
Besides the fact that the newer versions of font-awesome can't be
shipped with distros like debian due to license issues, fork-awesome
also provides more FOSS related icons and builds on top of version 4.7.x
of font-awesome, which we used until this patch.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
The noopener construct protects from some nasty clickjacking attacks. We
can apply them savely to all our links since we don't rely on the
previously used page.
Some more details: https://mathiasbynens.github.io/rel-noopener/
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Since the youtube video on our feature page seems to have vanished, this
patch replaces it with an video of the blender foundation
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Removing copyrigt sign since we are not copyrighting things.
Changing hackmd.io to codimd.org since HackMD is more and more dividing
from CodiMD and may brings up wrong expectations.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
We broke the follow us before by removing Facebook and Twitter. Adding
POEditor should fix it and help to attract new translators.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Apart from the uri versioning, one big change is the snippet visibility post data (visibility_level -> visibility)
Default gitlab api version to v4
Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
The ToC generated broken HTML with unclosed `<li>` tags. This got fixed
as well as some minor optimisation and adding list elements for the
subentries so the elements appear in the ToC while scrolling.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This replaces the existing iterative implementation of the ToC
generation with an recursive one.
This also solves the problem of skipped headers which causes wrong
leveling of them.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
We have some issues with night mode and the font color. This should fix
this in the permission table and the delete node modal. As well as some
picture styling.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
It wasn't possible to create unicode based URLs in freeurl mode, because
the noteid used for the websocket connection is double escaped. When we
decode it and let socketio-client reencode it, we get the real
shortid/noteid and can find the note in the database and open the
connection.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
It redirects the user to the print view of the document. I claim that
people should either be smart enough to use ctrl+P or ask someone who
knows how to print a webpage. I don't want to babysit our users.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Looks like I missed a few. This should be complete now. And make us
ready for the repo rename and merging.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Even when it looks a bit weird in first place to rename all internals
step by step, it makes sense to do so, because we run into confusion
afterwards.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Since static path is providing with a high expiration data, we provide
configs via API. This shouldn't add any noticeable load while making it
uncached and this way working again.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
First fixed some linting issues. Also optimized some functions to be
undoable with one ctrl+z.
This should also speedup some operations
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
We don't support it on CDN false instances, but it doesn't hurt to keep
it in for CDN-enabled instances
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This translation was contributed via POEditor by the user Basix.
Thanks a lot for your work!
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
As we use various services and integration we should provide an example
privacy policy.
It has to be adjust when using it to match your setup.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This adds the UI for the export feature introduced in
bcbb8c67c9
It allows to download all notes from the main page in the default user
submenu.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
In the current setup users could be tricked into deleting their data by
providing a malicious link like `[click me](/me/delete)`. This commit
prevents such an easy attack and need the user's deleteToken to get his
data deleted. In case someone requests his deletion by email you can
also ask him for this token.
We can add a GUI that shows it later on.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This provides the UI for the delete user feature introduced in
4229084c62
Placing of the user delete button is not perfect, but can be moved to an
own user tab later on.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
To be GDPR compliant we need to provide privacy statement. These should
be linked on the index page. So as soon as a document exist under
`public/docs/privacy.md` the link will show up.
Since we already add legal links, we also add Terms of Use, which will
show up as soon as `public/docs/terms-of-use.md` exists.
This should allow everyone to provide the legal documents they need for
GDPR and other privacy and business laws.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
It's sad but it's not working. For multiple releases this should be
already broken which shows how often it's used.
As there is also a security issue related to that, it's better to
remove the feature completely. Whoever wants to rewrite it, feel free to
go.
This commit removes the Google Drive integration from HackMD's Frontend
editor and this way removes the need to provide any API key and Client
ID in the frontend.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This temporarily removes the Upload from the UI as it's broken right
now.
Needs a refactoring and can be added in again later on by undoing this
commit.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
As an active part of the community prefers Matrix.org over Gitter, we
should link Matrix.org as a place to meet us.
As the matrix and gitter channels are interconnected. We don't loose any
message if a person decides to go for one or another.
We use an more universal way of translation to make it easier to provide
a link to various platforms.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Adding some documentation for night mode and upload times. Extend the
contact section for community support.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This commit should fix existing problems with Disqus and Google
Analytics enabled in the meta-yaml section of a note.
Before this commit they were blocked by the strict CSP. It's still
possible to disable the added directives using `addDisqus` and
`addGoogleAnalytics` in the `csp` config section.
They are enabled by default to prevent breaking changes.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Night mode provides a generally, dark interface. This fix provides the
needed CSS to also turn modal and panels into night mode design as well.
This mainly effects the help modal.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Right now the full title of an element is may not shown as the space of
the ToC is limited. With this path it'll be shower on hover and this way
provide more useful information.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
The night mode toggle doesn't get the right state after restore from
local storage. This results in the need to toggle twice to disable night
mode.
This patch adds the needed class so the toggleNightMode function gets
the right state on execution.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This refactors the configs a bit to now use camel case everywhere.
This change should help to clean up the config interface and make it
better understandable.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Right now the night mode is possible to set by a toggle in the menu bar
but needs to be re-enabled on every document switch, reload, etc.. This
is super annoying so we should keep this state in local storage or
a cookie.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
HTML5 provides a wide feature set of useful elements. Since Markdown
usually supports HTML it should be able to use these HTML5 tags as well.
As they were requested by some users and they where checked for being
safe, whitelisting them isn't a problem. To make the experience the same
as on GitHub when it comes to the basic look and feel of the rendered
markdown, some CSS was added to make the summary and the details tag
look like on GitHub.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This change allows all input modes of codemirror to use the information
from an input esc-key and make this way vim and sublime more
functional. To prevent this change from breaking the return from the
fullscreen mode, it catches the esc-key in this case. Hopefully this is
an acceptable solution.
As before the vim-mode is handled different in fulltext-mode as it is
esc-key heavy.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
