From 2391e406cb91a1b0092af90ff81831bcf5a6b83b Mon Sep 17 00:00:00 2001 From: Erik Michelson Date: Mon, 22 Jun 2026 23:52:19 +0200 Subject: [PATCH] chore(config): remove unused allowOrigin config option Signed-off-by: Erik Michelson --- docs/content/configuration.md | 1 - lib/config/default.js | 1 - lib/config/environment.js | 1 - lib/config/hackmdEnvironment.js | 1 - public/docs/release-notes.md | 3 ++- 5 files changed, 2 insertions(+), 5 deletions(-) diff --git a/docs/content/configuration.md b/docs/content/configuration.md index 0d3363dd..9eeaa9e7 100644 --- a/docs/content/configuration.md +++ b/docs/content/configuration.md @@ -86,7 +86,6 @@ these are rarely used for various reasons. | `protocolUseSSL` | `CMD_PROTOCOL_USESSL` | **`false`** or `true` | set to use SSL protocol for resources path (only applied when domain is set) | | `useSSL` | | **`false`** or `true` | set to use SSL server (if `true`, will auto turn on `protocolUseSSL`) | | `urlAddPort` | `CMD_URL_ADDPORT` | **`false`** or `true` | set to add port on callback URL (ports `80` or `443` won't be applied) (only applied when domain is set) | -| `allowOrigin` | `CMD_ALLOW_ORIGIN` | **`['localhost']`**, `['hedgedoc.org']`, `['localhost', 'hedgedoc.org']` | domain name whitelist (use comma to separate) | ## Web security aspects diff --git a/lib/config/default.js b/lib/config/default.js index 4e07db6b..6aa103c9 100644 --- a/lib/config/default.js +++ b/lib/config/default.js @@ -9,7 +9,6 @@ module.exports = { port: 3000, loglevel: 'info', urlAddPort: false, - allowOrigin: ['localhost'], useSSL: false, hsts: { enable: true, diff --git a/lib/config/environment.js b/lib/config/environment.js index 9bcc3ad5..940db5ed 100644 --- a/lib/config/environment.js +++ b/lib/config/environment.js @@ -31,7 +31,6 @@ module.exports = { rateLimitUsingCloudflare: toBooleanConfig(process.env.CMD_RATE_LIMIT_USING_CLOUDFLARE), cookiePolicy: process.env.CMD_COOKIE_POLICY, protocolUseSSL: toBooleanConfig(process.env.CMD_PROTOCOL_USESSL), - allowOrigin: toArrayConfig(process.env.CMD_ALLOW_ORIGIN), allowAnonymous: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS), allowAnonymousEdits: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS_EDITS), allowFreeURL: toBooleanConfig(process.env.CMD_ALLOW_FREEURL), diff --git a/lib/config/hackmdEnvironment.js b/lib/config/hackmdEnvironment.js index c40ffc96..663fcd38 100644 --- a/lib/config/hackmdEnvironment.js +++ b/lib/config/hackmdEnvironment.js @@ -19,7 +19,6 @@ module.exports = { reportURI: process.env.HMD_CSP_REPORTURI }, protocolUseSSL: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL), - allowOrigin: toArrayConfig(process.env.HMD_ALLOW_ORIGIN), allowAnonymous: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS), allowAnonymousEdits: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS_EDITS), allowFreeURL: toBooleanConfig(process.env.HMD_ALLOW_FREEURL), diff --git a/public/docs/release-notes.md b/public/docs/release-notes.md index 3dcfba3b..362ffe1c 100644 --- a/public/docs/release-notes.md +++ b/public/docs/release-notes.md @@ -10,9 +10,10 @@ - Enabled `.webp` for file uploads (for all backends but `imgur`, since it does not support it) - Removed unnecessary entries in the XSS whitelist -### Refactor +### Refactoring / Clean-up - Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed. +- Removed unused `allowOrigin` (environment variable `CMD_ALLOW_ORIGIN`) config option. ### Bugfixes