ep_comments_page 0.1.81 → 0.1.85

package/index.js

@@ -1,11 +1,14 @@
 'use strict';
 
+const AttributePool = require('ep_etherpad-lite/static/js/AttributePool');
+const Changeset = require('ep_etherpad-lite/static/js/Changeset');
 const eejs = require('ep_etherpad-lite/node/eejs/');
 const settings = require('ep_etherpad-lite/node/utils/Settings');
 const formidable = require('formidable');
 const commentManager = require('./commentManager');
 const apiUtils = require('./apiUtils');
 const _ = require('underscore');
+const padMessageHandler = require('ep_etherpad-lite/node/handler/PadMessageHandler');
 const readOnlyManager = require('ep_etherpad-lite/node/db/ReadOnlyManager.js');
 
 let io;
@@ -26,13 +29,31 @@ exports.padCopy = async (hookName, context) => {
   ]);
 };
 
-exports.handleMessageSecurity = (hookName, context, callback) => {
-  const {message: {data: {apool} = {}} = {}} = context;
-  if (apool && apool[0] && apool[0][0] === 'comment') {
-    // Comment change, allow it to override readonly security model!!
-    return callback(true);
+exports.handleMessageSecurity = async (hookName, {message, client: socket}) => {
+  const {type: mtype, data: {type: dtype, apool, changeset} = {}} = message;
+  if (mtype !== 'COLLABROOM') return;
+  if (dtype !== 'USER_CHANGES') return;
+  // Nothing needs to be done if the user already has write access.
+  if (!padMessageHandler.sessioninfos[socket.id].readonly) return;
+  const pool = new AttributePool().fromJsonable(apool);
+  const cs = Changeset.unpack(changeset);
+  const opIter = Changeset.opIterator(cs.ops);
+  while (opIter.hasNext()) {
+    const op = opIter.next();
+    // Only operations that manipulate the 'comment' attribute on existing text are allowed.
+    if (op.opcode !== '=') return;
+    const forbiddenAttrib = new Error();
+    try {
+      Changeset.eachAttribNumber(op.attribs, (n) => {
+        // Use an exception to break out of the iteration early.
+        if (pool.getAttribKey(n) !== 'comment') throw forbiddenAttrib;
+      });
+    } catch (err) {
+      if (err !== forbiddenAttrib) throw err;
+      return;
+    }
   }
-  return callback();
+  return true;
 };
 
 exports.socketio = (hookName, args, cb) => {

package/locales/oc.json

@@ -0,0 +1,15 @@
+{
+	"@metadata": {
+		"authors": [
+			"Quentí"
+		]
+	},
+	"ep_comments_page.comment": "Comentari",
+	"ep_comments_page.comments": "Comentaris",
+	"ep_comments_page.add_comment.title": "Apondre un comentari novèl sus la seleccion",
+	"ep_comments_page.comments_template.accept_change.value": "Acceptar la modificacion",
+	"ep_comments_page.comments_template.cancel.value": "Anullar",
+	"ep_comments_page.comments_template.reply.value": "Respondre",
+	"ep_comments_page.comments_template.edit_comment.save": "enregistrar",
+	"ep_comments_page.comments_template.edit_comment.cancel": "anullar"
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "description": "Adds comments on sidebar and link it to the text.  For no-skin use ep_page_view.",
   "name": "ep_comments_page",
-  "version": "0.1.81",
+  "version": "0.1.85",
   "author": {
     "name": "Nicolas Lescop",
     "email": "limplementeur@gmail.com"
@@ -27,15 +27,15 @@
     "underscore": "^1.13.1"
   },
   "devDependencies": {
-    "eslint": "^7.18.0",
-    "eslint-config-etherpad": "^2.0.0",
-    "eslint-plugin-cypress": "^2.11.3",
+    "eslint": "^7.32.0",
+    "eslint-config-etherpad": "^2.0.2",
+    "eslint-plugin-cypress": "^2.12.1",
     "eslint-plugin-eslint-comments": "^3.2.0",
     "eslint-plugin-mocha": "^9.0.0",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-prefer-arrow": "^1.2.3",
-    "eslint-plugin-promise": "^5.1.0",
-    "eslint-plugin-you-dont-need-lodash-underscore": "^6.10.0",
+    "eslint-plugin-promise": "^5.1.1",
+    "eslint-plugin-you-dont-need-lodash-underscore": "^6.12.0",
     "socket.io-client": "^2.3.0",
     "superagent": "^6.1.0"
   },
@@ -48,10 +48,11 @@
     ]
   },
   "scripts": {
-    "lint": "eslint ."
+    "lint": "eslint .",
+    "lint:fix": "eslint --fix ."
   },
   "engines": {
-    "node": ">=10.13.0"
+    "node": ">=12.13.0"
   },
   "peerDependencies": {
     "ep_etherpad-lite": ">=1.8.6"
@@ -62,6 +63,6 @@
   },
   "funding": {
     "type": "individual",
-    "url": "http://etherpad.org/"
+    "url": "https://etherpad.org/"
   }
 }

package/static/js/commentBoxes.js

@@ -11,13 +11,6 @@ const getCommentsContainer = () => getPadOuter().find('#comments');
 
 /* ***** Public methods: ***** */
 
-const showComment = (commentId, e) => {
-  const commentElm = getCommentsContainer().find(`#${commentId}`);
-  commentElm.show();
-
-  highlightComment(commentId, e);
-};
-
 const hideComment = (commentId, hideCommentTitle) => {
   const commentElm = getCommentsContainer().find(`#${commentId}`);
   commentElm.removeClass('full-display');
@@ -122,7 +115,6 @@ const shouldNotCloseComment = (e) => {
   return false;
 };
 
-exports.showComment = showComment;
 exports.hideComment = hideComment;
 exports.hideAllComments = hideAllComments;
 exports.highlightComment = highlightComment;

package/static/tests/backend/specs/readOnlyPad.js

@@ -0,0 +1,134 @@
+'use strict';
+
+const AttributePool = require('ep_etherpad-lite/static/js/AttributePool');
+const Changeset = require('ep_etherpad-lite/static/js/Changeset');
+const assert = require('assert').strict;
+const common = require('ep_etherpad-lite/tests/backend/common');
+const padManager = require('ep_etherpad-lite/node/db/PadManager');
+const readOnlyManager = require('ep_etherpad-lite/node/db/ReadOnlyManager');
+const shared = require('../../../js/shared.js');
+
+describe(__filename, function () {
+  let agent;
+  let pad;
+  let padId;
+  let roPadId;
+  let socket;
+
+  const makeUserChanges = (opcode, attribs) => {
+    const oldLen = pad.text().length;
+    assert(oldLen > 0);
+    const apool = new AttributePool();
+    const op = Changeset.newOp(opcode);
+    op.chars = 1;
+    op.attribs = Changeset.makeAttribsString(opcode, attribs, apool);
+    const assem = Changeset.smartOpAssembler();
+    assem.append(op);
+    const cs = assem.toString();
+    const newLen = oldLen + assem.getLengthChange();
+    const changeset = Changeset.pack(oldLen, newLen, cs, opcode === '+' ? 'x' : '');
+    return {baseRev: pad.head, changeset, apool: apool.toJsonable()};
+  };
+
+  before(async function () {
+    agent = await common.init();
+  });
+
+  beforeEach(async function () {
+    padId = `testpad${common.randomString()}`;
+    assert(!await padManager.doesPadExist(padId));
+    pad = await padManager.getPad(padId, 'text');
+    assert(pad.text().startsWith('text'));
+    roPadId = await readOnlyManager.getReadOnlyId(padId);
+    const res = await agent.get(`/p/${roPadId}`).expect(200);
+    socket = await common.connect(res);
+    const {type, data: clientVars} = await common.handshake(socket, roPadId);
+    assert.equal(type, 'CLIENT_VARS');
+    assert(clientVars.readonly);
+    assert.equal(clientVars.readOnlyId, roPadId);
+  });
+
+  afterEach(async function () {
+    if (socket != null) socket.close();
+    socket = null;
+    if (pad != null) await pad.remove();
+    pad = null;
+  });
+
+  describe('comment-only changes are accepted', function () {
+    it('add/change comment attribute', async function () {
+      await Promise.all([
+        common.waitForAcceptCommit(socket, pad.head + 1),
+        common.sendUserChanges(
+            socket, makeUserChanges('=', [['comment', shared.generateCommentId()]])),
+      ]);
+    });
+
+    it('remove comment attribute', async function () {
+      await Promise.all([
+        common.waitForAcceptCommit(socket, pad.head + 1),
+        common.sendUserChanges(
+            socket, makeUserChanges('=', [['comment', shared.generateCommentId()]])),
+      ]);
+      await Promise.all([
+        common.waitForAcceptCommit(socket, pad.head + 1),
+        common.sendUserChanges(socket, makeUserChanges('=', [['comment', '']])),
+      ]);
+    });
+  });
+
+  describe('other changes are rejected', function () {
+    const testCases = [
+      {
+        desc: 'keep with non-comment attrib add/change',
+        opcode: '=',
+        attribs: [['bold', 'true']],
+      },
+      {
+        desc: 'keep with non-comment attrib removal',
+        opcode: '=',
+        attribs: [['bold', '']],
+      },
+      {
+        desc: 'keep with comment and non-comment attrib adds/changes',
+        opcode: '=',
+        attribs: [['comment', shared.generateCommentId()], ['bold', 'true']],
+      },
+      {
+        desc: 'insert with no attribs',
+        opcode: '+',
+        attribs: [],
+      },
+      {
+        desc: 'insert with comment attrib',
+        opcode: '+',
+        attribs: [['comment', shared.generateCommentId()]],
+      },
+      {
+        desc: 'insert with non-comment attrib',
+        opcode: '+',
+        attribs: [['bold', 'true']],
+      },
+      {
+        desc: 'insert with comment and non-comment attribs',
+        opcode: '+',
+        attribs: [['comment', shared.generateCommentId()], ['bold', 'true']],
+      },
+      {
+        desc: 'remove',
+        opcode: '-',
+        attribs: [],
+      },
+    ];
+
+    for (const {desc, opcode, attribs} of testCases) {
+      it(desc, async function () {
+        const head = pad.head;
+        await common.sendUserChanges(socket, makeUserChanges(opcode, attribs));
+        // common.sendUserChanges() waits for message ack, so if the message was accepted then head
+        // should have already incremented by the time we get here.
+        assert.equal(pad.head, head);
+      });
+    }
+  });
+});