Commit graph

386 commits

Author SHA1 Message Date
David Mehren
4a0216096a
Escape custom Open Graph tags
HedgeDoc allows to specify custom Open Graph tags using the
`opengraph` key in the YAML metadata of a note.

These are rendered into the HTML delivered to clients using `ejs` and
its `<%-` tag. This outputs the variable unescaped into the template
and therefore allows to inject arbitrary strings,
including `<script>` tags.

This commit changes the template to use ejs's `<%=` tag instead,
which automatically escapes the variables content,
thereby mitigating the XSS vector.

See also https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gjg7-4j2h-94fq

Co-authored-by: Christoph (Sheogorath) Kern <sheogorath@shivering-isles.com>
Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-09 19:21:27 +02:00
Erik Michelson
0d943d1284
Extract list of supported languages in separate file
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2021-04-26 21:45:31 +02:00
David Mehren
837cf59ef9
Add support for freshly imported languages
New languages: bg, fa, gl, he, hu, oc, pt-br

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-26 21:42:06 +02:00
Philip Molares
8e6aab0145 Templates: Remove lang and add translation parameter
Since the interface is not always in english, we mostly removed the lang attribute from all html tags. Since the error messages in error.ejs are not translated, but always in english, there the global lang="en" should be kept.
Also in the slide and editor template the div, which contains the user generated text, has the attribute translate="no" now, to avoid unwanted translations.
Since on the publish view (pretty.ejs) only the user generated content is shown, we set the lang to the language defined in yaml (or 'en') as a default, but that was also moved to the corresponding markdown div instead of html.

Fixes #881
See also #437

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-16 10:48:44 +01:00
David Mehren
b468fb623b
Switch to ejs 3 compliant imports
Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-09 20:27:39 +01:00
David Mehren
e985c2e694
Merge pull request #599 from hedgedoc/fix/icons
Fix shortcut icon urls pointing to old (nonexistent) files
2020-11-27 21:06:07 +01:00
David Mehren
b506db11a0
Replace references to Matrix room with chat.hedgedoc.org
Signed-off-by: David Mehren <git@herrmehren.de>
2020-11-27 19:53:26 +01:00
Erik Michelson
68c8f2860d
Fixed shortcut icon urls pointing to old (nonexistent) files
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2020-11-27 11:29:34 +01:00
Tilman Vatteroth
97312b5ed3
Remove pdf export code
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>
2020-11-26 21:09:23 +01:00
Tilman Vatteroth
cb265986f3
Remove irritating footer files
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>
2020-11-18 21:52:50 +01:00
Tilman Vatteroth
cdc5a89cd7
apply review suggestions 2020-11-15 20:12:39 +01:00
Tilman Vatteroth
978538c0de
Correct repo name
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>
2020-11-14 22:24:44 +01:00
Tilman Vatteroth
7ce89d0ac5
Replace placeholder with actual link
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>
2020-11-14 21:21:39 +01:00
Erik Michelson
b28839484d
Replace CodiMD with HedgeDoc
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: References in public/views

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Update links in README

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Update links in SECURITY.md

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Update links in LICENSE

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Update links in docs/configuration.md

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Update links in bin/setup

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: References in docs/guides

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: References in docs/dev

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: References in docs/guides/auth

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: References in docs/setup

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Update various links in code to the new GitHub org.

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: codiMDVersion.js is now hedgeDocVersion.js

Signed-off-by: David Mehren <git@herrmehren.de>
Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: References in docs/setup/yunohost

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rebrand to HedgeDoc: Add banner and logo

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Update links in docs/guides/migrate-etherpad

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Remove note in docs/guides/auth/github

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Replace links in public/docs/features

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Add todo placeholder in docs/history

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Replace github link in public/views/index/body

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Replace github link in README

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Add logo to README

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Rename to HedgeDoc: Add note about the renaming to the front page

Signed-off-by: Tilman Vatteroth <tilman.vatteroth@tu-dortmund.de>

Removed Travis from README.md and change CodiMD to HedgeDoc in some places

Signed-off-by: Yannick Bungers <git@innay.de>

Some more renaming to HedgeDoc
- Fixed capitalization of HedgeDoc
- Added renaming for etherpad migration doc

Signed-off-by: Yannick Bungers <git@innay.de>

Changed Repo name to hedgedoc

Signed-off-by: Yannick Bungers <git@innay.de>
2020-11-14 21:18:36 +01:00
David Mehren
1a074cd411
Update CDN links and integrity hashes for upgraded libraries
Signed-off-by: David Mehren <git@herrmehren.de>
2020-11-10 22:56:00 +01:00
David Mehren
82aff80b88
Merge pull request #496 from codimd/fix/element-links 2020-09-29 11:37:25 +02:00
Erik Michelson
fcacbb2175
Change all element.io links to matrix.to links
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2020-09-28 13:05:22 +02:00
Sheogorath
31f6a3640b
Add Malayalam translation
This patch adds the Malayalam translation to CodiMD. Do by our awesome
translation supporters civic john, Sooraj Kenoth, Nithin Prabhakaran and
Jothish.

Thank you very much!

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-09-09 12:51:34 +02:00
Erik Michelson
213154a742
Update matrix chat link from riot.im to app.element.io and change room alias
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2020-09-08 10:06:30 +02:00
Erik Michelson
c9442c3859
Made changed/created status translatable
The current version of CodiMD/HedgeDoc does only support translations to be filled on server-side rendering. To allow the translation of the changed/created texts, I duplicated the container that holds the text, and pre-filed these containers with the translation server-side. The client just needs to hide the unneeded container and show the right one to show the translated status text.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2020-08-13 23:55:28 +02:00
Erik Michelson
ee4210a511 Added dynamic lang-attr to pretty.ejs
CodiMD currently only uses the 'lang' attribute in YAML-metadata of a note for setting certain js-elements of the markdown-renderer. This commit adds the chosen lang into the published version of a note.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2020-07-03 00:06:03 +02:00
Nick Hahn
043f2c3193 Fix checksums of mermaid
Signed-off-by: Nick Hahn <nick.hahn@posteo.de>
2020-05-28 14:06:33 +02:00
Nick Hahn
ae7772a3f3 Update to mermaid 8.5.1
Signed-off-by: Nick Hahn <nick.hahn@posteo.de>
2020-05-27 14:06:03 +02:00
Sheogorath
54bde6b11f
Add translations for permissions
Adding translations for permissions for a possible 1.6.1 release doesn't
hurt but might helps some usecases of running CodiMD and we'll need the
translations in the new frontend anyway.

This patch adds the translations as well as the english local file.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-05-26 16:22:41 +02:00
Antoine Aflalo
adf37550be Update mermaid in CDN
Signed-off-by: Antoine Aflalo <antoine@warrantymaster.com>
2020-02-10 17:12:31 +00:00
Enrico Guiraud
23c7b5b0a6
Fix urlPath support, let CodiMD be served from a subpath correctly
Webpack now uses relative paths for resources linked from by static
snippets. A templated <base> tag has been introduced in headers
so app.js can set the base URL at runtime.

Signed-off-by: Enrico Guiraud <enrico.guiraud@cern.ch>
2019-12-20 12:03:16 +01:00
Sheogorath
cd34a8c702
Merge pull request #191 from ErikMichelson/feature/ogmetadata
Add customizable opengraph metadata for notes (see #40)
2019-10-10 14:55:34 +02:00
Erik Michelson
f26f48793f
Fixed bugs, added default image
Signed-off-by: Erik Michelson <erik@liltv.de>
2019-10-09 23:01:43 +02:00
Martin Turoci
c1f629161b Slovak locale
Signed-off-by: Martin Turoci <martinturoci@gmail.com>
2019-10-05 22:32:47 +02:00
Erik Michelson
2881f8211a
Added customizable og-metadata to notes
Signed-off-by: Erik Michelson <erik@liltv.de>
2019-10-04 19:49:45 +02:00
Erik Michelson
116bd7230c
Added og-metadata to index page
- image and URL properties are only included if
 the server url is set, because opengraph
 protocol does not support relative links

Signed-off-by: Erik Michelson <erik@liltv.de>
2019-10-04 11:04:58 +02:00
PetrTodorov
f0a8ff5eb3 Added Czech translation
Signed-off-by: PetrTodorov <info@petrtodorov.cz>
2019-10-03 23:02:03 +02:00
Matthias Lindinger
fe2c8634d3 Add link to imprint
Signed-off-by: Matthias Lindinger <m.lindinger@live.de>
2019-08-26 14:57:44 +02:00
Sheogorath
fce0e18ad0
Add arabian translation
Thanks to our great translators that made it to translate the major
parts of CodiMD into Arabic!

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-08-15 23:20:52 +02:00
Sheogorath
da4665c759
Respect DNT header
Do Not Track (DNT) is an old web standard in order to notify pages that
the user doesn't want to be tracked. Even while a lot of pages either
ignore this header or even worse, use it for tracking purposes, the
orignal intention of this header is good and should be adopted.

This patch implements a respect of the DNT header by no longer including
the optional Google Analytics and disqus integrations when sending a DNT
header. This should reduce outside resource usage and help to stay more
private.

This should later-on extended towards other document content (i.e.
iframe based content).

The reason to not change the CDN handling is that CDNs will be
deprecated with next release and removed in long term.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-06-08 23:43:50 +02:00
Sheogorath
e02defd402
Add Discourse link to footer
As we are about to announce the community forum, we should provide a
link to it in the footer. This patch adds Discouse between Riot, GitHub
and Mastodon as platform to follow our progress.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-05-30 00:02:37 +02:00
Sheogorath
c89c43b0bc
Add vietnamese language
There was some awesome work by Hồng in the recent days who translated
CodiMD completely into Vietnamese language! This patch provides this
awesome contributions.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-05-26 05:34:52 +02:00
Amolith
871d8ea183
remove single quote preceding mastodon link
Signed-off-by: Amolith <amolith@nixnet.xyz>
2019-05-20 15:16:49 -04:00
Amolith
0eb1d4d612
add mastodon link to index - complete #70
Signed-off-by: Amolith <amolith@nixnet.xyz>
2019-05-19 21:52:21 -04:00
Amolith
4a02ca5d11
fix issue 72
Signed-off-by: Amolith <amolith@nixnet.xyz>
2019-05-19 20:50:53 -04:00
Sheogorath
9101be92ab
Update jQuery to version 3.4.1 2019-05-06 10:42:41 +02:00
Sheogorath
c0e75b8606
Replace js-url with wurl
js-url is outdated and wurl is it's successor. This will fix some
vulnerabilities in the dependencies and also optimize the build process
by removing the external library toward internal tooling.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-04-16 19:28:23 +02:00
Sheogorath
454b39ac10
Add community forum to help section
We have a community forum and want to use it for users support and to
bring developers and end-users together. In order to achieve this, it
would be helpful to inform users about its existence.

This patch adds the community forum as resource to the help section and
aligns it along the Matrix channel and GitHub issue tracker.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-04-12 12:29:56 +02:00
Henrik Hüttemann
5951dd1805 Add missing space to footer
Signed-off-by: Henrik "HerHde" Hüttemann <mail@herh.de>
2019-04-01 09:47:06 +02:00
Christoph (Sheogorath) Kern
3a0ff5edd3
Merge pull request #9 from SISheogorath/feature/moveUpload
Move upload button into toolbar
2019-03-31 15:14:31 +02:00
Christoph (Sheogorath) Kern
52055ec7b7
Merge pull request #8 from SISheogorath/fix/languages
Fix capital letters in language selection
2019-03-31 03:30:15 +02:00
Sheogorath
7cde6958f3
Update links to new repositories
After a long discussion, it turned out that CodiMD as community project
and HackMD as a company, have fundamental different views on the project
governance.

Due to this, it came to point where the decision for a fork was made.
After the fork and move towards an own organisation, this patch updates
all links inside the project to the new repositories.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-03-27 19:31:34 +01:00
Sheogorath
1544b45af5
Move upload button into toolbar
Currently we have the odd situation to have two toolbars. One inside the
header and one in the editor.

Since we only show the image upload button when the editor is visible we
should move the upload button into the editor toolbar.

This patch does this by adding the image upload button besides the image
tag button.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-03-25 22:33:27 +01:00
Sheogorath
d167f7b092
Fix capital letters in language selection
Vladan[1] gave a hint about some minor problems with the capitalization
of language names.

This patch should fix most of them. and removes some "language" prefix
and suffixes which are not needed to make clear what people are
selecting here.

[1]: https://github.com/cvladan

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-03-24 23:13:48 +01:00
Christoph (Sheogorath) Kern
992f02c294
Merge pull request #1158 from SISheogorath/feature/serbianLanguage
Add serbian language
2019-03-16 19:58:45 +01:00