mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-04-22 16:36:15 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 33
8791 commits 213 branches 107 tags 72 MiB
Commit graph

498 commits

Author SHA1 Message Date
Richard Hansen
30544b564e express: Skip express-session middleware if pre-authorized 2021-12-20 20:08:19 -05:00
Richard Hansen
649fbdccf5 express: Move static handlers to expressPreSession 
This avoids the need to exempt the paths from authentication checks,
and it eliminates unnecessary express-session state.
 2021-12-20 20:08:19 -05:00
Richard Hansen
72f4ae444d express: New expressPreSession server-side hook 2021-12-20 20:08:19 -05:00
Richard Hansen
0b1ec20c5c express: Move preAuthorize middleware before express-session 2021-12-20 20:08:19 -05:00
Richard Hansen
bf35dcfc50 webaccess: Move preAuthorize to its own middleware 2021-12-20 20:08:19 -05:00
Richard Hansen
7f3d0e71f7 express: Check access before expressConfigure middleware 
There are no guarantees about the order of execution of hook
functions, which means that a plugin's `expressConfigure` hook
function could theoretically register a handler/middleware before the
access check middleware is registered. If that happens, the plugin's
handler would run before the access check, which would be bad. Avoid
the problem by explicitly installing the `webaccess.checkAccess`
middleware before running the `expressConfigure` hook.
 2021-12-20 20:08:18 -05:00
Richard Hansen
472eddc821 webaccess: Skip checks if next is called in preAuthenticate 2021-12-20 20:08:18 -05:00
webzwo0i
8b73f2ee70 padurlsanitize: Don't crash if sanitizePadId() throws 
Let Express send a 500 status code to the user instead.

Co-authored-by: Richard Hansen <rhansen@rhansen.org>
 2021-12-18 18:47:01 -05:00
Richard Hansen
19e9c2f114 adminsettings: Pay attention to --settings 2021-11-12 23:45:05 -05:00
Richard Hansen
46ad93024d adminsettings: Promisify 2021-11-12 23:45:05 -05:00
Richard Hansen
4e2f816665 adminsettings: Use object destructuring 2021-11-12 23:45:05 -05:00
Richard Hansen
3a5c44c8f7 /jserror: Enable colors to improve readability 2021-10-07 19:55:02 -04:00
Richard Hansen
629e7d5072 /jserror: Log all of the provided data 2021-10-07 19:55:01 -04:00
Richard Hansen
cb01ae8cbb /jserror: Reject files 2021-10-07 19:55:01 -04:00
Richard Hansen
e909072776 /jserror: Refactor to handle errors better 2021-10-07 19:55:01 -04:00
webzwo0i
58bd96ce8f padreadonly: Remove dead /ro/:id handling 
Read-only pads are accessed using `/p/` path since commit
ba3430ebb7.
 2021-09-14 17:07:55 -04:00
Richard Hansen
d9782ac628 tests: Send frontend test spec list as JSON 2021-06-05 03:51:06 -04:00
Richard Hansen
c714ff1014 tests: Let Express handle errors when serving frontendTestSpecs.js 
Express v4.x doesn't understand Promises so we have to manually catch
Promise rejections and pass the error object to `next()`.
 2021-06-05 03:50:36 -04:00
Richard Hansen
e4f011df76 tests: Use require() to load frontend test specs 
This makes core and plugin tests consistent with each other, makes it
possible to `require()` relative paths in spec files, simplifies the
code somewhat, and should make it easier to move away from
require-kernel.

Also:
  * Wrap plugin tests inside a `describe()` that contains the plugin
    name to make it easier to grep for a plugin's tests and for
    consistency with core tests.
  * Add "<core>" to the core test descriptions to make it easier to
    distinguish them from plugin tests.
 2021-06-05 03:50:26 -04:00
Richard Hansen
d8eb79428f tests: Recurse under frontend spec dir 2021-06-05 03:49:13 -04:00
Richard Hansen
5d54c1657a tests: Redirect /tests/frontend/index.html to /tests/frontend/ 2021-06-05 03:49:12 -04:00
Richard Hansen
712b8c5769 tests: Redirect /tests/frontend to /tests/frontend/ 2021-06-05 03:49:12 -04:00
Richard Hansen
573da027e5 tests: Preserve query string when redirecting 2021-06-05 03:49:12 -04:00
Richard Hansen
dfd649dbe9 tests: Use a relative redirect for /tests/frontend 
This avoids problems if Etherpad is served under a path like
`/etherpad`.
 2021-06-03 15:10:23 -04:00
Richard Hansen
617267ce71 tests: Use plugin_defs to get plugin frontend test spec paths 2021-06-03 15:10:23 -04:00
Richard Hansen
1b7b96f57e tests: Avoid deprecated fs.existsSync() 2021-06-03 15:10:23 -04:00
Richard Hansen
ab824c728f tests: Move slashes to improve readability 2021-06-03 15:10:22 -04:00
Richard Hansen
1516bf473f tests: Delete unnecessary staticDir variable 2021-06-03 15:10:22 -04:00
Richard Hansen
d69345bb4e tests: Use map+reduce to improve readability 2021-06-03 15:10:22 -04:00
Richard Hansen
a8e77126e8 tests: Combine .map().filter().map() into single .map() 2021-06-03 15:10:22 -04:00
Richard Hansen
2414203434 tests: Remove unnecessary return 2021-06-03 15:10:22 -04:00
Richard Hansen
0852df74f1 tests: Unexport unnecessarily exported functions 2021-06-03 15:10:22 -04:00
Richard Hansen
ed44449639 tests: Pretty-print frontendTestSpecs.js to make troubleshooting easier 2021-06-03 15:10:22 -04:00
Richard Hansen
4fa9f9e9d8 tests: Use window.foo instead of var foo 2021-06-03 15:10:22 -04:00
Richard Hansen
aea2fb7448 tests: Rename specs_list to frontendTestSpecs 2021-06-03 15:10:22 -04:00
Richard Hansen
b85a040f13 tests: Reuse sanitizePathname when serving frontend specs 2021-06-03 15:10:22 -04:00
Richard Hansen
ade17490e0 tests: Combine frontend test file handlers 2021-06-03 15:10:22 -04:00
Richard Hansen
995e381243 tests: Only wrap *.js files in describe() 2021-06-03 15:10:22 -04:00
Richard Hansen
e1c2c963f0 tests: URL decode test spec pathnames 
Express automatically URL decodes route parameters.
 2021-06-03 15:10:22 -04:00
Richard Hansen
998e77ec25 tests: Switch to promisified readFile 2021-06-03 15:10:22 -04:00
Richard Hansen
6cf27a7133 tests: Use fs.promises instead of wrapping with util.promisify 2021-06-03 15:10:22 -04:00
Richard Hansen
f00f9aa14c tests: Avoid .then() inside async functions 2021-06-03 15:10:22 -04:00
Richard Hansen
d87b4e0c20 tests: Use async/await instead of returning Promises 
This makes stack traces more useful.
 2021-06-03 15:10:21 -04:00
Richard Hansen
59c03bde20 lint: Re-run eslint --fix 2021-05-12 11:26:35 +02:00
Richard Hansen
ea8846154f favicon: Redo favicon customization 2021-04-20 13:33:55 -04:00
Richard Hansen
92e0bff80c favicon: Refactor handler and add tests 2021-04-20 13:33:55 -04:00
Richard Hansen
d0d4b95980 favicon: Only serve from /favicon.ico 2021-04-20 13:33:54 -04:00
Richard Hansen
329d037431 Simplify read-only pad ID checks 2021-04-12 22:51:06 -04:00
pcworld
3c71e8983b Fix read only pad access with authentication 
Before this commit, webaccess.checkAccess saved the authorization in
user.padAuthorizations[padId] with padId being the read-only pad ID,
however later stages, e.g. in PadMessageHandler, use the real pad ID for
access checks. This led to authorization being denied.

This commit fixes it by only storing and comparing the real pad IDs and
not read-only pad IDs.

This fixes test case "authn user readonly pad -> 200, ok" in
src/tests/backend/specs/socketio.js.
 2021-04-12 22:51:06 -04:00
webzwo0i
e483b91916 Don't make browsers fail on sync-xhr until require-kernel is dropped 2021-04-05 04:34:29 -04:00