From c11f795c1d9ae50fcef4d70cbfc7f27d4fb8735d Mon Sep 17 00:00:00 2001 From: Dan Brown Date: Wed, 26 Jan 2022 20:45:14 +0000 Subject: [PATCH 01/11] Added cloudabove sponsor logo --- readme.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/readme.md b/readme.md index de5da04d9..e555b952a 100644 --- a/readme.md +++ b/readme.md @@ -34,11 +34,14 @@ Big thanks to these companies for supporting the project. Note: Listed services are not tested, vetted nor supported by the official BookStack project in any manner. [View all sponsors](https://github.com/sponsors/ssddanbrown). -#### Silver Sponsor +#### Silver Sponsors +
- Diagrams.net + Diagrams.net + + Cloudabove
From 73eac83afe585fe4777b8dfeb193188d6c59a6b0 Mon Sep 17 00:00:00 2001 From: Dan Brown Date: Fri, 28 Jan 2022 14:00:55 +0000 Subject: [PATCH 02/11] Fixed OIDC JWT key parsing in microsoft environments Made existence of 'alg' optional when JWK array set so we instead infer it as RSA256 if not existing. Fixes #3206 --- app/Auth/Access/Oidc/OidcJwtSigningKey.php | 7 ++++-- app/Auth/Access/Oidc/OidcProviderSettings.php | 3 ++- tests/Auth/OidcTest.php | 25 +++++++++++++++++++ 3 files changed, 32 insertions(+), 3 deletions(-) diff --git a/app/Auth/Access/Oidc/OidcJwtSigningKey.php b/app/Auth/Access/Oidc/OidcJwtSigningKey.php index a70f3b3c7..012a6cbf9 100644 --- a/app/Auth/Access/Oidc/OidcJwtSigningKey.php +++ b/app/Auth/Access/Oidc/OidcJwtSigningKey.php @@ -60,8 +60,11 @@ class OidcJwtSigningKey */ protected function loadFromJwkArray(array $jwk) { - if ($jwk['alg'] !== 'RS256') { - throw new OidcInvalidKeyException("Only RS256 keys are currently supported. Found key using {$jwk['alg']}"); + // 'alg' is optional for a JWK, but we will still attempt to validate if + // it exists otherwise presume it will be compatible. + $alg = $jwk['alg'] ?? null; + if ($jwk['kty'] !== 'RSA' || !(is_null($alg) || $alg === 'RS256')) { + throw new OidcInvalidKeyException("Only RS256 keys are currently supported. Found key using {$alg}"); } if (empty($jwk['use'])) { diff --git a/app/Auth/Access/Oidc/OidcProviderSettings.php b/app/Auth/Access/Oidc/OidcProviderSettings.php index 32946d058..016d006d2 100644 --- a/app/Auth/Access/Oidc/OidcProviderSettings.php +++ b/app/Auth/Access/Oidc/OidcProviderSettings.php @@ -164,7 +164,8 @@ class OidcProviderSettings protected function filterKeys(array $keys): array { return array_filter($keys, function (array $key) { - return $key['kty'] === 'RSA' && $key['use'] === 'sig' && $key['alg'] === 'RS256'; + $alg = $key['alg'] ?? null; + return $key['kty'] === 'RSA' && $key['use'] === 'sig' && (is_null($alg) || $alg === 'RS256'); }); } diff --git a/tests/Auth/OidcTest.php b/tests/Auth/OidcTest.php index 0b033ea81..9fa4d0012 100644 --- a/tests/Auth/OidcTest.php +++ b/tests/Auth/OidcTest.php @@ -318,6 +318,31 @@ class OidcTest extends TestCase $this->assertCount(4, $transactions); } + public function test_auth_login_with_autodiscovery_with_keys_that_do_not_have_alg_property() + { + $this->withAutodiscovery(); + + $keyArray = OidcJwtHelper::publicJwkKeyArray(); + unset($keyArray['alg']); + + $this->mockHttpClient([ + $this->getAutoDiscoveryResponse(), + new Response(200, [ + 'Content-Type' => 'application/json', + 'Cache-Control' => 'no-cache, no-store', + 'Pragma' => 'no-cache', + ], json_encode([ + 'keys' => [ + $keyArray, + ], + ])), + ]); + + $this->assertFalse(auth()->check()); + $this->runLogin(); + $this->assertTrue(auth()->check()); + } + protected function withAutodiscovery() { config()->set([ From 99202b3bb80a4b835de2e88b518d0dab1a8290b3 Mon Sep 17 00:00:00 2001 From: julesdevops Date: Sat, 29 Jan 2022 10:56:13 +0100 Subject: [PATCH 03/11] fix(503): massively simplify the 503 error view This view was relying on too much app logic, which could lead to errors when rendering it. --- resources/views/errors/503.blade.php | 33 +++++++++++++++++++++------- 1 file changed, 25 insertions(+), 8 deletions(-) diff --git a/resources/views/errors/503.blade.php b/resources/views/errors/503.blade.php index 9f86bfdc6..acf588f4a 100644 --- a/resources/views/errors/503.blade.php +++ b/resources/views/errors/503.blade.php @@ -1,12 +1,29 @@ -@extends('layouts.simple') + + + + {{ isset($pageTitle) ? $pageTitle . ' | ' : '' }}{{ setting('app-name') }} -@section('content') + + + -
-
-

{{ trans('errors.app_down', ['appName' => setting('app-name')]) }}

-

{{ trans('errors.back_soon') }}

+ + + + + + @include('common.custom-styles') + @include('common.custom-head') + + +
+
+
+

{{ trans('errors.app_down', ['appName' => setting('app-name')]) }}

+

{{ trans('errors.back_soon') }}

+
- -@stop \ No newline at end of file + + From e17cdab4208a735835233fd50beceda51e28f2fa Mon Sep 17 00:00:00 2001 From: Dan Brown Date: Sun, 30 Jan 2022 16:33:03 +0000 Subject: [PATCH 04/11] Updated default branch name references --- .github/workflows/phpstan.yml | 4 ++-- .github/workflows/phpunit.yml | 4 ++-- .github/workflows/test-migrations.yml | 4 ++-- readme.md | 12 ++++++------ 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml index c7f3179d0..c3a24fda9 100644 --- a/.github/workflows/phpstan.yml +++ b/.github/workflows/phpstan.yml @@ -3,10 +3,10 @@ name: phpstan on: push: branches-ignore: - - l10n_master + - l10n_development pull_request: branches-ignore: - - l10n_master + - l10n_development jobs: build: diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml index c4be516f3..ea7281198 100644 --- a/.github/workflows/phpunit.yml +++ b/.github/workflows/phpunit.yml @@ -3,10 +3,10 @@ name: phpunit on: push: branches-ignore: - - l10n_master + - l10n_development pull_request: branches-ignore: - - l10n_master + - l10n_development jobs: build: diff --git a/.github/workflows/test-migrations.yml b/.github/workflows/test-migrations.yml index 4c16cf016..7195f75ce 100644 --- a/.github/workflows/test-migrations.yml +++ b/.github/workflows/test-migrations.yml @@ -3,10 +3,10 @@ name: test-migrations on: push: branches-ignore: - - l10n_master + - l10n_development pull_request: branches-ignore: - - l10n_master + - l10n_development jobs: build: diff --git a/readme.md b/readme.md index e555b952a..a1a4501ef 100644 --- a/readme.md +++ b/readme.md @@ -1,7 +1,7 @@ # BookStack [![GitHub release](https://img.shields.io/github/release/BookStackApp/BookStack.svg)](https://github.com/BookStackApp/BookStack/releases/latest) -[![license](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/BookStackApp/BookStack/blob/master/LICENSE) +[![license](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/BookStackApp/BookStack/blob/development/LICENSE) [![Crowdin](https://badges.crowdin.net/bookstack/localized.svg)](https://crowdin.com/project/bookstack) [![Discord](https://img.shields.io/static/v1?label=chat&message=discord&color=738adb&logo=discord)](https://discord.gg/ztkBqR2) [![Repo Stats](https://img.shields.io/static/v1?label=GitHub+project&message=stats&color=f27e3f)](https://gh-stats.bookstackapp.com/) @@ -82,7 +82,7 @@ Feature releases, and some patch releases, will be accompanied by a post on the ## 🛠️ Development & Testing -All development on BookStack is currently done on the master branch. When it's time for a release the master branch is merged into release with built & minified CSS & JS then tagged at its version. Here are the current development requirements: +All development on BookStack is currently done on the `development` branch. When it's time for a release the `development` branch is merged into release with built & minified CSS & JS then tagged at its version. Here are the current development requirements: * [Node.js](https://nodejs.org/en/) v14.0+ @@ -178,9 +178,9 @@ Feel free to create issues to request new features or to report bugs & problems. Pull requests are welcome. Unless a small tweak or language update, It may be best to open the pull request early or create an issue for your intended change to discuss how it will fit in to the project and plan out the merge. Just because a feature request exists, or is tagged, does not mean that feature would be accepted into the core project. -Pull requests should be created from the `master` branch since they will be merged back into `master` once done. Please do not build from or request a merge into the `release` branch as this is only for publishing releases. If you are looking to alter CSS or JavaScript content please edit the source files found in `resources/`. Any CSS or JS files within `public` are built from these source files and therefore should not be edited directly. +Pull requests should be created from the `development` branch since they will be merged back into `development` once done. Please do not build from or request a merge into the `release` branch as this is only for publishing releases. If you are looking to alter CSS or JavaScript content please edit the source files found in `resources/`. Any CSS or JS files within `public` are built from these source files and therefore should not be edited directly. -The project's code of conduct [can be found here](https://github.com/BookStackApp/BookStack/blob/master/.github/CODE_OF_CONDUCT.md). +The project's code of conduct [can be found here](https://github.com/BookStackApp/BookStack/blob/development/.github/CODE_OF_CONDUCT.md). ## 🔒 Security @@ -188,7 +188,7 @@ Security information for administering a BookStack instance can be found on the If you'd like to be notified of new potential security concerns you can [sign-up to the BookStack security mailing list](https://updates.bookstackapp.com/signup/bookstack-security-updates). -If you would like to report a security concern, details of doing so can [can be found here](https://github.com/BookStackApp/BookStack/blob/master/.github/SECURITY.md). +If you would like to report a security concern, details of doing so can [can be found here](https://github.com/BookStackApp/BookStack/blob/development/.github/SECURITY.md). ## ♿ Accessibility @@ -206,7 +206,7 @@ The BookStack source is provided under the MIT License. The libraries used by, a The great people that have worked to build and improve BookStack can [be seen here](https://github.com/BookStackApp/BookStack/graphs/contributors). -The wonderful people that have provided translations, either through GitHub or via Crowdin [can be seen here](https://github.com/BookStackApp/BookStack/blob/master/.github/translators.txt). +The wonderful people that have provided translations, either through GitHub or via Crowdin [can be seen here](https://github.com/BookStackApp/BookStack/blob/development/.github/translators.txt). These are the great open-source projects used to help build BookStack: From 4a1d060eb93928959620b296e9f974676b9fbc8e Mon Sep 17 00:00:00 2001 From: StyleCI Bot Date: Sun, 30 Jan 2022 16:44:19 +0000 Subject: [PATCH 05/11] Apply fixes from StyleCI --- app/Auth/Access/Oidc/OidcProviderSettings.php | 1 + 1 file changed, 1 insertion(+) diff --git a/app/Auth/Access/Oidc/OidcProviderSettings.php b/app/Auth/Access/Oidc/OidcProviderSettings.php index 016d006d2..d15705782 100644 --- a/app/Auth/Access/Oidc/OidcProviderSettings.php +++ b/app/Auth/Access/Oidc/OidcProviderSettings.php @@ -165,6 +165,7 @@ class OidcProviderSettings { return array_filter($keys, function (array $key) { $alg = $key['alg'] ?? null; + return $key['kty'] === 'RSA' && $key['use'] === 'sig' && (is_null($alg) || $alg === 'RS256'); }); } From a709fd04b539c8da466596ad74b962a426e40bfd Mon Sep 17 00:00:00 2001 From: Dan Brown Date: Sun, 30 Jan 2022 17:40:42 +0000 Subject: [PATCH 06/11] Added option to configure PDF export paper size For #995 --- .env.example.complete | 5 +++++ app/Config/dompdf.php | 7 ++++++- app/Config/snappy.php | 6 ++++++ tests/Unit/ConfigTest.php | 14 ++++++++++++++ 4 files changed, 31 insertions(+), 1 deletion(-) diff --git a/.env.example.complete b/.env.example.complete index 37b46fec2..9d24fceeb 100644 --- a/.env.example.complete +++ b/.env.example.complete @@ -297,6 +297,11 @@ RECYCLE_BIN_LIFETIME=30 # Maximum file size, in megabytes, that can be uploaded to the system. FILE_UPLOAD_SIZE_LIMIT=50 +# Export Page Size +# Primarily used to determine page size of PDF exports. +# Can be 'a4' or 'letter'. +EXPORT_PAGE_SIZE=a4 + # Allow