Commit graph

82 commits

Author SHA1 Message Date
Richard Hansen
794dfb1863 lint: Bump eslint-config-etherpad and install its new deps 2020-12-17 22:18:29 +00:00
Richard Hansen
fc234d0088 lint: Bump eslint and eslint-config-etherpad versions 2020-12-16 22:09:48 +00:00
Richard Hansen
edf647044c Update package-lock.json and src/package-lock.json 2020-12-14 20:31:35 +00:00
webzwo0i
0c7df88f8a
add rehype-minify-whitespace to package.json (#4544) 2020-12-05 12:16:25 +00:00
John McLear
159b6a4ba1 database: bump ueberdb to 056 to ensure correct engine is used 2020-12-05 07:51:17 +00:00
Richard Hansen
2fdac836d0 lint: Bump eslint-config-etherpad to 1.0.13
Also bump eslint to 7.14.0.
2020-11-27 06:25:43 +00:00
Richard Hansen
a78d6605b7 lint: Configure ESLint 2020-11-24 20:06:12 +00:00
Viljami Kuosmanen
c502ca3259 Use isHttpError utility provided by http-errors
This new utility method was introduced in http-errors v1.8.0. Let's use
that instead of instanceof. This also upgrades the http-errors dependency
2020-10-25 10:45:58 +00:00
Richard Hansen
36aceb3aba hooks: Rewrite callAll and aCallAll for consistency
Rewrite the `callAll` and `aCallAll` functions to support all
reasonable hook behaviors and to report errors for unreasonable
behaviors (e.g., calling the callback twice).

Now a hook function like the following works as expected when invoked
by `aCallAll`:

```
exports.myHookFn = (hookName, context, cb) => {
  cb('some value');
  return;
};
```
2020-10-24 16:08:50 +01:00
Richard Hansen
3ab0f30ac8 cookies: Use js-cookie to read and write cookies
Rather than reinvent the wheel, use a well-tested library to parse and
write cookies. This should also help prevent XSS vulnerabilities
because the library handles special characters such as semicolon.
2020-10-04 08:57:44 +01:00
webzwo0i
ceb09ce99a
security: Support proxy with rate limiting and include CI test coverage for nginx rev proxy (#4373)
Previously Etherpad would not pass the correct client IP address through and this caused the rate limiter to limit users behind reverse proxies.  This change allows Etherpad to use a client IP passed from a reverse proxy.

Note to devs: This header can be spoofed and spoofing the header could be used in an attack.  To mitigate additional *steps should be taken by Etherpad site admins IE doing rate limiting at proxy.*  This only really applies to large scale deployments but it's worth noting.
2020-10-01 10:39:01 +01:00
John McLear
5964055dec
package updates: update deps and resolve some potential security issues (#4369) 2020-09-29 13:21:35 +01:00
Richard Hansen
889a3f7261 Bump Etherpad version in src/package-lock.json 2020-09-26 19:37:05 +01:00
Richard Hansen
23131a501c tests: Rewrite import/export tests to use async and supertest 2020-09-26 10:46:16 +01:00
Richard Hansen
0f6baac7b5
Revert "tests: Use wtfnode to determine why mocha isn't exiting" (#4315)
This reverts commit ae1142a799.

According to
https://github.com/ether/etherpad-lite/pull/4304#issuecomment-694833456
wtfnode always seems to exit with 0 even if the tests fail.
2020-09-22 22:47:26 +01:00
Richard Hansen
ae1142a799 tests: Use wtfnode to determine why mocha isn't exiting
If mocha hangs after running the tests, hit Ctrl-C and wtfnode will
print open files, open sockets, running timers, and running intervals.
Adding an `after` function that closes/stops all of those things will
ensure that mocha exits when it finishes running the tests.
2020-09-15 21:22:52 +01:00
Richard Hansen
9e6d3f3f63 tests: Add authentication, authorization bypass tests 2020-09-15 20:03:30 +01:00
John McLear
9f3cc7aae0 deps: update UeberDB to fix issue with Postgres which was causing 1.8.5 to fail on PG sites. 2020-09-15 13:15:28 +01:00
John McLear
5dfae625b9 Package Lock update 2020-09-09 18:15:47 +01:00
Stefan Mueller
e64a269a65 Update version to 1.8.5 2020-09-08 22:09:56 +02:00
John McLear
7258d75cc5 bumping ueber 2020-09-08 16:03:15 +01:00
John McLear
40014d8230
Rate limit Socket IO communication - WIP (#4036)
Includes settings
    Includes i18n
    Includes a nice notification
    Disconnects on rate limit
    Includes feeding into metrics/stats
    Include console warn to server console.
2020-07-19 22:44:24 +01:00
John McLear
410d20417d
Bumping async (#4171)
Resolves #3940
2020-07-16 17:37:42 +01:00
John McLear
313bba09d6
Update ueberdb big update (#4149) 2020-07-05 11:05:32 +01:00
John McLear
f1e3aff72f stale code: use terser instead of uglify 2020-06-07 20:09:10 +00:00
John McLear
166e1371da socket.io bump to 2.3.0 2020-06-07 19:12:11 +00:00
John McLear
512a51149d Revert "Merge branch 'develop' of github.com:ether/etherpad-lite into develop"
This reverts commit 6fad0210f8, reversing
changes made to 128f3e15eb.
2020-06-07 18:46:41 +00:00
John McLear
564e8fee07 forcing back to last known stable before parent merge 2020-06-07 18:44:01 +00:00
John McLear
49cd270592 including terser, again 2020-06-07 17:09:48 +00:00
John McLear
0ab9e1e8c3 ffs npm how you get so broke 2020-06-07 16:53:49 +00:00
John McLear
4b37034f0c ugh attempt to overwrite package files due to weirdness 2020-06-07 16:38:50 +00:00
John McLear
b1ce372035 bump package lock 2020-06-07 13:57:58 +00:00
John McLear
0669280af0 Revert "socketio230"
This reverts commit fbb7b5123b.
2020-06-07 13:46:53 +00:00
John McLear
fbb7b5123b socketio230 2020-06-07 12:57:28 +00:00
John McLear
ea9a9cd883 Revert "Revert "stale: Terser instead of uglify (#4075)""
This reverts commit 423be7f081.
2020-06-07 10:08:11 +00:00
John McLear
423be7f081 Revert "stale: Terser instead of uglify (#4075)"
This reverts commit 552b6d7adb.
2020-06-05 23:55:14 +00:00
John McLear
552b6d7adb
stale: Terser instead of uglify (#4075) 2020-06-05 23:10:24 +01:00
John McLear
33ad48714c stale code: update package-lock.json and force re-run tests 2020-06-05 20:04:50 +00:00
John McLear
a4bdcc3392
tests/editor/ul/li/ol/import/export: Introduce contentcollector.js tests & various OL/UL/LI related bugfixes
1. Introduce contentcollector.js backend tests
1. Fix issue with OL LI items not being properly numbered after import
1. Fix issue with nested OL LI items being improperly numbered on export
1. Fix issue with new lines not being introduced after lists in on import #3961
1. Sanitize HTML on the way in (import)
1. Fix ExportHTML CSS because it needs to support OL > LI > OL not OL > OL [The latter being the correct format]
1. Fix backend tests.
2020-06-05 20:54:16 +01:00
Chocobozzz
c854cced65
performance: Use worker threads to minify JS/CSS files (#3823) 2020-06-04 14:00:50 +01:00
John McLear
71bffed190
tests: fix for fuzz tests (#4068) 2020-06-01 18:52:46 +01:00
John McLear
8deac52c84 tests: include mocha froth in package lock and better syntax for package.json 2020-06-01 16:35:38 +00:00
John McLear
7273778e5f doh, recommit package-lock 2020-05-30 18:40:44 +00:00
John McLear
add3b23f66 tests: load testing into core 2020-05-30 18:17:33 +00:00
muxator
4644e7a127 dependencies: update cookie-parser 1.4.4 -> 1.4.5 2020-05-15 13:09:56 +02:00
muxator
7ea85cbb03 dependencies: update wd 1.11.4 -> 1.12.1
This is a dev dependency. No impact in production.
2020-05-15 13:09:56 +02:00
muxator
026675170d dependencies: update mocha 7.1.1 -> 7.1.2
This is a dev dependency. No impact in production.
2020-05-15 13:09:56 +02:00
muxator
9da53707e4 dependencies: update nyc 15.0.0 -> 15.0.1
This is a dev dependency. No impact in production.
2020-05-15 13:09:56 +02:00
muxator
b5cf3cf718 dependencies: update request 2.88.0 -> 2.88.2 2020-05-15 13:09:56 +02:00
muxator
14b0c3a7bd dependencies: update express-session 1.17.0 -> 1.17.1 2020-05-15 13:09:56 +02:00