049231e4af
Feature/axios ( #5776 )
...
* Move from deprecated request package to axios.
* Fixed package.json
* Another check.
* Fixing npm - hopefully the last.
* Remove double parsing of JSON.
* Bump bundled npm to also get rid of request in the bundled npm.
* Revert "Bump bundled npm to also get rid of request in the bundled npm."
This reverts commit b60fa4f435c141bca332a5b344c36204eb0cc7b4.
2023-06-27 21:20:53 +02:00
1e98033632
Security: Fix revision parsing ( #5772 )
...
A carefully crated URL can cause Etherpad to hang.
2023-06-26 18:17:06 +01:00
88c0ab8255
ExportEtherpad: Support custom subkeys
2022-05-05 19:33:21 -04:00
4b2e2dd9f2
tests: Add tests for `exportEtherpadAdditionalContent` hook
2022-05-05 19:33:21 -04:00
7c6746612c
tests: Missing chat messages should cause check failure
2022-04-15 23:52:16 -04:00
06f0318dc4
Stream: New utility library for iterables
2022-04-15 19:14:59 -04:00
8053875d45
pad_utils: Factor out author token generation
2022-03-16 06:10:28 -04:00
cfb68e5725
pad_utils: Rate limit identical `warnDeprecated` calls
2022-02-27 02:55:35 -05:00
908175d1ca
pad_utils: Custom logger interface for `warnDeprecated`
2022-02-27 02:55:09 -05:00
b733ed9ab0
Pad: Convert line endings in text from `padDefaultContent` hook
2022-02-24 17:40:04 -05:00
cd43625be8
tests: Add some tests for `src/node/db/Pad.js`
2022-02-24 17:40:04 -05:00
b276eb0a23
PadMessageHandler: Improve message sanity checking
...
Use exceptions instead of silent drops so that the client can detect
the error and react appropriately.
2022-02-24 17:39:38 -05:00
32c82917e3
Merge branch 'master' into develop
2022-02-23 17:25:38 -05:00
ba370b0e05
PadMessageHandler: Don't trust user-provided `padId`
2022-02-23 16:11:21 -05:00
aa286b7dbd
API: Add optional `authorId` param to mutation functions
2022-02-19 14:55:42 -05:00
50fafe608b
tests: Basic test for `restoreRevision` API
2022-02-19 14:55:42 -05:00
945e6848e2
SessionStore: Delete DB record when session expires
...
This only deletes records known to the current Etherpad instance --
old records from previous runs are not automatically cleaned up.
2022-01-17 21:45:56 -05:00
72cd983f0f
SessionStore: Option to update DB record on `touch()`
2022-01-17 21:45:52 -05:00
b991948e21
SessionStore: Don't write DB record if already expired
2022-01-17 21:33:58 -05:00
4d498725c7
SessionStore: Improve cookie expiration check
...
* Don't mutate `sess.cookie.expires`.
* Allow `sess.cookie` to be nullish.
* Always compare `Date` objects.
2022-01-17 18:17:40 -05:00
928c598ecf
tests: Add SessionStore backend tests
2022-01-17 17:51:08 -05:00
d3984aa621
express: Move `preAuthorize` hook after `express-session`
...
The `ep_openid_connect` plugin needs access to session state before
authorization checks are made (to securely redirect the user back to
the start page when authentication completes). Now that the
`expressPreSession` hook exists, the rationale for moving
`preAuthorize` before the `express-session` middleware is gone.
This change undoes the following commits:
* bf35dcfc500b1ec20c5c30544b564e
2022-01-14 00:44:54 -05:00
02a56dc58c
PadMessageHandler: Allow `handleMessageSecurity` to grant one-time write access
2021-12-21 17:23:56 -05:00
696f9c3367
specialpages: New `/health` endpoint for health checking
...
This endpoint is intended to conform with:
https://www.ietf.org/archive/id/draft-inadarei-api-health-check-06.html
2021-12-21 17:19:56 -05:00
649fbdccf5
express: Move static handlers to `expressPreSession`
...
This avoids the need to exempt the paths from authentication checks,
and it eliminates unnecessary express-session state.
2021-12-20 20:08:19 -05:00
472eddc821
webaccess: Skip checks if `next` is called in `preAuthenticate`
2021-12-20 20:08:18 -05:00
fc498f0ae6
tests: Delete test pad before attempting import
2021-12-20 20:08:18 -05:00
02d1b90d30
tests: Factor out USER_CHANGES/ACCEPT_COMMIT helpers
...
This will make it possible for other tests to reuse the code.
2021-12-19 16:53:24 -05:00
cff089e54e
PadMessageHandler: Accept retransmissions of USER_CHANGES
2021-12-14 01:02:00 -05:00
a370cfa5c6
Pad: Don't create no-op revisions
2021-12-14 01:02:00 -05:00
dbacc73c36
tests: Basic USER_CHANGES backend tests
2021-12-14 01:02:00 -05:00
6cca27dea6
API: `getText` with old revision should only return text, not atext
...
Co-authored-by: Richard Hansen <rhansen@rhansen.org>
2021-12-05 18:50:39 -05:00
a02e45499d
Use the new AttributeMap and Changeset APIs
2021-11-28 23:47:27 -05:00
f00b1ae89b
Merge branch 'master' into develop
2021-11-28 23:10:45 -05:00
19909eae53
ImportEtherpad: Rigorously check imported data
2021-11-28 22:28:55 -05:00
23f8a12922
ImportEtherpad: Don't make any changes if data is bad
2021-11-28 22:28:55 -05:00
a2e77a7128
ImportEtherpad: Enforce single-pad records
2021-11-28 22:28:54 -05:00
00fc7c8e86
ImportEtherpad: Reject unknown DB records
2021-11-28 22:27:44 -05:00
fea7948b05
ImportEtherpad: Fix author info processing
2021-11-28 19:00:44 -05:00
777d045246
GroupManager: Clean up any mappings when deleting a group
2021-11-28 14:06:47 +00:00
dab881139d
Pad: Fix `copyPadWithoutHistory` apool corruption bug
2021-11-22 18:40:22 -05:00
ed78b56079
tests: Refine `copyPadWithoutHistory` tests
2021-11-22 18:40:22 -05:00
f1eb7a25a6
Changeset: Migrate to the new attribute API
2021-11-21 04:11:41 -05:00
f40d285109
tests: Refine contentcollector tests
2021-11-21 04:11:41 -05:00
263105d185
tests: Remove overly aggressive timeouts
2021-11-13 03:05:38 -05:00
3c6aef11bd
lint: Add `'use strict';`
2021-11-13 03:02:40 -05:00
26675c5019
chat: New `chatNewMessage` server-side hook
2021-11-01 01:54:29 -04:00
23a98e5946
tests: Refactor `waitForSocketEvent()` to improve readability
2021-11-01 01:54:29 -04:00
3132235f2c
tests: Rename `getSocketEvent()` to `waitForSocketEvent()`
2021-11-01 01:54:29 -04:00
65bd597053
tests: Move socket.io connection helpers to `common.js`
2021-11-01 01:54:28 -04:00
SamTV12345
John McLear
Richard Hansen