sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: add config option to disable external link warning

Browse Source 
Since it is heavily requested by users, this adds a new config option
to disable the previously introduced external link warning.
Be aware however, that disabling this config option weakens the
security of your HedgeDoc instance and is therefore only recommended
for closed trustworthy user groups.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This commit is contained in:
Erik Michelson
2026-07-05 00:28:59 +02:00
committed by Philip Molares
parent d20619315e
commit 0ebf0dbc6b
7 changed files with 32 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
docs/content/configuration.md
View File

@@ -31,29 +31,30 @@ to work.*
## HedgeDoc basics ## HedgeDoc basics
| config file | environment | **default** and example value | description | | config file | environment | **default** and example value | description |
|----------------------|---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |-------------------------|-------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| | `CMD_CONFIG_FILE` | **no default**, `/path/to/config.json` | optional override for the path to HedgeDoc's config file | | | `CMD_CONFIG_FILE` | **no default**, `/path/to/config.json` | optional override for the path to HedgeDoc's config file |
| `db` | | **`undefined`**, `{ "dialect": "sqlite", "storage": "./db.hedgedoc.sqlite" }` | set the db configs, [see more here](https://sequelize.org/v5/manual/dialects.html) | | `db` | | **`undefined`**, `{ "dialect": "sqlite", "storage": "./db.hedgedoc.sqlite" }` | set the db configs, [see more here](https://sequelize.org/v5/manual/dialects.html) |
| `db.username` | `CMD_DB_USERNAME` | **`undefined`**, `hedgedoc-db-user` | Username used to authenticate to the database (host). | | `db.username` | `CMD_DB_USERNAME` | **`undefined`**, `hedgedoc-db-user` | Username used to authenticate to the database (host). |
| `db.password` | `CMD_DB_PASSWORD` | **`undefined`** | Password used to authenticate to the database (host). | | `db.password` | `CMD_DB_PASSWORD` | **`undefined`** | Password used to authenticate to the database (host). |
| `db.database` | `CMD_DB_DATABASE` | **`undefined`**, `hedgedoc` | Name of the database used to store hedgedoc data. | | `db.database` | `CMD_DB_DATABASE` | **`undefined`**, `hedgedoc` | Name of the database used to store hedgedoc data. |
| `db.host` | `CMD_DB_HOST` | **`undefined`**, `db-host.example.com` | Hostname used to connect the database server. | | `db.host` | `CMD_DB_HOST` | **`undefined`**, `db-host.example.com` | Hostname used to connect the database server. |
| `db.post` | `CMD_DB_PORT` | **`undefined`**, `5432` | Port used to connect the database server. | | `db.post` | `CMD_DB_PORT` | **`undefined`**, `5432` | Port used to connect the database server. |
| `db.dialect` | `CMD_DB_DIALECT` | **`undefined`**, `postgres`, `mariadb` | [Dialect](https://sequelize.org/v5/manual/dialects.html) / protocol used to connect to the database. | | `db.dialect` | `CMD_DB_DIALECT` | **`undefined`**, `postgres`, `mariadb` | [Dialect](https://sequelize.org/v5/manual/dialects.html) / protocol used to connect to the database. |
| `dbURL` | `CMD_DB_URL` | **`undefined`**, `postgres://username:password@localhost:5432/hedgedoc`, `mysql://username:password@localhost:3306/hedgedoc`, or `sqlite:///path/to/hedgedoc.db` | Set the db in URL style. If set, then the relevant `db` config entries will be overridden. | | `dbURL` | `CMD_DB_URL` | **`undefined`**, `postgres://username:password@localhost:5432/hedgedoc`, `mysql://username:password@localhost:3306/hedgedoc`, or `sqlite:///path/to/hedgedoc.db` | Set the db in URL style. If set, then the relevant `db` config entries will be overridden. |
| `loglevel` | `CMD_LOGLEVEL` | **`info`**, `debug` ... | Defines what kind of logs are provided to stdout. Available options: `debug`, `verbose`, `info`, `warn`, `error` | | `loglevel` | `CMD_LOGLEVEL` | **`info`**, `debug` ... | Defines what kind of logs are provided to stdout. Available options: `debug`, `verbose`, `info`, `warn`, `error` |
| `forbiddenNoteIDs` | `CMD_FORBIDDEN_NOTE_IDS` | **`['robots.txt', 'favicon.ico', 'api', 'build', 'css', 'docs', 'fonts', 'js', 'uploads', 'vendor', 'views']`**, `['robots.txt']` or `'robots.txt'` | disallow creation of notes, even if `allowFreeUrl` or `CMD_ALLOW_FREEURL` is `true` | | `forbiddenNoteIDs` | `CMD_FORBIDDEN_NOTE_IDS` | **`['robots.txt', 'favicon.ico', 'api', 'build', 'css', 'docs', 'fonts', 'js', 'uploads', 'vendor', 'views']`**, `['robots.txt']` or `'robots.txt'` | disallow creation of notes, even if `allowFreeUrl` or `CMD_ALLOW_FREEURL` is `true` |
| `externalLinkWhitelist` | `CMD_EXTERNAL_LINK_WHITELIST` | **`[]`**, `example.com,trusted.org` | Comma-separated list of domains (and their subdomains) that bypass the external link warning page. Links to these domains open directly without the `/_link` redirect. | | `externalLinkWarning` | `CMD_EXTERNAL_LINK_WARNING` | **`true`**, `false` | When set to `false`, disables the external link warning page entirely. All external links open directly without being routed through the `/_link` redirect. |
| `imageUploadType` | `CMD_IMAGE_UPLOAD_TYPE` | **`filesystem`**, `imgur`, `s3`, `minio`, `azure`, `lutim` | Where to upload images. For S3, see our Image Upload Guides for [S3](guides/media/s3-image-upload.md) or [Minio](guides/media/minio-image-upload.md), also there's a whole section on their respective env vars below. | | `externalLinkWhitelist` | `CMD_EXTERNAL_LINK_WHITELIST` | **`[]`**, `example.com,trusted.org` | Comma-separated list of domains (and their subdomains) that bypass the external link warning page. Links to these domains open directly without the `/_link` redirect. |
| `sourceURL` | `CMD_SOURCE_URL` | **no default**, `https://github.com/hedgedoc/hedgedoc/tree/<current commit>` | Provides the link to the source code of HedgeDoc on the entry page (Please, make sure you change this when you run a modified version) | | `imageUploadType` | `CMD_IMAGE_UPLOAD_TYPE` | **`filesystem`**, `imgur`, `s3`, `minio`, `azure`, `lutim` | Where to upload images. For S3, see our Image Upload Guides for [S3](guides/media/s3-image-upload.md) or [Minio](guides/media/minio-image-upload.md), also there's a whole section on their respective env vars below. |
| `tooBusyLag` | `CMD_TOOBUSY_LAG` | **`70`** | CPU time for one event loop tick until node throttles connections. (milliseconds) | | `sourceURL` | `CMD_SOURCE_URL` | **no default**, `https://github.com/hedgedoc/hedgedoc/tree/<current commit>` | Provides the link to the source code of HedgeDoc on the entry page (Please, make sure you change this when you run a modified version) |
| `staticCacheTime` | | **`1 * 24 * 60 * 60 * 1000`** | static file cache time | | `tooBusyLag` | `CMD_TOOBUSY_LAG` | **`70`** | CPU time for one event loop tick until node throttles connections. (milliseconds) |
| `heartbeatInterval` | | **`5000`** | socket.io heartbeat interval | | `staticCacheTime` | | **`1 * 24 * 60 * 60 * 1000`** | static file cache time |
| `heartbeatTimeout` | | **`10000`** | socket.io heartbeat timeout | | `heartbeatInterval` | | **`5000`** | socket.io heartbeat interval |
| `documentMaxLength` | `CMD_DOCUMENT_MAX_LENGTH` | **`100000`** | note max length | | `heartbeatTimeout` | | **`10000`** | socket.io heartbeat timeout |
| `linkifyHeaderStyle` | | **`keep-case`**, `lower-case`, `gfm` | how is a header text converted into a link id | | `documentMaxLength` | `CMD_DOCUMENT_MAX_LENGTH` | **`100000`** | note max length |
| `enableStatsApi` | `CMD_ENABLE_STATS_API` | **`true`**, `false` | Enables or disables the /status and /metrics endpoint. | | `linkifyHeaderStyle` | | **`keep-case`**, `lower-case`, `gfm` | how is a header text converted into a link id |
| `enableStatsApi` | `CMD_ENABLE_STATS_API` | **`true`**, `false` | Enables or disables the /status and /metrics endpoint. |
## HedgeDoc paths stuff ## HedgeDoc paths stuff

1
lib/config/default.js
View File

@@ -193,5 +193,6 @@ module.exports = {
// 3rd appearance: "31-good-morning-my-friend---do-you-have-5-2" // 3rd appearance: "31-good-morning-my-friend---do-you-have-5-2"
linkifyHeaderStyle: 'keep-case', linkifyHeaderStyle: 'keep-case',
enableStatsApi: true, enableStatsApi: true,
externalLinkWarning: true,
externalLinkWhitelist: [] externalLinkWhitelist: []
} }

1
lib/config/environment.js
View File

@@ -167,5 +167,6 @@ module.exports = {
openID: toBooleanConfig(process.env.CMD_OPENID), openID: toBooleanConfig(process.env.CMD_OPENID),
linkifyHeaderStyle: process.env.CMD_LINKIFY_HEADER_STYLE, linkifyHeaderStyle: process.env.CMD_LINKIFY_HEADER_STYLE,
enableStatsApi: toBooleanConfig(process.env.CMD_ENABLE_STATS_API), enableStatsApi: toBooleanConfig(process.env.CMD_ENABLE_STATS_API),
externalLinkWarning: toBooleanConfig(process.env.CMD_EXTERNAL_LINK_WARNING, true),
externalLinkWhitelist: toArrayConfig(process.env.CMD_EXTERNAL_LINK_WHITELIST) externalLinkWhitelist: toArrayConfig(process.env.CMD_EXTERNAL_LINK_WHITELIST)
} }

1
lib/web/statusRouter.js
View File

@@ -113,6 +113,7 @@ statusRouter.get('/config', function (req, res) {
linkifyHeaderStyle: config.linkifyHeaderStyle, linkifyHeaderStyle: config.linkifyHeaderStyle,
cookiePolicy: config.cookiePolicy, cookiePolicy: config.cookiePolicy,
enableUploads: config.enableUploads, enableUploads: config.enableUploads,
externalLinkWarning: config.externalLinkWarning,
externalLinkWhitelist: config.externalLinkWhitelist, externalLinkWhitelist: config.externalLinkWhitelist,
userToken: req.user ? req.user.deleteToken : '' userToken: req.user ? req.user.deleteToken : ''
} }

1
public/docs/release-notes.md
View File

@@ -5,6 +5,7 @@
### Enhancements ### Enhancements
- Added external link whitelist setting (`externalLinkWhitelist` in config.json or `CMD_EXTERNAL_LINK_WHITELIST`) to skip warning page for certain domains - Added external link whitelist setting (`externalLinkWhitelist` in config.json or `CMD_EXTERNAL_LINK_WHITELIST`) to skip warning page for certain domains
- Added external link warning setting (`externalLinkWarning` in config.json or `CMD_EXTERNAL_LINK_WARNING`) to disable the external link warning page entirely
- Enabled `.webp` for file uploads (for all backends but `imgur`, since it does not support it) - Enabled `.webp` for file uploads (for all backends but `imgur`, since it does not support it)
### Bugfixes ### Bugfixes

3
public/js/extra.js
View File

@@ -592,6 +592,9 @@ window.postProcess = postProcess
// rewrite external links to go through the /_link warning page // rewrite external links to go through the /_link warning page
export function rewriteExternalLinks (view) { export function rewriteExternalLinks (view) {
if (window.externalLinkWarning === false) {
return
}
const whitelist = window.externalLinkWhitelist || [] const whitelist = window.externalLinkWhitelist || []
view.find('a[href]').each((index, linkTag) => { view.find('a[href]').each((index, linkTag) => {
const anchor = $(linkTag) const anchor = $(linkTag)

1
public/js/lib/common/constant.ejs
View File

@@ -8,6 +8,7 @@ window.allowedUploadMimeTypes = <%- JSON.stringify(allowedUploadMimeTypes) %>
window.linkifyHeaderStyle = '<%- linkifyHeaderStyle %>' window.linkifyHeaderStyle = '<%- linkifyHeaderStyle %>'
window.externalLinkWarning = <%- JSON.stringify(externalLinkWarning) %>
window.externalLinkWhitelist = <%- JSON.stringify(externalLinkWhitelist) %> window.externalLinkWhitelist = <%- JSON.stringify(externalLinkWhitelist) %>
window.DROPBOX_APP_KEY = '<%- DROPBOX_APP_KEY %>' window.DROPBOX_APP_KEY = '<%- DROPBOX_APP_KEY %>'