Allowed domains consist of `REMARK_URL` second-level domain (or whole IP in case it's IP like `127.0.0.1`) and `ALLOWED_HOSTS`. That is needed to prevent Remark42 from asking arbitrary servers and storing the page title as the comment.PostTitle.
Previous behaviour allowed the caller of the API to create a comment
with an arbitrary URL and learn the title of the page, which might be
accessible to the server Remark42 is installed on but not to the user
outside that network (CWE-918).
Allowed domains consist of `REMARK_URL` second-level domain (or whole IP in case it's IP like `127.0.0.1`) and `ALLOWED_HOSTS`. That is needed to prevent Remark42 from asking arbitrary servers and storing the page title as the comment.PostTitle.
Previous behaviour allowed the caller of the API to create a comment
with an arbitrary URL and learn the title of the page, which might be
accessible to the server Remark42 is installed on but not to the user
outside that network (CWE-918).
Without this option, the aud is ignored.
It works only with RPC admin storage.
The shared key returned for all requests with the default shared admin
storage, so enabling that option does not affect it.
For example, when notify.telegram.token and telegram.token
are both set but to different values, user might see
"access denied" error in log on attempt to send telegram
notification, thinking that notify.telegram.token value
is used, when in fact it is ignored and only telegram.token
is used.
New behavior is the same, ignoring the old param when new
one is set, but issuing the error log message which
explicitly tells the user about that.
Resolves#1218.
The current state is a mess of user and admin
notifications, which will become worse after
implementing the new user notification methods
like a telegram.
This change makes things simpler
for the remark42 users.
Before:
failed to make notify service,
failed to create email notification destination:
can't set templates:
can't read message template:
open email_reply.html.tmpl:
no such file or directory
After:
make notify, types=[email]
create notifier service, queue size=100, destinations=1
* fix admin name check for anon login #605
* update readme with admin names info
* lint: list of static site params
* typo
* don't allow email users to reuse admin names
* move admin.names to restricted-names
* forgotten names member
* remove names from example admin
* remove names from prepTestStore
* move SMTP settings to separate group
* move deprecated options in separate section in readme
* adjust variables in docker-compose
* add description to SmtpGroup
* remove SMTP option setting which is already set to same value
* remove smtp port default for consistency
* add server deprecated functions handling
* satisfy linter
* add missing bracket in description
* add test for handleDeprecatedFlags
* add HandleDeprecatedFlags function to CommonOptionsCommander
* improve HandleDeprecatedFlags behavior
* add missing result check to ServerCommand.HandleDeprecatedFlags
* increase timeout for TestServerAuthHooks http client
* replace assert.Equal checks for slice length with require.Equal
* unify channel name across tests
* fix panic in Test_Main
* increase TestRest_CreateWithPictures timeout for HDD slowness
* increase TestService_VoteSameIPWithDuration timeout for HDD slowness
* increase go test timeout for HDD run
* increase TestRest_CreateWithPictures timeout for HDD slowness
* improve TestServer* reliability
* improve TestService_UserReplies reliability
* increase timeout for Test_Main
* improve TestRest_CreateWithPictures readability and reliability
* introduce random port to REST over SSL tests
* tinker TestRest_InfoStreamSince to have more slack before failure
* finalize test errors check unification
* simplify prepServerApp in cmd package tests
* improve TestRest_InfoStreamCancel reliability
* adjust TestServerApp_WithSSL to use sslPort in all test checks
* make Test_Main reliable and remove 5s sleep
* make test finishing reliable using "done" channel for TestServerApp*
Dmitry VerkhoturovandUmputun
romanilchyshyn
bakurinandUmputun
vdimirandUmputun
Pavel MineevandUmputun