Commit Graph

616 Commits

Author SHA1 Message Date
BoHong Li ab1a3b663e
chore: upgrade spin.js to 4.0.0
Signed-off-by: BoHong Li <raccoon@hackmd.io>
2019-08-04 23:56:24 +08:00
Max Wu 0c4d0a05e0 feat: add plantuml to support charts textcomplete list
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2019-08-03 21:23:28 +08:00
Yukai Huang 6f7de25079
Make details element syncscrollable
Signed-off-by: Yukai Huang <yukaihuangtw@gmail.com>
2019-08-03 19:20:44 +08:00
Yukai Huang 8d889a6736
Support "spoiler" container syntax
Signed-off-by: Yukai Huang <yukaihuangtw@gmail.com>
2019-08-03 14:43:16 +08:00
Chulki Lee 5ce981859e Render plantuml only in fence
Signed-off-by: Chulki Lee <chulki.lee@gmail.com>
2019-07-31 10:02:07 -07:00
Chulki Lee 1d7895c869 Add plantuml support
Signed-off-by: Chulki Lee <chulki.lee@gmail.com>
2019-07-31 10:02:07 -07:00
BoHong Li c628737411
Merge branch 'develop' into refactor-realtime
Signed-off-by: BoHong Li <raccoon@hackmd.io>

# Conflicts:
#	README.md
#	package.json
2019-07-30 18:20:09 +08:00
Max Wu dd267096c9 fix: use lodash escapeHTML
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2019-07-28 20:04:41 +08:00
Max Wu a7082633aa Upgrade mermaid to 8.2.3
to avoid XSS inside the svg tag

Signed-off-by: Max Wu <jackymaxj@gmail.com>
2019-07-28 20:04:41 +08:00
Yukai Huang f3a3c14aca
Merge branch 'develop' into feature/slides-spotlight 2019-06-27 17:37:16 +08:00
Yukai Huang e315127d31
Merge branch 'master' into feature/slides-timer 2019-06-26 11:39:22 +08:00
Yukai Huang d5a5ebc4d0
Merge branch 'master' into feature/slides-spotlight 2019-06-26 11:39:19 +08:00
BoHong Li a6036cb70b
refactor: back to use js-standard
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-05-27 17:53:08 +08:00
Max Wu fbb18b6e0a Fix stored XSS in the graphviz error message rendering [Security Issue]
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2019-04-14 12:12:02 -04:00
BoHong Li b0dee3ee14
refactor: fix lint warning on public/js/lib/common/login.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:45 +08:00
BoHong Li bf727b5878
refactor: fix lint warning on public/js/lib/editor/utils.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:25 +08:00
BoHong Li 45ba0c646d
refactor: fix lint warning on public/js/syncscroll.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:25 +08:00
BoHong Li e564c40b4d
refactor: fix lint warning on public/js/cover.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:25 +08:00
BoHong Li d387cac690
refactor: fix lint warning on public/js/extra.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:25 +08:00
BoHong Li 0498dc70e8
refactor: fix lint warning on public/js/history.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:24 +08:00
BoHong Li 573501389a
refactor: fix lint warning on public/js/index.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:24 +08:00
BoHong Li a40a8bfc02
refactor: fix lint warning on public/js/pretty.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:24 +08:00
BoHong Li 33fcfd416d
refactor: fix lint warning on public/js/render.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:23 +08:00
BoHong Li 73bc7ae8e6
refactor: fix lint warning on public/js/slide.js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:23 +08:00
BoHong Li 4ae1c0ab3e
refactor: replace lz-string with @hackmd/lz-string
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:22 +08:00
BoHong Li 67707d097f
fix: remove string.js for sucurity issue
1. Upgrade Imgur to fix npm install
2. Upgrade less version for security
3. Change package name in package.json to fit npm package.json rule

Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:22 +08:00
BoHong Li 56d86ee25e
fix: lint error
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-12 18:00:21 +08:00
BoHong Li f915957a4f
refactor: replace js-url with wurl (original version of js-url)
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-11 19:35:12 +08:00
BoHong Li 628e679916
refactor: replace Idle.js to @hackmd/idle-js
Signed-off-by: BoHong Li <a60814billy@gmail.com>
2019-04-11 18:30:20 +08:00
PastLeo 9696e60248
add reveal.js-elapsed-time-bar
Signed-off-by: PastLeo <chgu82837@gmail.com>
2019-04-05 15:53:23 +08:00
PastLeo 5621d45bf9
add spotlight dep for slides mode
Signed-off-by: PastLeo <chgu82837@gmail.com>
2019-04-05 15:17:48 +08:00
Sheogorath 982775f6dc
Fix broken HTML export with emojis
HTML export was broken due to missing alt-attribute for emojis.

This patch adds the old alt-element style and restores the exportability
this way.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-03-09 15:04:07 +01:00
Sheogorath 1f0fb12755
Fix CI errors for unused variables
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-02-21 01:36:39 +01:00
Sheogorath c5ca7b634a
Remove broken speakerdeck embedding
The current speakerdeck implementation is broken. An alternative
implementation using oembed doesn't work due to CORS, which could be
solved by proxying the speakerdeck API, but we decided to not do this.

This patch provides the link to the speakerdeck presentation instead,
and this way doesn't break existing notes. This is right now the best
solution we could come up with.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2019-02-21 01:26:37 +01:00
Max Wu 067cfe2d1e Fix to escape html comment tag [Security Issue]
Signed-off-by: Max Wu <jackymaxj@gmail.com>
2018-12-28 16:42:55 +08:00
Sheogorath 33774c11b9
Update from to-markdown to turndown
We got a security alert for a regular expression DoS attack on our used
library `to-markdown`.

After checking `to-markdown` to be maintained or not, it turned out they
renamed the library to `turndown`. So upgrading to `turndown` should fix
this vulnerbility.

References:
https://www.npmjs.com/package/to-markdown
https://github.com/domchristie/turndown/wiki/Migrating-from-to-markdown-to-Turndown
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-21 11:12:09 +01:00
Christoph (Sheogorath) Kern 271dff3808
Merge pull request #1043 from SISheogorath/fix/tocEmptyHead
Fix ToC breaking documents with empty h* elements
2018-11-19 21:33:34 +01:00
Sheogorath d6dd33620c
Fix wrong anchors
While experimenting with the ToC changes, it became obvious that anchors
for those unnamed headers don't work.

This patch fixes those links by running the autolinkify twice and make
sure linkify only adds links to non-empty ids.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-19 20:20:56 +01:00
Claudius Coenen 858a59529e switching to eslint for code checking
most rules degraded to WARN, so we don't go insane. This will
change over time. The aim is to conform to a common style

Signed-off-by: Claudius Coenen <opensource@amenthes.de>
2018-11-14 23:15:36 +01:00
Sheogorath c59b94a37b
Remove the xss library from webpack
We can load the xss functions directly from the library instead of
loading them through the expose loader of webpack, this should simplify
the setup and maybe even improve speed a bit.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-11-10 20:27:07 +01:00
Sheogorath d188b3526a
Again: Replace emoji-plugin regex
The Regex introduced in the last commit[1], was already working quite
good. But still resulted in false positives for all URL that contained a
second `:`.

To fix this once and for all, we craft a simple, but long regex based on
all emoji names and use this to match them.

We could probably optimize it, but that should also be something the
regex engine itself can and should do.

[1]: 7e45533c75 (in this source tree)

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-10-31 15:33:45 +01:00
Sheogorath 7e45533c75
Fix emoji regex
The old regex, adapted from the other plugins, was a bit too open for
matching. This leads to matching something like: `This is a sentence:
[And something with a: in it.]()` which doesn't become a link anymore.
Because the match is: ` [And something with a`.

This patch provides a fix for the regex to only match non-space string
within the `:`'s.

References:
- Introducing commit:
2063eb8bdf
- Inspirational source of the original RegEx:
2063eb8bdf/public/js/extra.js (L1095)

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-10-29 20:37:47 +01:00
Christoph (Sheogorath) Kern e115423d12
Merge pull request #1006 from SISheogorath/fix/missingEmojis
Fix not rendered autocomplete emojis
2018-10-22 23:02:33 +02:00
Christoph (Sheogorath) Kern 1abf7c54ae
Merge pull request #1004 from SISheogorath/feature/integrateHljs
Add autocomplete for highlight.js languages into codemirror
2018-10-11 17:30:03 +02:00
Sheogorath 1d452a6ed4
Remove dead package octicon
Octicon no longer provides its CSS classes and this way is useless in
CodiMD. Replacing all used classes in the UI and remove it from build
system.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-10-10 23:42:41 +02:00
Sheogorath 2063eb8bdf
Fix not rendered autocomplete emojis
Currently we have some emojis that are autocompleted but won't show up
in the resulting document.

This patch adds all emojis that are pushed to Codemirror and applies
them to the markdown rendering process, so they become usable.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-10-10 21:24:33 +02:00
Sheogorath 1a9df22680
Add autocomplete for highlight.js languages into codemirror
Right now we support code highlighting for rust, but it doesn't appear
in autocomplete of codemirror, because codemirror is not aware of it.

This patch lets highlightjs simply tell codemirror, what it supports and
adds this to the autocomplete list.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-10-10 11:13:52 +02:00
Cédric Couralet 702f52f07c Fix #986 : Visibility is now transmitted with gitlab V4 api
Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
2018-10-09 06:46:25 +00:00
Sheogorath 75a23fe2c9
Add rel="noopener" to target="_blank" links
The noopener construct protects from some nasty clickjacking attacks. We
can apply them savely to all our links since we don't rely on the
previously used page.

Some more details: https://mathiasbynens.github.io/rel-noopener/

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2018-10-04 01:49:36 +02:00
Cédric Couralet 66d374b128 Add possibility to choose between version v3 or v4 for the gitlab api.
Apart from the uri versioning, one big change is the snippet visibility post data (visibility_level -> visibility)

Default gitlab api version to v4

Signed-off-by: Cédric Couralet <cedric.couralet@gmail.com>
2018-07-31 08:36:56 +00:00