Socket.IO seems to include an own reconnect mechanism for some time.
HedgeDoc however built an own reconnect mechanism on top of that.
Since the 'reconnect' event was dropped for socket.io 4.x, the
reconnect-cleanup code didn't run anymore.
This commit fixes this by:
- removing the manual reconnect interval,
- putting the reconnect handler into the correct place,
- setting reconnection options on the server side
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The disconnect handler for the realtime connection checks whether the
disconnecting socket was the last user for that note. If that's the
case and the note had unsaved changes, it persists them to the database
which is an async progress. In the callback of this async progress, the
note and all its pending changes (should be empty) are deleted.
However, when the user reconnects quickly because of a flaky
connection, it could happen that they create new pending changes before
the database saving finished. As there was no additional "no-users"
check before clearing the note, this could lead to content loss.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The addition of external link warning has changed the behavior of
opening links from opening in a new tab to opening in the same tab.
This restores the old behavior and opens all links in a new tab.
Signed-off-by: Tony Chau <90050474+fo5for@users.noreply.github.com>
If you combine OIDC with local accounts or if your OIDC provider is an
external company (Facebook, GitHub, …) it makes sense for HedgeDoc to
show a additional login modal so users know that they will leave the
page.
However, if OAuth2/OIDC is a deployment's primary sign-in method and a
local OIDC provider is being used, users expect the common SSO method
being used, and he "Choose method" modal is a redundant extra click.
Essentially, you may have to click login thrice:
- Click login -> modal opens
- Click Login with provider -> provider login opens
- Log in (unless you are logged in already)
This simple patch adds an auto-login configuration, which makes the Sign
In button link straight to the provider's OAuth2 flow, improving the UX
of tHedgeDoc's login.
Signed-off-by: Lars Kiesow <lkiesow@uos.de>
We just released 1.11.1 and noticed some things that need to be changed in the release checklist.
Signed-off-by: Philip Molares <philip.molares@udo.edu>
The permission checks did not check for unknown permission values
submitted to the server. This allowed bypassing permission checks
under certain circumstances. However, this is not as critical as
it might sound at first, since checks guard that only the owner
can modify note permissions and the owner already has always
full permission to their note.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This change fixes the displaying of (nested) list items in the preview
pane of the editor. Previously, list items were all treated as inline
blocks and therefore nested list items were placed next to the previous
item instead of below it. Now they align properly as expected.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
All the deleted entries are in the default white contained and don't need to be added another time.
Signed-off-by: Philip Molares <philip.molares@udo.edu>
The previously contributed config option for whitelisting domains
treated all entries like wildcard entries and matched subdomains
too. Since some users don't want this behaviour, this changes the
config option to differentiate between wildcard entries like
"*.example.com" and strict host entries like "example.com".
Since this config option was not released yet, it is safe to
change it without breaking user setups.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Since it is heavily requested by users, this adds a new config option
to disable the previously introduced external link warning.
Be aware however, that disabling this config option weakens the
security of your HedgeDoc instance and is therefore only recommended
for closed trustworthy user groups.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The docs claimed that host and port are completely ignored when a
UNIX domain socket path is configured. However, the port is still
used for URL generation when urlAddPort is enabled.
Closes#6515
Signed-off-by: Shivam Shukla <lucifer84670@gmail.com>
This change removes the meta-marked dependency which solely was
used for extracting the frontmatter, which is possible as well
with one function. Furthermore, this introduces constraints to
objects resulting from frontmatter parsing and enforces them in
order to prevent attacks like a yaml bomb (massive alias expansion).
This change should resolve a possible DoS attack.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
