Commit graph

2483 commits

Author SHA1 Message Date
Simeon Keske
bab0409ed0
add error handling to saml-certs
Signed-off-by: Simeon Keske <git@n0emis.eu>
Signed-off-by: Leo Maroni <git@em0lar.de>
2020-07-11 21:21:00 +02:00
Leo Maroni
35ec617007
Fixed Image Sources in saml-keycloak guide
Signed-off-by: Leo Maroni <git@em0lar.de>
2020-07-11 21:20:59 +02:00
Leo Maroni
ae8bb96cc6
Create Keycloak SAML guide
Co-authored-by: Simeon Keske <git@n0emis.eu>
Signed-off-by: Simeon Keske <git@n0emis.eu>
Signed-off-by: Leo Maroni <git@em0lar.de>
2020-07-11 21:20:53 +02:00
Simeon Keske
17f0067ab2
allow to set a saml client certificate
Signed-off-by: Simeon Keske <git@n0emis.eu>
2020-07-11 21:19:49 +02:00
David Mehren
3db8b0df43
Merge pull request #410 from oupala/feature/markdown-linting 2020-07-10 19:59:32 +02:00
David Mehren
0b7dbd1f43
Merge pull request #431 from ericgaspar/yunohost-setup
Create yunohost.md
2020-07-10 19:03:53 +02:00
oupala
89895cef2e chore: update yarn.lock
Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-07-10 18:57:59 +02:00
oupala
2f462f90d4 style: linting markdown files
Linting markdown files according to default remark-lint configuration.

Files inside the `public` directory were not linted.

Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-07-10 18:57:59 +02:00
oupala
7321990960 fix: override markdown linting preset
Override markdown linting preset to disable a rule that seems useless and to change the default setting of 2 other rules.

Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-07-10 18:57:31 +02:00
David Mehren
88b292fbe0
Merge pull request #437 from codimd/enhancement/lang-attr-published 2020-07-10 12:01:33 +02:00
David Mehren
5b8d948c8c
Merge pull request #439 from codimd/snyk-fix-8abe8148a4aed9acdfa517dfcae7bbd1
[Snyk] Security upgrade lodash from 4.17.15 to 4.17.16
2020-07-10 11:37:11 +02:00
snyk-bot
09d210e70b fix: package.json & yarn.lock to reduce vulnerabilities
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
2020-07-10 05:35:53 +00:00
Erik Michelson
e4214f32a0
Fixed meta parsing of lang-attribute for using it in the published-view
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2020-07-04 03:37:19 +02:00
Erik Michelson
ee4210a511 Added dynamic lang-attr to pretty.ejs
CodiMD currently only uses the 'lang' attribute in YAML-metadata of a note for setting certain js-elements of the markdown-renderer. This commit adds the chosen lang into the published version of a note.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2020-07-03 00:06:03 +02:00
David Mehren
aadb35975e
Merge pull request #432 from codimd/docs/fix-yaml
Fix yaml-metadata docs example for lang
2020-07-02 22:33:38 +02:00
Erik Michelson
7346a67d85 Fixed yaml-metadata docs
In the yaml-metadata docs, the example for the 'lang' attribute had an invalid key 'langs'.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2020-07-02 21:40:30 +02:00
ericgaspar
91582ea722
Create yunohost.md
Signed-off-by: ericgaspar <junk.eg@free.fr>

Add setup doc about deploying CodiMD with YunoHost.
2020-07-02 21:31:47 +02:00
oupala
94058ef0a0 chore: add markdown linter in travis CI
Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-07-02 11:55:44 +02:00
oupala
3d0cdc914c feat: add remark-lint dependencies and script
Add remark-lint dependencies as dev dependencies, and an npm script alias to launch markdown linting with `npm run markdownlint`.

Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-07-02 11:55:44 +02:00
oupala
d34775b194 doc: add a markdown linting configuration file
Add a markdown linting configuration file. The configuration file is using [remark-preset-lint-markdown-style-guide](https://github.com/remarkjs/remark-lint/tree/master/packages/remark-preset-lint-markdown-style-guide). This preset configure `remark-lint` with settings that the [Markdown Style Guide](http://www.cirosantilli.com/markdown-style-guide/) recommends.

Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-07-02 11:55:44 +02:00
Sheogorath
3cc957a88b
Upgrade LDAP-auth to fix RCE in ldapauth dependency
Synk reported an Remote Code Execution vulnerability for the
passport-ldapauth dependency `bunyan`. This RCE is due to wrong command
sanitizing but doesn't only affects the executable the libary provides.
It has no impact on CodiMD.

This patch just updates passport-ldapauth since it's long overdue anyway
and to silence annoying security scanners that pretend this is rather
critical for us.

Reference:
ea21d75f54
https://app.snyk.io/vuln/SNYK-JS-BUNYAN-573166
2020-06-27 13:04:54 +02:00
Sheogorath
c789b71cc3
Merge pull request #423 from codimd/SuperSandro2000-patch-1
Fix browser logo links
2020-06-26 10:55:45 +02:00
Sandro
e95de9b102
Fix browser logo links
Signed-off-by: Sandro Jäckel <sandro.jaeckel@gmail.com>
2020-06-26 09:48:24 +02:00
Sheogorath
5c45b35a82
Merge pull request #419 from vberger/master
Backport of #278 for 1.6.1
2020-06-23 16:49:38 +02:00
Victor Berger
5f3a1b6266 Backport of #278 for 1.6.1
This is a backport of #278 with the default value of `scope` changed to
`undefined`. This is thus a fully backward-compatible change.

Signed-off-by: Victor Berger <victor.berger@m4x.org>
2020-06-20 16:48:25 +02:00
Sheogorath
0ef5261e61
Merge pull request #398 from gramakri/patch-1
Update Cloudron docs
2020-06-20 14:58:05 +02:00
Sheogorath
01dcce23e8
Merge pull request #416 from oupala/patch-2
fix: outdated internal links in documentation
2020-06-20 13:45:48 +02:00
oupala
1ea99b0ec2 fix: outdated internal links in documentation
Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-06-20 11:44:29 +02:00
Sheogorath
20a1563d7f
Merge pull request #414 from dalcde/config
Fix docs/configuration formatting
2020-06-19 02:11:02 +02:00
Dexter Chua
aba68eb39a Fix docs/configuration formatting
Signed-off-by: Dexter Chua <dalcde@yahoo.com.hk>
2020-06-19 06:23:23 +08:00
Sheogorath
c07a107b1f
Merge pull request #404 from oupala/master
improve documentation about configuration
2020-06-18 11:13:09 +02:00
oupala
46e86b1be3 refactor: move some documentation
Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-06-17 15:33:55 +02:00
oupala
712e2194f4 fix: document CMD_S3_ENDPOINT ENV variable
fix #349

Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-06-17 10:54:12 +02:00
oupala
65fc44e32f refactor: lint markdown
Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-06-17 10:54:12 +02:00
oupala
e46d520ca2 doc: merge configuration-config-file.md and configuration-env-vars.md to configuration.md
Signed-off-by: oupala <oupala@users.noreply.github.com>
2020-06-17 10:54:12 +02:00
Sheogorath
3436d118e5
Merge pull request #400 from david-sawatzke/fix-anonymous-edits-docu
Fix allow anonymous edit documentation
2020-06-13 11:26:29 +02:00
David Sawatzke
c5ff30c5a1 Fix allow anonymous edit documentation
The default is false and the option only matters if allowAnonymous is true

Signed-off-by: David Sawatzke <d-git@sawatzke.dev>
2020-06-12 22:17:43 +02:00
Girish Ramakrishnan
8319c19aa5 Update Cloudron docs
Added a link to the demo and source code repo

Signed-off-by: Girish Ramakrishnan <girish@cloudron.io>
2020-06-12 11:23:10 -07:00
Sheogorath
3d1fab0512
Relax cookie restrictions to 'lax' to allow frontend to work
Our frontend requests the `/me` pathname in order to determine whether
it's logged in or not. Due to the fact that the sameSite attribute of
the session cookie was set to `strict` in a previous commit, the session
token was no longer sent along with HTTP calls initiated by JS. This is
due to the RFCs definition of "safe" HTTP calls in RFC7231.

The bug triggers the UI to show up like an unauthenticated user, even
after a successful login. In order to debug it a look into the send
cookies to the `/me` turned out to be very enlightening.

The fix this patch implements is rather simple, it replaces the sameSite
attribute to `lax` which enables the cookies for those requests again.

Some older and mobile clients were unaffected by this due to the lack of
implementations of sameSite policies.

References:
https://tools.ietf.org/html/rfc7231#section-4.2.1
https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-05#section-5.3.7.1
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
e77e7b165a

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-06-10 15:16:32 +02:00
Sheogorath
8cf3b50ee9
Fix broken cookie handling due to missing proxy awareness
We enabled the `secure` flag for various cookies in previous commits.
This caused setups behind reverse proxies to drop cookies as the nodejs
instance wasn't aware of the fact that it was able to hand out secure
commits using an insecure connection (between the codimd instance and
the reverse proxy).

This patch makes express, the webserver framework we use, aware of
proxies and this way re-enabled the handing out of cookies. Not only the
cookie monster will enjoy, but also functionality like authentication
and real-time editing will return as intended.

References:
https://www.npmjs.com/package/express-session#cookiesecure
383d791a50

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-06-10 12:26:23 +02:00
Sheogorath
d6ce60c86e
Upgrade pg to fix node version 14 compatibility
As @davidmehren figured out, the problem that NodeJS version 14 gets
stuck while CodiMD is starting, was due to the outdated postgres
dependency. The old pg version doesn't work with node version 14 due to
an undocumented API change in the `readyState` in the socket API.

This patch updates the required dependency and this way resolves the
issue.

Reference:
https://github.com/sequelize/sequelize/issues/12158
149f482324

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-06-09 20:26:51 +02:00
Sheogorath
2890022d4d
Merge branch 'fix/sessionCookies' 2020-06-08 16:30:26 +02:00
Sheogorath
7e02a92c45
Merge branch 'pr-upstream-389' 2020-06-08 16:27:56 +02:00
Sheogorath
cdd18aebfd
Remove unused socket.io cookie
The socket.io cookie doesn't really have any purpose as it's no longer
user in modern socket.io versions. This patch disables it.

References:
https://github.com/socketio/socket.io/issues/2276
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-06-08 16:10:00 +02:00
Sheogorath
383d791a50
Ensure session cookies are secure
While HSTS should take care of most of this, setting cookies to be
secure, and only applied on same site helps to improve situations where
for whatever reason, downgrade attacks are still a thing.

This patch adds the `sameSite` and `secure` to the session cookie and
this way prevent all accidents where a browser may doesn't support HSTS
or HSTS is intentionally dropped.

Reference:
https://www.npmjs.com/package/express-session#cookiesecure

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2020-06-08 16:09:49 +02:00
David Mehren
2215da9431
Disable unneeded 'io' cookie.
According to https://github.com/socketio/socket.io/issues/2276 this cookie is not used for anything. To avoid browser warnings about the sameSite attribute, we disable it here.

Signed-off-by: David Mehren <dmehren1@gmail.com>
2020-06-08 15:52:08 +02:00
David Mehren
e77e7b165a
Set all cookies with sameSite: strict
Modern browsers do not support (or will stop supporting) sameSite: none (or no sameSite attribute) without the Secure flag. As we don't want everyone to be able to make requests with our cookies anyway, this commit sets sameSite to strict. See https://developer.mozilla.org/de/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Signed-off-by: David Mehren <dmehren1@gmail.com>
2020-06-08 15:27:31 +02:00
Sheogorath
49de5f5bd6
Merge pull request #375 from codingHahn/fix-checksums
Fix checksums of mermaid
2020-05-28 18:06:30 +02:00
Nick Hahn
043f2c3193 Fix checksums of mermaid
Signed-off-by: Nick Hahn <nick.hahn@posteo.de>
2020-05-28 14:06:33 +02:00
Sheogorath
407c53b9d9
Merge pull request #373 from codingHahn/update-mermaid
Update to mermaid 8.5.1
2020-05-27 19:42:28 +02:00