mirrors/remark42
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,032 Commits 6 Branches 56 Tags
243c8356e7fde9525545a7cf9921705bda04669f
Commit Graph
3032 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dmitry Verkhoturov 243c8356e7 do not sanitise the original comment markdown 
Previously it was sanitised using the HTML sanitiser,
but it had proven troublesome and unnecessary.
Remark42 rendered the markdown into proper HTML, but then some pieces
of it (like cited HTML code inside the code block, marked by backticks)
were cut out, which then showed the incorrect markdown to a user when
they were editing the comment.

For example, the comment "`foo<bar>`" became "foo" after sanitising,
and despite the proper render user saw only "foo" when editing
the comment.

After this change, the initial comment markdown is preserved unaltered.
It could contain dangerous HTML with JS, which I assume shouldn't
be a problem as it's never rendered as HTML but instead supposed
to be converted to HTML by the interpreter. In Remark42, it's stored
in a comment.Text field and sanitised and thus safe.

I've left information about the potential danger of rendering
the original markdown as-is without an interpreter in
all relevant places I could find.
 2022-07-22 01:08:08 +02:00
Dmitry VerkhoturovandUmputun 2d2f2ab02a return docker build for frontend and backend code outside in CI 
Previously we built a Docker image just for the test,
but the introduction of multi-arch build in 9fbf0952
build also meant the push of the image, so it was
restricted only to the master branch.
This change re-introduces the Docker image build
outside the master branch, which is helpful
in pull requests.

We recently had a few frontend PRs which broke
the Docker image build silently, and that change
prevents it from happening.
 2022-07-19 19:25:54 -05:00
Dmitry VerkhoturovandUmputun 50785e0577 bump didip/tollbooth from v6 to v7 2022-07-19 17:13:02 -05:00
Dmitry VerkhoturovandUmputun 9c1a827685 update alecthomas/chroma and Depado/bfchroma to v2 2022-07-13 20:29:46 -05:00
Paul MineevandUmputun 8c658b7eda fix frontend test/build in docker 2022-07-13 14:35:54 -05:00
Paul MineevandUmputun 26d8d3daee use pnpm lock 2022-07-13 14:00:48 -05:00
Dmitry VerkhoturovandUmputun 26476db95d update go-pkgz/rest, stretchr/testify, three stdlib modules 2022-07-13 12:40:30 -05:00
Pavel Mineev 3c90f6ae61 increase size-limit 2022-07-12 13:34:44 -07:00
Pavel Mineev 4889afdf0c use size-limit/file 2022-07-12 13:34:44 -07:00
Paul MineevandPaul Mineev 2e777ea752 switch to pnpm 2022-07-11 20:13:39 -07:00
Paul MineevandPaul Mineev fddf1e21f3 prettier 2022-07-11 16:21:44 -07:00
Paul MineevandPaul Mineev d6013b10e6 separate persist logic from compnennt 2022-07-11 16:21:44 -07:00
Pavel MineevandUmputun aac6af40cc update height when an image is loaded 2022-07-11 12:54:48 -05:00
Dmitry VerkhoturovandUmputun 1f96a0e4d3 update go-pkgz/auth module to fix dev provider work 
Fix for error introduced in the following commit:
https://github.com/go-pkgz/auth/commit/06e72788bcbb23d958c60655b42892b95457477e

After text/template was replaced with the html/template,
the dev provider started escaping parameters
which were not supposed to be escaped.
 2022-07-10 10:49:41 -05:00
Paul MineevandUmputun 99716984ad up node version, add nvmrc, recommend nvm 2022-07-02 11:48:22 -05:00
Paul MineevandUmputun 24e9404a6f Fix email autofill in subscription popup 2022-07-01 12:33:15 -05:00
Paul MineevandUmputun 1f1adba5fd up eslint 2022-07-01 12:22:57 -05:00
Paul MineevandUmputun b907354746 update size limit for remark chunk 2022-07-01 12:22:57 -05:00
Paul MineevandUmputun 9a08d4a412 fix problems after update 2022-07-01 12:22:57 -05:00
Paul MineevandUmputun 3a08e6dd55 bump prod deps 2022-07-01 12:22:57 -05:00
Paul MineevandUmputun 02f782a5ab use ts for jest config, use transformIgnorePatterns, jsdom env by default 2022-07-01 12:22:57 -05:00
Paul MineevandUmputun 30d68b2d1e update eslint config 2022-07-01 12:22:57 -05:00
Paul MineevandUmputun 8974cde582 bump dev deps 2022-07-01 12:22:57 -05:00
Paul MineevandUmputun 5f3206a4e8 preact preset already includes rules for jest 2022-07-01 11:13:28 -05:00
Paul MineevandUmputun 40e38d225e fix broken deps 2022-07-01 11:13:28 -05:00
Dmitry VerkhoturovandUmputun a73072c8fb add documentation on running remark42 on a separate domain 2022-06-30 19:12:00 -05:00
Dmitry VerkhoturovandGitHub 6a5c5a4c08 add missing env_delim to ALLOWED_HOSTS parameter (#1395) 2022-06-29 22:32:48 -05:00
Dzung DoandGitHub fa7d5cee87 Translate some string into Vietnamese (#1381) 
* Finish Vietnamese translation and editing some typo missing
* Update vi.json
 2022-06-07 10:45:41 -05:00
Paul MineevandUmputun fe4db30e6d show subscription buttons in simple view, add ability to hide rss button 2022-06-06 10:00:24 -05:00
Paul MineevandUmputun 6936268fd2 fix basepath for oauth icons v1.10.1 2022-06-05 17:46:31 -05:00
Umputun e55f6ffdf3 go mod tidy for examples 2022-06-05 12:53:34 -05:00
Umputun e182e3c776 switch to master version of auth 
for https://github.com/go-pkgz/auth/pull/119
 2022-06-05 12:49:30 -05:00
UmputunandGitHub 6309443d1f removes .git from build layer, emulates GH build (#1375) 
* removes .git from build layer, emulates GH build #269

* rundev target with git version passed in
 2022-06-05 12:36:18 -05:00
Umputun 6f81bf00e8 add validation for email and site 2022-06-05 11:57:51 -05:00
Umputun 86a1f5ee5d exact match on email login path 2022-06-05 11:57:51 -05:00
Umputun b3e460eebd sleep in anon test to prevent limiter 2022-06-05 11:57:51 -05:00
Umputun 5121c48c31 reduce max limiter for /auth to 2r/s 2022-06-05 11:57:51 -05:00
Umputun 5f8e16cbe2 add email auth validation with middleware 2022-06-05 11:57:51 -05:00
Ruslan NagimovandUmputun 12e4f283fe typo 2022-06-02 10:47:06 -05:00
Dzung DoandUmputun 20ca0896a6 Finish Vietnamese translation 
and editing some typo missing
 2022-05-30 13:39:45 -05:00
Dmitry VerkhoturovandUmputun 3b5f44da46 bump go modules, fix StartTLS email notifications 
In #1359, we discovered that StartTLS was not working\
due to the wrong host passed. This bumps the library for the fix.

Also, after a switch to go-pkgz/notify MailGun email sending
broke due to the difference in the destination email parsing,
the fix is also applied after this commit.
backend/v1.10.0 v1.10.0 		2022-05-20 16:00:30 -05:00
Dmitry VerkhoturovandUmputun 9049d7a616 add missing RPC type of image storage to the documentation 2022-05-15 15:56:53 -05:00
Dmitry VerkhoturovandUmputun adb77d9a11 sync server parameters with their description 2022-05-12 11:41:52 -05:00
Paul MineevandUmputun 18cc34535f fix lint and test 2022-05-10 14:47:34 -05:00
Paul MineevandUmputun 9053668cfe fix editing mode 2022-05-10 14:06:02 -05:00
Alena MaslovaandUmputun b82ed825f7 add comment about custom ID user generation 2022-05-10 12:59:49 -05:00
Alena MaslovaandUmputun ac492180e8 use custom UserIDFunc for anonymous provider 2022-05-10 12:59:49 -05:00
dmitry.konchalenkovandUmputun 168a6d36c0 Update translations 2022-05-09 02:52:06 -05:00
UmputunandGitHub 7cdb006f81 Links rune (#1344) 
* shorten links with non-latin properly

* lint: unneeded conversion
 2022-04-30 12:03:52 -05:00
dependabot[bot]andUmputun 5a6ca7a82b Bump ejs from 3.1.6 to 3.1.7 in /site 
Bumps [ejs](https://github.com/mde/ejs) from 3.1.6 to 3.1.7.
- [Release notes](https://github.com/mde/ejs/releases)
- [Changelog](https://github.com/mde/ejs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/mde/ejs/compare/v3.1.6...v3.1.7)

---
updated-dependencies:
- dependency-name: ejs
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-04-29 13:34:05 -05:00