Etherpad-lite relies on the user's browser to generate a random pad
name, but the current solution is not safe against collisions. In order
to generate unique pad names, the following modifications are made:
* use a PRNG instead of Math.random() and ensure uniform distribution
when selecting chars.
* choose the pad name length to achieve a specific number of bits of
security.
Closes: #3516
colibris: preparatory changes
This series consists of the preparatory changes done by @seballot on the Etherpad core code in order to prepare it for the introduction of the colibris skin (proposed in #3441).
They were extracted from #3496, isolating the modifications performed outside of skins/colibris.
The expected effects on Etherpad (and its default skin) should be none: any major deviation from the original behavior is to be considered a bug.
A followup series will merge the colibris skin itself.
a) these rules:
[class^="icon-"]:before
[class*=" icon-"]:before
b) were the same as this one:
[data-icon]:before
except the rules in b) had a "content: attr(data-icon)" rule, too.
This commit groups all of them together, and gets rid of the "attr(data-icon)".
The commit that introduced these rules in the first place, and that are now
partially reverted, was 9aea689438 (move tiny bit
of font awesome we actually use into pad.css) from 2014-11-19.
Preparatory work for introducing colibris skin
The documentation was written on 2011-08-03:
31067f163f: added a documentation for the database structure
The implementation using sha512 instead of bcrypt was committed two days later,
on 2011-08-10:
ce1012438e: added setPublicStatus, getPublicStatus, setPassword and isPasswordProtected
In installDeps.sh we have a bunch of code (from 2011) that checks for the
existence of jQuery and eventually downloads it, but since 1239ce7f28 (year
2012) jquery is vendorized in /src/static/js/jquery.js.
Also, stop mentioning curl as a dependency in the README.md
Fixes#3494
This commit implements the following behaviour:
1. adds a function clientPluginNames() to hooks.js (mimicking what is done in
static.js), which returns an array containing the list of currently installed
client side plugins. The array is eventually empty.
2. calls that function in pad.html at rendering time (thus server-side) to
populate a class attribute.
Example results:
- with no client-side plugins installed:
<div id="editorcontainerbox" class="">
- with some client-side plugins installed:
<div id="editorcontainerbox" class="ep_author_neat ep_adminpads">
Looking at the existing code (src/node/hooks/express/static.js#L39-L57), a
client-side plugin is defined as a plugin that implements at least a client side
hook.
NOTE: there is currently no support for notifying plugin removal/installation
to the connected clients: for now, in order to get an updated class list,
the clients will have to refresh the page.
Fixes#3488
