mirrors/etherpad-lite
1
0
Fork 0
mirror of https://github.com/ether/etherpad-lite.git synced 2025-04-22 16:36:15 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 33
etherpad-lite/src/node
History
Richard Hansen 8b0baa9679 SecurityManager: Refactor checkAccess for readability, correctness 
* Move session validity check and session author ID fetch to a
    separate function. This separate function can be used by hooks,
    making it easier for them to properly determine the author ID.
  * Rewrite the remainder of checkAccess. Benefits:
      - The function is more readable and maintainable now.
      - Vulnerability fix: Before, the session IDs in sessionCookie
        were not validated when checking settings.requireSession. Now,
        sessionCookie must identify a valid session for the
        settings.requireSession test to pass.
      - Bug fix: Before, checkAccess would sometimes use the author ID
        associated with the token even if sessionCookie identified a
        valid session. Now it always uses the author ID associated
        with the session if available.
2020-09-12 09:42:47 +01:00
..
db SecurityManager: Refactor checkAccess for readability, correctness 2020-09-12 09:42:47 +01:00
eejs pluginfw/performance: Dont cache if max age is 0 (#4098) 2020-06-08 17:21:55 +01:00
handler PadMessageHandler: Use await instead of p.then() 2020-09-11 22:11:03 +01:00
hooks import: Use the correct author ID when using sessions 2020-09-08 15:04:17 +01:00
utils SecurityManager: Refactor checkAccess for readability, correctness 2020-09-12 09:42:47 +01:00
easysync_tests.js Revert "51c14d9947 changed the return value of" 2015-02-16 06:22:49 +01:00
padaccess.js access controls: promisification 2019-01-23 16:29:36 +00:00
README.md minor typo fix 2019-08-08 21:58:30 +02:00
server.js plugins: Move plugin definitions to avoid monkey patching 2020-09-08 00:50:24 +01:00
stats.js node8: we no longer need to use a shim for Object.values in stats.js 2019-02-19 22:01:12 +01:00

README.md

About the folder structure

  • db - all modules that are accessing the data structure and are communicating directly to the database
  • handler - all modules that respond directly to requests/messages of the browser
  • utils - helper modules

Module name conventions

Module file names start with a capital letter and uses camelCase

Where does it start?

server.js is started directly