sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
4,497 Commits 2 Branches 0 Tags
b930fe04cee92cd4723044030bb59c36781c7137
Commit Graph

4497 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Erik Michelson
b930fe04ce fix(security): increase CSP policy by explicitly sandboxing uploads 
Adding the sandbox attribute tells browsers to apply stricter
restrictions like preventing execution of plugins and scripts.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-04 20:27:41 +01:00
Erik Michelson
74daa0e7a1 fix(security): headers were not applied to uploads 
Due to express static overriding the response, applying the extra headers
like CSP and Content-Disposition did not work for files served under the
/uploads route. By reordering, the code this works now.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-04 20:27:41 +01:00
Erik Michelson
6fc411d17f chore(deps): update lockfile 
renovate was tired, so I did it manually

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-03 20:48:50 +01:00
Erik Michelson
0e9e2177cf chore(deps): update dependencies 
renovate was tired, so I did it manually

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-02-03 20:44:27 +01:00
renovate[bot]
f529214660 chore(deps): update actions/cache action to v5.0.3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:19:26 +01:00
renovate[bot]
ebf98130d7 chore(deps): update actions/checkout action to v6.0.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:18:58 +01:00
renovate[bot]
d2dd6762a7 chore(deps): update dependency jquery-ui to v1.14.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:16:19 +01:00
renovate[bot]
14edc1a7a5 fix(deps): update dependency connect-session-sequelize to v8.0.5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:13:31 +01:00
renovate[bot]
58d436c924 fix(deps): update dependency mysql2 to v3.16.3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 20:13:01 +01:00
renovate[bot]
a3b49a6e24 chore(deps): update dependency esbuild-loader to v4.4.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:56:20 +01:00
renovate[bot]
a96e9cbdf9 fix(deps): update dependency lodash to v4.17.23 [security] 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:55:09 +01:00
renovate[bot]
a2da69ede5 chore(deps): update dependency eslint-plugin-n to v17.23.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:53:31 +01:00
renovate[bot]
8725196df6 chore(deps): update dependency utf-8-validate to v6.0.6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:51:43 +01:00
renovate[bot]
7c9d1ec712 fix(deps): update dependency body-parser to v2.2.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-02-03 19:51:12 +01:00
Erik Michelson
092e4d428d docs: permissions page in the docs references 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2026-01-28 20:26:25 +01:00
Philip Molares
67b1917467 docs: fix number of permissions HD1 has 
Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2026-01-28 20:08:25 +01:00
renovate[bot]
e7055b43a4 chore(deps): update dependency mkdocs-material to v9.7.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-01-21 19:18:55 +01:00
renovate[bot]
eba2b2d711 chore(deps): update actions/cache action to v5.0.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-01-21 19:18:10 +01:00
xenein
cb7588d6fa docs: Add speaker view and speaker notes to slide-options.md (#6322) 2026-01-15 13:12:10 +01:00
renovate[bot]
48a207571b chore(deps): update actions/upload-artifact action to v6 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:31:28 +01:00
renovate[bot]
b76f397983 chore(deps): update actions/cache action to v5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:27:48 +01:00
renovate[bot]
e77b9ced58 fix(deps): update dependency mysql2 to v3.16.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:17:17 +01:00
renovate[bot]
98e9e6cefc chore(deps): update dependency pymdown-extensions to v10.19.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:13:50 +01:00
renovate[bot]
35f0b44906 chore(deps): update dependency less to v4.5.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:08:47 +01:00
renovate[bot]
92efa38948 chore(deps): update linters to v9.39.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-17 20:00:12 +01:00
renovate[bot]
4df25c436b fix(deps): update dependency aws-sdk to v2.1693.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-09 22:02:02 +01:00
renovate[bot]
72e38c6bfd chore(deps): update dependency pymdown-extensions to v10.18 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-09 21:21:31 +01:00
renovate[bot]
b0911e4434 fix(deps): update dependency winston to v3.19.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-08 11:00:20 +01:00
Philip Molares
9cb00262f6 docs: update release-checklist 
Add the missings tests that lead to the problem with
HedgeDoc 1.10.4

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2025-12-07 16:37:16 +01:00
Erik Michelson
7185a44448 docs: update for release 1.10.5 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-06 17:45:55 +01:00
Philip Molares
f51e402a48 docs: update release-checklist 
The 1.10.4 release taught us a few new things. They are documented
now.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2025-12-05 23:45:35 +01:00
Erik Michelson
0a5f4ccefd docs: update for release 1.10.4 
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 23:36:12 +01:00
Erik Michelson
92522e3f33 fix(deps): downgrade formidable to v2 to fix uploads 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 23:36:12 +01:00
Erik Michelson
35f36fccba fix(auth): add state parameters and PKCE support 
Only the OAuth2 auth strategy was using the state parameter,
which should be used as described in the RFC. The other
auth strategies such as GitHub, GitLab or Google were lacking
the state parameter.
This change adds the required state parameter as well as
enabling PKCE support on providers where it's possible.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 22:06:30 +01:00
renovate[bot]
53f2ada7a3 chore(deps): lock file maintenance 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 22:02:12 +01:00
renovate[bot]
b6ab3e0c16 fix(deps): update dependency cookie to v1.1.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:59:07 +01:00
Erik Michelson
ef724d0fc2 fix(renderer): use credentialless and sandbox attributes on iframes 
Websites loaded via an iframe could interrupt the user's workflow by initiating certain actions like opening print dialogs, alert boxes, etc. on the user's browser or even initiate file downloads.
By using the sandbox attribute, the iframe is limited in it's actions and can't access browser APIs such as to download files.
With the additional credentialless attribute, the page in the iframe is loaded in a completely separate browsing context on Chromium-based browsers, thus isolating the content even more.
The functionality could previously be abused to initiate certain actions on 3rd-party websites where the user is logged-in, if these 3rd-party websites have no proper CSRF protection. However, this is not a security risk to HedgeDoc itself.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-05 21:57:19 +01:00
renovate[bot]
61e3421697 chore(deps): update actions/setup-node action to v6.1.0 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:56:52 +01:00
renovate[bot]
de2498e854 fix(deps): update dependency express to v4.22.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:56:29 +01:00
renovate[bot]
cca19aa159 fix(deps): update dependency connect-session-sequelize to v8.0.4 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:55:36 +01:00
renovate[bot]
b02248bfa6 chore(deps): update dependency pymdown-extensions to v10.17.2 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:54:54 +01:00
renovate[bot]
89bbd7e302 chore(deps): update dependency @eslint/eslintrc to v3.3.3 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:52:56 +01:00
renovate[bot]
454650df2c chore(deps): update actions/checkout action to v6.0.1 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-12-05 21:52:45 +01:00
Erik Michelson
10ec965ed3 fix(renderer): correct regexes for list extra tags 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-03 19:52:52 +01:00
Erik Michelson
801ef14b7e fix(shutdown): kill server after timeout when hanging on shutdown 
When socket.io is not able to close a connection somehow, the code
never reaches the final shutdown state but keeps waiting for all
connections to be closed. This can cause a high CPU load on failing
shutdown. It is very unlikely to happen, except when the server is
shut down exactly at the same time a socket is disconnecting and not
already marked as disconnected. This change adds a fallback timer
which forcefully kills the server after a certain amount of time.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-03 19:52:52 +01:00
Erik Michelson
1028d61bf9 fix(embeddings): replace removed sample PDF file with another one 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-03 19:52:52 +01:00
Erik Michelson
1c9a5e4283 fix(embeddings): YouTube embedding requires referrer 
The embedded YouTube player seemed not to work anymore
and showed a warning "invalid player configuration".
This seems to be related to the iframe being loaded
without a referrer to the origin domain. YouTube
nowadays requires this (probably to track from which
domains a YouTube player is embedded).

See also: https://developers.google.com/youtube/terms/required-minimum-functionality#embedded-player-api-client-identity

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-12-03 19:52:52 +01:00
Philip Molares
bc2075ae9d refactor: use user-token for historyDelete too 
Previously, the user token was only used for the endpoint
to delete the user itself. This commit adds that token to
the history deletion as well.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
 2025-11-26 19:28:53 +01:00
Erik Michelson
05a937ea22 chore(node): run tests and linting with Node 24 too 
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
 2025-11-26 09:23:29 +01:00
renovate[bot]
c6e2cefa8f chore(deps): update dependency js-yaml to v3.14.2 [security] 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2025-11-25 00:32:29 +01:00