merge latest develop

2025-04-27 19:06:15 -04:00 · 2015-04-11 16:16:03 +01:00 · 2015-04-11 16:16:03 +01:00 · 4234681efd
commit 4234681efd
parent e488d95aca 25092fcb90
12 changed files with 80 additions and 42 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,3 +1,6 @@
+# 1.5.4
+ * SECURITY: Also don't allow read files on directory traversal on frontend tests path
+
 # 1.5.3
 * NEW: Accessibility support for Screen readers, includes new fonts and keyboard shortcuts
 * NEW: API endpoint for Append Chat Message and Chat Backend Tests
--- a/doc/api/http_api.md
+++ b/doc/api/http_api.md
@ -61,7 +61,7 @@ Portal submits content into new blog post
 ## Usage

 ### API version
-The latest version is `1.2.11`
+The latest version is `1.2.12`

 The current version can be queried via /api.

@ -232,7 +232,7 @@ creates a new session. validUntil is an unix timestamp in seconds
 deletes a session

 *Example returns:*
-  * `{code: 1, message:"ok", data: null}`
+  * `{code: 0, message:"ok", data: null}`
  * `{code: 1, message:"sessionID does not exist", data: null}`

 #### getSessionInfo(sessionID)
@ -388,10 +388,12 @@ Group pads are normal pads, but with the name schema GROUPID$PADNAME. A security
 * API >= 1

 creates a new (non-group) pad.  Note that if you need to create a group Pad, you should call **createGroupPad**.
+You get an error message if you use one of the following characters in the padID: "/", "?", "&" or "#".

 *Example returns:*
  * `{code: 0, message:"ok", data: null}`
-  * `{code: 1, message:"pad does already exist", data: null}`
+  * `{code: 1, message:"padID does already exist", data: null}`
+  * `{code: 1, message:"malformed padID: Remove special characters", data: null}`

 #### getRevisionsCount(padID)
 * API >= 1
--- a/src/node/db/API.js
+++ b/src/node/db/API.js
@ -687,12 +687,21 @@ Example returns:
 exports.createPad = function(padID, text, callback)
 {  
  //ensure there is no $ in the padID
-  if(padID && padID.indexOf("$") != -1)
+  if(padID)
  {
-    callback(new customError("createPad can't create group pads","apierror"));
-    return;
+    if(padID.indexOf("$") != -1)
+    {
+      callback(new customError("createPad can't create group pads","apierror"));
+      return;
+    }
+    //check for url special characters
+    else if(padID.match(/(\/|\?|&|#)/))
+    {
+      callback(new customError("malformed padID: Remove special characters","apierror"));
+      return;
+    }
  }
-  
+
  //create pad
  getPadSafe(padID, false, text, function(err)
  {
--- a/src/node/eejs/index.js
+++ b/src/node/eejs/index.js
@ -26,7 +26,7 @@ var hooks = require("ep_etherpad-lite/static/js/pluginfw/hooks.js");
 var resolve = require("resolve");

 exports.info = {
-  buf_stack: [],
+  __output_stack: [],
  block_stack: [],
  file_stack: [],
  args: []
@ -41,27 +41,27 @@ function createBlockId(name) {
 }

 exports._init = function (b, recursive) {
-  exports.info.buf_stack.push(exports.info.buf);
-  exports.info.buf = b;
+  exports.info.__output_stack.push(exports.info.__output);
+  exports.info.__output = b;
 }

 exports._exit = function (b, recursive) {
  getCurrentFile().inherit.forEach(function (item) {
    exports._require(item.name, item.args);
  });
-  exports.info.buf = exports.info.buf_stack.pop();
+  exports.info.__output = exports.info.__output_stack.pop();
 }

 exports.begin_capture = function() {
-  exports.info.buf_stack.push(exports.info.buf.concat());
-  exports.info.buf.splice(0, exports.info.buf.length);
+  exports.info.__output_stack.push(exports.info.__output.concat());
+  exports.info.__output.splice(0, exports.info.__output.length);
 }

 exports.end_capture = function () {
-  var res = exports.info.buf.join("");
-  exports.info.buf.splice.apply(
-    exports.info.buf,
-    [0, exports.info.buf.length].concat(exports.info.buf_stack.pop()));
+  var res = exports.info.__output.join("");
+  exports.info.__output.splice.apply(
+    exports.info.__output,
+    [0, exports.info.__output.length].concat(exports.info.__output_stack.pop()));
  return res;
 }

@ -80,7 +80,7 @@ exports.end_block = function () {
  var renderContext = exports.info.args[exports.info.args.length-1];
  var args = {content: exports.end_define_block(), renderContext: renderContext};
  hooks.callAll("eejsBlock_" + name, args);
-  exports.info.buf.push(args.content);
+  exports.info.__output.push(args.content);
 }

 exports.begin_block = exports.begin_define_block;
@ -114,7 +114,7 @@ exports.require = function (name, args, mod) {

  args.e = exports;
  args.require = require;
-  var template = '<% e._init(buf); %>' + fs.readFileSync(ejspath).toString() + '<% e._exit(); %>';
+  var template = '<% e._init(__output); %>' + fs.readFileSync(ejspath).toString() + '<% e._exit(); %>';
  
  exports.info.args.push(args);
  exports.info.file_stack.push({path: ejspath, inherit: []});
@ -127,5 +127,5 @@ exports.require = function (name, args, mod) {
 }

 exports._require = function (name, args) {
-  exports.info.buf.push(exports.require(name, args));
+  exports.info.__output.push(exports.require(name, args));
 }
--- a/src/node/hooks/express/static.js
+++ b/src/node/hooks/express/static.js
@ -9,7 +9,7 @@ exports.expressCreateServer = function (hook_name, args, cb) {

  // Cache both minified and static.
  var assetCache = new CachingMiddleware;
-  args.app.all(/\/(javascripts|static)\/(.*)/, assetCache.handle);
+  args.app.all(/\/javascripts\/(.*)/, assetCache.handle);

  // Minify will serve static files compressed (minify enabled). It also has
  // file-specific hacks for ace/require-kernel/etc.
--- a/src/package.json
+++ b/src/package.json
@ -15,12 +15,12 @@
                      "etherpad-yajsml"         : "0.0.2",
                      "request"                 : "2.55.0",
                      "requirejs"		: "2.1.17",
-                      "etherpad-require-kernel" : "1.0.8",
+                      "etherpad-require-kernel" : "1.0.9",
                      "resolve"                 : "1.1.6",
                      "socket.io"               : "1.3.5",
                      "ueberDB"                 : "0.2.15",
                      "express"                 : "4.12.3",
-                      "express-session"         : "1.10.4",
+                      "express-session"         : "1.11.1",
                      "cookie-parser"           : "1.3.4",
                      "async"                   : "0.9.0",
                      "clean-css"               : "3.1.9",
@ -29,21 +29,21 @@
                      "log4js"                  : "0.6.22",
                      "cheerio"                 : "0.19.0",
                      "async-stacktrace"        : "0.0.2",
-                      "npm"                     : "2.7.5",
-                      "ejs"                     : "1.0.0",
+                      "npm"                     : "2.7.6",
+                      "ejs"                     : "2.3.1",
                      "graceful-fs"             : "3.0.6",
                      "slide"                   : "1.1.6",
                      "semver"                  : "4.3.3",
                      "security"                : "1.0.0",
                      "tinycon"                 : "0.0.1",
-                      "underscore"              : "1.5.1",
+                      "underscore"              : "1.8.3",
                      "unorm"                   : "1.3.3",
                      "languages4translatewiki" : "0.1.3",
                      "swagger-node-express"    : "2.1.3",
                      "channels"                : "0.0.4",
                      "jsonminify"              : "0.2.3",
                      "measured"                : "1.0.0",
-                      "mocha"                   : "2.2.1",
+                      "mocha"                   : "2.2.4",
                      "supertest"               : "0.15.0"
                     },
  "bin":             { "etherpad-lite": "./node/server.js" },
@ -56,5 +56,5 @@
  "repository"     : { "type" : "git",
                       "url" : "http://github.com/ether/etherpad-lite.git"
                     },
-  "version"        : "1.5.3"
+  "version"        : "1.5.4"
 }
--- a/src/static/css/iframe_editor.css
+++ b/src/static/css/iframe_editor.css
@ -210,8 +210,9 @@ ol {
  list-style-type: decimal;
 }

+/* Fixes #2223 and #1836 */
 ol > li {
-  display:inline;   
+  display:block;
 }

 /* Set the indentation */
--- a/src/static/js/ace2_inner.js
+++ b/src/static/js/ace2_inner.js
@ -4955,7 +4955,10 @@ function Ace2Inner(){

    // Don't paste on middle click of links
    $(root).on("paste", function(e){
-      if(e.target.a){
+      // TODO: this breaks pasting strings into URLS when using 
+      // Control C and Control V -- the Event is never available
+      // here.. :(
+      if(e.target.a || e.target.localName === "a"){
        e.preventDefault();
      }
    })
--- a/src/static/js/broadcast_slider.js
+++ b/src/static/js/broadcast_slider.js
@ -166,6 +166,7 @@ function loadBroadcastSliderJS(fireWhenAllScriptsAreLoaded)
      padmodals.showModal("disconnected");
    }

+    // Throttle seems like overkill here...  Not sure why we do it!
    var fixPadHeight = _.throttle(function(){
      var height = $('#timeslider-top').height();
      $('#editorcontainerbox').css({marginTop: height});
--- a/tests/backend/specs/api/pad.js
+++ b/tests/backend/specs/api/pad.js
@ -2,7 +2,8 @@ var assert = require('assert')
 supertest = require(__dirname+'/../../../../src/node_modules/supertest'),
        fs = require('fs'),
       api = supertest('http://localhost:9001');
-      path = require('path');
+      path = require('path'),
+     async = require(__dirname+'/../../../../src/node_modules/async');

 var filePath = path.join(__dirname, '../../../../APIKEY.txt');

@ -80,6 +81,7 @@ describe('Permission', function(){
                               -> setHTML(padID) -- Should fail on invalid HTML
                                -> setHTML(padID) *3 -- Should fail on invalid HTML
                                 -> getHTML(padID) -- Should return HTML close to posted HTML
+                                  -> createPad -- Tries to create pads with bad url characters

 */

@ -494,6 +496,23 @@ describe('getHTML', function(){
  });
 })

+describe('createPad', function(){
+  it('errors if pad can be created', function(done) {
+    var badUrlChars = ["/", "%23", "%3F", "%26"];
+    async.map(
+      badUrlChars, 
+      function (badUrlChar, cb) {
+        api.get(endPoint('createPad')+"&padID="+badUrlChar)
+        .expect(function(res){
+          if(res.body.code !== 1) throw new Error("Pad with bad characters was created");
+        })
+        .expect('Content-Type', /json/)
+        .end(cb);
+      },
+      done);
+  });
+})
+

 /*
                          -> movePadForce Test
--- a/tests/frontend/specs/importexport.js
+++ b/tests/frontend/specs/importexport.js
@ -52,7 +52,7 @@ describe("import functionality", function(){
    return exportresults
  }

-  it("import a pad with newlines from txt", function(done){
+  xit("import a pad with newlines from txt", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var textWithNewLines = 'imported text\nnewline'
    importrequest(textWithNewLines,importurl,"txt")
@ -64,7 +64,7 @@ describe("import functionality", function(){
    expect(results[1][1]).to.be("imported text\nnewline\n\n")
    done()
  })
-  it("import a pad with newlines from html", function(done){
+  xit("import a pad with newlines from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithNewLines = '<html><body>htmltext<br/>newline</body></html>'
    importrequest(htmlWithNewLines,importurl,"html")
@ -76,7 +76,7 @@ describe("import functionality", function(){
    expect(results[1][1]).to.be("htmltext\nnewline\n\n")
    done()
  })
-  it("import a pad with attributes from html", function(done){
+  xit("import a pad with attributes from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithNewLines = '<html><body>htmltext<br/><span class="b s i u"><b><i><s><u>newline</u></s></i></b></body></html>'
    importrequest(htmlWithNewLines,importurl,"html")
@ -88,7 +88,7 @@ describe("import functionality", function(){
    expect(results[1][1]).to.be('htmltext\nnewline\n\n')
    done()
  })
-  it("import a pad with bullets from html", function(done){
+  xit("import a pad with bullets from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li><li>bullet2 line 2</li></ul></ul></body></html>'
    importrequest(htmlWithBullets,importurl,"html")
@ -105,7 +105,7 @@ describe("import functionality", function(){
    expect(results[1][1]).to.be('\t* bullet line 1\n\t* bullet line 2\n\t\t* bullet2 line 1\n\t\t* bullet2 line 2\n\n')
    done()
  })
-  it("import a pad with bullets and newlines from html", function(done){
+  xit("import a pad with bullets and newlines from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li></ul><br/><ul class="list-bullet1"><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li></ul></ul><br/><ul class="list-bullet1"><ul class="list-bullet2"><li>bullet2 line 2</li></ul></ul></body></html>'
    importrequest(htmlWithBullets,importurl,"html")
@ -124,7 +124,7 @@ describe("import functionality", function(){
    expect(results[1][1]).to.be('\t* bullet line 1\n\n\t* bullet line 2\n\t\t* bullet2 line 1\n\n\t\t* bullet2 line 2\n\n')
    done()
  })
-  it("import a pad with bullets and newlines and attributes from html", function(done){
+  xit("import a pad with bullets and newlines and attributes from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li></ul><br/><ul class="list-bullet1"><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li></ul></ul><br/><ul class="list-bullet1"><ul class="list-bullet2"><ul class="list-bullet3"><ul class="list-bullet4"><li><span class="b s i u"><b><i><s><u>bullet4 line 2 bisu</u></s></i></b></span></li><li><span class="b s "><b><s>bullet4 line 2 bs</s></b></span></li><li><span class="u"><u>bullet4 line 2 u</u></span><span class="u i s"><i><s><u>uis</u></s></i></span></li></ul></ul></ul></ul></body></html>'
    importrequest(htmlWithBullets,importurl,"html")
@ -143,7 +143,7 @@ describe("import functionality", function(){
    expect(results[1][1]).to.be('\t* bullet line 1\n\n\t* bullet line 2\n\t\t* bullet2 line 1\n\n\t\t\t\t* bullet4 line 2 bisu\n\t\t\t\t* bullet4 line 2 bs\n\t\t\t\t* bullet4 line 2 uuis\n\n')
    done()
  })
-  it("import a pad with nested bullets from html", function(done){
+  xit("import a pad with nested bullets from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li></ul><ul class="list-bullet1"><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li></ul></ul><ul class="list-bullet1"><ul class="list-bullet2"><ul class="list-bullet3"><ul class="list-bullet4"><li>bullet4 line 2</li><li>bullet4 line 2</li><li>bullet4 line 2</li></ul><li>bullet3 line 1</li></ul></ul><li>bullet2 line 1</li></ul></body></html>'
    importrequest(htmlWithBullets,importurl,"html")
@ -165,7 +165,7 @@ describe("import functionality", function(){
    expect(results[1][1]).to.be('\t* bullet line 1\n\t* bullet line 2\n\t\t* bullet2 line 1\n\t\t\t\t* bullet4 line 2\n\t\t\t\t* bullet4 line 2\n\t\t\t\t* bullet4 line 2\n\t\t\t* bullet3 line 1\n\t* bullet2 line 1\n\n')
    done()
  })
-  it("import a pad with 8 levels of bullets and newlines and attributes from html", function(done){
+  xit("import a pad with 8 levels of bullets and newlines and attributes from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li></ul><br/><ul class="list-bullet1"><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li></ul></ul><br/><ul class="list-bullet1"><ul class="list-bullet2"><ul class="list-bullet3"><ul class="list-bullet4"><li><span class="b s i u"><b><i><s><u>bullet4 line 2 bisu</u></s></i></b></span></li><li><span class="b s "><b><s>bullet4 line 2 bs</s></b></span></li><li><span class="u"><u>bullet4 line 2 u</u></span><span class="u i s"><i><s><u>uis</u></s></i></span></li><ul class="list-bullet5"><ul class="list-bullet6"><ul class="list-bullet7"><ul class="list-bullet8"><li><span class="">foo</span></li><li><span class="b s"><b><s>foobar bs</b></s></span></li></ul></ul></ul></ul><ul class="list-bullet5"><li>foobar</li></ul></ul></ul></ul></body></html>'
    importrequest(htmlWithBullets,importurl,"html")
--- a/tests/frontend/specs/importindents.js
+++ b/tests/frontend/specs/importindents.js
@ -49,7 +49,7 @@ describe("import indents functionality", function(){
    return exportresults
  }

-  it("import a pad with indents from html", function(done){
+  xit("import a pad with indents from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithIndents = '<html><body><ul class="list-indent1"><li>indent line 1</li><li>indent line 2</li><ul class="list-indent2"><li>indent2 line 1</li><li>indent2 line 2</li></ul></ul></body></html>'
    importrequest(htmlWithIndents,importurl,"html")
@ -67,7 +67,7 @@ describe("import indents functionality", function(){
    done()
  })
  
-  it("import a pad with indented lists and newlines from html", function(done){
+  xit("import a pad with indented lists and newlines from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithIndents = '<html><body><ul class="list-indent1"><li>indent line 1</li></ul><br/><ul class="list-indent1"><li>indent 1 line 2</li><ul class="list-indent2"><li>indent 2 times line 1</li></ul></ul><br/><ul class="list-indent1"><ul class="list-indent2"><li>indent 2 times line 2</li></ul></ul></body></html>'
    importrequest(htmlWithIndents,importurl,"html")
@ -86,7 +86,7 @@ describe("import indents functionality", function(){
    expect(results[1][1]).to.be('\tindent line 1\n\n\tindent 1 line 2\n\t\tindent 2 times line 1\n\n\t\tindent 2 times line 2\n\n')
    done()
  })
-  it("import a pad with 8 levels of indents and newlines and attributes from html", function(done){
+  xit("import a pad with 8 levels of indents and newlines and attributes from html", function(done){
    var importurl = helper.padChrome$.window.location.href+'/import'
    var htmlWithIndents = '<html><body><ul class="list-indent1"><li>indent line 1</li></ul><br/><ul class="list-indent1"><li>indent line 2</li><ul class="list-indent2"><li>indent2 line 1</li></ul></ul><br/><ul class="list-indent1"><ul class="list-indent2"><ul class="list-indent3"><ul class="list-indent4"><li><span class="b s i u"><b><i><s><u>indent4 line 2 bisu</u></s></i></b></span></li><li><span class="b s "><b><s>indent4 line 2 bs</s></b></span></li><li><span class="u"><u>indent4 line 2 u</u></span><span class="u i s"><i><s><u>uis</u></s></i></span></li><ul class="list-indent5"><ul class="list-indent6"><ul class="list-indent7"><ul class="list-indent8"><li><span class="">foo</span></li><li><span class="b s"><b><s>foobar bs</b></s></span></li></ul></ul></ul></ul><ul class="list-indent5"><li>foobar</li></ul></ul></ul></ul></body></html>'
    importrequest(htmlWithIndents,importurl,"html")