Allowed domains consist of `REMARK_URL` second-level domain (or whole IP in case it's IP like `127.0.0.1`) and `ALLOWED_HOSTS`. That is needed to prevent Remark42 from asking arbitrary servers and storing the page title as the comment.PostTitle.
Previous behaviour allowed the caller of the API to create a comment
with an arbitrary URL and learn the title of the page, which might be
accessible to the server Remark42 is installed on but not to the user
outside that network (CWE-918).
Allowed domains consist of `REMARK_URL` second-level domain (or whole IP in case it's IP like `127.0.0.1`) and `ALLOWED_HOSTS`. That is needed to prevent Remark42 from asking arbitrary servers and storing the page title as the comment.PostTitle.
Previous behaviour allowed the caller of the API to create a comment
with an arbitrary URL and learn the title of the page, which might be
accessible to the server Remark42 is installed on but not to the user
outside that network (CWE-918).
Previously, we stripped unsafe HTML tags but left some,
but it's not expected to have a link in a title or username,
so the new behaviour is stripping everything.
Previously, proxied and local images were checked for presence in the
storage before previewing or posting the comment. That logic resulted in
an inability to post with an image when a proxy for images is enabled,
as proxied images are not downloaded to disk before the first time
someone loads them, which could only happen after the user either
previews or posts the message.
After this change, preview and post only checks the local images'
presence and ignore the proxied ones.
1) Current implementation simply removes the last word, without truncating up to limit length.
2) In case if even the first word (magnet link or some base64?) is too long don't add extra space.
* Email subscription params in request body
* Email subscription params in request body
fix tests
* Skip confirm step on email sub
When user logged in with the same email he tries to subscribe
* Skip confirm step on email sub
set autoConfirm param to make it work
* Update size-limit
* Handle 409: already subscribed
* refactor: prevStep to justSubscribed
prevStep is not used anywhere else and because of it influences output text (haveSubscribed), have changed it to more intuitive justSubscribed variable
* Test case for http error 409
(url) is a text inserted by default and never an intended URL.
That additional validation will ensure that users won't post relative
links because they are rarely intended.
Dmitry VerkhoturovandUmputun
sharief007andUmputun
Dzung DoandUmputun
Alexander GusmanandUmputun
Justin HawkinsandGitHub
Yury KotovandUmputun
EugeneandGitHub
LoneExileandUmputun
Vasilii BlazhnovandUmputun
SimonHaasandUmputun
Paul MineevandUmputun
Dejavu MoeandUmputun
konstantin krivleniaandUmputun
dmitry.konchalenkovandUmputun