github/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2024-11-22 17:56:30 -05:00
Code Issues Projects Releases Packages Wiki Activity
3160 commits 39 branches 47 tags 112 MiB
Commit graph

3160 commits

This branch
This branch
All branches
Author SHA1 Message Date
David Mehren
7f3c04c9fc
SAML: Use privateKey option 
The old `privateCert` option was removed in
https://github.com/node-saml/passport-saml/pull/569

Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-17 18:46:00 +02:00
Renovate Bot
1119b30535
Update dependency passport-saml to v3 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-17 16:30:27 +00:00
David Mehren
3658d1aab2
Merge pull request #1286 from hedgedoc/renovate/master-optimize-css-assets-webpack-plugin-6.x 
Update dependency optimize-css-assets-webpack-plugin to v6 (master)
 2021-05-17 18:29:09 +02:00
Renovate Bot
f9f5f51204
Update dependency optimize-css-assets-webpack-plugin to v6 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-17 02:44:55 +00:00
David Mehren
6b95833404
Merge pull request #1282 from hedgedoc/fix-vimeo 
Replace vimeo meta data api
 2021-05-16 21:52:40 +02:00
Tilman Vatteroth
41b9ab956c
Replace vimeo meta data api 
Vimeo deprecated the v2 api and recommends to
use https://developer.vimeo.com/api/oembed/videos

Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
 2021-05-15 21:25:03 +02:00
David Mehren
3762c6a00d
Merge pull request #1279 from hedgedoc/renovate/master-linters 
Update dependency eslint-plugin-import to v2.23.2 (master)
 2021-05-15 20:49:15 +02:00
Renovate Bot
c460f9c9f8
Update dependency eslint-plugin-import to v2.23.2 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-15 16:49:05 +00:00
David Mehren
8b374d8c19
Merge pull request #1267 from hedgedoc/release/1.8.2 2021-05-11 21:41:11 +02:00
David Mehren
32e31ac1e3
Bump version to 1.8.2 
Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-11 21:28:10 +02:00
David Mehren
81d73b2db9
Add release notes for 1.8.2 
Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-11 21:28:10 +02:00
David Mehren
01dad5821e
Merge pull request from GHSA-gjg7-4j2h-94fq 
Fix XSS in Open Graph & User metadata
 2021-05-11 21:13:25 +02:00
David Mehren
4cc9b3abe5
Merge pull request #1259 from hedgedoc/renovate/master-lock-file-maintenance 
Lock file maintenance (master)
 2021-05-11 19:42:43 +02:00
Renovate Bot
716808fa95
Lock file maintenance 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-11 17:15:20 +00:00
David Mehren
65bf66adc3
Merge pull request #1263 from hedgedoc/renovate/master-mermaid-8.x 
Update dependency mermaid to v8.10.1 (master)
 2021-05-11 19:13:35 +02:00
Renovate Bot
0b997b540a
Update dependency mermaid to v8.10.1 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-10 17:39:12 +00:00
David Mehren
f552b14e11
Sanitize username and photo URL 
HedgeDoc displays the username and user photo at various places
by rendering the respective variables into an `ejs` template.
As the values are user-provided or generated from user-provided data,
it may be possible to inject unwanted HTML.

This commit sanitizes the username and photo URL by passing them
through the `xss` library.

Co-authored-by: Christoph (Sheogorath) Kern <sheogorath@shivering-isles.com>
Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-09 19:28:44 +02:00
David Mehren
4a0216096a
Escape custom Open Graph tags 
HedgeDoc allows to specify custom Open Graph tags using the
`opengraph` key in the YAML metadata of a note.

These are rendered into the HTML delivered to clients using `ejs` and
its `<%-` tag. This outputs the variable unescaped into the template
and therefore allows to inject arbitrary strings,
including `<script>` tags.

This commit changes the template to use ejs's `<%=` tag instead,
which automatically escapes the variables content,
thereby mitigating the XSS vector.

See also https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gjg7-4j2h-94fq

Co-authored-by: Christoph (Sheogorath) Kern <sheogorath@shivering-isles.com>
Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-09 19:21:27 +02:00
David Mehren
87c83dcba5
Merge pull request #1246 from hedgedoc/fix/heroku_pg_ssl 
Ignore Postgres SSL errors on Heroku
 2021-05-09 14:59:29 +02:00
David Mehren
24883f7d99
Merge pull request #1241 from hedgedoc/renovate/master-test-packages 
Update dependency mocha to v8.4.0 (master)
 2021-05-09 14:46:02 +02:00
David Mehren
396e651254
Merge pull request #1247 from hedgedoc/renovate/master-linters 
Update dependency eslint to v7.26.0 (master)
 2021-05-09 14:45:31 +02:00
Renovate Bot
e7110c6305
Update dependency mocha to v8.4.0 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-09 12:40:58 +00:00
Renovate Bot
165327ad59
Update dependency eslint to v7.26.0 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-09 12:40:44 +00:00
David Mehren
f545fbd9a1
Merge pull request #1250 from hedgedoc/renovate/master-pymdown-extensions-8.x 
Update dependency pymdown-extensions to v8.2 (master)
 2021-05-09 14:39:48 +02:00
Renovate Bot
1d5cd3cdc9
Update dependency pymdown-extensions to v8.2 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-08 17:26:14 +00:00
Yannick Bungers
db50bdf919
Merge pull request #1249 from hedgedoc/adjustSetup 
Docs: Add mention to install devDependencies
 2021-05-08 16:07:10 +02:00
Philip Molares
a4b4ebd80c Docs: Add mention to install devDependencies 
Before `yarn build` can be succesfully run, we need to install the devDependencies.
This is necessary, because `bin/setup` does not install the devDependencies…

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2021-05-08 13:47:31 +02:00
David Mehren
86be1243f8
Ignore Postgres SSL errors on Heroku 
The connection to Heroku's Postgres instances must use SSL,
 but not check the certificate.

 This adds the necessary configuration to the Heroku setup script.

Fixes #1245

Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-07 21:43:06 +02:00
David Mehren
3e836d815b
Fix typo in release notes 
Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-06 22:37:47 +02:00
David Mehren
71841d7d35
Merge pull request #1239 from hedgedoc/release/1.8.1 2021-05-06 22:31:39 +02:00
David Mehren
a897ef7dea
Update example config 
The development config now runs on http://localhost:3000 out-of-the-box.

The production config now makes clear that domain should be changed.

Both configs don't include `"linkifyHeaderStyle": "gfm"` anymore
to make the links on the homepage work.

Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-06 22:24:02 +02:00
David Mehren
0555d01f4a
Bump version to 1.8.1 
Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-06 22:24:02 +02:00
David Mehren
62452cda9a
Update maintainers list 
Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-06 22:24:02 +02:00
David Mehren
1b1b328d49
Add release notes for 1.8.1 
Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-06 22:24:02 +02:00
David Mehren
2c12feb127
Fix 1.8.0 changelog 
CVE-2021-29475 has been fixed since
HedgeDoc 1.5.0, instead of 1.6.0

Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-06 21:34:30 +02:00
David Mehren
d9604ce134
Merge pull request #1240 from hedgedoc/renovate/master-pin-dependencies 
Pin dependencies (master)
 2021-05-06 21:34:04 +02:00
Renovate Bot
3a8b4c9634
Pin dependencies 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-06 19:28:40 +00:00
David Mehren
4625276ef7
Merge pull request #1227 from hedgedoc/enhancement/esbuild 
Use esbuild to minify frontend JS
 2021-05-06 21:27:33 +02:00
David Mehren
c243859c45
Merge pull request #1237 from hedgedoc/renovate/master-mkdocs-material-7.x 
Update dependency mkdocs-material to v7.1.4 (master)
 2021-05-06 21:26:47 +02:00
David Mehren
dfaa6b25a7
Merge pull request #1236 from hedgedoc/renovate/master-webpack-cli-4.x 
Update dependency webpack-cli to v4.7.0 (master)
 2021-05-06 21:26:07 +02:00
David Mehren
cec032d151
Merge pull request #1223 from hedgedoc/fix/useSSL 
Automatically enable protocolUseSSL when useSSL is set
 2021-05-06 21:24:49 +02:00
David Mehren
aece96f539
Automatically enable protocolUseSSL when useSSL is set 
This makes the behavior consistent with the docs and
 saves the user from having to both set
 `useSSL` and `protocolUseSSL`.

Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-06 21:19:14 +02:00
David Mehren
140b2c261c
Merge pull request #1222 from hedgedoc/fix/upgrade_insecure_requests 
Fix upgradeInsecureRequests CSP directive
 2021-05-06 21:18:46 +02:00
David Mehren
dc1f621eb8
Merge pull request #1233 from hedgedoc/fix/insertOnStartOfLines 
Fix insertOnStartOfLines behaviour
 2021-05-06 21:16:22 +02:00
David Mehren
41c86d1cf1
Use esbuild to minify frontend JS 
This speeds up build times massively

Signed-off-by: David Mehren <git@herrmehren.de>
 2021-05-06 21:13:56 +02:00
Renovate Bot
24e2f62f1c
Update dependency webpack-cli to v4.7.0 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-06 19:10:17 +00:00
Renovate Bot
0ec7daf5f7
Update dependency mkdocs-material to v7.1.4 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2021-05-06 19:09:54 +00:00
David Mehren
ad7fadee17
Merge pull request #1226 from hedgedoc/enhancement/devDependencies 2021-05-06 21:08:44 +02:00
David Mehren
9d3902d208
Merge pull request #1234 from hedgedoc/fix/numbered-task-lists 
Fix click handler for numbered task lists
 2021-05-06 21:07:21 +02:00
Erik Michelson
7f8be22e97
Fix click handler for numbered task lists 
The regex for tasklists in 1.x didn't include upper-case x/X letters nor ordered lists (1. [ ] abc).
This commit changes the regex to allow both.

Signed-off-by: Erik Michelson <opensource@erik.michelson.eu>
 2021-05-05 23:34:03 +02:00