merge latest develop

CHANGELOG.md

@@ -1,3 +1,6 @@
+# 1.5.4
+ * SECURITY: Also don't allow read files on directory traversal on frontend tests path
+
 # 1.5.3
  * NEW: Accessibility support for Screen readers, includes new fonts and keyboard shortcuts
  * NEW: API endpoint for Append Chat Message and Chat Backend Tests

doc/api/http_api.md

@@ -61,7 +61,7 @@ Portal submits content into new blog post
 ## Usage
 
 ### API version
-The latest version is `1.2.11`
+The latest version is `1.2.12`
 
 The current version can be queried via /api.
 
@@ -232,7 +232,7 @@ creates a new session. validUntil is an unix timestamp in seconds
 deletes a session
 
 *Example returns:*
-  * `{code: 1, message:"ok", data: null}`
+  * `{code: 0, message:"ok", data: null}`
   * `{code: 1, message:"sessionID does not exist", data: null}`
 
 #### getSessionInfo(sessionID)
@@ -388,10 +388,12 @@ Group pads are normal pads, but with the name schema GROUPID$PADNAME. A security
  * API >= 1
 
 creates a new (non-group) pad.  Note that if you need to create a group Pad, you should call **createGroupPad**.
+You get an error message if you use one of the following characters in the padID: "/", "?", "&" or "#".
 
 *Example returns:*
   * `{code: 0, message:"ok", data: null}`
-  * `{code: 1, message:"pad does already exist", data: null}`
+  * `{code: 1, message:"padID does already exist", data: null}`
+  * `{code: 1, message:"malformed padID: Remove special characters", data: null}`
 
 #### getRevisionsCount(padID)
  * API >= 1

src/node/db/API.js

@@ -687,12 +687,21 @@ Example returns:
 exports.createPad = function(padID, text, callback)
 {  
   //ensure there is no $ in the padID
-  if(padID && padID.indexOf("$") != -1)
+  if(padID)
   {
-    callback(new customError("createPad can't create group pads","apierror"));
+    if(padID.indexOf("$") != -1)
-    return;
+    {
+      callback(new customError("createPad can't create group pads","apierror"));
+      return;
+    }
+    //check for url special characters
+    else if(padID.match(/(\/|\?|&|#)/))
+    {
+      callback(new customError("malformed padID: Remove special characters","apierror"));
+      return;
+    }
   }
-  
+
   //create pad
   getPadSafe(padID, false, text, function(err)
   {

src/node/eejs/index.js

@@ -26,7 +26,7 @@ var hooks = require("ep_etherpad-lite/static/js/pluginfw/hooks.js");
 var resolve = require("resolve");
 
 exports.info = {
-  buf_stack: [],
+  __output_stack: [],
   block_stack: [],
   file_stack: [],
   args: []
@@ -41,27 +41,27 @@ function createBlockId(name) {
 }
 
 exports._init = function (b, recursive) {
-  exports.info.buf_stack.push(exports.info.buf);
+  exports.info.__output_stack.push(exports.info.__output);
-  exports.info.buf = b;
+  exports.info.__output = b;
 }
 
 exports._exit = function (b, recursive) {
   getCurrentFile().inherit.forEach(function (item) {
     exports._require(item.name, item.args);
   });
-  exports.info.buf = exports.info.buf_stack.pop();
+  exports.info.__output = exports.info.__output_stack.pop();
 }
 
 exports.begin_capture = function() {
-  exports.info.buf_stack.push(exports.info.buf.concat());
+  exports.info.__output_stack.push(exports.info.__output.concat());
-  exports.info.buf.splice(0, exports.info.buf.length);
+  exports.info.__output.splice(0, exports.info.__output.length);
 }
 
 exports.end_capture = function () {
-  var res = exports.info.buf.join("");
+  var res = exports.info.__output.join("");
-  exports.info.buf.splice.apply(
+  exports.info.__output.splice.apply(
-    exports.info.buf,
+    exports.info.__output,
-    [0, exports.info.buf.length].concat(exports.info.buf_stack.pop()));
+    [0, exports.info.__output.length].concat(exports.info.__output_stack.pop()));
   return res;
 }
 
@@ -80,7 +80,7 @@ exports.end_block = function () {
   var renderContext = exports.info.args[exports.info.args.length-1];
   var args = {content: exports.end_define_block(), renderContext: renderContext};
   hooks.callAll("eejsBlock_" + name, args);
-  exports.info.buf.push(args.content);
+  exports.info.__output.push(args.content);
 }
 
 exports.begin_block = exports.begin_define_block;
@@ -114,7 +114,7 @@ exports.require = function (name, args, mod) {
 
   args.e = exports;
   args.require = require;
-  var template = '<% e._init(buf); %>' + fs.readFileSync(ejspath).toString() + '<% e._exit(); %>';
+  var template = '<% e._init(__output); %>' + fs.readFileSync(ejspath).toString() + '<% e._exit(); %>';
   
   exports.info.args.push(args);
   exports.info.file_stack.push({path: ejspath, inherit: []});
@@ -127,5 +127,5 @@ exports.require = function (name, args, mod) {
 }
 
 exports._require = function (name, args) {
-  exports.info.buf.push(exports.require(name, args));
+  exports.info.__output.push(exports.require(name, args));
 }

src/node/hooks/express/static.js

@@ -9,7 +9,7 @@ exports.expressCreateServer = function (hook_name, args, cb) {
 
   // Cache both minified and static.
   var assetCache = new CachingMiddleware;
-  args.app.all(/\/(javascripts|static)\/(.*)/, assetCache.handle);
+  args.app.all(/\/javascripts\/(.*)/, assetCache.handle);
 
   // Minify will serve static files compressed (minify enabled). It also has
   // file-specific hacks for ace/require-kernel/etc.

src/package.json

@@ -15,12 +15,12 @@
                       "etherpad-yajsml"         : "0.0.2",
                       "request"                 : "2.55.0",
                       "requirejs"		: "2.1.17",
-                      "etherpad-require-kernel" : "1.0.8",
+                      "etherpad-require-kernel" : "1.0.9",
                       "resolve"                 : "1.1.6",
                       "socket.io"               : "1.3.5",
                       "ueberDB"                 : "0.2.15",
                       "express"                 : "4.12.3",
-                      "express-session"         : "1.10.4",
+                      "express-session"         : "1.11.1",
                       "cookie-parser"           : "1.3.4",
                       "async"                   : "0.9.0",
                       "clean-css"               : "3.1.9",
@@ -29,21 +29,21 @@
                       "log4js"                  : "0.6.22",
                       "cheerio"                 : "0.19.0",
                       "async-stacktrace"        : "0.0.2",
-                      "npm"                     : "2.7.5",
+                      "npm"                     : "2.7.6",
-                      "ejs"                     : "1.0.0",
+                      "ejs"                     : "2.3.1",
                       "graceful-fs"             : "3.0.6",
                       "slide"                   : "1.1.6",
                       "semver"                  : "4.3.3",
                       "security"                : "1.0.0",
                       "tinycon"                 : "0.0.1",
-                      "underscore"              : "1.5.1",
+                      "underscore"              : "1.8.3",
                       "unorm"                   : "1.3.3",
                       "languages4translatewiki" : "0.1.3",
                       "swagger-node-express"    : "2.1.3",
                       "channels"                : "0.0.4",
                       "jsonminify"              : "0.2.3",
                       "measured"                : "1.0.0",
-                      "mocha"                   : "2.2.1",
+                      "mocha"                   : "2.2.4",
                       "supertest"               : "0.15.0"
                      },
   "bin":             { "etherpad-lite": "./node/server.js" },
@@ -56,5 +56,5 @@
   "repository"     : { "type" : "git",
                        "url" : "http://github.com/ether/etherpad-lite.git"
                      },
-  "version"        : "1.5.3"
+  "version"        : "1.5.4"
 }

src/static/css/iframe_editor.css

@@ -210,8 +210,9 @@ ol {
   list-style-type: decimal;
 }
 
+/* Fixes #2223 and #1836 */
 ol > li {
-  display:inline;   
+  display:block;
 }
 
 /* Set the indentation */

src/static/js/ace2_inner.js

@@ -4955,7 +4955,10 @@ function Ace2Inner(){
 
     // Don't paste on middle click of links
     $(root).on("paste", function(e){
-      if(e.target.a){
+      // TODO: this breaks pasting strings into URLS when using 
+      // Control C and Control V -- the Event is never available
+      // here.. :(
+      if(e.target.a || e.target.localName === "a"){
         e.preventDefault();
       }
     })

src/static/js/broadcast_slider.js

@@ -166,6 +166,7 @@ function loadBroadcastSliderJS(fireWhenAllScriptsAreLoaded)
       padmodals.showModal("disconnected");
     }
 
+    // Throttle seems like overkill here...  Not sure why we do it!
     var fixPadHeight = _.throttle(function(){
       var height = $('#timeslider-top').height();
       $('#editorcontainerbox').css({marginTop: height});

tests/backend/specs/api/pad.js

@@ -2,7 +2,8 @@ var assert = require('assert')
  supertest = require(__dirname+'/../../../../src/node_modules/supertest'),
         fs = require('fs'),
        api = supertest('http://localhost:9001');
-      path = require('path');
+      path = require('path'),
+     async = require(__dirname+'/../../../../src/node_modules/async');
 
 var filePath = path.join(__dirname, '../../../../APIKEY.txt');
 
@@ -80,6 +81,7 @@ describe('Permission', function(){
                                -> setHTML(padID) -- Should fail on invalid HTML
                                 -> setHTML(padID) *3 -- Should fail on invalid HTML
                                  -> getHTML(padID) -- Should return HTML close to posted HTML
+                                  -> createPad -- Tries to create pads with bad url characters
 
 */
 
@@ -494,6 +496,23 @@ describe('getHTML', function(){
   });
 })
 
+describe('createPad', function(){
+  it('errors if pad can be created', function(done) {
+    var badUrlChars = ["/", "%23", "%3F", "%26"];
+    async.map(
+      badUrlChars, 
+      function (badUrlChar, cb) {
+        api.get(endPoint('createPad')+"&padID="+badUrlChar)
+        .expect(function(res){
+          if(res.body.code !== 1) throw new Error("Pad with bad characters was created");
+        })
+        .expect('Content-Type', /json/)
+        .end(cb);
+      },
+      done);
+  });
+})
+
 
 /*
                           -> movePadForce Test

tests/frontend/specs/importexport.js

@@ -52,7 +52,7 @@ describe("import functionality", function(){
     return exportresults
   }
 
-  it("import a pad with newlines from txt", function(done){
+  xit("import a pad with newlines from txt", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var textWithNewLines = 'imported text\nnewline'
     importrequest(textWithNewLines,importurl,"txt")
@@ -64,7 +64,7 @@ describe("import functionality", function(){
     expect(results[1][1]).to.be("imported text\nnewline\n\n")
     done()
   })
-  it("import a pad with newlines from html", function(done){
+  xit("import a pad with newlines from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithNewLines = '<html><body>htmltext<br/>newline</body></html>'
     importrequest(htmlWithNewLines,importurl,"html")
@@ -76,7 +76,7 @@ describe("import functionality", function(){
     expect(results[1][1]).to.be("htmltext\nnewline\n\n")
     done()
   })
-  it("import a pad with attributes from html", function(done){
+  xit("import a pad with attributes from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithNewLines = '<html><body>htmltext<br/><span class="b s i u"><b><i><s><u>newline</u></s></i></b></body></html>'
     importrequest(htmlWithNewLines,importurl,"html")
@@ -88,7 +88,7 @@ describe("import functionality", function(){
     expect(results[1][1]).to.be('htmltext\nnewline\n\n')
     done()
   })
-  it("import a pad with bullets from html", function(done){
+  xit("import a pad with bullets from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li><li>bullet2 line 2</li></ul></ul></body></html>'
     importrequest(htmlWithBullets,importurl,"html")
@@ -105,7 +105,7 @@ describe("import functionality", function(){
     expect(results[1][1]).to.be('\t* bullet line 1\n\t* bullet line 2\n\t\t* bullet2 line 1\n\t\t* bullet2 line 2\n\n')
     done()
   })
-  it("import a pad with bullets and newlines from html", function(done){
+  xit("import a pad with bullets and newlines from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li></ul><br/><ul class="list-bullet1"><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li></ul></ul><br/><ul class="list-bullet1"><ul class="list-bullet2"><li>bullet2 line 2</li></ul></ul></body></html>'
     importrequest(htmlWithBullets,importurl,"html")
@@ -124,7 +124,7 @@ describe("import functionality", function(){
     expect(results[1][1]).to.be('\t* bullet line 1\n\n\t* bullet line 2\n\t\t* bullet2 line 1\n\n\t\t* bullet2 line 2\n\n')
     done()
   })
-  it("import a pad with bullets and newlines and attributes from html", function(done){
+  xit("import a pad with bullets and newlines and attributes from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li></ul><br/><ul class="list-bullet1"><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li></ul></ul><br/><ul class="list-bullet1"><ul class="list-bullet2"><ul class="list-bullet3"><ul class="list-bullet4"><li><span class="b s i u"><b><i><s><u>bullet4 line 2 bisu</u></s></i></b></span></li><li><span class="b s "><b><s>bullet4 line 2 bs</s></b></span></li><li><span class="u"><u>bullet4 line 2 u</u></span><span class="u i s"><i><s><u>uis</u></s></i></span></li></ul></ul></ul></ul></body></html>'
     importrequest(htmlWithBullets,importurl,"html")
@@ -143,7 +143,7 @@ describe("import functionality", function(){
     expect(results[1][1]).to.be('\t* bullet line 1\n\n\t* bullet line 2\n\t\t* bullet2 line 1\n\n\t\t\t\t* bullet4 line 2 bisu\n\t\t\t\t* bullet4 line 2 bs\n\t\t\t\t* bullet4 line 2 uuis\n\n')
     done()
   })
-  it("import a pad with nested bullets from html", function(done){
+  xit("import a pad with nested bullets from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li></ul><ul class="list-bullet1"><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li></ul></ul><ul class="list-bullet1"><ul class="list-bullet2"><ul class="list-bullet3"><ul class="list-bullet4"><li>bullet4 line 2</li><li>bullet4 line 2</li><li>bullet4 line 2</li></ul><li>bullet3 line 1</li></ul></ul><li>bullet2 line 1</li></ul></body></html>'
     importrequest(htmlWithBullets,importurl,"html")
@@ -165,7 +165,7 @@ describe("import functionality", function(){
     expect(results[1][1]).to.be('\t* bullet line 1\n\t* bullet line 2\n\t\t* bullet2 line 1\n\t\t\t\t* bullet4 line 2\n\t\t\t\t* bullet4 line 2\n\t\t\t\t* bullet4 line 2\n\t\t\t* bullet3 line 1\n\t* bullet2 line 1\n\n')
     done()
   })
-  it("import a pad with 8 levels of bullets and newlines and attributes from html", function(done){
+  xit("import a pad with 8 levels of bullets and newlines and attributes from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithBullets = '<html><body><ul class="list-bullet1"><li>bullet line 1</li></ul><br/><ul class="list-bullet1"><li>bullet line 2</li><ul class="list-bullet2"><li>bullet2 line 1</li></ul></ul><br/><ul class="list-bullet1"><ul class="list-bullet2"><ul class="list-bullet3"><ul class="list-bullet4"><li><span class="b s i u"><b><i><s><u>bullet4 line 2 bisu</u></s></i></b></span></li><li><span class="b s "><b><s>bullet4 line 2 bs</s></b></span></li><li><span class="u"><u>bullet4 line 2 u</u></span><span class="u i s"><i><s><u>uis</u></s></i></span></li><ul class="list-bullet5"><ul class="list-bullet6"><ul class="list-bullet7"><ul class="list-bullet8"><li><span class="">foo</span></li><li><span class="b s"><b><s>foobar bs</b></s></span></li></ul></ul></ul></ul><ul class="list-bullet5"><li>foobar</li></ul></ul></ul></ul></body></html>'
     importrequest(htmlWithBullets,importurl,"html")

tests/frontend/specs/importindents.js

@@ -49,7 +49,7 @@ describe("import indents functionality", function(){
     return exportresults
   }
 
-  it("import a pad with indents from html", function(done){
+  xit("import a pad with indents from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithIndents = '<html><body><ul class="list-indent1"><li>indent line 1</li><li>indent line 2</li><ul class="list-indent2"><li>indent2 line 1</li><li>indent2 line 2</li></ul></ul></body></html>'
     importrequest(htmlWithIndents,importurl,"html")
@@ -67,7 +67,7 @@ describe("import indents functionality", function(){
     done()
   })
   
-  it("import a pad with indented lists and newlines from html", function(done){
+  xit("import a pad with indented lists and newlines from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithIndents = '<html><body><ul class="list-indent1"><li>indent line 1</li></ul><br/><ul class="list-indent1"><li>indent 1 line 2</li><ul class="list-indent2"><li>indent 2 times line 1</li></ul></ul><br/><ul class="list-indent1"><ul class="list-indent2"><li>indent 2 times line 2</li></ul></ul></body></html>'
     importrequest(htmlWithIndents,importurl,"html")
@@ -86,7 +86,7 @@ describe("import indents functionality", function(){
     expect(results[1][1]).to.be('\tindent line 1\n\n\tindent 1 line 2\n\t\tindent 2 times line 1\n\n\t\tindent 2 times line 2\n\n')
     done()
   })
-  it("import a pad with 8 levels of indents and newlines and attributes from html", function(done){
+  xit("import a pad with 8 levels of indents and newlines and attributes from html", function(done){
     var importurl = helper.padChrome$.window.location.href+'/import'
     var htmlWithIndents = '<html><body><ul class="list-indent1"><li>indent line 1</li></ul><br/><ul class="list-indent1"><li>indent line 2</li><ul class="list-indent2"><li>indent2 line 1</li></ul></ul><br/><ul class="list-indent1"><ul class="list-indent2"><ul class="list-indent3"><ul class="list-indent4"><li><span class="b s i u"><b><i><s><u>indent4 line 2 bisu</u></s></i></b></span></li><li><span class="b s "><b><s>indent4 line 2 bs</s></b></span></li><li><span class="u"><u>indent4 line 2 u</u></span><span class="u i s"><i><s><u>uis</u></s></i></span></li><ul class="list-indent5"><ul class="list-indent6"><ul class="list-indent7"><ul class="list-indent8"><li><span class="">foo</span></li><li><span class="b s"><b><s>foobar bs</b></s></span></li></ul></ul></ul></ul><ul class="list-indent5"><li>foobar</li></ul></ul></ul></ul></body></html>'
     importrequest(htmlWithIndents,importurl,"html")