sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
4,605 Commits 2 Branches 0 Tags
0749c31100cd731c556d50147df404461473eba5
Commit Graph

4605 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Philip Molares
7e2a783161 fix(realtime): aboard finishConnection if user is missing 
This can happen if the user disconnects during connection creation.

See #6101

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2026-02-21 23:47:53 +01:00
renovate[bot]
edf1f62b2e chore(deps): update dependency pymdown-extensions to v10.21.1 2026-02-21 20:48:08 +01:00
renovate[bot]
6a4ab2bc5b chore(deps): update actions/setup-node action to v6.2.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-21 20:44:01 +01:00
Erik Michelson
fd4d5bfbd1 fix(editor): always use random hex colors 
chance.color() can output all valid CSS
values for colors, including rgba() syntax and predefined color
names. Due to the usage of hex2rgb and other methods, this can
break the editor. This commit ensures that all randomly generated
colors are specified in hex format.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-18 19:43:33 +01:00
xenein
7408217b6a docs(features): clarification on locations for light/dark mode (#6355) 
Signed-off-by: xenein <76600392+xenein@users.noreply.github.com>
 2026-02-15 21:07:54 +01:00
Erik Michelson
2e66e4d5ec fix(docs): update release checklist 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-04 21:34:39 +01:00
Erik Michelson
145e3ee318 chore(release): bump versions and release notes 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-04 20:27:41 +01:00
Erik Michelson
f910000d2b feat(security): sanitize SVG files on upload 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-04 20:27:41 +01:00
Erik Michelson
b930fe04ce fix(security): increase CSP policy by explicitly sandboxing uploads 
Adding the sandbox attribute tells browsers to apply stricter
restrictions like preventing execution of plugins and scripts.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-04 20:27:41 +01:00
Erik Michelson
74daa0e7a1 fix(security): headers were not applied to uploads 
Due to express static overriding the response, applying the extra headers
like CSP and Content-Disposition did not work for files served under the
/uploads route. By reordering, the code this works now.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-04 20:27:41 +01:00
Erik Michelson
6fc411d17f chore(deps): update lockfile 
renovate was tired, so I did it manually

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-03 20:48:50 +01:00
Erik Michelson
0e9e2177cf chore(deps): update dependencies 
renovate was tired, so I did it manually

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-03 20:44:27 +01:00
renovate[bot]
f529214660 chore(deps): update actions/cache action to v5.0.3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:19:26 +01:00
renovate[bot]
ebf98130d7 chore(deps): update actions/checkout action to v6.0.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:18:58 +01:00
renovate[bot]
d2dd6762a7 chore(deps): update dependency jquery-ui to v1.14.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:16:19 +01:00
renovate[bot]
14edc1a7a5 fix(deps): update dependency connect-session-sequelize to v8.0.5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:13:31 +01:00
renovate[bot]
58d436c924 fix(deps): update dependency mysql2 to v3.16.3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:13:01 +01:00
renovate[bot]
a3b49a6e24 chore(deps): update dependency esbuild-loader to v4.4.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:56:20 +01:00
renovate[bot]
a96e9cbdf9 fix(deps): update dependency lodash to v4.17.23 [security] 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:55:09 +01:00
renovate[bot]
a2da69ede5 chore(deps): update dependency eslint-plugin-n to v17.23.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:53:31 +01:00
renovate[bot]
8725196df6 chore(deps): update dependency utf-8-validate to v6.0.6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:51:43 +01:00
renovate[bot]
7c9d1ec712 fix(deps): update dependency body-parser to v2.2.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:51:12 +01:00
Erik Michelson
092e4d428d docs: permissions page in the docs references 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-01-28 20:26:25 +01:00
Philip Molares
67b1917467 docs: fix number of permissions HD1 has 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2026-01-28 20:08:25 +01:00
renovate[bot]
e7055b43a4 chore(deps): update dependency mkdocs-material to v9.7.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-01-21 19:18:55 +01:00
renovate[bot]
eba2b2d711 chore(deps): update actions/cache action to v5.0.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-01-21 19:18:10 +01:00
xenein
cb7588d6fa docs: Add speaker view and speaker notes to slide-options.md (#6322) 2026-01-15 13:12:10 +01:00
renovate[bot]
48a207571b chore(deps): update actions/upload-artifact action to v6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:31:28 +01:00
renovate[bot]
b76f397983 chore(deps): update actions/cache action to v5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:27:48 +01:00
renovate[bot]
e77b9ced58 fix(deps): update dependency mysql2 to v3.16.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:17:17 +01:00
renovate[bot]
98e9e6cefc chore(deps): update dependency pymdown-extensions to v10.19.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:13:50 +01:00
renovate[bot]
35f0b44906 chore(deps): update dependency less to v4.5.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:08:47 +01:00
renovate[bot]
92efa38948 chore(deps): update linters to v9.39.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:00:12 +01:00
renovate[bot]
4df25c436b fix(deps): update dependency aws-sdk to v2.1693.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-09 22:02:02 +01:00
renovate[bot]
72e38c6bfd chore(deps): update dependency pymdown-extensions to v10.18 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-09 21:21:31 +01:00
renovate[bot]
b0911e4434 fix(deps): update dependency winston to v3.19.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-08 11:00:20 +01:00
Philip Molares
9cb00262f6 docs: update release-checklist 
Add the missings tests that lead to the problem with
HedgeDoc 1.10.4

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2025-12-07 16:37:16 +01:00
Erik Michelson
7185a44448 docs: update for release 1.10.5 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-06 17:45:55 +01:00
Philip Molares
f51e402a48 docs: update release-checklist 
The 1.10.4 release taught us a few new things. They are documented
now.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2025-12-05 23:45:35 +01:00
Erik Michelson
0a5f4ccefd docs: update for release 1.10.4 
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 23:36:12 +01:00
Erik Michelson
92522e3f33 fix(deps): downgrade formidable to v2 to fix uploads 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 23:36:12 +01:00
Erik Michelson
35f36fccba fix(auth): add state parameters and PKCE support 
Only the OAuth2 auth strategy was using the state parameter,
which should be used as described in the RFC. The other
auth strategies such as GitHub, GitLab or Google were lacking
the state parameter.
This change adds the required state parameter as well as
enabling PKCE support on providers where it's possible.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 22:06:30 +01:00
renovate[bot]
53f2ada7a3 chore(deps): lock file maintenance 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 22:02:12 +01:00
renovate[bot]
b6ab3e0c16 fix(deps): update dependency cookie to v1.1.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:59:07 +01:00
Erik Michelson
ef724d0fc2 fix(renderer): use credentialless and sandbox attributes on iframes 
Websites loaded via an iframe could interrupt the user's workflow by initiating certain actions like opening print dialogs, alert boxes, etc. on the user's browser or even initiate file downloads.
By using the sandbox attribute, the iframe is limited in it's actions and can't access browser APIs such as to download files.
With the additional credentialless attribute, the page in the iframe is loaded in a completely separate browsing context on Chromium-based browsers, thus isolating the content even more.
The functionality could previously be abused to initiate certain actions on 3rd-party websites where the user is logged-in, if these 3rd-party websites have no proper CSRF protection. However, this is not a security risk to HedgeDoc itself.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 21:57:19 +01:00
renovate[bot]
61e3421697 chore(deps): update actions/setup-node action to v6.1.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:56:52 +01:00
renovate[bot]
de2498e854 fix(deps): update dependency express to v4.22.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:56:29 +01:00
renovate[bot]
cca19aa159 fix(deps): update dependency connect-session-sequelize to v8.0.4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:55:36 +01:00
renovate[bot]
b02248bfa6 chore(deps): update dependency pymdown-extensions to v10.17.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:54:54 +01:00
renovate[bot]
89bbd7e302 chore(deps): update dependency @eslint/eslintrc to v3.3.3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:52:56 +01:00