etherpad-lite/bin
Richard Hansen 6c2a361935 import: Use the correct author ID when using sessions
There are two different ways an author ID becomes associated with a
user: either bound to a token or bound to a session ID. (The token and
session ID come from the `token` and `sessionID` cookies, or, in the
case of socket.io messages, from the `token` and `sessionID` message
properties.) When `settings.requireSession` is true or the user is
accessing a group pad, the session ID should be used. Otherwise the
token should be used.

Before this change, the `/p/:pad/import` handler was always using the
token, even when `settings.requireSession` was true. This caused the
following error because a different author ID was bound to the token
versus the session ID:

> Unable to import file into ${pad}. Author ${authorID} exists but he
> never contributed to this pad

This bug was reported in issue #4006. PR #4012 worked around the
problem by binding the same author ID to the token as well as the
session ID.

This change does the following:
  * Modifies the import handler to use the session ID to obtain the
    author ID (when appropriate).
  * Expands the documentation for the SecurityManager checkAccess
    function.
  * Removes the workaround from PR #4012.
  * Cleans up the `bin/createUserSession.js` test script.
2020-09-08 15:04:17 +01:00
..
deb-src cp readme on build 2013-11-24 13:08:26 +00:00
doc doc: remove old vendorized marked module and replace with 0.8.2 2020-04-24 02:24:53 +02:00
plugins housekeeping: v3 of automatic plugin fixing tool. 2020-08-22 15:50:55 +01:00
buildDebian.sh bin: replace double backticks (``) with $() 2020-03-29 00:53:17 +01:00
buildForWindows.sh bin: Simplify cd to install dir 2020-06-03 23:11:44 -04:00
checkAllPads.js utility scripts: converted to use the Promise interface 2019-01-26 23:52:02 +00:00
checkPad.js utility scripts: converted to use the Promise interface 2019-01-26 23:52:02 +00:00
checkPadDeltas.js checkPadDeltas: version by JohnMcLear 2020-03-27 01:50:56 +01:00
cleanRun.sh bin: replace double backticks (``) with $() 2020-03-29 00:53:17 +01:00
convert.js Fix for better user color selection. (#4142) 2020-06-30 09:40:14 +01:00
convertSettings.json.template formatting: bulk remove trailing whitespaces 2019-10-20 02:09:22 +02:00
createRelease.sh createRelease.sh: deprecate the script. It will be removed or modified. 2018-08-17 00:09:25 +02:00
createUserSession.js import: Use the correct author ID when using sessions 2020-09-08 15:04:17 +01:00
debugRun.sh bin: Simplify cd to install dir 2020-06-03 23:11:44 -04:00
deleteAllGroupSessions.js script: Delete group sessions script and fix issue where loadSettings has been moved breaking deletePad (#3973) 2020-06-01 19:36:40 +01:00
deletePad.js script: Delete group sessions script and fix issue where loadSettings has been moved breaking deletePad (#3973) 2020-06-01 19:36:40 +01:00
dirty-db-cleaner.py formatting: bulk remove trailing whitespaces 2019-10-20 02:09:22 +02:00
extractPadData.js utility scripts: converted to use the Promise interface 2019-01-26 23:52:02 +00:00
fastRun.sh bin: add fastRun.sh script for developers 2020-04-17 18:36:24 +02:00
importSqlFile.js bin: use correct ueberdb module path "ueberDB" -> "ueberdb2" in tools in /bin 2020-05-15 01:22:41 +02:00
installDeps.sh bin: Simplify cd to install dir 2020-06-03 23:11:44 -04:00
installOnWindows.bat startup: use "npm ci" instead of "npm install" in startup scripts 2020-05-15 02:20:46 +02:00
migrateDirtyDBtoRealDB.js migrateDirtyDBtoRealDB: fix the script not trusting length, and directly iterating on dirtyDB tuples 2020-05-13 23:04:01 +02:00
rebuildPad.js bin: use correct ueberdb module path "ueberDB" -> "ueberdb2" in tools in /bin 2020-05-15 01:22:41 +02:00
repairPad.js bin/repairPad.js: conversion to promise/async 2019-01-30 10:47:50 +00:00
run.sh bin: Fix 'for' loop style 2020-06-03 23:11:44 -04:00
safeRun.sh bin: Use ISO 8601 date format 2020-06-03 23:11:44 -04:00
updatePlugins.sh bin: replace double backticks (``) with $() 2020-03-29 00:53:17 +01:00