We just released 1.11.1 and noticed some things that need to be changed in the release checklist.
Signed-off-by: Philip Molares <philip.molares@udo.edu>
The permission checks did not check for unknown permission values
submitted to the server. This allowed bypassing permission checks
under certain circumstances. However, this is not as critical as
it might sound at first, since checks guard that only the owner
can modify note permissions and the owner already has always
full permission to their note.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This change fixes the displaying of (nested) list items in the preview
pane of the editor. Previously, list items were all treated as inline
blocks and therefore nested list items were placed next to the previous
item instead of below it. Now they align properly as expected.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
All the deleted entries are in the default white contained and don't need to be added another time.
Signed-off-by: Philip Molares <philip.molares@udo.edu>
The previously contributed config option for whitelisting domains
treated all entries like wildcard entries and matched subdomains
too. Since some users don't want this behaviour, this changes the
config option to differentiate between wildcard entries like
"*.example.com" and strict host entries like "example.com".
Since this config option was not released yet, it is safe to
change it without breaking user setups.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Since it is heavily requested by users, this adds a new config option
to disable the previously introduced external link warning.
Be aware however, that disabling this config option weakens the
security of your HedgeDoc instance and is therefore only recommended
for closed trustworthy user groups.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The docs claimed that host and port are completely ignored when a
UNIX domain socket path is configured. However, the port is still
used for URL generation when urlAddPort is enabled.
Closes#6515
Signed-off-by: Shivam Shukla <lucifer84670@gmail.com>
This change removes the meta-marked dependency which solely was
used for extracting the frontmatter, which is possible as well
with one function. Furthermore, this introduces constraints to
objects resulting from frontmatter parsing and enforces them in
order to prevent attacks like a yaml bomb (massive alias expansion).
This change should resolve a possible DoS attack.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The state of the OAuth2 response was not verified.
In theory an attacker could use this to extract the contents of a note.
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Previously, maliciously crafted email addresses
could be used to sneak HTML code into the HedgeDoc
editor, since HedgeDoc uses the local part of the
address as a display name for users.
We're now sanitizing this using DOMPurify.
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The dependency set may differ between node versions.
This fixed caching makes it harder for version-specific deps and
might introduce bugs therefore. We now include the node version
in the cache key.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Andy Piper
Philip Molares
Erik Michelson
renovate[bot]
Andre Julius
Shivam Shukla
odpay
Tobias Dillig
Tobi
Will Hawkins