mirrors/remark42
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,239 Commits 6 Branches 56 Tags
8df986e70ad394812cc45b0487ad9dfd40ca2677
Commit Graph
267 Commits
Author SHA1 Message Date
Dmitry VerkhoturovandUmputun e0423b8683 fix type for value for refresh token cache 
It was set to string by mistake, proper type is token.Claims.
 2024-03-22 04:16:29 -05:00
Dmitry VerkhoturovandUmputun 1313dee829 update to lcw v2 with generic types 2024-02-20 14:15:35 -06:00
Dmitry VerkhoturovandUmputun 532573fb34 fix problems reported by golangci-lint 2024-02-20 12:10:39 -06:00
Dmitry VerkhoturovandUmputun 0050c65596 add meaningful error for lack of auth on import, remap and backup 
Previously, the error printed was just the following:

error response "401 Unauthorized", Unauthorized"

New error:

error response "401 Unauthorized", ensure you have set ADMIN_PASSWD
and provided it to the command you're running: Unauthorized
 2024-01-28 12:16:24 -06:00
Vladimir DandUmputun 30f46efa5b TLS InsecureSkipVerify option 2023-12-26 11:47:09 -06:00
Dmitry VerkhoturovandUmputun d143932924 add MIN_COMMENT_SIZE parameter 2023-12-02 12:16:26 -06:00
Dmitry Verkhoturov dcc7613409 allow disabling fancy HTML formatting 
It might be necessary if the comments should preserve
original quotes instead of replacing them with angled ones.
 2023-11-26 09:13:53 +01:00
Dmitry VerkhoturovandUmputun 19e1616129 allow title extraction only from full match of AllowedHosts 
Previously, we extracted the second-level domain,
but it doesn't make sense for a list of domains defined explicitly
to display the comments.
 2023-11-04 12:45:19 -05:00
Dmitry VerkhoturovandUmputun efceed6f68 limit TitleExtractor to allow only Remark42 whitelisted domains 
Allowed domains consist of `REMARK_URL` second-level domain (or whole IP in case it's IP like `127.0.0.1`) and `ALLOWED_HOSTS`. That is needed to prevent Remark42 from asking arbitrary servers and storing the page title as the comment.PostTitle.

Previous behaviour allowed the caller of the API to create a comment
with an arbitrary URL and learn the title of the page, which might be
accessible to the server Remark42 is installed on but not to the user
outside that network (CWE-918).
 2023-10-10 23:34:35 -05:00
Dmitry VerkhoturovandUmputun f4358173c7 limit TitleExtractor to allow only Remark42 whitelisted domains 
Allowed domains consist of `REMARK_URL` second-level domain (or whole IP in case it's IP like `127.0.0.1`) and `ALLOWED_HOSTS`. That is needed to prevent Remark42 from asking arbitrary servers and storing the page title as the comment.PostTitle.

Previous behaviour allowed the caller of the API to create a comment
with an arbitrary URL and learn the title of the page, which might be
accessible to the server Remark42 is installed on but not to the user
outside that network (CWE-918).
 2023-10-10 23:34:35 -05:00
Umputun e30d4da455 update auth lib to master #1660 
adopt tests for the mandatory provider check

fix leftover test for the server
 2023-08-20 19:37:39 -05:00
Umputun b572966bc4 remove cmd/var 2023-08-07 13:32:44 -05:00
Umputun 9ad4f0b75e lint: remove deprecated rand.Seed from tests 2023-08-07 13:09:38 -05:00
Umputun 2093f4ece2 update go to 1.20, bump deps 2023-08-07 13:03:16 -05:00
Dmitry VerkhoturovandUmputun 136d7e8215 switch from telegram_bot_username to telegram_notifications 
Bot username is returned as an answer to subscribe request,
so knowing it in advance is unnecessary.
 2023-06-29 10:52:00 -05:00
Dmitry VerkhoturovandUmputun 1b90604b2d update go modules, fix Apple auth redirect 
Previously the redirect after successful authentication didn't work.
 2023-04-02 03:47:35 -05:00
Dmitry VerkhoturovandUmputun 41a3359085 add the ability to set the JWS aud per site_id 
Without this option, the aud is ignored.
It works only with RPC admin storage.

The shared key returned for all requests with the default shared admin
storage, so enabling that option does not affect it.
 2023-01-10 11:24:41 -06:00
Dmitry VerkhoturovandUmputun 099aad8475 add apple bad key test, fix key location 
Previously, default location was outside of container mount.
 2023-01-04 03:54:38 -06:00
Dmitry VerkhoturovandUmputun c1b3fba344 add backend support for Apple auth provider 
It's a bit different from other OAuth providers and requires a
different set of options and a private key file.
 2023-01-03 23:47:42 -06:00
Dmitry VerkhoturovandUmputun cebe929118 bump go modules, enable LoginAuth option for email 
That option is needed for outlook.com and Office 365, resolves #1472.
 2022-10-03 03:26:34 -05:00
Dmitry VerkhoturovandUmputun 372429a9f5 call admin store with a proper key 
Previously it was set to fixed strings, likely a test artefact.

Resolves #1499.
 2022-09-28 16:04:19 -05:00
Dmitry Verkhoturov 9ad3be2e97 bump go modules, make auth dev hostname customisable 
After this commit, dev auth would start working with the `REMARK_URL`
hostname instead of the previously hardcoded 127.0.0.1.

Breaks development setup where `REMARK_URL` was set
to a non-standard value and dev auth was running on 127.0.0.1
and working, as, after that change, it would stop working.
 2022-08-26 23:35:57 +02:00
Dmitry VerkhoturovandUmputun a9836aaea0 move static web files from rakyll/statik to go:embed 
There is no need for the rakyll/statik package starting with Go 1.16,
which provides us with tools for embedding files
without third-party libraries.
 2022-08-03 15:41:02 -05:00
Dmitry Verkhoturov 86d059bf99 move templates from rakyll/statik to go:embed 
There is no need for the rakyll/statik package starting with Go 1.16,
which provides us with tools for embedding files
without third-party libraries.
 2022-07-29 19:07:49 +02:00
Dmitry Verkhoturov 41d47fdb3e don't enable telegram user notifications when they are disabled 
Before that change, enabling Telegram auth
also enabled Telegram user notifications.
 2022-07-27 23:21:09 +02:00
Dmitry VerkhoturovandUmputun f104a6e1b6 move common options to cmd.go 
Timeout, admin password and site id are set in many commands,
and we need to take care of synchronising the descriptions
and flags between them.

This change moves these standard options to cmd.go importing them
in the same manner CommonOpts imported by all commands already.
 2022-07-25 12:42:13 -05:00
Dmitry VerkhoturovandGitHub 6a5c5a4c08 add missing env_delim to ALLOWED_HOSTS parameter (#1395) 2022-06-29 22:32:48 -05:00
Umputun b3e460eebd sleep in anon test to prevent limiter 2022-06-05 11:57:51 -05:00
Dmitry VerkhoturovandUmputun adb77d9a11 sync server parameters with their description 2022-05-12 11:41:52 -05:00
Alena MaslovaandUmputun b82ed825f7 add comment about custom ID user generation 2022-05-10 12:59:49 -05:00
Alena MaslovaandUmputun ac492180e8 use custom UserIDFunc for anonymous provider 2022-05-10 12:59:49 -05:00
Dmitry VerkhoturovandUmputun a980bdbad2 switch to go-pkgz/notify package: email 2022-04-29 13:32:15 -05:00
Dmitry VerkhoturovandUmputun 0d9c80aec7 switch to go-pkgz/notify package: slack 2022-04-29 13:32:15 -05:00
Dmitry VerkhoturovandUmputun ad0ac693de switch to go-pkgz/notify package: webhook 2022-04-29 13:32:15 -05:00
Dmitry VerkhoturovandUmputun 0c3053d4ad CloseIdleConnections on http clients 
Without this, go.uber.org/goleak reports
leaking goroutine caused by HTTP client
on many tests when ran one by one.
 2022-04-29 10:51:49 -05:00
Dmitry VerkhoturovandUmputun 91b9324080 cleanup test files 2022-04-29 10:51:49 -05:00
Dmitry VerkhoturovandUmputun ba86db1263 replace errors package with fmt.Errorf 
https://gist.github.com/Peltoche/60b8b81dfbf70164d0e2b88988003229
was used for it, thanks to @Peltoche for publishing it.
 2022-04-26 00:25:09 -05:00
Dmitry VerkhoturovandUmputun 2a7966b9e6 replace numbers with proper HTTP status codes in tests 
Also, remove unneeded whitespaces using whitespace
linter for golangci-lint.
 2022-04-17 19:42:45 -05:00
Umputun 65e3a82d8b add no-signature mode suppressing app info middleware #1305 2022-04-05 12:08:44 -05:00
Dmitry VerkhoturovandUmputun 39c141c98d increase timeout for backup and restore and remap 15m->60m 
Resolves #1297
 2022-03-25 15:55:37 -05:00
Dmitry VerkhoturovandUmputun 2ef1cfe1ea fix logic of detecting deprecated notify type params 2022-02-19 02:43:34 -06:00
Dmitry VerkhoturovandUmputun 8d42d0714f bump backend dependencies 
Also, switch from fork github.com/umputun/go-flags back to original
github.com/jessevdk/go-flags.
 2022-01-31 14:24:33 -06:00
Dmitry Verkhoturov 31af19e456 make FindDeprecatedFlagsCollisions private method 2022-01-31 00:40:03 +03:00
Dmitry Verkhoturov 8689b11e7c log when deprecated and new args are set at the same time 
For example, when notify.telegram.token and telegram.token
are both set but to different values, user might see
"access denied" error in log on attempt to send telegram
notification, thinking that notify.telegram.token value
is used, when in fact it is ignored and only telegram.token
is used.

New behavior is the same, ignoring the old param when new
one is set, but issuing the error log message which
explicitly tells the user about that.

Resolves #1218.
 2022-01-31 00:40:03 +03:00
Dmitry VerkhoturovandUmputun 151913f371 style fixes to the documentation and CLI params description 2021-12-20 13:36:58 -06:00
Dmitry VerkhoturovandUmputun e341e25f0f improve notifications documentation (telegram, webhook) 2021-12-20 02:56:38 -06:00
Dmitry VerkhoturovandUmputun 11c8bf6228 do not issue deprecation warning on notify.type by default 
Default configuration for notify.type is "none",
and prior to this change it was issuing the
deprecation warning which was not an intended
behaviour.
 2021-12-19 23:32:48 -06:00
Dmitry VerkhoturovandUmputun f43dfd57e0 clarify telegram channel ID param and documentation 2021-12-19 13:56:16 -06:00
Dmitry VerkhoturovandUmputun 90e537358d update golangci-lint to 1.43.0, fix found issues 2021-11-23 15:00:40 -06:00
Dmitry VerkhoturovandUmputun be3643ed10 use single loop for telegram auth and notify 2021-11-09 02:04:51 -06:00