Commit graph

242 commits

Author SHA1 Message Date
John McLear
83e28ec031
docs: correct name for callback function 2020-11-26 10:10:43 +00:00
Richard Hansen
cedd27e4fe plugins: Default the module name to the plugin name 2020-11-13 20:30:27 +00:00
Richard Hansen
6c07229d38 docs: Revise plugin documentation 2020-11-13 20:30:27 +00:00
Richard Hansen
cc8dbb07fd docs: Wrap long lines
Also add blank lines around section headings and code blocks.
2020-11-13 20:30:27 +00:00
Richard Hansen
6a8563eeab import/export: Simplify exportEtherpadAdditionalContent processing
Also:
  * Improve parallelization
  * Refine the documentation
2020-11-10 23:02:43 +00:00
Richard Hansen
68a91f5e24 HTML export: Move padId to context object property 2020-11-10 07:13:26 +00:00
John McLear
881d8b8d95
pluginfw: Hook to include additional body in HTML exports (#4469)
* hook, needs docs

* docs
2020-11-06 13:48:59 +00:00
John McLear
3fa58efede
pluginfw: Export .etherpad hooks (#4466)
* export support

* proper prefix

* just a basic example, needs working on still

* docs

* comments shouldnt be hard coded
2020-11-06 13:48:25 +00:00
Richard Hansen
91268e14b7 PadMessageHandler: Rename client to socket
The `client` variable is actually a socket.io Socket object. Rename it
to reduce confusion.
2020-11-02 20:39:08 +00:00
chandi
30b1273853 docs: fix key in padUpdate context 2020-10-26 23:43:09 +00:00
Richard Hansen
36aceb3aba hooks: Rewrite callAll and aCallAll for consistency
Rewrite the `callAll` and `aCallAll` functions to support all
reasonable hook behaviors and to report errors for unreasonable
behaviors (e.g., calling the callback twice).

Now a hook function like the following works as expected when invoked
by `aCallAll`:

```
exports.myHookFn = (hookName, context, cb) => {
  cb('some value');
  return;
};
```
2020-10-24 16:08:50 +01:00
chandi
94cb000e8f
plugins: include more data within padUpdate hook (#4425)
* Including more data at pad update event

* docs: new context fields in padUpdate

Co-authored-by: Pedro Beschorner Marin <pedrobmarin@gmail.com>
2020-10-21 18:04:03 +01:00
Richard Hansen
a4927095ae CSP: Disable the indexCustomInlineScripts hook 2020-10-11 20:31:00 +01:00
John McLear
66df0a572f
Security: FEATURE REMOVAL: Remove all plain text password logic and ui (#4178)
This will be a breaking change for some people.  

We removed all internal password control logic.  If this affects you, you have two options:

1. Use a plugin for authentication and use session based pad access (recommended).
1. Use a plugin for password setting.

The reasoning for removing this feature is to reduce the overall security footprint of Etherpad.  It is unnecessary and cumbersome to keep this feature and with the thousands of available authentication methods available in the world our focus should be on supporting those and allowing more granual access based on their implementations (instead of half assed baking our own).
2020-10-07 13:43:54 +01:00
Richard Hansen
ba6bdf35be Make the aceAttribClasses hook harder to misuse 2020-10-07 10:37:56 +01:00
Richard Hansen
bf9d613e95
feature: New user-specific readOnly and canCreate settings (#4370)
Also:
  * Group the tests for readability.
  * Factor out some common test setup.
2020-09-28 11:22:06 +01:00
Richard Hansen
180983736d security: Enable authorize plugins to grant read-only access 2020-09-27 22:55:49 +01:00
Richard Hansen
304318b618 webaccess: Move pre-authn authz check to a separate hook
Before this change, the authorize hook was invoked twice: once before
authentication and again after (if settings.requireAuthorization is
true). Now pre-authentication authorization is instead handled by a
new preAuthorize hook, and the authorize hook is only invoked after
the user has authenticated.

Rationale: Without this change it is too easy to write an
authorization plugin that is too permissive. Specifically:

  * If the plugin does not check the path for /admin then a non-admin
    user might be able to access /admin pages.
  * If the plugin assumes that the user has already been authenticated
    by the time the authorize function is called then unauthenticated
    users might be able to gain access to restricted resources.

This change also avoids calling the plugin's authorize function twice
per access, which makes it easier for plugin authors to write an
authorization plugin that is easy to understand.

This change may break existing authorization plugins: After this
change, the authorize hook will no longer be able to authorize
non-admin access to /admin pages. This is intentional. Access to admin
pages should instead be controlled via the `is_admin` user setting,
which can be set in the config file or by an authentication plugin.

Also:
  * Add tests for the authenticate and authorize hooks.
  * Disable the authentication failure delay when testing.
2020-09-27 21:19:58 +01:00
Richard Hansen
ab5934cbda webaccess: Split authFailure hook into authnFailure and authzFailure
This makes it possible for plugins to return different pages to the
user depending on whether the auth failure was authn or authz.
2020-09-26 19:37:11 +01:00
Richard Hansen
02757079c0 security: Enable authorize plugins to grant modify-only access 2020-09-26 18:36:36 +01:00
Richard Hansen
53fd0b4f98 webaccess: Return 401 for authn failure, 403 for authz failure
This makes it possible for reverse proxies to transform 403 errors
into something like "upgrade to a premium account to access this
pad".

Also add some webaccess tests.
2020-09-24 10:41:58 +01:00
Richard Hansen
1bb44098df PadMessageHandler: Move handleMessage hooks after access check
Move the handleMessageSecurity and handleMessage hooks after the call
to securityManager.checkAccess.

Benefits:

  * A handleMessage plugin can safely assume the message will be
    handled unless the plugin itself drops the message, so it doesn't
    need to repeat the access checks done by the `handleMessage`
    function.
  * This paves the way for a future enhancement: pass the author ID to
    the hooks.

Note: The handleMessageSecurity hook is broken in several ways:

  * The hook result is ignored for `CLIENT_READY` and `SWITCH_TO_PAD`
    messages because the `handleClientReady` function overwrites the
    hook result. This causes the client to receive client vars with
    `readonly` set to true, which causes the client to display an
    immutable pad even though the pad is technically writable.
  * The formatting toolbar buttons are removed for read-only pads
    before the handleMessageSecurity hook even runs.
  * It is awkwardly named: Without reading the documentation, how is
    one supposed to know that "handle message security" actually means
    "grant one-time write access to a read-only pad"?
  * It is called for every message even though calls after a
    `CLIENT_READY` or `SWITCH_TO_PAD` are mostly pointless.
  * Why would anyone want to grant write access when the user visits a
    read-only pad URL? The user should just visit the writable pad URL
    instead.
  * Why would anyone want to grant write access that only lasts for a
    single socket.io connection?
  * There are better ways to temporarily grant write access (e.g., the
    authorize hook).
  * This hook is inviting bugs because it breaks a core assumption
    about `/p/r.*` URLs.

I think the hook should be deprecated and eventually removed.
2020-09-23 08:26:47 +01:00
Richard Hansen
a000a93dc6 Refactor startup/shutdown for tests
* `src/node/server.js` can now be run as a script (for normal
    operation) or imported as a module (for tests).
  * Move shutdown actions to `src/node/server.js` to be close to the
    startup actions.
  * Put startup and shutdown in functions so that tests can call them.
  * Use `await` instead of callbacks.
  * Block until the HTTP server is listening to avoid races during
    test startup.
  * Add a new `shutdown` hook.
  * Use the `shutdown` hook to:
      * close the HTTP server
      * call `end()` on the stats collection to cancel its timers
      * call `terminate()` on the Threads.Pool to stop the workers
  * Exit with exit code 0 (instead of 1) on SIGTERM.
  * Export the HTTP server so that tests can get the HTTP server's
    port via `server.address().port` when `settings.port` is 0.
2020-09-22 11:07:21 +01:00
Joas Souza
8c04fe8775
Feature: Copy Pad without history (#4295)
New feature to copy a pad without copying entire history.  This is useful to perform a low CPU intensive operation while still copying current pad state.
2020-09-16 19:24:09 +01:00
Richard Hansen
b80a37173e security: Fix authorization bypass vulnerability
Before, a malicious user could bypass authorization restrictions
imposed by the authorize hook:

 * Step 1: Fetch any resource that the malicious user is authorized to
   access (e.g., static content).
 * Step 2: Use the signed express_sid cookie generated in step 1 to
   create a socket.io connection.
 * Step 3: Perform the CLIENT_READY handshake for the desired pad.
 * Step 4: Profit!

Now the authorization decision made by the authorize hook is
propagated to SecurityManager so that it can approve or reject
socket.io messages as appropriate.

This also sets up future support for per-user read-only and
modify-only (no create) authorization levels.
2020-09-15 21:40:25 +01:00
Richard Hansen
80639fdc6a webaccess: Pass settings.users to the authenticate hook
Authentication plugins almost always want to read and modify
`settings.users`. The settings can already be accessed in a few other
ways, but this is much more convenient.
2020-09-15 19:26:24 +01:00
Richard Hansen
362b567276 docs: Revise documentation for handleMessage and handleMessageSecurity 2020-09-15 19:25:04 +01:00
Richard Hansen
9f288480e8 docs: Revise hooks overview section 2020-09-05 20:34:47 +01:00
Richard Hansen
55f201a2aa docs: Document the authFailure hook 2020-09-05 12:37:46 +01:00
Richard Hansen
f0b7dc7c53
pluginfw: PadMessageHandler: Pass socket.io Socket object to clientVars hook (#4245)
Also revise the clientVars hook documentation.
2020-09-05 10:51:39 +01:00
Richard Hansen
4c0ab8a14e
docs: Document the authorize hook (#4233) 2020-09-04 18:52:25 +01:00
Richard Hansen
aee1c3e7c5
docs: Document the authenticate hook (#4232) 2020-08-27 12:57:38 +01:00
Daniel Krol
ca6da2c724
Fix doc typo (#4187) 2020-07-21 13:22:31 +01:00
b_b
66a56234fa
docs: index hooks / ref #3978 (#4077) 2020-06-03 10:55:44 +01:00
Daniel Krol
61c7bb9699
feat(i18n) Custom i18n strings (#4000)
* Custom i18n strings (and some code formatting)

* Documentation for per-instance l10n overwrites
2020-05-19 13:21:31 +01:00
muxator
4816785aef doc: in the Docker example with custom plugins, replace ep_codepad -> ep_comments_page
Prefer promoting ep_comments_page, since it has a wider audience and is better
maintained.
2020-05-13 23:16:51 +02:00
b_b
35f0217056
typo on index.html hooks (#3982)
just a typo, maybe the smallest commit in this repo :p
2020-05-13 11:25:57 +01:00
Mikk Andresen
c074dfeff2 docs: basic styles for tables
This is a cosmetic fix for PR #3921 (109aa2d489).
Discussion on #3563
2020-05-03 21:56:28 +02:00
muxator
1aebbe8892 docs: also mention the infos we have about sessionID cookie 2020-04-24 03:06:13 +02:00
Mikk Andresen
109aa2d489 docs: add cookies section
Closes #3563
2020-04-24 03:06:13 +02:00
muxator
d1eb108ede README.md: losslessly reduce the size of the PNG images
It's not much, but these images will hopefully be downloaded many times. The
smaller they are, the lowest the latency will be.

Command:
    optipng {etherpad_basic.png,etherpad_full_features.png}

BEFORE:
    $ du -sch *.png
    16K     etherpad_basic.png
    104K    etherpad_full_features.png
    120K    total

AFTER:
    $ du -sch *.png
    12K     etherpad_basic.png
    92K     etherpad_full_features.png
    104K    total
2020-04-23 22:29:58 +02:00
Sebastian Castro
1003d9c40e
Update gif demo (#3924)
Include parallel writing with two users
2020-04-23 16:45:33 +01:00
Paul Tiedtke
85adaa44d8 docker: make settings fully configurable via env vars
Now every setting in the official Etherpad container will be configurable via
environment variables.
2020-04-21 04:44:56 +02:00
muxator
8d39cc4db2 docker: fill in the default values in the documentation 2020-04-21 04:44:56 +02:00
muxator
a0b5e515aa docker: switch to table layout in the docs about the available settings
In this way, we also gain an explicit place for the default setting (still not
filled in).

No functional changes.
This is in preparation of a future commit by Paul Tiedke.
2020-04-21 04:44:56 +02:00
muxator
ca3d095d35 docker: in the db documentation, specify that we are not going to include every single variable a driver may want 2020-04-21 04:44:56 +02:00
muxator
f08d517625 docker: in the documentation, reorganize categorically the available parameters
No functional changes.
This is in preparation of a future commit by Paul Tiedke.
2020-04-21 04:44:56 +02:00
Sebastian Castro
11f88a9b36 Update Readme with new screenshots
closes #2140
closes #3779
2020-04-19 18:05:59 +02:00
muxator
5ade38c86b docker: build & run the container in production mode
This is leaner (no development dependencies are included in the container) and
faster (among other things, assets are minified & compressed).
2020-04-19 04:41:29 +02:00
muxator
5acbdb83e5 docker: allow to control import/export rate limiting parameters
The newly introduces environment variables are IMPORT_EXPORT_RATE_LIMIT_WINDOW
and IMPORT_EXPORT_MAX_REQ_PER_IP.
2020-04-14 03:36:13 +02:00