Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Editor controls shown when running with --no-edit #1785

Closed
geraldcombs opened this issue Dec 20, 2021 · 11 comments
Closed

Editor controls shown when running with --no-edit #1785

geraldcombs opened this issue Dec 20, 2021 · 11 comments

Comments

@geraldcombs
Copy link

Please read the CONTRIBUTION GUIDELINES before submitting!

If your have problems using or installing the software which stem from bugs in the software or a lack of documentation, we are always happy to help out! However, for ordinary usage questions, please consider asking elsewhere, for instance on StackOverflow.

Describe the bug

Gollum shows edit controls when running with --no-edit.

To Reproduce
Steps to reproduce the behavior:

  1. Run gollum --host localhost --no-edit ....
  2. open localhost:4567 in your browser.
  3. Hover over a heading and click on the pencil icon.
  4. Gollum yanks away the football and displays an error page that says "Error / Forbidden. This wiki is set to no-edit mode."

Expected behavior

Gollum should probably either hide the pencil icon or show it as grayed / disabled.

Environment Info

Gollum 5.2.3
Running on: universal.x86_64-darwin21 with Ruby version 2.6.8
Using:
rugged 1.1.1
gollum-rugged_adapter 1.1.2
gollum-lib 5.1.3
Markdown rendering gem: kramdown
Other renderering gems:
none
@dometto
Copy link
Member

dometto commented Dec 20, 2021

I guess the most straightforward way to implement this would be to override the CSS for hX.hover if --no-edit is active, from the layout mustache template.

@bubbasnmp
Copy link

Is it possible to change the text on the error page? That way the user could be pointed to the process needed to update the page using a different route.

@benjaminwil
Copy link
Member

I think that if you start gollum with --no-edit nothing is editable from any route.

So I think the only way forward is to either

  • override the CSS as suggested previously, and/or
  • add some more conditions to the relevant Mustache templates so we can be sure we are not rendering any editing-related HTML/CSS when --no-edit is turned on.

@benjaminwil
Copy link
Member

I would be happy to submit a PR to resolve this issue, but I don't think I have the time to until February.

@bartkamphorst
Copy link
Member

Thanks @benjaminwil ! I think that timeline is perfectly acceptable.

add some more conditions to the relevant Mustache templates

If we can fix it in the templates then that would have my preference.

@benjaminwil
Copy link
Member

benjaminwil commented Feb 16, 2022

I started investigating this issue more deeply today.

I've discovered a couple of interesting things:

  1. gollum-lib is responsible for rendering page headings with the class "editable". And gollum-lib has no knowledge of the --no-edit flag (or the allow_editing setting). Link to source.
  2. If the class "editable" is present on a heading, Gollum adds the edit ✏️ icon link via JavaScript. Link to source.

So I don't think any hacky fixes are required to resolve this issue. It seems it's just a matter of telling gollum-lib to not render the "editable" class in some scenarios.

@benjaminwil
Copy link
Member

I am actually unsure what it means for a heading to have the class "editable". If we removed this class from all headers, what would we be losing? Maybe @dometto knows?

@benjaminwil
Copy link
Member

I've made a PR against gollum-lib as a first step to resolving this issue: gollum/gollum-lib#415

I believe I'm taking a reasonable approach but am open to other strategies.

@dometto
Copy link
Member

dometto commented Feb 16, 2022

I am actually unsure what it means for a heading to have the class "editable". If we removed this class from all headers, what would we be losing? Maybe @dometto knows?

The "editable" class indicates that the pencil icon should be shown when hovering above it, and is used for the per-section-editing functionality. Not all headers can be edited per section, as is explained here. So unfortunately we can't lose the class entirely!

@benjaminwil
Copy link
Member

I've merged the pull request that resolves this issue: gollum/gollum-lib#415. It should be live in the next release of gollum-lib.

@dometto
Copy link
Member

dometto commented May 26, 2022

Released in v5.3.0 gollum-lib v5.2.0. (Perhaps we should start labeling issues with Resolved in next release or something?).

@dometto dometto closed this as completed May 26, 2022
wip-sync pushed a commit to NetBSD/pkgsrc-wip that referenced this issue Nov 12, 2023
5.2.4 / 2023-03-22

* Bugfix release: address XSS vulnerability ( @6661620a, @dometto)

5.2.3 / 2023-03-13

* Bugfix release: update adapter dependencies for Ruby 3.2 support.

5.2.2 / 2023-01-18

* Bugfix release: set Nokogiri default XHTML conversion options more
  relaibly. See sparklemotion/nokogiri#2761

5.2.1 / 2022-09-13

* Fixed: 'controls' attribute in audio and video tags should not be
  sanitized. #430 (@dometto)

5.2 / 2022-05-28

* Conditionally render "editable" heading classes. Resolves
  gollum/gollum#1785 (@benjaminwil)
* Improvement: Allow escaping quotations in quoted macro
  arguments. #406. (@srbaker)
* Improvement: [Allow for extended PlantUML
  types](https://github.com/gollum/gollum/wiki#plantuml-diagrams).
  #413. (@manofstick)
* API Addition: allow defining handlers for specific languages in
codeblocks. #410. (@dometto)

v5.1.2

* SECURITY UPDATE: sanitize HTML generated by Macros.

v5.0.1

* Bugfix release: fix emoji when using base path. Thanks to
  @heavywatal.

v5.0

For a detailed overview of changes in 5.0 and a guide to migrating
your wiki, see https://github.com/gollum/gollum/wiki/5.0-release-notes

* Removed support for Web Sequence Diagroms, PlantUML now default.
  ** PlantUML users in 4.x please note: in this release PlantUML uses
  the server at https://plantuml.com by default, not `localhost`. Use
  the config option to keep using your own server.

v4.2.1

* Performances improvements
* Dependency updates

ruby-gollum-lib: 5.2.4
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants