Previously, media uploads were associated with one note upload but
served regardless of the requesting user's permission. As we have
a fine-grade permission system in place, we can use this as well
for enforcing permission checks on media uploads. In order to make
an upload reusable across multiple notes, this adds the capability
to link one media upload to multiple notes and unlink that accordingly
again.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The slide where the user currently has their cursor in the editor,
will automatically be viewed in the renderer side.
This behaviour is toggable using the existing sync-scroll setting.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
It was mentioned that the splitter was too thick and therefore
taking up too much screen-space. This commit changes it to be thinner.
While the visual representation is just a thin line, the actual trigger
zone is wider to make it not a perfect-pixel-matching game.
Furthermore, you can now drag the splitter on every point of it, not
just on the button.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Previously the hardcoded colors only made a contrast of 3.39 to the
background. Furthermore changing the overall theme variables wouldn't
change the colors for the table-of-contents as well. This commit
changes that to use the theme variables, therefore ensuring better
maintainability and contrast (now 7.29)
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Apparently, opening a link from a sandboxed iframe enabled the
sandbox mode for the opened new tab as well. For most pages,
this is not a problem since these pages don't depend on anything
special. However when clicking a link to a PDF file, Chromium-
based browsers don't open the tab, since the built-in PDF viewer
is not compatible with the sandboxing.
The attribute `allow-popups-to-escape-sandbox` allows pages opened
from the sandbox into a new tab to be not sandboxed. Since we don't
have opener access there, this is no risk to HedgeDoc and can safely
be enabled and therefore fix PDF links.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
We did not implement this functionality yet and won't for some time so in order for HedgeDoc 2 to become release ready, this button will be removed.
Fixes#6478
Signed-off-by: Philip Molares <philip.molares@udo.edu>
The notification key 'editor.modal.permissions.error' was meant to be used with the ErrorToI18nKeyMapper as a base
which gets different suffixes added depending on the error code and not as a normal error code by itself.
Signed-off-by: Philip Molares <philip.molares@udo.edu>
The frontmatter validator was still the one left place that used Joi instead
of the now widely used zod in HedgeDoc. Since zod can do validation, coercion
and providing types based on the schema, the code could be drastically reduced
compared to the old frontmatter validator.
At the same time, the validator is now less strict. Custom fields are still
allowed for people that want to add their own frontmatter tags which are
unrelated to HedgeDoc. Furthermore, we now allow the complete set of
RevealOptions for the slideOptions key instead of only a few handpicked
ones.
Fixes#5946
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
oxlint now includes support for TypeScript-aware linting by using
the oxlint-tsgolint package. While this increases the chance of
finding bugs early, it requires a few changes to the TypeScript
configuration, especially the explicit declaration of CSS imports
and changing the moduleResolution to bundler mode.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This method updates the backend and changes the redux state in one call, instead of just calling the backend.
With this the state get's updated, and the user see that they pinned a note immediately.
Fixes#6484
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Docker / build-and-push (backend) (push) Has been cancelled
Docker / build-and-push (frontend) (push) Has been cancelled
E2E Tests / backend-sqlite (push) Has been cancelled
E2E Tests / backend-mariadb (push) Has been cancelled
E2E Tests / backend-postgres (push) Has been cancelled
Lint and check format / Lint files and check formatting (push) Has been cancelled
REUSE Compliance Check / reuse (push) Has been cancelled
Scorecard supply-chain security / Scorecard analysis (push) Has been cancelled
Static Analysis / Njsscan code scanning (push) Has been cancelled
Static Analysis / CodeQL analysis (javascript) (push) Has been cancelled
Run tests & build / Test and build with NodeJS 24 (push) Has been cancelled
We had two different approcaches to the redirect after the login / registration.
Because of this there were race conditions, and we sometimes got stuck on the redirect page.
Fixes#6467
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Embedding the full URL into the notes is a bit anoying if you want to
change hostname (or e.g. hosting from a local IP). Using the relative
URL should work in all(?) cases afaik.
I would also like to remove that `additionalUrlText` argument, which is
a bit confusing (not sure it works as intended?). It is only used in
file `use-on-image-upload-from-renderer.ts` - and not sure it even is
set to anything
Signed-off-by: Nicolai Søborg <git@xn--sb-lka.org>
Since the CSRF token is stored in the session, which is invalidated
on logout, we need to fetch a new token after logout.
Otherwise the client would require a full page reload to obtain a
new token.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Erik Michelson
Philip Molares
Nicolai Søborg
renovate[bot]