Erik Michelson
6c5b44eaec
Previously, the permission checks of the /media/:uuid route could be bypassed for the local filesystem as a media backend, because the /media/:uuid route performed a redirect to the target after checking the permissions. Since the target was always /uploads/:uuid.ext where ext was the extension of the uploaded file, you could simply try to guess the file extension and have access to the file since the /uploads endpoint was simply the complete uploads folder mounted. Now, media uploads from the local filesystem backend are served under the /media route directly instead of a redirect. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
HedgeDoc lets you create real-time collaborative markdown notes.
Getting Started
- ℹ️ Read all about HedgeDoc and the history of the project on our website
- 🧪 Try out HedgeDoc with the demo instance. Check out the features page!
- 💽 Install HedgeDoc yourself using the install guide
- ❓ Questions? Join our Matrix chat or the community forums
- 💬 Stay up to date by subscribing to the release feed
State of the project
HedgeDoc 1.x is stable and used around the world, but the codebase has grown over time,
making it hard to add new features.
We are currently working on HedgeDoc 2, a complete rewrite of HedgeDoc. Please note the following:
- This branch contains the latest development code and does not implement all features yet. If you are looking for the 1.x source code, have a look at the master branch.
- The 1.x release is maintenance-only. We do not accept feature requests or PRs for this release anymore and may choose to close non-critical bug reports, if the bug will be non-existent in 2.0.
- HedgeDoc 2 will be split in two components. The backend and the frontend. Both are present in this repository.
Development
Information for setting up a local development environment can be found in the developer documentation
HedgeDoc 2 Alpha
Curious about the new look and feel of HedgeDoc 2? We provide a demo of the alpha on hedgedoc.dev.
If you want to try it out on your own devices, visit the HedgeDoc 2 docs. But be aware that these may change over time.
Contributions
We welcome contributions!
Have a look at our contribution docs to find out how you can help. If you want to contribute to
HedgeDoc 2, please join our development chat.
License
Licensed under AGPLv3. For our list of contributors, see AUTHORS.
The license does not include the HedgeDoc logo, whose terms of usage can be found in the github repository.