Fix leancloud counter security bug #137

LEAFERx · 2018-02-12T11:07:43Z

PR Checklist

Please check if your PR fulfills the following requirements:

The commit message follows our guidelines.
Tests for the changes have been added (for bug fixes / features).
- Muse | Mist have been tested.
- Pisces | Gemini have been tested.
Docs have been added / updated (for bug fixes / features).

PR Type

What kind of change does this PR introduce?

What is the current behavior?

Issue Number(s): #25

sli1989 · 2018-02-12T11:58:14Z

😂

LEAFERx · 2018-02-12T12:01:47Z

@sli1989
这是为了配合我编写的插件而做的改动
中文文档已经写好，正在修饰当中
请用gitter或者邮箱联系我，我发给你文档链接（暂时不宜公开）

ivan-nginx · 2018-02-12T16:44:03Z

_config.yml

 leancloud_visitors:
  enable: false
+  security: false


Add short readme for dependencies here.

LEAFERx · 2018-02-13T14:25:27Z

the link on the readme is not available now.
i will release the doc as soon as this pr is merged.

wafer-li

Is it better to default to true of security

wafer-li · 2018-02-14T14:39:46Z

_config.yml

 leancloud_visitors:
  enable: false
+  security: false


Why not default to true?

Because need to install plugin separately.

Yes, I mean just like the gitmint, default to true, and ask the user to install the plugin.

Security is important, isn't it?

Important, but LC can work without security plugin.

ivan-nginx · 2018-02-15T01:29:21Z

layout/_third-party/analytics/lean-analytics.swig

-              }
-            });
+            {% if theme.leancloud_visitors.security %}
+              console.log('Counter not initialized!');


Ok, i see what here is security option just add warning in console log. There is some my 5 cents on it:

Replace console.log with hexo.log.warn for better warning message.

security can be set to true by default. So, if user wan't to install security plugin, he can turn off security option. If he don't know about security (newbie in NexT) and just turn on LC option, he will seen this warning message with following instructions to install plugin.

Warning message should be informative. Instead of Counter not initialized! something like ATTENTION! LeanCloud counter have security bug, for solve it see here: https://github.com/theme-next/hexo-leancloud-counter-security.

OR

We can just cut out security option and add in NexT config comments under leancloud options what there are some security issues and can be solved under the plugin link. For now option — it's just console warning, no more. Who know about this — will know, option will be useless, i think. 1 excess interation in swig. That's what i suggest.

but this file is excuted in browser where there is no hexo.log.warn

Oh! So, why this warn needed if user will not see it?

because if they turn on the security but not install the plugin and follow the instruction to config th e Leancloud background, the counter will not work at all

So, stay as it? False by default?

Also, need to provide some badges for this repo. NPM link, version, compatability, etc.

LEAFERx · 2018-02-15T03:17:02Z

now the error msg on browser is like this:

@ivan-nginx

ivan-nginx · 2018-02-15T03:20:58Z

Yeah, it's good for now! Well done! 👍

LEAFERx · 2018-02-15T03:25:08Z

so the config is default to true now.
anything else?

ivan-nginx · 2018-02-15T03:27:12Z

Em.. i think need to false. But other guys sugessted to true it. Need to make a decision about it.

anything else?

Also, need to provide some badges for this repo. NPM link, version, compatability, etc.

Post not found: https://leaferx.online/2018/02/11/lc-security/
Maybe better to add in NexT docs this info?
P.S. Later all this docs will be moved to main theme-next.org site.

LEAFERx · 2018-02-15T03:55:36Z

badges added.
i haven't release the doc yet because this pr is nor merged.

LEAFERx · 2018-02-15T07:50:57Z

Now that docs has been released.

LEAFERx · 2018-02-15T07:52:17Z

Question need discussion: what default value of security should be set

ivan-nginx · 2018-02-21T12:12:03Z

Guys, can we please to deside this option?

LEAFERx · 2018-02-26T05:27:35Z

@wafer-li @tsanie @maple3142 @ivan-nginx
can we decide what default value of security should be set?

wafer-li · 2018-02-26T05:47:15Z

@LEAFERx @tsanie @maple3142 @ivan-nginx

What about making a vote?

I still vote for default to true, if you agree with me, 👍 with this comment, otherwise 👎 with this comment.

ivan-nginx · 2018-03-15T11:55:02Z

@sli1989 @wafer-li @tsanie @maple3142 anybody of u can today translate from CN docs to EN docs?

sli1989 · 2018-03-15T12:42:04Z

It's better for @LEAFERx to do it...😅

ivan-nginx · 2018-03-15T13:10:41Z

@sli1989 moved to here.

fix leancloud counter security bug

LEAFERx added 2 commits February 12, 2018 19:05

fix leancloud counter security bug

4537c00

Merge branch 'master' into master

21ad6c8

ivan-nginx reviewed Feb 12, 2018

View reviewed changes

_config.yml Outdated

leancloud_visitors:

enable: false

security: false

Copy link

Member

ivan-nginx Feb 12, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add short readme for dependencies here.

LEAFERx added 2 commits February 13, 2018 22:17

Merge branch 'master' into master

b8baa54

Add a little readme

7ddc761

LEAFERx added 2 commits February 14, 2018 18:34

fix readme

fff01b7

Merge branch 'master' into master

c2a6cf4

wafer-li reviewed Feb 14, 2018

View reviewed changes

Refactored LC configuration.

49b3152

ivan-nginx reviewed Feb 15, 2018

View reviewed changes

ivan-nginx requested review from tsanie and maple3142 February 15, 2018 01:30

ivan-nginx added ⭐ Feature Discussion 📖 Docs labels Feb 15, 2018

ivan-nginx added this to the v6.0.5 milestone Feb 15, 2018

ivan-nginx mentioned this pull request Feb 15, 2018

A serious security bug in leancloud visitor counter [solved] #25

Closed

3 tasks

LEAFERx added 2 commits February 15, 2018 11:16

a better error message

c15bd56

Merge branch 'master' of https://github.com/LEAFERx/hexo-theme-next-ng

4707ec8

set security config default to true

2d1552a

Update warning message.

00e1c89

Add lc-security doc

1a75e2f

LEAFERx added 2 commits February 15, 2018 13:21

format the doc

9268493

add issue & pr link

2fa0a46

LEAFERx added 2 commits February 21, 2018 21:09

fix some err in the doc

8072fc8

a performance fix

066e209

add betterPerformance in doc

3260799

ivan-nginx merged commit 8b2e72a into theme-next:master Feb 27, 2018

ivan-nginx modified the milestones: v6.0.5, v6.0.6 Feb 27, 2018

ivan-nginx removed the 👍 Top Issue! label Apr 1, 2019

stevenjoezhang changed the title ~~fix leancloud counter security bug~~ Fix leancloud counter security bug Sep 15, 2019

tongluyang pushed a commit to tongluyang/hexo-theme-next that referenced this pull request Nov 19, 2019

Merge pull request theme-next#137 from LEAFERx/master

3a4cd16

fix leancloud counter security bug

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix leancloud counter security bug #137

Fix leancloud counter security bug #137

LEAFERx commented Feb 12, 2018

sli1989 commented Feb 12, 2018

LEAFERx commented Feb 12, 2018

ivan-nginx Feb 12, 2018

LEAFERx commented Feb 13, 2018

wafer-li left a comment

wafer-li Feb 14, 2018

ivan-nginx Feb 14, 2018

wafer-li Feb 15, 2018

ivan-nginx Feb 15, 2018

ivan-nginx Feb 15, 2018 •

edited

Loading

LEAFERx Feb 15, 2018

ivan-nginx Feb 15, 2018

LEAFERx Feb 15, 2018

ivan-nginx Feb 15, 2018

LEAFERx commented Feb 15, 2018

ivan-nginx commented Feb 15, 2018

LEAFERx commented Feb 15, 2018

ivan-nginx commented Feb 15, 2018 •

edited

Loading

LEAFERx commented Feb 15, 2018

LEAFERx commented Feb 15, 2018

LEAFERx commented Feb 15, 2018

ivan-nginx commented Feb 21, 2018

LEAFERx commented Feb 26, 2018

wafer-li commented Feb 26, 2018

ivan-nginx commented Mar 15, 2018

sli1989 commented Mar 15, 2018 •

edited

Loading

ivan-nginx commented Mar 15, 2018

Fix leancloud counter security bug #137

Fix leancloud counter security bug #137

Conversation

LEAFERx commented Feb 12, 2018

PR Checklist

PR Type

What is the current behavior?

sli1989 commented Feb 12, 2018

LEAFERx commented Feb 12, 2018

Choose a reason for hiding this comment

LEAFERx commented Feb 13, 2018

wafer-li left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ivan-nginx Feb 15, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

LEAFERx commented Feb 15, 2018

ivan-nginx commented Feb 15, 2018

LEAFERx commented Feb 15, 2018

ivan-nginx commented Feb 15, 2018 • edited Loading

LEAFERx commented Feb 15, 2018

LEAFERx commented Feb 15, 2018

LEAFERx commented Feb 15, 2018

ivan-nginx commented Feb 21, 2018

LEAFERx commented Feb 26, 2018

wafer-li commented Feb 26, 2018

ivan-nginx commented Mar 15, 2018

sli1989 commented Mar 15, 2018 • edited Loading

ivan-nginx commented Mar 15, 2018

ivan-nginx Feb 15, 2018 •

edited

Loading

ivan-nginx commented Feb 15, 2018 •

edited

Loading

sli1989 commented Mar 15, 2018 •

edited

Loading