b80a37173e
security: Fix authorization bypass vulnerability
...
Before, a malicious user could bypass authorization restrictions
imposed by the authorize hook:
* Step 1: Fetch any resource that the malicious user is authorized to
access (e.g., static content).
* Step 2: Use the signed express_sid cookie generated in step 1 to
create a socket.io connection.
* Step 3: Perform the CLIENT_READY handshake for the desired pad.
* Step 4: Profit!
Now the authorization decision made by the authorize hook is
propagated to SecurityManager so that it can approve or reject
socket.io messages as appropriate.
This also sets up future support for per-user read-only and
modify-only (no create) authorization levels.
2020-09-15 21:40:25 +01:00
80639fdc6a
webaccess: Pass `settings.users` to the authenticate hook
...
Authentication plugins almost always want to read and modify
`settings.users`. The settings can already be accessed in a few other
ways, but this is much more convenient.
2020-09-15 19:26:24 +01:00
362b567276
docs: Revise documentation for handleMessage and handleMessageSecurity
2020-09-15 19:25:04 +01:00
9f288480e8
docs: Revise hooks overview section
2020-09-05 20:34:47 +01:00
55f201a2aa
docs: Document the authFailure hook
2020-09-05 12:37:46 +01:00
f0b7dc7c53
pluginfw: PadMessageHandler: Pass socket.io Socket object to clientVars hook ( #4245 )
...
Also revise the clientVars hook documentation.
2020-09-05 10:51:39 +01:00
4c0ab8a14e
docs: Document the authorize hook ( #4233 )
2020-09-04 18:52:25 +01:00
aee1c3e7c5
docs: Document the authenticate hook ( #4232 )
2020-08-27 12:57:38 +01:00
ca6da2c724
Fix doc typo ( #4187 )
2020-07-21 13:22:31 +01:00
66a56234fa
docs: index hooks / ref #3978 ( #4077 )
2020-06-03 10:55:44 +01:00
61c7bb9699
feat(i18n) Custom i18n strings ( #4000 )
...
* Custom i18n strings (and some code formatting)
* Documentation for per-instance l10n overwrites
2020-05-19 13:21:31 +01:00
4816785aef
doc: in the Docker example with custom plugins, replace ep_codepad -> ep_comments_page
...
Prefer promoting ep_comments_page, since it has a wider audience and is better
maintained.
2020-05-13 23:16:51 +02:00
35f0217056
typo on index.html hooks ( #3982 )
...
just a typo, maybe the smallest commit in this repo :p
2020-05-13 11:25:57 +01:00
c074dfeff2
docs: basic styles for tables
...
This is a cosmetic fix for PR #3921 (109aa2d489#3563
2020-05-03 21:56:28 +02:00
1aebbe8892
docs: also mention the infos we have about sessionID cookie
2020-04-24 03:06:13 +02:00
109aa2d489
docs: add cookies section
...
Closes #3563
2020-04-24 03:06:13 +02:00
d1eb108ede
README.md: losslessly reduce the size of the PNG images
...
It's not much, but these images will hopefully be downloaded many times. The
smaller they are, the lowest the latency will be.
Command:
optipng {etherpad_basic.png,etherpad_full_features.png}
BEFORE:
$ du -sch *.png
16K etherpad_basic.png
104K etherpad_full_features.png
120K total
AFTER:
$ du -sch *.png
12K etherpad_basic.png
92K etherpad_full_features.png
104K total
2020-04-23 22:29:58 +02:00
1003d9c40e
Update gif demo ( #3924 )
...
Include parallel writing with two users
2020-04-23 16:45:33 +01:00
85adaa44d8
docker: make settings fully configurable via env vars
...
Now every setting in the official Etherpad container will be configurable via
environment variables.
2020-04-21 04:44:56 +02:00
8d39cc4db2
docker: fill in the default values in the documentation
2020-04-21 04:44:56 +02:00
a0b5e515aa
docker: switch to table layout in the docs about the available settings
...
In this way, we also gain an explicit place for the default setting (still not
filled in).
No functional changes.
This is in preparation of a future commit by Paul Tiedke.
2020-04-21 04:44:56 +02:00
ca3d095d35
docker: in the db documentation, specify that we are not going to include every single variable a driver may want
2020-04-21 04:44:56 +02:00
f08d517625
docker: in the documentation, reorganize categorically the available parameters
...
No functional changes.
This is in preparation of a future commit by Paul Tiedke.
2020-04-21 04:44:56 +02:00
11f88a9b36
Update Readme with new screenshots
...
closes #2140
closes #3779
2020-04-19 18:05:59 +02:00
5ade38c86b
docker: build & run the container in production mode
...
This is leaner (no development dependencies are included in the container) and
faster (among other things, assets are minified & compressed).
2020-04-19 04:41:29 +02:00
5acbdb83e5
docker: allow to control import/export rate limiting parameters
...
The newly introduces environment variables are IMPORT_EXPORT_RATE_LIMIT_WINDOW
and IMPORT_EXPORT_MAX_REQ_PER_IP.
2020-04-14 03:36:13 +02:00
f5d9b94ca1
docker: allow to control the maximum file size of an import via IMPORT_MAX_SIZE
2020-04-14 03:36:13 +02:00
684f374ece
runtime: require node >= 10.13.0 LTS
...
At the moment, NodeJS 10.x is the lowest supported LTS version. NodeJS 8.x is no
longer supported upstream.
Implements #3835 .
Planned in #3650 .
2020-04-09 04:43:37 +02:00
79406051fa
Settings.js: support newlines in default values when using variable substitution
...
This allows, among other things, to correctly support the configuration of
defaultPadText in Docker via an environment variable.
2020-04-07 04:32:37 +02:00
82b919fc65
api: add getStats() function
2020-04-04 22:03:46 +02:00
e821bbcad8
openapi: add documentation, small optimisation
2020-04-03 01:03:11 +02:00
7a999ee398
hooks: allow to set the duration of the gritter notification when a new chat message arrives
...
This is done adding a new "duration" parameter to the chatNewMessage() client
side hook.
2020-03-27 02:39:29 +01:00
8a01a5e437
doc: fix numbering in chatNewMessage() client hook parameters
...
This was originally introduced in bcb92f25a6
2020-03-27 02:39:29 +01:00
6fd2bf4472
hooks: introduce goToRevisionEvent(), a new client-side hook
...
This hook gets fired both on timeslider load (as timeslider shows a new
revision) and when the new revision is showed to a user.
2020-03-24 23:46:17 +01:00
0b3cf7cc96
docker: Add Run with volume example
...
Supersedes https://github.com/ether/etherpad-lite/pull/3631
Co-authored-by: RaymondCavallaro <RaymondCavallaro@users.noreply.github.com>
2019-12-25 00:48:30 +01:00
a817acbbcc
security: when served over https, set the "secure" flag for "express_sid" and "language" cookie
...
The mechanism used for determining if the application is being served over SSL
is wrapped by the "express-session" library for "express_sid", and manual for
the "language" cookie, but it's very similar in both cases.
The "secure" flag is set if one of these is true:
1. we are directly serving Etherpad over SSL using the native nodejs
functionality, via the "ssl" options in settings.json
2. Etherpad is being served in plaintext by nodejs, but we are using a reverse
proxy for terminating the SSL for us;
In this case, the user has to be instructed to properly set trustProxy: true
in settings.json, and the information wheter the application is over SSL or
not will be extracted from the X-Forwarded-Proto HTTP header.
Please note that this will not be compatible with applications being served over
http and https at the same time.
The change on webaccess.js amends 009b61b338https://github.com/expressjs/session/blob/v1.17.0/README.md#cookiesecure
Closes #3561 .
2019-12-07 04:36:01 +01:00
30fd53f1fd
docker: move docker/settings.json to /settings.json.docker
2019-11-08 23:50:50 +01:00
dc15f4a43c
docker: build from the local working directory
...
With this change, the Dockerfile builds the Docker image from the code
checked out in the local filesystem, instead of downloading a revision
from git.
Implements #3657
2019-11-08 22:56:30 +01:00
c008ee36bd
docker: incorporate the docker docs into the official documentation
...
This also means increasing the indentation level.
2019-11-08 23:17:34 +01:00
312c72c364
formatting: bulk remove trailing whitespaces
...
Do not touch vendorized files (e.g. libraries that were imported from external
projects).
No functional changes.
Command:
find . -name '*.<EXTENSION>' -type f -print0 | xargs -0 sed -i 's/[[:space:]]*$//'
2019-10-20 02:09:22 +02:00
fc661ee13a
core: allow URL parameters and POST bodies to co-exist.
...
Node 8.14.0 prohibits HTTP headers that exceed 8 KB (source:
https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/#denial-of-service-with-large-http-headers-cve-2018-12121 ).
This patch allows for the parameters within the body of an HTTP POST request to
be used in addition to those within the URL (and will override them).
Closes #3568 .
---
Muxator 2019-10-19:
- this commit was cherry-picked from 882b93487f
2019-06-27 00:52:53 +02:00
705cc6f5e4
Change everywhere the link to https://etherpad.org (it was plain http)
2019-04-16 00:54:54 +02:00
9d35d15ae3
node8: require nodejs >= 8.9.0, npm >= 6.4
...
Next version will be Etherpad 1.8. As planned in #3424 , we are going to require
NodeJS >=8.9.0 and npm >= 6.4.
This commit implements that change and updates documentation and scripts.
Subsequent changes will get rid of old idioms, dating back to node < 0.7, that
still survive in the code.
Once migrated to NodeJS 8, we will be able to start working on migrating the
code base from callbacks to async/await, greatly simplifying legibility (see
#3540 ).
Closes #3557
2019-02-19 22:01:12 +01:00
4f0a2785da
release: prepare for 1.7.5
...
Written the changelog and updated package.json.
2019-01-26 00:16:03 +01:00
fce55df2b7
Fix typos
2019-01-16 11:14:04 +01:00
aca8fae682
easysync-full-description: regenerate the pdf document
...
The .tex source was updated to fix some typos, but the corresponding pdf was not
regenerated.
Command used to generate the pdf:
pdflatex easysync-full-description.tex
The incorporated changes are:
- 49114d2b7ac7548450c0
2018-12-09 15:56:17 +01:00
66d87babfa
doc: passwordHash does not contain a bcrypted password, but a salted sha512 sum
...
The documentation was written on 2011-08-03:
31067f163f17: added a documentation for the database structure
The implementation using sha512 instead of bcrypt was committed two days later,
on 2011-08-10:
ce1012438ef8: added setPublicStatus, getPublicStatus, setPassword and isPasswordProtected
2018-11-05 22:45:00 +01:00
23eab79946
pad.html: for each client plugin, add a class to #editorcontainerbox
...
This commit implements the following behaviour:
1. adds a function clientPluginNames() to hooks.js (mimicking what is done in
static.js), which returns an array containing the list of currently installed
client side plugins. The array is eventually empty.
2. calls that function in pad.html at rendering time (thus server-side) to
populate a class attribute.
Example results:
- with no client-side plugins installed:
<div id="editorcontainerbox" class="">
- with some client-side plugins installed:
<div id="editorcontainerbox" class="ep_author_neat ep_adminpads">
Looking at the existing code (src/node/hooks/express/static.js#L39-L57), a
client-side plugin is defined as a plugin that implements at least a client side
hook.
NOTE: there is currently no support for notifying plugin removal/installation
to the connected clients: for now, in order to get an updated class list,
the clients will have to refresh the page.
Fixes #3488
2018-10-02 21:22:13 +02:00
6620014b77
skins: describe the skins in the documentation
2018-08-26 21:17:04 +02:00
d499e1b046
docs: direct link to measured.Collection from stats.md
2018-08-14 13:27:31 +02:00
e9fb63f426
docs: "```js" -> "```json" in Markdown of some json blocks
2018-08-09 22:27:56 +02:00
7544585908
runtime: enforce minimal node version to 6.9.0
...
Etherpad 1.6.6 does not run on node <= 5 already.
Node 6.9 is the first LTS release in the 6 series, and comes with npm 3.10.8.
Declarations in package.json are advisory unless the user has set
`engine-strict` config flag.
Updated the docs accordingly.
2018-07-28 23:33:24 +02:00
2765a95774
Merge pull request #3218 from klausweiss/develop
...
Feature: New server-side hook: onAccessCheck
2018-04-03 13:38:47 +01:00
c7548450c0
Typos and minor fixes in bin, doc, and root
2017-09-14 13:33:27 +02:00
5c8a15c3d7
fix `sessionCookie` number in onAccessCheck
2017-07-12 00:28:51 +02:00
35702a0589
[feat] New server-side hook: onAccessCheck
2017-07-10 20:54:32 +02:00
fc89034a55
[feat] New server-side hook: padCopy
...
Let plugins know when a pad is copied.
2017-05-18 18:52:14 -03:00
d78681350b
Merge pull request #3149 from AdamNiederer/patch-1
...
Remove an extra space
2017-03-13 06:55:07 -03:00
cb8fe92df7
Fix typo
2017-03-11 22:09:49 -05:00
7520377026
Spelling fixes
2017-03-11 21:38:50 -05:00
52d5fc713e
Spelling fixes
2017-03-11 21:36:37 -05:00
867e2d69d4
Spelling, grammar, and style improvements
2017-03-11 21:35:00 -05:00
6d279f0ee1
Spelling fix
...
Also removes an extra space
2017-03-11 21:34:34 -05:00
a5e576c564
Grammar fix
2017-03-11 21:30:32 -05:00
eeb8e82771
Remove an extra space
2017-03-11 21:27:34 -05:00
d48395089c
Update called from for two hooks
...
`expressCreateServer` and `expressConfigure` are called from `express.js`, not
from `server.js`.
2017-01-17 14:59:24 +01:00
cd7f01f40a
minor changes in docs
...
- correct link to doc generation tool.
- fixed incomplete sentence regarding API client libraries
2016-12-26 20:18:34 +01:00
01d23b1f6a
Merge pull request #2929 from xavidotron/develop
...
Pass through the "item" parameter to registerAceCommand callbacks.
2016-12-13 06:12:26 -02:00
2341d09807
Add undocumented API function restoreRevision to doc
...
This commit is dedicated to Schoumi. Thx for supporting me on Tipeee :-)
2016-11-16 10:36:18 +01:00
f09e10b122
Merge pull request #2944 from storytouch/aceRegisterNonScrollableEditEvents
...
Create hook to register events that won't scroll editor after aceEditEvt
2016-06-20 10:36:53 +01:00
69ac8e1722
Include usage example for aceRegisterNonScrollableEditEvents
2016-06-20 06:31:11 -03:00
56b851a46f
Pass through the "item" parameter to registerAceCommand callbacks.
2016-05-06 21:58:24 -04:00
3fb695a7a0
Create hook to register events that won't scroll editor after aceEditEvt
2016-03-30 11:51:18 -03:00
4846798528
extend attributesonselection method
2016-03-26 22:00:34 +08:00
c70d655b96
Add appendText API (from #2810 ) to docs.
2016-01-13 07:26:20 -05:00
4ad759dd25
Add postToolbarInit documentation and usage examples
2015-12-18 13:33:49 +02:00
03a4828d31
Update aceEditorCSS hook documentation
2015-12-02 13:15:27 +02:00
92a8253449
Create hook exportHtmlAdditionalTagsWithData
...
The new hook does the same as exportHtmlAdditionalTags, but is declared
in another hook to avoid confusion about how to export tags when they
are stored as ['tag', 'value'] on attribute pool.
This complements #2762 , as per @Gared suggestions.
2015-11-03 07:16:55 -02:00
c337a0585c
Merge pull request #2724 from xavidotron/develop
...
Add a aceSelectionChanged hook to allow plugins to react when the cursor moves
2015-10-22 16:19:07 +01:00
504cc102a0
Merge pull request #2762 from storytouch/exportTagsAsArrays
...
Accepting Arrays on 'exportHtmlAdditionalTags'
2015-10-17 18:24:18 +02:00
9d29b15def
Merge pull request #2730 from emilyxxie/clientready_hook
...
added clientReady hook
2015-10-10 13:30:36 +02:00
1d134f0b13
Fixing ed52626. It was closing the span with </span data-TAG=VALUE>, not </span>
2015-09-17 15:30:09 -03:00
ed5262650a
Generating pad HTML with tags like <span data-TAG="VALUE"> instead of <TAG:VALUE>
2015-09-07 03:55:56 -07:00
1a5985dc75
Accepting Arrays on 'exportHtmlAdditionalTags' to handle attributes stored as ['key', 'value'] (and not only ['key', 'true'])
2015-08-24 07:58:45 -07:00
c8d7e6e0b8
Add appendChatMessage API to docs
2015-08-15 22:41:09 +02:00
21f0d12d31
clientReady hook- pass entire message, updated doc
2015-07-20 11:45:41 -04:00
008d4e653c
Add a aceSelectionChanged hook to allow plugins to react when the cursor
...
location changes.
2015-07-11 11:33:20 -04:00
bc78e0c68d
Update documentation for the updatePad and createPad hooks to include 'author'
...
in the context.
2015-06-21 11:34:59 -04:00
48da5c1ab1
docs for handle message security
2015-05-20 01:09:35 +01:00
6bd2013c71
Fixing documentation of collectContentPre
2015-05-15 11:18:58 -03:00
b4163fc862
fix docs
2015-04-23 17:27:54 +01:00
d31523aa08
Update hooks_server-side.md
2015-04-17 15:58:23 +01:00
1d44490dc4
Merge pull request #2599 from Gared/doc_api_fix
...
Fix documentation for deleteSession api method
2015-04-11 15:07:18 +01:00
a842eb4f5c
Fix documentation for deleteSession api method
2015-04-11 16:05:41 +02:00
84b3f1728f
Merge pull request #2597 from Gared/increase_api_version
...
increase http api version to latest version
2015-04-11 14:56:47 +01:00
d26c3d5f7e
increase http api version
2015-04-11 13:45:59 +02:00
601be46993
Add docs for new error message for createPad api method
2015-04-11 13:16:03 +02:00
1e8e64d675
feature #2567 added documentation
2015-03-31 10:50:20 +02:00
845788c39d
Add a saveRevision API function
...
Calling saveRevision create an author which name is "API"
2015-02-25 01:04:27 +01:00
a08c50a77d
Fixes #1870
...
Add two functions to API :
* getSavedRevisionsCount
* listSavedRevisions
2015-02-24 23:42:35 +01:00
4166f19078
Set correct API version in doc
...
The doc says current version is 1.2.9, but there is getPadID which uses 1.2.10 API.
2015-02-22 22:32:18 +01:00
4de42da2e3
Merge pull request #2497 from ether/image-support-hook
...
clean support for image hook
2015-01-26 16:07:56 +00:00
b8ac349b53
Update hooks_client-side.md
2015-01-26 16:07:46 +00:00
2c3ce30fed
docs
2015-01-26 02:42:48 +00:00
4c64b7a670
Revert 'asyncLineHTMLForExport' hook
2015-01-25 22:08:40 +01:00
378ed02269
docs
2015-01-24 13:30:03 +00:00
4ecf0dfad2
docs for export HTML
2015-01-24 02:24:10 +00:00
c878a957b7
fix issue in docs
2015-01-24 02:18:59 +00:00
fccfc3bd41
docs
2014-12-09 16:16:19 +00:00
b94a525e07
docs
2014-12-09 01:35:59 +00:00
ce004f9c59
docs
2014-12-08 19:48:02 +00:00
2218cbd252
docs
2014-12-08 19:08:12 +00:00
2f8b860e69
Added a `userLeave` hook that gets called when a user leaves a pad
2014-08-08 15:49:15 +01:00
44cb676ba2
Merge pull request #2150 from ether/export-file-name-hook
...
Server side hook to modify the export file name
2014-06-16 16:47:15 +01:00
40a97f08bb
Merge pull request #2169 from stephan48/develop
...
Added documentation for the newly added API method getPadID
2014-06-02 20:31:37 +02:00
bbd50dfc62
Added documentation for the newly added API method getPadID
2014-06-02 20:25:16 +02:00
49114d2b7a
Fix typos in easysync-full-description.tex
2014-06-01 23:57:20 -05:00
d09e66e271
use call first and update docs
2014-05-12 15:08:32 +01:00
a8d9a3868d
docs for new hook
2014-05-06 21:22:03 +01:00
a7671a690b
docs: update api version
2014-03-30 15:10:29 +02:00
33ecc1d8df
Update docs
2014-03-30 13:08:26 +02:00
3a82cba4c5
Polish the styles of our docs a little
2014-03-27 18:08:55 +01:00
a69793a203
Add docs for toolbar controller and pad_editbar
2014-03-16 15:43:38 +01:00
df205a4ef4
docs
2014-03-05 21:44:22 +00:00
7dd29454e9
Remove duplicate doc entry for setHTML()
2013-12-14 21:11:37 +01:00
58bbfd8a65
resolve merge conflict
2013-12-09 21:55:04 +00:00
505dc70df5
Merge pull request #2013 from ether/getAttributeOnSelection
...
getAttributeOnSelection function
2013-12-09 09:46:57 -08:00
d9ef40f9d7
docs but not sure how to specify the verison this was introduced
2013-12-07 17:48:06 +00:00
3d8452b143
Replace tabs indentation with spaces indentation
...
Some files are obviously external libraries, I didn't touch them
2013-12-05 08:41:29 +01:00
5409cdaa3f
add some documentation for move/copy
2013-11-18 14:38:44 +02:00
b769acaee0
Forgot to bump the API version
2013-11-07 23:28:07 +01:00
5bccfdf060
Forgot a small chunck of documentation for getRevisionChangeset
2013-11-07 22:46:35 +01:00
a4194efaf1
Fixed #1981 - uncomplete HTTP API documentation
2013-11-07 22:22:37 +01:00
5bce9bc336
Add docs for stats
2013-10-27 21:59:40 +01:00
b34224559d
‘Etherpad Lite’ -> ‘Etherpad’
2013-09-29 13:57:37 +02:00
4377f7a2e4
Fix encoding issue in localization.md
2013-09-01 10:57:31 +02:00
bc5dc74f90
pass pad in postAceInit hook
...
no way for plugins to access current pad otherwise.
2013-06-17 15:52:51 +02:00
8f262d0ede
document aceSetAuthorStyle
2013-06-15 11:07:13 +08:00
e96baf6ef1
API documentation: listAllPads() returns {padIDs: [...]} instead of [...]
2013-03-26 16:37:57 +01:00
bcb92f25a6
Refactor chat notifications and the chatNewMessage hook
2013-03-19 20:21:27 +01:00
8406cc95ab
docs for hook
2013-03-19 03:43:38 +00:00
760e1b82c3
Add a setting for RTL text direction (integrating the url paramter)
...
Fixes #1191
2013-03-05 23:12:00 +01:00
716cac9c95
timeslider init hook docs
2013-02-27 15:17:22 +00:00
9e1dfc9487
docs for setHTML
2013-02-12 23:44:09 +00:00
fde10052ca
Update doc/api/http_api.md
...
Updated
2013-02-12 21:57:01 +01:00
280b3a404c
doh, doc fix
2013-02-09 17:02:54 +00:00
bb1d462612
plugin test docs
2013-02-09 15:45:00 +00:00
a19ad983f1
docs for api change
2013-01-29 16:48:56 +00:00
cb2b93b133
Added getChatHistory and getChatHead (api+code+doc)
2013-01-26 14:35:26 +01:00
41cb5d8265
Added hook for clientVars and hook-doc
2013-01-14 22:51:26 +01:00
Richard Hansen