From 9a1bad08bc4836ff0f7189a92e771b4e8ab021da Mon Sep 17 00:00:00 2001 From: DianaXWiki Date: Thu, 31 Aug 2023 15:29:04 +0300 Subject: [PATCH 01/12] Add scroll to about panel --- www/common/common-interface.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/www/common/common-interface.js b/www/common/common-interface.js index cd3d1b406..fbff7adf0 100644 --- a/www/common/common-interface.js +++ b/www/common/common-interface.js @@ -539,7 +539,8 @@ define([ message, dialog.getButtons(opt.buttons, opt.onClose) ]); - + frame.style.minHeight='400px'; + frame.style.overflowY='auto'; if (opt.forefront) { $(frame).addClass('forefront'); } return frame; }; From 6c986e22bd70cfd4a4dd4e6bbd7f146f7c02be02 Mon Sep 17 00:00:00 2001 From: DianaXWiki Date: Thu, 31 Aug 2023 15:30:19 +0300 Subject: [PATCH 02/12] Add scroll to about panel #1088 --- www/common/common-interface.js | 1 + 1 file changed, 1 insertion(+) diff --git a/www/common/common-interface.js b/www/common/common-interface.js index fbff7adf0..0365ce49c 100644 --- a/www/common/common-interface.js +++ b/www/common/common-interface.js @@ -514,6 +514,7 @@ define([ }); return dialog.nav(navs); }; + dialog.customModal = function (msg, opt) { var force = false; if (typeof(opt) === 'object') { From 97a531ac84e636cf59e82f96b8820fbd5d938725 Mon Sep 17 00:00:00 2001 From: DianaXWiki Date: Thu, 31 Aug 2023 16:01:54 +0300 Subject: [PATCH 03/12] Add scroll property in less file #1088 --- customize.dist/src/less2/include/alertify.less | 1 + www/common/common-interface.js | 4 +--- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/customize.dist/src/less2/include/alertify.less b/customize.dist/src/less2/include/alertify.less index 8ad8c3b43..9c69bfe2d 100644 --- a/customize.dist/src/less2/include/alertify.less +++ b/customize.dist/src/less2/include/alertify.less @@ -144,6 +144,7 @@ display: flex; > * { + overflow:auto; width: 100%; min-width: 260px; max-width: 500px; diff --git a/www/common/common-interface.js b/www/common/common-interface.js index 0365ce49c..53bf55582 100644 --- a/www/common/common-interface.js +++ b/www/common/common-interface.js @@ -514,7 +514,7 @@ define([ }); return dialog.nav(navs); }; - + dialog.customModal = function (msg, opt) { var force = false; if (typeof(opt) === 'object') { @@ -540,8 +540,6 @@ define([ message, dialog.getButtons(opt.buttons, opt.onClose) ]); - frame.style.minHeight='400px'; - frame.style.overflowY='auto'; if (opt.forefront) { $(frame).addClass('forefront'); } return frame; }; From 920c307608f9e21410f3fbb34a0759990961e5cf Mon Sep 17 00:00:00 2001 From: yflory Date: Mon, 4 Sep 2023 12:10:48 +0200 Subject: [PATCH 04/12] Fix websocket issue with some dev instances --- lib/env.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/env.js b/lib/env.js index 98fb1093c..a0f8fee2b 100644 --- a/lib/env.js +++ b/lib/env.js @@ -102,7 +102,7 @@ module.exports.create = function (config) { removeDonateButton: config.removeDonateButton, httpPort: isValidPort(config.httpPort)? config.httpPort: 3000, - httpAddress: typeof(config.httpAddress) === 'string'? config.httpAddress: '127.0.0.1', + httpAddress: typeof(config.httpAddress) === 'string'? config.httpAddress: 'localhost', websocketPath: config.externalWebsocketURL, OFFLINE_MODE: false, From e76e5fc34de7a963b55447f30bfada29fe86841f Mon Sep 17 00:00:00 2001 From: daria Date: Tue, 5 Sep 2023 13:21:57 +0300 Subject: [PATCH 05/12] uncommented button margin fixed 5.4.0 regression --- customize.dist/src/less2/include/sidebar-layout.less | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/customize.dist/src/less2/include/sidebar-layout.less b/customize.dist/src/less2/include/sidebar-layout.less index 4248bbdb5..db530f175 100644 --- a/customize.dist/src/less2/include/sidebar-layout.less +++ b/customize.dist/src/less2/include/sidebar-layout.less @@ -135,9 +135,9 @@ &>div { margin: 10px 0; } - //button.btn { - // margin: 0 5px 0 0; - //} + button.btn { + margin: 0 5px 0 0; + } span.cp-password-container { margin-bottom: 1rem; } From fde6f1527042d4b3acc012d36a0ab2d98292f7be Mon Sep 17 00:00:00 2001 From: yflory Date: Tue, 5 Sep 2023 13:01:41 +0200 Subject: [PATCH 06/12] Fix headers added by node for the recommended config --- lib/http-worker.js | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/lib/http-worker.js b/lib/http-worker.js index 8e3a10187..3216d4e28 100644 --- a/lib/http-worker.js +++ b/lib/http-worker.js @@ -127,23 +127,15 @@ var getHeaders = function (Env, type) { csp = Default.contentSecurity(Env); } headers['Content-Security-Policy'] = csp; - - if (Env.NO_SANDBOX) { // handles correct configuration for local development - // https://stackoverflow.com/questions/11531121/add-duplicate-http-response-headers-in-nodejs - headers["Cross-Origin-Resource-Policy"] = 'cross-origin'; - headers["Cross-Origin-Embedder-Policy"] = 'require-corp'; - } + headers["Cross-Origin-Resource-Policy"] = 'cross-origin'; + headers["Cross-Origin-Embedder-Policy"] = 'require-corp'; + cacheHeaders(Env, key, headers); // Don't set CSP headers on /api/ endpoints // because they aren't necessary and they cause problems // when duplicated by NGINX in production environments - if (type === 'api') { - cacheHeaders(Env, key, headers); - return headers; - } + if (type === 'api') { delete headers['Content-Security-Policy']; } - headers["Cross-Origin-Resource-Policy"] = 'cross-origin'; - cacheHeaders(Env, key, headers); return headers; }; From bccfb28ac98ea51bf0e8818f735fa638148ca191 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= <41020854+mthld@users.noreply.github.com> Date: Tue, 5 Sep 2023 13:17:12 +0200 Subject: [PATCH 07/12] move old default Nginx example config to advanced file --- docs/{example.nginx.conf => example-advanced.nginx.conf} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename docs/{example.nginx.conf => example-advanced.nginx.conf} (100%) diff --git a/docs/example.nginx.conf b/docs/example-advanced.nginx.conf similarity index 100% rename from docs/example.nginx.conf rename to docs/example-advanced.nginx.conf From c756909a8911fff340ab22c0f204b436f9ca99cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= <41020854+mthld@users.noreply.github.com> Date: Tue, 5 Sep 2023 13:19:25 +0200 Subject: [PATCH 08/12] add new default Nginx example config file --- docs/example.nginx.conf | 69 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 docs/example.nginx.conf diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf new file mode 100644 index 000000000..c3eea6066 --- /dev/null +++ b/docs/example.nginx.conf @@ -0,0 +1,69 @@ +# This file is included strictly as an example of how Nginx can be configured +# to work with CryptPad. This example WILL NOT WORK AS IS. For best results, +# compare the sections of this configuration file against a working CryptPad +# installation (http server by the Nodejs process). If you are using CryptPad +# in production and require professional support please contact sales@cryptpad.fr + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + # Let's Encrypt webroot + include letsencrypt-webroot; + + # CryptPad serves static assets over these two domains. + # `your-main-domain` is what users will enter in their address bar. + # Privileged computation such as key management is handled in this scope + # UI content is loaded via the `your-sandbox-domain`. + # "Content Security Policy" headers prevent content loaded via the sandbox + # from accessing privileged information. + # This setup allows to take advantage of CryptPad's sandboxing techniques. + # In the event of an XSS vulnerability in CryptPad's front-end code + # this will limit the amount of information accessible to attackers. + server_name your-main-domain.com your-sandbox-domain.com; + + # You'll need to Set the path to your certificates and keys here + # IMPORTANT: this config is intended to serve assets for at least two domains + # (your main domain and your sandbox domain). As such, you'll need to generate a single SSL certificate + # that includes both domains in order for things to work as expected. + ssl_certificate /etc/ssl/lets-encrypt/your-main-domain.com/cert; + ssl_certificate_key /etc/ssl/lets-encrypt/your-main-domain.com/key; + + # diffie-hellman parameters are used to negotiate keys for your session + # generate strong parameters using the following command + ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096 + + # Speeds things up a little bit when resuming a session + ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; + ssl_session_tickets off; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + + # HSTS (ngx_http_headers_module is required) (63072000 seconds) + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + + # verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt; + + # replace with the IP address of your resolver + resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220; + + location / { + proxy_pass http://localhost:3000; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + client_max_body_size 150m; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection upgrade; + } +} From 53f53d1a7e67df4931f85a83823f4c81c86ee69d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= <41020854+mthld@users.noreply.github.com> Date: Tue, 5 Sep 2023 13:21:16 +0200 Subject: [PATCH 09/12] fix two little header issues in Nginx advanced example --- docs/example-advanced.nginx.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/example-advanced.nginx.conf b/docs/example-advanced.nginx.conf index 3b38a4606..4bc139b31 100644 --- a/docs/example-advanced.nginx.conf +++ b/docs/example-advanced.nginx.conf @@ -245,6 +245,8 @@ server { proxy_hide_header 'Access-Control-Allow-Origin'; proxy_hide_header 'Permissions-Policy'; proxy_hide_header 'X-XSS-Protection'; + proxy_hide_header 'Cross-Origin-Resource-Policy'; + proxy_hide_header 'Cross-Origin-Embedder-Policy'; proxy_pass http://localhost:3000; } From 87dc6e66d4070dbb3af3f65041dec7f108a1a937 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathilde=20Gr=C3=BCnig?= <41020854+mthld@users.noreply.github.com> Date: Tue, 5 Sep 2023 13:22:15 +0200 Subject: [PATCH 10/12] replace tabs by spaces, not rendered properly by GitHub --- docs/example-advanced.nginx.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/example-advanced.nginx.conf b/docs/example-advanced.nginx.conf index 4bc139b31..dedd4902e 100644 --- a/docs/example-advanced.nginx.conf +++ b/docs/example-advanced.nginx.conf @@ -245,7 +245,7 @@ server { proxy_hide_header 'Access-Control-Allow-Origin'; proxy_hide_header 'Permissions-Policy'; proxy_hide_header 'X-XSS-Protection'; - proxy_hide_header 'Cross-Origin-Resource-Policy'; + proxy_hide_header 'Cross-Origin-Resource-Policy'; proxy_hide_header 'Cross-Origin-Embedder-Policy'; proxy_pass http://localhost:3000; } From 55a143499505b3dfada35d342e16141e28afba72 Mon Sep 17 00:00:00 2001 From: David Benque Date: Tue, 5 Sep 2023 15:44:24 +0100 Subject: [PATCH 11/12] Replace unit with rem --- customize.dist/src/less2/include/sidebar-layout.less | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/customize.dist/src/less2/include/sidebar-layout.less b/customize.dist/src/less2/include/sidebar-layout.less index db530f175..397add8ac 100644 --- a/customize.dist/src/less2/include/sidebar-layout.less +++ b/customize.dist/src/less2/include/sidebar-layout.less @@ -136,7 +136,7 @@ margin: 10px 0; } button.btn { - margin: 0 5px 0 0; + margin: 0 0.5rem 0 0; } span.cp-password-container { margin-bottom: 1rem; From a0e59dd65b7ad4b8639856b13674accc85787290 Mon Sep 17 00:00:00 2001 From: yflory Date: Mon, 11 Sep 2023 11:53:59 +0200 Subject: [PATCH 12/12] Fix form responses deletion #1239 --- lib/http-worker.js | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/http-worker.js b/lib/http-worker.js index 3216d4e28..b990e5264 100644 --- a/lib/http-worker.js +++ b/lib/http-worker.js @@ -489,6 +489,7 @@ var serveBroadcast = makeRouteCache(function () { return [ 'define(function(){', 'return ' + JSON.stringify({ + curvePublic: Env.curvePublic, lastBroadcastHash: Env.lastBroadcastHash, surveyURL: Env.surveyURL, maintenance: maintenance