When clicking the print button in the sidebar or executing the
print keyboard shortcut, we toggle to reveal.js' print mode
in order to print all slides correctly. After printing, the mode
is toggled back. Since this might hang under certain circumstances,
there is a delay and fallback to always return back to the normal
view even if the afterprint event didn't fire correctly.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
React hooks may not be called inside other react hooks
due to the "rule of hooks". Furthermore, with the recent
iframe-communicator changes, the hook for printing from
outside the iframe failed - no matter whether on normal
documents or slides. This change therefore uses two
distinct hooks that represent the event listeners for
each side, instead of a shared one.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
When the renderer communicator is not properly cleaned-up by
marking it as having disabled communication, it fails on
reloading notes with required communication as for example
slides.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The KaTeX renderer usually renders the raw KaTeX into MathML.
This can not be properly displayed inside the toc and further
makes problems when trying to render a fallback, because then
parts could become duplicated. This commit fixes this by
stripping MathML code completely for the title processing,
leaving the raw KaTeX code intact. The only downside of this
approach is that the surrounding '$' get lost, but this seems
still better than nothing or duplicated content.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Instead of scrolling to the very top the footnote backrefs
return the user to the footnoted thing
The problem was that we intended to scroll to the topOffset of the linked item,
but the backrefs link to an a-tag in sup-tag. The a-tag has topOffset of 0 and so we scroll to the very top.
To fix this we now check if any link links to something in a sup-tag with className footnote-ref and use the offset of that parent element instead.
Signed-off-by: Philip Molares <philip.molares@udo.edu>
The 404 page for notes renders a button to create a note with the
requested alias. This button was previously rendered unconditionally,
and therefore rendered even when the user (or guest) didn't have any
permission to create notes. The button is now hidden when no permission
to create notes is existing.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Previously, the permission checks of the /media/:uuid route could be
bypassed for the local filesystem as a media backend, because the
/media/:uuid route performed a redirect to the target after checking
the permissions. Since the target was always /uploads/:uuid.ext where
ext was the extension of the uploaded file, you could simply try to
guess the file extension and have access to the file since the
/uploads endpoint was simply the complete uploads folder mounted.
Now, media uploads from the local filesystem backend are served
under the /media route directly instead of a redirect.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Previously, media uploads were associated with one note upload but
served regardless of the requesting user's permission. As we have
a fine-grade permission system in place, we can use this as well
for enforcing permission checks on media uploads. In order to make
an upload reusable across multiple notes, this adds the capability
to link one media upload to multiple notes and unlink that accordingly
again.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The slide where the user currently has their cursor in the editor,
will automatically be viewed in the renderer side.
This behaviour is toggable using the existing sync-scroll setting.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
It was mentioned that the splitter was too thick and therefore
taking up too much screen-space. This commit changes it to be thinner.
While the visual representation is just a thin line, the actual trigger
zone is wider to make it not a perfect-pixel-matching game.
Furthermore, you can now drag the splitter on every point of it, not
just on the button.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Previously the hardcoded colors only made a contrast of 3.39 to the
background. Furthermore changing the overall theme variables wouldn't
change the colors for the table-of-contents as well. This commit
changes that to use the theme variables, therefore ensuring better
maintainability and contrast (now 7.29)
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Apparently, opening a link from a sandboxed iframe enabled the
sandbox mode for the opened new tab as well. For most pages,
this is not a problem since these pages don't depend on anything
special. However when clicking a link to a PDF file, Chromium-
based browsers don't open the tab, since the built-in PDF viewer
is not compatible with the sandboxing.
The attribute `allow-popups-to-escape-sandbox` allows pages opened
from the sandbox into a new tab to be not sandboxed. Since we don't
have opener access there, this is no risk to HedgeDoc and can safely
be enabled and therefore fix PDF links.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Previously, the cleanup algorithm let to data-loss as it could
delete the only remaining revision of a note when it was older
than the retention period. The new cleanup algorithm strictly
differentiates between cases where only one revision exists at
all, where multiple revisions exists older than the retention
period but no newer one (compacting them properly) as well as
where both revisions older than the retention period and ones
newer than that period exist (cleaning up the old ones).
This should prevent data loss by clean ups.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The generated SQL from Knex contained ambigous column names, resulting
in failure in the real-world since these queries were rejected by the
SQLite library. This patch fixes the problem by properly making all
column names explicit.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This fixes a reported security vulnerability where one use could
retrieve revisions of another note where they don't have access
to. This was possible, because the URL included both the note alias
and the revision UUID, the backend then checked the user's permissions
for the note alias but fetched and returned the revision by its UUID
without checking whether the revision belongs to that note.
Credits for finding and reporting this vulnerability to:
- The Raw (https://github.com/therawdev)
- Vishal (https://github.com/shukla304)
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
We did not implement this functionality yet and won't for some time so in order for HedgeDoc 2 to become release ready, this button will be removed.
Fixes#6478
Signed-off-by: Philip Molares <philip.molares@udo.edu>
The test checked the wrong error code, that was thrown because we don't provide the correct request body. The test never failed because of the forbidden alias
Signed-off-by: Philip Molares <philip.molares@udo.edu>
The notification key 'editor.modal.permissions.error' was meant to be used with the ErrorToI18nKeyMapper as a base
which gets different suffixes added depending on the error code and not as a normal error code by itself.
Signed-off-by: Philip Molares <philip.molares@udo.edu>
This is a moderate increase from about 2 req/minute to 2.6 req/minute
with an increase of the window to 15 minutes. Switching between
accounts a few times should be covered by the higher rate limit.
At the same time, the window increase reduces the attack/abuse chance
again.
Fixes#6471
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The frontmatter validator was still the one left place that used Joi instead
of the now widely used zod in HedgeDoc. Since zod can do validation, coercion
and providing types based on the schema, the code could be drastically reduced
compared to the old frontmatter validator.
At the same time, the validator is now less strict. Custom fields are still
allowed for people that want to add their own frontmatter tags which are
unrelated to HedgeDoc. Furthermore, we now allow the complete set of
RevealOptions for the slideOptions key instead of only a few handpicked
ones.
Fixes#5946
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Erik Michelson
Philip Molares
renovate[bot]