Dan Brown
ce3f489188
Merge branch '3027_attachment_vuln'
2021-11-01 13:25:12 +00:00
Dan Brown
f4201e5740
New Crowdin updates ( #3023 )
...
* New translations errors.php (Polish)
* New translations activities.php (Dutch)
* New translations auth.php (Dutch)
* New translations common.php (Dutch)
* New translations entities.php (Dutch)
* New translations auth.php (Dutch)
* New translations auth.php (Dutch)
* New translations auth.php (Dutch)
* New translations settings.php (Latvian)
2021-11-01 13:16:15 +00:00
Dan Brown
bfbccbede1
Updated attachments to not be saved with a complete extension
...
Intended to limit impact in the event the storage path is potentially
exposed.
2021-11-01 11:32:00 +00:00
Dan Brown
4360da03d4
Ran a pass through image and attachment routes
...
Added some stronger types, formatting changes and simplifications along
the way.
2021-11-01 11:17:30 +00:00
Dan Brown
c7fea8fe08
Cleaned up logic within ImageRepo
...
- Moved out extension check to ImageService as that seems more relevant.
- Updated models to use static-style references instead of facade to align with common modern usage within the app.
- Updated custom image_extension validation rule to use shared logic in image service.
2021-11-01 00:24:42 +00:00
Dan Brown
43830a372f
Updated showImage file serving to not be traversable
...
For #3030
2021-10-31 23:53:17 +00:00
Dan Brown
ae155d6745
Added safe mime sniffing to prevent serving HTML
...
(Amoung other content types)
For #3027
2021-10-31 17:58:56 +00:00
Dan Brown
5c834f24a6
Updated AzureAD provider to use microsoft graph
...
Since AzureAD graph is going away.
Tested using old AzureAD graph usage for backwards-compatbility, did not
seem to break things. Could not test with conditional access though due
to azure never enforcing it no matter what I attempted.
Fpr #3028
2021-10-31 13:09:30 +00:00
Dan Brown
85dc8d9791
Updated sponsor link
2021-10-30 11:51:49 +01:00
Dan Brown
5fd10e695a
Added sponsors to readme, updated license file
2021-10-29 21:37:10 +01:00
Dan Brown
e7bec79f25
New Crowdin updates ( #3014 )
...
* New translations entities.php (Estonian)
* New translations entities.php (Estonian)
2021-10-28 15:55:13 +01:00
Dan Brown
4f55fe2f8e
Made further changes to page image extraction validation
...
Fixes #3019
Increased testing to cover the failing case amoung others.
2021-10-28 15:54:00 +01:00
Dan Brown
3166541002
Added test to cover #3010
2021-10-27 12:29:01 +01:00
Dan Brown
b31fbf5ba8
Merge branch 'master' of https://github.com/haxatron/BookStack into haxatron_upload_issue
2021-10-27 12:21:27 +01:00
Dan Brown
624d55a773
New Crowdin updates ( #3006 )
...
* New translations auth.php (Latvian)
* New translations errors.php (Latvian)
* New translations auth.php (Latvian)
* New translations entities.php (Latvian)
* New translations settings.php (Latvian)
* New translations settings.php (Estonian)
* New translations entities.php (Estonian)
* New translations settings.php (Estonian)
* New translations validation.php (Estonian)
* New translations entities.php (Estonian)
* New translations settings.php (Spanish, Argentina)
* New translations settings.php (Vietnamese)
* New translations settings.php (Slovenian)
* New translations settings.php (Swedish)
* New translations settings.php (Turkish)
* New translations settings.php (Ukrainian)
* New translations settings.php (Chinese Simplified)
* New translations settings.php (Chinese Traditional)
* New translations settings.php (Portuguese, Brazilian)
* New translations settings.php (Russian)
* New translations settings.php (Indonesian)
* New translations settings.php (Persian)
* New translations settings.php (Croatian)
* New translations settings.php (Latvian)
* New translations settings.php (Bosnian)
* New translations settings.php (Norwegian Bokmal)
* New translations settings.php (Slovak)
* New translations settings.php (Portuguese)
* New translations settings.php (Polish)
* New translations settings.php (Catalan)
* New translations settings.php (Estonian)
* New translations settings.php (Japanese)
* New translations settings.php (French)
* New translations settings.php (Spanish)
* New translations settings.php (Arabic)
* New translations settings.php (Bulgarian)
* New translations settings.php (Czech)
* New translations settings.php (Dutch)
* New translations settings.php (Danish)
* New translations settings.php (German)
* New translations settings.php (Hebrew)
* New translations settings.php (Hungarian)
* New translations settings.php (Italian)
* New translations settings.php (Korean)
* New translations settings.php (Lithuanian)
* New translations settings.php (German Informal)
* New translations settings.php (Polish)
* New translations settings.php (French)
* New translations settings.php (German)
* New translations settings.php (German Informal)
2021-10-27 12:17:53 +01:00
Dan Brown
42f0ba1875
Added security policy md file
2021-10-26 16:09:41 +01:00
Dan Brown
0d312e5348
Merge pull request #3008 from IndrekHaav/et-typo
...
Minor capitalisation fix for Estonian
2021-10-26 13:33:27 +01:00
Dan Brown
7b244ea012
Updated php deps
...
Also removes abandoned status of sebastian/resource-operations as per
issue #3007
2021-10-26 13:12:40 +01:00
Indrek Haav
538b5ef4eb
Minor capitalisation fix for Estonian
2021-10-26 15:09:38 +03:00
Haxatron
64937ab826
Update ImageRepo.php
...
fix image validation vulnerability
2021-10-26 09:39:16 +08:00
Dan Brown
a5401eb00a
New Crowdin updates ( #3005 )
...
* New translations settings.php (Spanish, Argentina)
* New translations settings.php (Polish)
* New translations settings.php (Estonian)
* New translations errors.php (Spanish, Argentina)
* New translations settings.php (Japanese)
* New translations activities.php (German Informal)
* New translations auth.php (German Informal)
* New translations settings.php (French)
* New translations settings.php (Spanish)
* New translations settings.php (Arabic)
* New translations settings.php (Bulgarian)
* New translations settings.php (Catalan)
* New translations settings.php (Norwegian Bokmal)
* New translations settings.php (German Informal)
* New translations settings.php (Bosnian)
* New translations settings.php (Czech)
* New translations settings.php (Slovak)
* New translations settings.php (Danish)
* New translations settings.php (German)
* New translations settings.php (Hebrew)
* New translations settings.php (Hungarian)
* New translations settings.php (Italian)
* New translations settings.php (Korean)
* New translations settings.php (Lithuanian)
* New translations settings.php (Dutch)
* New translations settings.php (Portuguese)
* New translations settings.php (Russian)
* New translations settings.php (Slovenian)
* New translations settings.php (Latvian)
* New translations settings.php (Swedish)
* New translations settings.php (Turkish)
* New translations settings.php (Ukrainian)
* New translations settings.php (Chinese Simplified)
* New translations settings.php (Chinese Traditional)
* New translations settings.php (Vietnamese)
* New translations settings.php (Portuguese, Brazilian)
* New translations settings.php (Indonesian)
* New translations settings.php (Persian)
* New translations settings.php (Croatian)
* New translations validation.php (German Informal)
2021-10-25 15:01:32 +01:00
Dan Brown
fa466139f0
Updated translators before v21.10 release
2021-10-25 14:49:21 +01:00
Dan Brown
a75cfd1f25
Added estonian to language logic
2021-10-25 14:49:03 +01:00
Dan Brown
9c2b8057ab
New Crowdin updates ( #2983 )
...
* New translations auth.php (Polish)
* New translations common.php (Polish)
* New translations entities.php (Polish)
* New translations auth.php (Polish)
* New translations common.php (Polish)
* New translations settings.php (Polish)
* New translations validation.php (Polish)
* New translations activities.php (Estonian)
* New translations auth.php (Estonian)
* New translations common.php (Estonian)
* New translations components.php (Estonian)
* New translations entities.php (Estonian)
* New translations errors.php (Estonian)
* New translations pagination.php (Estonian)
* New translations passwords.php (Estonian)
* New translations settings.php (Estonian)
* New translations validation.php (Estonian)
* New translations activities.php (Estonian)
* New translations activities.php (Estonian)
* New translations auth.php (Estonian)
* New translations common.php (Estonian)
* New translations components.php (Estonian)
* New translations entities.php (Estonian)
* New translations pagination.php (Estonian)
* New translations passwords.php (Estonian)
* New translations entities.php (Estonian)
* New translations errors.php (Estonian)
* New translations validation.php (Estonian)
* New translations settings.php (Estonian)
* New translations auth.php (Estonian)
* New translations entities.php (Estonian)
* New translations passwords.php (Estonian)
* New translations settings.php (Estonian)
* New translations auth.php (Estonian)
* New translations entities.php (Estonian)
* New translations errors.php (Estonian)
* New translations settings.php (Estonian)
* New translations settings.php (Estonian)
* New translations errors.php (German)
* New translations errors.php (Portuguese, Brazilian)
* New translations errors.php (Swedish)
* New translations errors.php (Turkish)
* New translations errors.php (Ukrainian)
* New translations errors.php (Chinese Simplified)
* New translations errors.php (Chinese Traditional)
* New translations errors.php (Vietnamese)
* New translations errors.php (Indonesian)
* New translations errors.php (Slovak)
* New translations errors.php (Persian)
* New translations errors.php (Spanish, Argentina)
* New translations errors.php (Croatian)
* New translations errors.php (Latvian)
* New translations errors.php (Bosnian)
* New translations errors.php (Norwegian Bokmal)
* New translations errors.php (Slovenian)
* New translations errors.php (Russian)
* New translations errors.php (Estonian)
* New translations errors.php (Danish)
* New translations errors.php (French)
* New translations errors.php (Spanish)
* New translations errors.php (Arabic)
* New translations errors.php (Bulgarian)
* New translations errors.php (Catalan)
* New translations errors.php (Czech)
* New translations errors.php (Hebrew)
* New translations errors.php (Portuguese)
* New translations errors.php (Hungarian)
* New translations errors.php (Italian)
* New translations errors.php (Japanese)
* New translations errors.php (Korean)
* New translations errors.php (Lithuanian)
* New translations errors.php (Dutch)
* New translations errors.php (Polish)
* New translations errors.php (German Informal)
* New translations errors.php (Spanish)
* New translations auth.php (Estonian)
* New translations entities.php (Estonian)
* New translations errors.php (Estonian)
* New translations activities.php (Japanese)
* New translations activities.php (Japanese)
* New translations auth.php (Japanese)
* New translations components.php (Japanese)
* New translations passwords.php (Japanese)
* New translations errors.php (Estonian)
* New translations settings.php (Estonian)
* New translations validation.php (Estonian)
* New translations errors.php (French)
* New translations activities.php (Japanese)
* New translations settings.php (Japanese)
* New translations entities.php (Japanese)
* New translations settings.php (Japanese)
* New translations common.php (Japanese)
* New translations settings.php (Japanese)
* New translations settings.php (Japanese)
* New translations entities.php (Japanese)
* New translations settings.php (Japanese)
* New translations settings.php (Japanese)
* New translations entities.php (Japanese)
* New translations settings.php (Japanese)
* New translations common.php (Japanese)
* New translations errors.php (Polish)
* New translations auth.php (Estonian)
* New translations components.php (Estonian)
* New translations entities.php (Estonian)
* New translations validation.php (Estonian)
* New translations errors.php (Estonian)
* New translations settings.php (Estonian)
* New translations errors.php (Chinese Simplified)
* New translations auth.php (Japanese)
* New translations auth.php (Japanese)
* New translations common.php (Japanese)
* New translations entities.php (Japanese)
* New translations errors.php (Italian)
* New translations common.php (Japanese)
* New translations auth.php (Italian)
* New translations entities.php (Italian)
* New translations entities.php (Japanese)
* New translations settings.php (Japanese)
* New translations common.php (Japanese)
* New translations entities.php (Japanese)
* New translations entities.php (Estonian)
* New translations settings.php (Estonian)
* New translations validation.php (Japanese)
* New translations errors.php (Japanese)
* New translations validation.php (Japanese)
* New translations auth.php (Japanese)
* New translations settings.php (Japanese)
* New translations activities.php (Indonesian)
* New translations auth.php (Indonesian)
* New translations validation.php (Estonian)
* New translations settings.php (Estonian)
2021-10-25 13:51:27 +01:00
Dan Brown
31ba972cfc
Tweaked sidepart list item padding, Review of #3000
...
- Scoped padding change to just entity-list-items within the sidebar
side reduction of right-hand-padding to zero was causing other
entity-list-items, such as those in the homepage listing, would then
have no padding.
- Updated styles to use css logical properties to retain support for RTL
languages such as Arabic, where the whole interface flips around.
Related: https://css-tricks.com/css-logical-properties-and-values/
2021-10-23 22:03:03 +01:00
Dan Brown
f73b82ee57
Merge branch 'fix_sidebar_css' of https://github.com/ffranchina/BookStack into ffranchina-fix_sidebar_css
2021-10-23 21:54:25 +01:00
Dan Brown
98072ba4a9
Reviewed SAML SLS changes for ADFS, #2902
...
- Migrated env usages to config.
- Removed potentially unneeded config options or auto-set signed options
based upon provision of certificate.
- Aligned SP certificate env option naming with similar IDP option.
Tested via AFDS on windows server 2019. To test on other providers.
2021-10-23 17:26:01 +01:00
Francesco Franchina
0b15e2bf1c
Fixes padding issues of the sidebar's items
2021-10-22 01:34:41 +02:00
Dan Brown
2e9ac21b38
Merge branch 'master' of https://github.com/theodor-franke/BookStack into theodor-franke-master
2021-10-21 14:04:23 +01:00
Dan Brown
129f3286d9
Applied styleci changes
2021-10-20 13:40:27 +01:00
Dan Brown
fe07cdaa06
Merge pull request #2996 from BookStackApp/saml2_acs_session
...
Updated SAML ACS post to retain user session
2021-10-20 13:38:35 +01:00
Dan Brown
cdef1b3ab0
Updated SAML ACS post to retain user session
...
Session was being lost due to the callback POST request cookies
not being provided due to samesite=lax. This instead adds an additional
hop in the flow to route the request via a GET request so the session is
retained. SAML POST data is stored encrypted in cache via a unique ID
then pulled out straight afterwards, and restored into POST for the SAML
toolkit to validate.
Updated testing to cover.
2021-10-20 13:34:00 +01:00
Dan Brown
859934d6a3
Applied latest changes from styleCI
2021-10-20 10:49:45 +01:00
Dan Brown
7bbcaa7cbc
Merge pull request #2986 from BookStackApp/attachments_api
...
Attachments API
2021-10-20 10:46:35 +01:00
Dan Brown
7e28c76e6f
Adjusted API docs table
2021-10-20 10:46:06 +01:00
Dan Brown
60d4c5902b
Added attachment API examples during manual testing
2021-10-20 10:43:03 +01:00
Dan Brown
2409d1850f
Added TestCase for attachments API methods
2021-10-20 00:58:56 +01:00
Dan Brown
c699f176bc
Fixed bug report yaml formatting
2021-10-19 15:15:35 +01:00
Dan Brown
72ad87b123
Update support_request.yml
2021-10-19 14:52:00 +01:00
Dan Brown
5d6d7ef5a7
Converted issues templates to forms
...
Added support request template
2021-10-19 14:49:49 +01:00
Dan Brown
7ad98fc3c3
Update language_request.yml
2021-10-19 14:07:45 +01:00
Dan Brown
0d6f1638fe
Delete language_request.md
2021-10-19 14:06:53 +01:00
Dan Brown
5a4b366e56
Create language_request.yml
2021-10-19 14:05:34 +01:00
Dan Brown
32f6ea946f
Build out core attachments API controller
...
Related to #2942
2021-10-18 17:46:55 +01:00
Dan Brown
1a8a6c609a
Added phpseclib to readme
2021-10-18 11:43:54 +01:00
Dan Brown
cb45c53029
Added base64 image extraction to markdown page content
...
- Included tests to cover.
- Manually tested via API update and interface page update.
Closes #2898
2021-10-18 11:42:50 +01:00
Dan Brown
6e325de226
Applied latest styles changes from style CI
2021-10-16 16:01:59 +01:00
Dan Brown
263384cf99
Merge branch 'oidc'
2021-10-16 15:51:13 +01:00
Dan Brown
5ba964b677
Updated readme with latest version info
...
Also updated version file to be current
2021-10-15 14:30:49 +01:00
Dan Brown
5647a8a091
New Crowdin updates ( #2980 )
...
* New translations entities.php (Spanish, Argentina)
* New translations activities.php (Spanish, Argentina)
* New translations auth.php (Spanish, Argentina)
* New translations settings.php (Spanish, Argentina)
* New translations validation.php (Spanish, Argentina)
* New translations auth.php (Spanish, Argentina)
2021-10-15 14:17:32 +01:00
