yflory
75cd470fb1
Fix checkup test when registration is restricted #1185
2023-08-21 16:42:04 +02:00
yflory
5807b4dddf
Reduce memory usage for the eviction script
2023-08-21 12:45:18 +02:00
yflory
650e4c42ca
Fix websocket only binds to localhost #1182
2023-08-18 10:40:35 +02:00
yflory
867efea83b
Fix CSP headers mismatch between node and Nginx
2023-08-17 16:10:39 +02:00
yflory
cf17b6924a
Fix typo in regex when listing channels
2023-07-20 16:28:31 +02:00
yflory
a70800f928
Remove false positive server error log on page reload
2023-07-13 14:49:07 +02:00
yflory
deb14c412f
Fix XXX
2023-07-13 14:12:47 +02:00
yflory
b11333e7a0
lint compliance
2023-07-11 10:35:44 +02:00
yflory
c10fc37645
Merge branch 'totp-ui' into 5.4-rc
2023-07-11 10:30:36 +02:00
yflory
d1d26571cf
SSO: fix issue with missing config
2023-07-02 12:04:21 +03:00
yflory
d6bf625733
SSO: prototype improvements
2023-06-29 12:32:45 +02:00
Wolfgang Ginolas
6f76972c47
Upgrade drawio to 21.5.2
...
https://github.com/jgraph/drawio/issues/3691
2023-06-29 10:23:49 +02:00
yflory
b93b5eae4e
SSO: OIDC login and register
2023-06-27 16:04:32 +02:00
yflory
0c94c1a602
Merge branch 'totp-ui' into authsso
2023-06-23 19:07:11 +02:00
yflory
18d6ccdfd3
SSO: OIDC auth
2023-06-23 19:06:29 +02:00
yflory
da5626cbae
TOTP: Use session token instead of JWT to prepare for SSO
2023-06-23 18:35:18 +02:00
Wolfgang Ginolas
f7d56eea16
Rename drawio to digram
...
https://github.com/cryptpad/cryptpad/issues/1062
2023-06-22 14:59:13 +02:00
Wolfgang Ginolas
b5c0cada55
Update draw.io script hashes
2023-06-22 14:39:06 +02:00
Wolfgang Ginolas
17e6d24de4
Use hashes instead of unsafe-eval to secure drawio
2023-06-22 14:39:06 +02:00
Wolfgang Ginolas
67362fc2b9
Remove unsave-eval from draw.ios CSP
2023-06-22 14:39:06 +02:00
yflory
2be39c3749
API: reload content on server restart
2023-06-22 14:39:04 +02:00
yflory
723ecc8bd6
Integration API prototype
2023-06-22 14:39:04 +02:00
yflory
9aac9d1c2f
TOTP: Use HTTP challenges to write and remove blocks
2023-06-09 15:06:17 +02:00
yflory
b3a620edc0
lint compliance
2023-06-06 16:09:17 +02:00
yflory
36a1c604d8
Auth: Disable TOTP/MFA from the admin panel
2023-05-16 15:11:43 +02:00
Mathilde Grünig
f5fb24031e
replace xwiki-labs by cryptpad
2023-05-16 14:54:39 +02:00
yflory
e893613b43
TOTP: recovery by secret key
2023-05-15 17:33:58 +02:00
yflory
d789627920
TOTP setup and revocation in settings
2023-05-12 18:21:19 +02:00
ansuz
bd19288869
notes on pending improvements to add before merge/release
2023-05-11 16:42:47 +05:30
ansuz
f82c877cbe
serialize possible errors
2023-05-07 12:17:28 +05:30
ansuz
921c46956d
fix a type error by ensuring Env.Log is defined
2023-05-06 20:42:11 +05:30
ansuz
493bf1346c
Merge tag '5.3.0' into 5.3-auth
2023-05-06 15:26:21 +05:30
ansuz
31dc7b523a
XXXs and TODOs for handling blocks now that 2FA is in play
2023-05-05 18:20:51 +05:30
ansuz
06232ab6d7
overwriting basic storage should fail with an error
2023-05-05 18:18:46 +05:30
ansuz
41e870d3db
serverside protocol work for authentication enforcement and configuration
2023-05-05 18:17:58 +05:30
ansuz
b753a067ac
avoid logging for common 404s
2023-05-03 16:32:09 +05:30
ansuz
e895990426
generate a secret at launch time
...
used for issuing and validating JWTs
2023-05-03 16:19:01 +05:30
ansuz
3c6a35b713
new types of storage for challenges, MFA settings, and sessions
2023-05-02 23:42:09 +05:30
yflory
7b03df37f7
Merge remote-tracking branch 'origin/deprecatedcache' into staging
2023-04-24 14:52:56 +02:00
yflory
6b743a787c
Fix mailbox message deletion
2023-03-28 12:19:16 +02:00
ansuz
cbaff2f3c0
Merge branch 'soon' into staging
2023-03-07 15:34:00 +05:30
ansuz
b5a01231b7
Merge branch '5.3-storage' into merge-storage
2023-03-07 14:49:28 +05:30
ansuz
d231451b49
Merge branch 'http-workers' into merge-storage
2023-03-07 14:49:22 +05:30
ansuz
d8ef2c8371
print login block size when it exceeds the maximum
2023-03-07 13:30:30 +05:30
ansuz
64d24f8b20
clean up http-worker code and add comments
2023-03-07 11:17:46 +05:30
ansuz
8fce5bcaf6
use configured http ports
2023-03-02 12:45:38 +05:30
ansuz
b003d4d825
Merge branch 'staging' into http-workers
2023-03-02 11:59:58 +05:30
ansuz
6bb336034b
Merge branch 'staging' into 5.3-storage
2023-03-02 10:53:05 +05:30
ansuz
47afa26fc5
Merge branch 'soon' into 5.3-storage
2023-02-09 16:16:26 +05:30
yflory
f4b477ee37
Clean XXX
2023-02-01 18:02:03 +01:00
ansuz
7b65d3e8c8
judge blob activity based on mtime instead of atime
...
and output a basic overview when eviction completes
2023-01-23 08:29:36 +05:30
ansuz
c7dedf4054
more logging for potentially long-running eviction processes
2023-01-19 10:14:22 +05:30
ansuz
0bf26588e5
Merge branch 'soon' into 5.3-storage
2023-01-19 09:57:16 +05:30
ansuz
15272a6604
relocate blobs that have been archived to the wrong location
2023-01-19 08:57:39 +05:30
ansuz
911c15df25
fix incorrectly constructed archival path for blobs
2023-01-19 08:56:32 +05:30
yflory
a0714b9cc8
Prevent type error with the new admin script
2023-01-12 15:54:16 +01:00
ansuz
b0d10c3777
oops - fix inverted not
2023-01-11 15:08:16 +05:30
ansuz
3f18a38714
report http-worker RPC errors to the main process for logging
2023-01-11 15:02:02 +05:30
ansuz
4968bbf961
WIP limit on block size
2023-01-11 14:50:16 +05:30
ansuz
96de4dffe9
fix an inverted not in a non-functional telemetry attribute
2023-01-11 13:03:10 +05:30
yflory
1971553e1f
Flush cache when adding new admin
2022-12-20 17:25:54 +01:00
yflory
70e602d9c9
Prototype install app
2022-12-20 16:57:51 +01:00
ansuz
953c817c5b
clean up more prototype code:
...
* remove commented code
* serialize errors sent from http workers to the main process
* drop support for custom http headers set via config.js#httpHeaders
* websockets: only listen on localhost, respect websocketPort config in workers' proxy config
2022-12-20 18:03:52 +05:30
ansuz
24274e6c9b
remove some prototyping code that was overwriting values in responses to http-workers
2022-12-20 17:10:10 +05:30
ansuz
7e4518b43d
More server cleanup:
...
* make the websocket port configurable
* reorder some tasks at launch time to use more consistent logging
* relaunch http workers if they crash
* refuse to launch if httpUnsafeOrigin cannot be parsed as a URL
* fix a path issue reintroduced by a git merge
2022-12-20 16:29:38 +05:30
ansuz
d58096636a
Merge tag '5.2.0' into test-merge
2022-12-20 14:49:47 +05:30
ansuz
6f19101f42
big server changes:
...
* use the nodejs cluster module to handle http traffic with multiple threads
* listen for websocket traffic on a new port because all such logic needs to share state
* proxy websocket URLs from the cluster to the new port so everything is backwards compatible
* implement logic for http workers to make requests and stay in sync with the main process
* unrelated: define the expected nodejs version in a constant
2022-12-20 14:20:59 +05:30
yflory
d39d64626d
Fix deprecated cache issue
2022-12-16 15:12:19 +01:00
yflory
9a6455759f
Merge branch 'staging' into deprecatedcache
2022-12-16 15:04:14 +01:00
yflory
600771682a
Allow edit/delete/multiple answers without a drive and fix race condition
2022-12-08 16:53:29 +01:00
ansuz
ed981f2b63
generalize recommended version code for easier updates
2022-12-07 13:09:24 +05:30
ansuz
c762353cad
interpret maxWorkers config in lib/env instead of in worker handler
2022-12-07 13:04:07 +05:30
yflory
c75a75b243
Don't search for an old hash in a file when a cache is deprecated
2022-11-30 14:39:38 +01:00
yflory
5d350f1c45
Merge branch 'form' into form-del
2022-10-26 17:51:10 +02:00
yflory
89448115c5
Delete form own answers
2022-10-18 10:19:57 +02:00
yflory
bde6bb0032
Clean server code
2022-10-14 16:53:38 +02:00
yflory
8a3be878e8
Merge branch 'staging' into form-del
2022-10-12 17:19:22 +02:00
yflory
c3df1bb0ec
Use flag in pad metadata to allow line deletion in file
2022-10-12 17:17:58 +02:00
yflory
6a1c64fe9a
Delete your own form answers
2022-10-06 17:12:23 +02:00
ansuz
1acdb4180d
fix for bogus metadata lines wiping ownership and other parameters
2022-10-06 16:05:05 +05:30
ansuz
863ab4f380
Merge branch 'soon' into absolute-paths
2022-10-06 15:34:05 +05:30
ansuz
fede73efb1
enable admin option to opt-in to aggregate statistics
2022-09-22 16:35:20 +05:30
ansuz
333ba82970
allow admins to overwrite live data with archived data when both exist
2022-09-13 18:32:50 +05:30
ansuz
2b365694f6
fix server logic and logs messages related to quotas
2022-09-13 13:00:36 +05:30
ansuz
cf180158dc
remove temporary comments
2022-09-07 18:15:19 +05:30
ansuz
e78e57c039
unify accounts_api and quota_api config options
2022-08-30 17:23:10 +05:30
ansuz
b903e1351d
serverside component of admin metadata history
2022-08-26 18:11:59 +05:30
ansuz
ccd0b580f8
fix broken file uploads
2022-08-24 12:38:34 +05:30
ansuz
6cfce42c58
refactor admin panel and include reasons for archiving and restoring
2022-08-24 10:10:32 +05:30
ansuz
d05063a5a2
ensure that the correct form of a signing key is used
2022-08-23 16:08:57 +05:30
ansuz
31f61c7f1d
refactor admin database tab
2022-08-11 18:30:19 +05:30
ansuz
60e58e8f7a
first version of admin 'database' tab
2022-08-11 11:53:03 +05:30
ansuz
6c73e05d19
ignore an expected error
2022-07-25 16:33:05 +05:30
yflory
6ae07bb480
Allow accounts server to trigger quota updates
2022-07-05 11:48:40 +02:00
ansuz
7e0977f0d6
add missing name, description, location to public instance telemetry
2022-06-08 13:30:25 +05:30
Quentin Dufour
51e6136a58
Create the block folder at boot
2022-05-17 10:08:56 +02:00
ansuz
958b3e4376
remove references to removed pages and notes that have been addressed
2022-05-13 15:50:38 +05:30
ansuz
0be64ac958
simplify accounts configuration on dev instances
2022-05-11 13:12:12 +05:30
ansuz
071c9706af
accept both new and old data format for server info on admin panel
2022-05-10 13:11:53 +05:30
ansuz
3c679509c4
adjust INSTANCE_STATUS RPC to accommodate new data format
2022-05-06 14:33:30 +05:30
ansuz
a2731c44b0
assorted home page fixes/improvements
...
* link to home page from other static pages
* home notice
* moved to the top of the home page
* configured via server API instead of application_config.js
* WIP admin panel UI
* more debugging info for unsupported decrees
* lint compliance probably
2022-05-06 13:55:00 +05:30
ansuz
6a708a7df0
fix inability to set instance name
2022-05-03 18:48:40 +05:30
ansuz
916c0dd322
Merge branch 'sandpaper-static' into 4.15-candidate
2022-05-03 18:31:56 +05:30
David Benqué
97832340cf
Remove Terms, What is, and Maintenance pages
2022-04-25 16:04:26 +01:00
ansuz
b014c4dbf1
fileHost is undefined for most use cases
2022-04-04 16:32:42 +05:30
ansuz
404b89eb28
update recommended settings for embedding to permit element desktop
2022-04-04 12:31:40 +05:30
ansuz
b4323b2c40
fix incorrect frame-ancestors and update test
2022-04-01 13:15:06 +05:30
ansuz
dae6d7fc1e
add hints for translation linting and remove notes
2022-03-25 16:53:10 +05:30
ansuz
e6c51e3dff
remove hardcoded translations and invert remote embedding logic
2022-03-24 12:43:16 +05:30
ansuz
386827d825
handle 500 errors
2022-03-22 16:41:42 +05:30
ansuz
af10547dca
warn if node is not launched with 'NODE_ENV=production'
2022-03-22 15:40:43 +05:30
ansuz
f34a60665f
check that the server is running at least NodeJS v16.14.2
2022-03-22 14:27:07 +05:30
ansuz
d405a5f086
disable remote embedding by default
2022-03-15 15:29:18 +05:30
ansuz
1051fc4da7
fix undefined safe origin
2022-03-14 17:43:51 +05:30
ansuz
a54a0af604
more tests on checkup page
2022-03-14 17:09:22 +05:30
ansuz
e38e08fb6e
Merge branch 'soon' into block-embeds
2022-03-14 12:52:55 +05:30
ansuz
45d2eb0267
Merge branch 'soon' of github.com:xwiki-labs/cryptpad into support-categories
...
and include some tweaks for the checkup page
* sort errors above warnings
* improve messages for new tests
2022-03-10 11:33:41 +05:30
ansuz
c111364024
add two new tests to diagnose unavailability of uploaded blocks and blobs
2022-03-08 18:20:11 +05:30
ansuz
ef398de4a1
disable measurement
2022-03-08 11:03:32 +05:30
ansuz
8398c05f1a
Merge branch 'justification' into mar7
2022-03-07 19:03:06 +05:30
ansuz
b65730b853
allow admins to enable configurable disk I/O profiling
2022-03-07 18:42:00 +05:30
ansuz
1202b7a691
WIP configure instance name, jurisdiction, and description on admin panel
2022-02-24 15:28:24 +05:30
ansuz
f1fc2d2ad9
WIP provide a reason when archiving or resoring a file through the admin panel
2022-02-18 18:45:52 +05:30
ansuz
0917b45035
implement proper support for forbidding remote media-tag inclusion
...
...and test that the basic headers are correctly set on the checkup page
2022-02-18 16:09:02 +05:30
ansuz
b40c81d088
support modifying CSP headers at runtime
2022-02-18 13:54:33 +05:30
ansuz
ef6f98c149
initial serverside components for 'disableEmbedding' functionality
2022-02-18 13:35:20 +05:30
ansuz
7b6c8b83ef
stricter websocket CSP and tests to match
2022-02-14 11:45:44 +05:30
ansuz
383684d339
add new, very specific tests for CSP to the checkup page
2022-02-10 16:53:14 +05:30
ansuz
ebcb6b2ab0
log child process ids in the event of an RPC timeout
2022-02-03 15:11:26 +05:30
ansuz
d2852fdba4
perform extra validation for private message rpc
2022-01-26 03:58:29 +05:30
ansuz
29fe4b7223
restrict unnecessarily permissive CSP
2022-01-21 18:01:55 +05:30
ansuz
a93ab05310
handle absolute paths in a few obviously problematic cases
2021-11-22 18:16:35 +05:30
ansuz
b8d6af7891
adjust CSP headers for printing from OnlyOffice
...
* allow outer to load resources from the sandbox (for fonts)
* test whether the expected CSP values are present on the checkup page
* simplify the nodejs server a bit
2021-10-19 14:22:10 +05:30
ansuz
c1f9d11333
delay working on some flagged issues till next release
2021-08-16 18:32:34 +05:30
ansuz
1c08a27f60
fix a newly introduced reference error
2021-08-10 18:48:34 +05:30
ansuz
a33774aa6f
properly abort from channel archival if no metadata is returned
...
and add some logging when trimming history
2021-08-10 15:24:23 +05:30
ansuz
854a635c5f
remove hardcoded translations and defer non-blocking issues till the next release
2021-07-27 03:40:03 +05:30
ansuz
9bb884cac6
fix a type error caused by (my) invalid API use
2021-07-06 18:21:55 +05:30
ansuz
f13b82bdf6
disable integrated eviction by default
...
we'll implement an admin panel checkbox to enable it later
2021-07-06 16:14:40 +05:30
ansuz
7bdabb5cbc
archive blocks before overwriting them
2021-07-06 15:42:37 +05:30
ansuz
1c1dc421a3
fix broken block archival
2021-07-01 16:44:40 +05:30
ansuz
f7f2146fa5
miscellaneous cleanup and notes
2021-06-30 19:09:53 +05:30
ansuz
d27cbb69dc
filter email and instance purpose from telemetry unless we have consent
2021-06-30 19:05:37 +05:30
ansuz
76b90d3c8a
correct a few more places where the client expected hashes in pin responses
...
or where the server incorrectly provided them
2021-06-30 18:15:55 +05:30
ansuz
8e725f3d7c
stop returning the hash of all user pins after pinning
...
the client doesn't use it and it's CPU-intensive
2021-06-30 17:20:03 +05:30
ansuz
7c7acbeae6
delegate block validation to workers
2021-06-28 15:07:48 +05:30
ansuz
ba1a7b37e1
separate validation and storage methods for blocks
2021-06-28 14:39:26 +05:30
ansuz
9806d718d5
implement block archival
2021-06-25 20:53:09 +05:30
ansuz
caece0123e
archive pin logs instead of removing them outright
2021-06-25 20:22:16 +05:30
ansuz
3cbf4c9d6f
save instancePurpose choice to server from admin panel
2021-06-25 13:04:29 +05:30
ansuz
9027409ce5
serverside components of instancePurpose flag
2021-06-25 12:29:13 +05:30
ansuz
f5e91ef3ef
provide installMethod detail in server telemetry
2021-06-22 16:32:33 +05:30
ansuz
bb7c40237b
detect new versions in server telemetry responses
2021-06-10 20:56:12 +05:30
ansuz
2fd812ff36
WIP admin translations and update available button
2021-06-09 18:45:02 +05:30
ansuz
98c8d7086f
include instance version in Env
2021-06-09 18:43:31 +05:30
ansuz
41db88a360
WIP admin 'network' panel
2021-06-08 20:24:30 +05:30
ansuz
eea0688879
log messages which fail signature validation
2021-05-31 15:53:55 +05:30
ansuz
87c6e3270d
make a note about restricting channel creation to registered users
2021-05-20 16:13:28 +05:30
ansuz
62f8fb93b5
take notes of desirable admin RPC commands
2021-05-07 18:07:13 +05:30
yflory
7a682397e2
Add checkup test about Google's Floc
2021-05-07 14:23:15 +02:00
ansuz
eb32651c67
leave some notes about a minor race condition
2021-05-05 12:07:45 +05:30
ansuz
30fc2a5edf
Merge branch 'staging' into restricted-registration
2021-05-01 02:04:22 +05:30
ansuz
8c61948d02
implement SET_ADMIN_EMAIL and SET_SUPPORT_MAILBOX decrees
...
and update changelog
2021-04-30 14:48:22 +05:30
ansuz
729d51fb9b
update block storage APIs
2021-04-29 13:32:19 +05:30
ansuz
15a8284a30
add some logging and avoid some errors
2021-04-29 07:09:16 +05:30
ansuz
18c73ad282
WIP working password change with restricted registration
2021-04-28 11:16:55 +05:30
ansuz
8896391536
refactor writeLoginBlock to account for more asynchronous flow
2021-04-27 17:13:31 +05:30
ansuz
50045c08d0
WIP restrict registration
2021-04-26 18:31:33 +05:30
ansuz
15d6f573e7
don't send DUPLICATE error
2021-04-12 17:47:45 +05:30
ansuz
75a316e70d
adjust or remove comments
2021-04-12 13:39:54 +05:30
yflory
6027123d12
Fix maintenance
2021-04-08 16:10:03 +02:00
yflory
7f44009617
Better validation function in decrees
2021-04-08 13:04:12 +02:00
ansuz
4e3a7fef24
add notes from our review
2021-04-02 17:14:15 +05:30
ansuz
67af5c220c
server notes
2021-04-02 09:59:28 +05:30
yflory
8f679c141c
Broadcast update
2021-03-30 17:41:12 +02:00
yflory
96892bff48
Merge branch 'staging' into broadcast
2021-03-30 13:53:49 +02:00
yflory
6f1caf3540
Fix team creation
2021-03-26 17:12:27 +01:00
ansuz
75f9459950
leave a FIXME in the server
2021-03-23 09:25:02 +05:30
ansuz
5eddb41d77
add more background info for some protocol semantics
2021-03-22 16:51:11 +05:30
yflory
ed09b92592
Fix deleted pad restored corrupted from cache
2021-03-22 10:39:46 +01:00
yflory
7971a6d267
Major broadcast refactoring
2021-03-16 17:00:23 +01:00
yflory
dbce0fe429
Use 33 characters admin channels
2021-03-16 15:25:28 +01:00
ansuz
5f269fbe53
Merge branch 'soon' into staging
2021-03-15 15:35:42 +05:30
yflory
d15c0461cc
Add /api/broadcast and improve message deletion
2021-03-12 12:46:11 +01:00
yflory
a17e732473
Add XXX
2021-03-10 17:40:42 +01:00
yflory
fee8a88169
Instance notification prototype
2021-03-09 18:27:12 +01:00
Dmitry Borodaenko
6cd2131f27
Pass archivePath to Store.create always
2021-03-03 11:31:08 -08:00
ansuz
c9d1996e0d
avoid incrementing index size twice for a single message
2021-03-01 18:23:24 +05:30
ansuz
4316264044
fix incomplete unowned file upload
2021-02-19 13:12:35 +05:30
yflory
f5908e5f57
Fix history range
2021-02-18 16:28:40 +01:00
ansuz
baab65fa36
Merge branch 'callback' into staging
2021-02-17 17:47:57 +05:30
ansuz
70ba468211
lint compliance
2021-02-17 17:47:23 +05:30
yflory
f09ef072ac
Fix XXX
2021-02-17 12:56:51 +01:00
ansuz
9e1d82f373
move archive deletion out of the main eviction script
2021-02-17 14:17:41 +05:30
ansuz
50bec7386d
flag logic that is missing callbacks
2021-02-16 19:25:47 +05:30
yflory
287b80d4b8
Merge branch 'staging' into callback
2021-02-09 15:30:46 +01:00
yflory
ea4c529e39
Remove offset code
2021-02-09 15:29:34 +01:00
ansuz
b8a7defad9
lint compliance
2021-01-31 15:29:55 +05:30
ansuz
4a29d9df00
implement admin GET_USER_TOTAL_SIZE call
2021-01-31 15:28:45 +05:30
ansuz
8990e8def9
provide more context for EUNKNOWN logs
2021-01-26 10:31:29 +05:30