From 33594a724682054d9bea7f983381d80cd9f46848 Mon Sep 17 00:00:00 2001 From: John McLear Date: Wed, 15 Apr 2015 11:52:03 +0100 Subject: [PATCH 1/5] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index bef84656f..12ea3998a 100644 --- a/README.md +++ b/README.md @@ -92,7 +92,7 @@ Documentation can be found in `docs/`. # Development ## Things you should know -Read this [git guide](http://learn.github.com/p/index.html) and watch this [video on getting started with Etherpad Development](http://youtu.be/67-Q26YH97E). +Understand [git](https://training.github.com/) and watch this [video on getting started with Etherpad Development](http://youtu.be/67-Q26YH97E). If you're new to node.js, start with Ryan Dahl's [Introduction to Node.js](http://youtu.be/jo_B4LTHi3I). From a3ce6b1ca78f4e5a92d39228122d778f47757e38 Mon Sep 17 00:00:00 2001 From: John McLear Date: Wed, 15 Apr 2015 15:51:13 +0100 Subject: [PATCH 2/5] remove two pointless dep removes --- bin/buildForWindows.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/bin/buildForWindows.sh b/bin/buildForWindows.sh index 212e946b4..6acf20b31 100755 --- a/bin/buildForWindows.sh +++ b/bin/buildForWindows.sh @@ -56,8 +56,6 @@ echo "remove git history to reduce folder size" rm -rf .git/objects echo "remove windows jsdom-nocontextify/test folder" -rm -rf /tmp/etherpad-lite-win/node_modules/ep_etherpad-lite/node_modules/jsdom-nocontextifiy/test/ -rm -rf /tmp/etherpad-lite-win/src/node_modules/jsdom-nocontextifiy/test/ rm -rf /tmp/etherpad-lite-win/src/node_modules/wd/node_modules/request/node_modules/form-data/node_modules/combined-stream/test rm -rf /tmp/etherpad-lite-win/src/node_modules/nodemailer/node_modules/mailcomposer/node_modules/mimelib/node_modules/encoding/node_modules/iconv-lite/encodings/tables From 6ff7d4e9a6f86d7a544adb029de5df9afc48b4c6 Mon Sep 17 00:00:00 2001 From: Tom Hunkapiller Date: Wed, 15 Apr 2015 14:30:53 -0500 Subject: [PATCH 3/5] revert to old path handling, but strip out "..". fixes #2614 --- src/node/utils/Minify.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/node/utils/Minify.js b/src/node/utils/Minify.js index 3b0be38c2..ee8f5f455 100644 --- a/src/node/utils/Minify.js +++ b/src/node/utils/Minify.js @@ -143,8 +143,11 @@ function minify(req, res, next) // No relative paths, especially if they may go up the file hierarchy. filename = path.normalize(path.join(ROOT_DIR, filename)); + filename = filename.replace(/\.\./g, '') + if (filename.indexOf(ROOT_DIR) == 0) { filename = filename.slice(ROOT_DIR.length); + filename = filename.replace(/\\/g, '/') } else { res.writeHead(404, {}); res.end(); @@ -165,6 +168,7 @@ function minify(req, res, next) var plugin = plugins.plugins[library]; var pluginPath = plugin.package.realPath; filename = path.relative(ROOT_DIR, pluginPath + libraryPath); + filename = filename.replace(/\\/g, '/'); // windows path fix } else if (LIBRARY_WHITELIST.indexOf(library) != -1) { // Go straight into node_modules // Avoid `require.resolve()`, since 'mustache' and 'mustache/index.js' From f81c6b64762533bda9462ba2b466c64ab08fddd5 Mon Sep 17 00:00:00 2001 From: Stefan Date: Thu, 16 Apr 2015 22:56:14 +0200 Subject: [PATCH 4/5] Update node version for windows build to 0.12.2 --- bin/buildForWindows.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/buildForWindows.sh b/bin/buildForWindows.sh index 212e946b4..9e8db1cc6 100755 --- a/bin/buildForWindows.sh +++ b/bin/buildForWindows.sh @@ -1,6 +1,6 @@ #!/bin/sh -NODE_VERSION="0.10.38" +NODE_VERSION="0.12.2" #Move to the folder where ep-lite is installed cd `dirname $0` From 2393ea01f0b0749d36c161e42e3676bf2735398e Mon Sep 17 00:00:00 2001 From: Stefan Date: Thu, 16 Apr 2015 23:06:24 +0200 Subject: [PATCH 5/5] Release version 1.5.6 --- CHANGELOG.md | 3 +++ src/package.json | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 82c1e117b..84d85000d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,6 @@ +# 1.5.6 + * Fix: Error on windows installations + # 1.5.5 * SECURITY: Also don't allow read files on directory traversal on minify paths * NEW: padOptions can be set in settings.json now diff --git a/src/package.json b/src/package.json index 8aed8ffb4..bfd3f2606 100644 --- a/src/package.json +++ b/src/package.json @@ -55,5 +55,5 @@ "repository" : { "type" : "git", "url" : "http://github.com/ether/etherpad-lite.git" }, - "version" : "1.5.5" + "version" : "1.5.6" }