ArthurHoaro [Tue, 6 Oct 2020 15:30:18 +0000 (17:30 +0200)]
Security: fix multiple XSS vulnerabilities + fix search tags with special chars
XSS vulnerabilities fixed in editlink, linklist, tag.cloud and tag.list.
Also fixed tag search with special characters: urlencode function needs to be applied on raw data, before espaping, otherwise the rendered URL is wrong.
Makefile: remove static_analysis_summary from all: target
static_analysis_summary was removed in 37c9c6b#diff-b67911656ef5d18c4ae36cb6741b7965 but not from the all: target dependencies. Therefore running make all always fails.
fixes https://github.com/shaarli/Shaarli/issues/1459
Mostly in order to get rid of deprecated deps, and upgrade vulnerable ones.
- Upgrade webpack from 3.x to 4.x
- Moved babel package to main repo
- Replaced deprecated extract-text-webpack-plugin with extract-text-webpack-plugin
- Replaced deprecated babel-minify-webpack-plugin with terser-webpack-plugin
- Replaced deprecated node-sass with (dart) sass package
- Replaced deprecated sass-lint with stylelint (the rules might be a bit different
Related to #1531: trivy doesn't raise any more issue
nodiscc [Sat, 15 Aug 2020 17:39:28 +0000 (19:39 +0200)]
doc: server configuration: remove apache logging options
see https://github.com/nodiscc/xsrv/blob/master/roles/apache/templates/etc_apache2_conf-available_logging.conf.j2 for an example server-wide logging configuration
nodiscc [Mon, 18 May 2020 19:07:32 +0000 (21:07 +0200)]
apache: fix let's encrypt configuration , copy it directly from reference file
including options-ssl-apache.conf requires python3-certbot-apache which pulls a lot of dependencies
- standardize page names, rework documentation structure, update TOC
- use same example paths everywhere
- level 1 titles on all pages
- fix broken links
- .md suffix on all page links (works both from readthedocs and github repository views)
**Server:**
A full and concise installation guide with examples is a frequent request. The documentation should provide such a guide for basic installation needs, while explaining alternative/advanced configuration at the end. Links to reference guides and documentation should be used more frequently to avoid recommending an outdated or excessively complex configuration.
- server: move most server-related info to server-configuration.md, cleanup/shorten
- server: update list of php dependencies/libraries, link to composer.json
- server: installation: support 3 install methods (from release zip, from sources, using docker)
- server: installation: use rsync instead of mv as mv results will change depending of taget directory already existing or not
- server: add example/basic usage of certbot
- server, upgrade, installation: update file permissions setup, use sudo for upgrade operations in webserver document root
- server: apache: add comments to configuration, fix and factorize file permissions setup, set cache-control header, deny access to dotfiles, add missing apache config steps, add http->https redirect example
- server: nginx: refactor nginx configuration, add comments, DO log access to denied/protected files
- server: add links to MDN for x-forwarded-* http headers explanation, cleanup/clarify robots.txt and crawlers section
- server: bump file upload size limit to 100MB we have reports of bookmark exports weighing +40MB - i have a 13MB one here
- server: simplify phpinfo documentation
- server: move backup and restore information to dedicated page
- docker: move all docker docs to Docker.md, simplify/ docker setup, add docker-compose.yml example, replace docker-101 with docker cheatsheet
- troubleshooting: move all troubleshooting documentation to troubleshooting.md
**Usage:**
- index: add getting started section on index page
- features/usage: move all usage-related documentation to usage.md, add links from the main feature list to corresponding usage docs, clarify/reword features list
- shaarli configuration: add note about configuring from web interface
- development: move development-related docs (static analysis, CI, unit tests, 3rd party libs, link structure/directory, guidelines, security....) to dev/ directory
- development: Merge several pages to development.md
- **Breaking change?:** remove mentions of 'stable' branch, switch to new branch/release model (master=latest commit, release=latest tag)
- **Breaking change?:** refer to base sharing unit as "Shaare" everywhere (TODO: reflect changes in the code?) doc: update featues list/link to usage.md for details
- development: directory structure: add note about required file permissions
- .travis-ci.yml: add comments
- .htaccess: add comment
projects / github / shaarli / Shaarli.git / log
