For the first time in a VERY long time, we now have exactly 0 vulnerabilities
reported by npm audit.
=====
BEFORE:
$ npm audit
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
[...]
found 4 low severity vulnerabilities in 13796 scanned packages
4 vulnerabilities require manual review. See the full report for details.
=====
AFTER:
$ npm audit
=== npm audit security report ===
found 0 vulnerabilities
in 13796 scanned packages
This is an old bug: after an import there were always two iframes with
duplicated content, and the last one was simply on top of the old one.
This bug was there since forever, and became evident when the layout was
migrated to Flexbox.
Before this change, we simply generated an error.
For example:
- if the browser sent 'ru-RU', but Etherpad has 'ru' available, select 'ru';
- if the browser sent 'zh', but we have 'zh-hans' available, use 'zh-hans'.
Fixes#3882.
"token" is a random token representing the author, of the form
t.randomstring_of_lenght_20. The random string is generated by the client. The
cookie is used for every pad in the web UI, and is not used for HTTP API.
This comes from the discussion at https://github.com/ether/etherpad-lite/issues/3563
In this way, if the browser sends a list of preferred languages via
Accept-Language HTTP header, Etherpad will honor that.
Before this change, Etherpad always forced on the user the language from
padOptions.lang in settings.json.
This reverts a feature that was introduced in 295672f598.
If Etherpad is hosted on Windows the frontend test URI needs to be
/tests/frontend/index.html (docs say .../frontend/), otherwise there is this
error: ERR_TOO_MANY_REDIRECTS.
Fixes#3804.
The server is fine with atext.text being an empty string, but the front end is
not, and crashes.
It is not clear if this is a problem in the server or in the client code, and
this is a client-side hack fix. The underlying problem needs to be
investigated.
See for reference:
- https://github.com/ether/etherpad-lite/issues/3861
With this change, it is no longer necessary to "cd" to the Etherpad base
directory to start it: Etherpad runs from everywhere.
Known issues:
- unless the program is started as before (CWD == base directory) it is still
not possible to install & uninstall plugins via the web interface
--HG--
branch : absolute-paths
- change default font for colibris and for no-skin
- add roboto and quicksand font files
- simplify font picker: directly use the name of the font, and reduce their
number
- simplify template
- use flexboxes
- simplify javascript code
- remove some obsolete code adjusting a background-position when using steppers buttons
- add comments and remove old code
- rename DOM wrapper because is was blacklisted by some ad blocker
- make the template and the lib to add gritter more simple (remove unused
option, make template simpler)
- add style for gritter error message
In the following commits Sebastian is going to edit three files. This change is
necessary make evident what he is going to modify, because some of them are old
vendorized libraries whose history we might want to reconstruct.
No functional changes.
Command:
sed --in-place 's/[[:space:]]*$//' src/static/js/farbtastic.js
sed --in-place 's/[[:space:]]*$//' src/static/js/gritter.js
sed --in-place 's/[[:space:]]*$//' tests/frontend/specs/change_user_color.js
No more javascript to change css properties
Remove a number of useless tables
Try to stop positioning elements with absolute, but use flex-boxes instead
Adds comment to pad template, and move popups and chatbox inside editorcontainerbox (so absolute positioning is straightforward)
Make the design more consistent: always use base color, font-family and font-size. USe relative font size if necessary (.9rem instead of 11px for example)
Remove two columns in the popups, just use one column
Remove css meant to support old browser (like -webkit-box-shadow, -moz-box-shadow). Those css rules are quite common now, and If we want to support very old browser, we should use clean-css or other tools to add them automatically
Starting with Etherpad 1.8.3 we decided to use Colibris as default skin for new
installs. Without this change, when starting with no settings.json file,
Etherpad would (wrongly) use "no-skin".
This change should have been part of 70bc71c0c3.
This is a departure from previous versions, which did not limit import/export
requests. Now such requests are ALWAYS rate limited. The default is 10 requests
per IP each 90 seconds, and also applies to old instances upgraded to 1.8.3.
Administrators can tune the parameters via settings.importExportRateLimiting.
Importing to a pad is allowed only if an author has a session estabilished and
has already contributed to that specific pad. This means that as long as the
user is on the pad (via the browser) then import is possible.
Note that an author session is NOT the same as a group session, which is not
required.
This setting does not apply to API requests, only to /p/$PAD$/import
This change of behaviour is introduced in Etherpad 1.8.3, and cannot be
disabled.
muxator