ep_comments_page 0.1.84 → 0.1.88

package/index.js

@@ -1,11 +1,14 @@
 'use strict';
 
+const AttributePool = require('ep_etherpad-lite/static/js/AttributePool');
+const Changeset = require('ep_etherpad-lite/static/js/Changeset');
 const eejs = require('ep_etherpad-lite/node/eejs/');
 const settings = require('ep_etherpad-lite/node/utils/Settings');
 const formidable = require('formidable');
 const commentManager = require('./commentManager');
 const apiUtils = require('./apiUtils');
 const _ = require('underscore');
+const padMessageHandler = require('ep_etherpad-lite/node/handler/PadMessageHandler');
 const readOnlyManager = require('ep_etherpad-lite/node/db/ReadOnlyManager.js');
 
 let io;
@@ -26,13 +29,31 @@ exports.padCopy = async (hookName, context) => {
   ]);
 };
 
-exports.handleMessageSecurity = (hookName, context, callback) => {
-  const {message: {data: {apool} = {}} = {}} = context;
-  if (apool && apool[0] && apool[0][0] === 'comment') {
-    // Comment change, allow it to override readonly security model!!
-    return callback(true);
+exports.handleMessageSecurity = async (hookName, {message, client: socket}) => {
+  const {type: mtype, data: {type: dtype, apool, changeset} = {}} = message;
+  if (mtype !== 'COLLABROOM') return;
+  if (dtype !== 'USER_CHANGES') return;
+  // Nothing needs to be done if the user already has write access.
+  if (!padMessageHandler.sessioninfos[socket.id].readonly) return;
+  const pool = new AttributePool().fromJsonable(apool);
+  const cs = Changeset.unpack(changeset);
+  const opIter = Changeset.opIterator(cs.ops);
+  while (opIter.hasNext()) {
+    const op = opIter.next();
+    // Only operations that manipulate the 'comment' attribute on existing text are allowed.
+    if (op.opcode !== '=') return;
+    const forbiddenAttrib = new Error();
+    try {
+      Changeset.eachAttribNumber(op.attribs, (n) => {
+        // Use an exception to break out of the iteration early.
+        if (pool.getAttribKey(n) !== 'comment') throw forbiddenAttrib;
+      });
+    } catch (err) {
+      if (err !== forbiddenAttrib) throw err;
+      return;
+    }
   }
-  return callback();
+  return true;
 };
 
 exports.socketio = (hookName, args, cb) => {

package/locales/diq.json

@@ -0,0 +1,14 @@
+{
+	"@metadata": {
+		"authors": [
+			"Mirzali"
+		]
+	},
+	"ep_comments_page.comment": "Mışewre",
+	"ep_comments_page.comments_template.comment.value": "Mışewre",
+	"ep_comments_page.comments_template.cancel.value": "Bıtexelne",
+	"ep_comments_page.comments_template.reply.value": "Cewab bıde",
+	"ep_comments_page.comments_template.reply.placeholder": "Cewab bıde",
+	"ep_comments_page.comments_template.edit_comment.save": "qeyd ke",
+	"ep_comments_page.comments_template.edit_comment.cancel": "bıtexelne"
+}

package/locales/tr.json

@@ -1,6 +1,7 @@
 {
 	"@metadata": {
 		"authors": [
+			"Can",
 			"Erdemkose",
 			"Hedda"
 		]
@@ -17,6 +18,8 @@
 	"ep_comments_page.comments_template.from": "Gönderen",
 	"ep_comments_page.comments_template.accept_change.value": "Değişikliği Kabul Et",
 	"ep_comments_page.comments_template.revert_change.value": "Değişikliği Geri Al",
+	"ep_comments_page.comments_template.suggested_change_from": "\"{{changeFrom}}\"'dan/den, {{changeTo}}'ye/ya önerilen değişiklik",
+	"ep_comments_page.comments_template.suggest_change_from": "\"{{changeFrom}}\"'den/dan şuraya önerilen değişiklik",
 	"ep_comments_page.comments_template.to": "Alıcı",
 	"ep_comments_page.comments_template.include_suggestion": "Önerilen değişikliği dahil et",
 	"ep_comments_page.comments_template.comment.value": "Yorum",

package/package.json

@@ -1,7 +1,7 @@
 {
   "description": "Adds comments on sidebar and link it to the text.  For no-skin use ep_page_view.",
   "name": "ep_comments_page",
-  "version": "0.1.84",
+  "version": "0.1.88",
   "author": {
     "name": "Nicolas Lescop",
     "email": "limplementeur@gmail.com"

package/static/tests/backend/specs/readOnlyPad.js

@@ -0,0 +1,134 @@
+'use strict';
+
+const AttributePool = require('ep_etherpad-lite/static/js/AttributePool');
+const Changeset = require('ep_etherpad-lite/static/js/Changeset');
+const assert = require('assert').strict;
+const common = require('ep_etherpad-lite/tests/backend/common');
+const padManager = require('ep_etherpad-lite/node/db/PadManager');
+const readOnlyManager = require('ep_etherpad-lite/node/db/ReadOnlyManager');
+const shared = require('../../../js/shared.js');
+
+describe(__filename, function () {
+  let agent;
+  let pad;
+  let padId;
+  let roPadId;
+  let socket;
+
+  const makeUserChanges = (opcode, attribs) => {
+    const oldLen = pad.text().length;
+    assert(oldLen > 0);
+    const apool = new AttributePool();
+    const op = Changeset.newOp(opcode);
+    op.chars = 1;
+    op.attribs = Changeset.makeAttribsString(opcode, attribs, apool);
+    const assem = Changeset.smartOpAssembler();
+    assem.append(op);
+    const cs = assem.toString();
+    const newLen = oldLen + assem.getLengthChange();
+    const changeset = Changeset.pack(oldLen, newLen, cs, opcode === '+' ? 'x' : '');
+    return {baseRev: pad.head, changeset, apool: apool.toJsonable()};
+  };
+
+  before(async function () {
+    agent = await common.init();
+  });
+
+  beforeEach(async function () {
+    padId = `testpad${common.randomString()}`;
+    assert(!await padManager.doesPadExist(padId));
+    pad = await padManager.getPad(padId, 'text');
+    assert(pad.text().startsWith('text'));
+    roPadId = await readOnlyManager.getReadOnlyId(padId);
+    const res = await agent.get(`/p/${roPadId}`).expect(200);
+    socket = await common.connect(res);
+    const {type, data: clientVars} = await common.handshake(socket, roPadId);
+    assert.equal(type, 'CLIENT_VARS');
+    assert(clientVars.readonly);
+    assert.equal(clientVars.readOnlyId, roPadId);
+  });
+
+  afterEach(async function () {
+    if (socket != null) socket.close();
+    socket = null;
+    if (pad != null) await pad.remove();
+    pad = null;
+  });
+
+  describe('comment-only changes are accepted', function () {
+    it('add/change comment attribute', async function () {
+      await Promise.all([
+        common.waitForAcceptCommit(socket, pad.head + 1),
+        common.sendUserChanges(
+            socket, makeUserChanges('=', [['comment', shared.generateCommentId()]])),
+      ]);
+    });
+
+    it('remove comment attribute', async function () {
+      await Promise.all([
+        common.waitForAcceptCommit(socket, pad.head + 1),
+        common.sendUserChanges(
+            socket, makeUserChanges('=', [['comment', shared.generateCommentId()]])),
+      ]);
+      await Promise.all([
+        common.waitForAcceptCommit(socket, pad.head + 1),
+        common.sendUserChanges(socket, makeUserChanges('=', [['comment', '']])),
+      ]);
+    });
+  });
+
+  describe('other changes are rejected', function () {
+    const testCases = [
+      {
+        desc: 'keep with non-comment attrib add/change',
+        opcode: '=',
+        attribs: [['bold', 'true']],
+      },
+      {
+        desc: 'keep with non-comment attrib removal',
+        opcode: '=',
+        attribs: [['bold', '']],
+      },
+      {
+        desc: 'keep with comment and non-comment attrib adds/changes',
+        opcode: '=',
+        attribs: [['comment', shared.generateCommentId()], ['bold', 'true']],
+      },
+      {
+        desc: 'insert with no attribs',
+        opcode: '+',
+        attribs: [],
+      },
+      {
+        desc: 'insert with comment attrib',
+        opcode: '+',
+        attribs: [['comment', shared.generateCommentId()]],
+      },
+      {
+        desc: 'insert with non-comment attrib',
+        opcode: '+',
+        attribs: [['bold', 'true']],
+      },
+      {
+        desc: 'insert with comment and non-comment attribs',
+        opcode: '+',
+        attribs: [['comment', shared.generateCommentId()], ['bold', 'true']],
+      },
+      {
+        desc: 'remove',
+        opcode: '-',
+        attribs: [],
+      },
+    ];
+
+    for (const {desc, opcode, attribs} of testCases) {
+      it(desc, async function () {
+        const head = pad.head;
+        await common.sendUserChanges(socket, makeUserChanges(opcode, attribs));
+        // common.sendUserChanges() waits for message ack, so if the message was accepted then head
+        // should have already incremented by the time we get here.
+        assert.equal(pad.head, head);
+      });
+    }
+  });
+});