Commit Graph

31 Commits

Author SHA1 Message Date
Kalista Payne
f51f0a0c93 fix(CSP): move trusted list to default-src 2025-12-12 16:52:14 -06:00
Kalista Payne
83b2ba7688 fix(CSP): explicit habitica/aws in script-src 2025-12-12 16:38:05 -06:00
Kalista Payne
d5ca5172d5 fix(CSP): need escaped single quotes 2025-12-12 16:31:38 -06:00
Kalista Payne
c677a1ffef fix(CSP): unsafe-eval 2025-12-12 16:27:46 -06:00
Kalista Payne
6ef35c3f72 fix(CSP): might need to skip entirely in dev but try no 'self' 2025-12-12 16:15:07 -06:00
Kalista Payne
5759fb37d8 fix(csp): permit AWS in default-src 2025-12-12 15:51:26 -06:00
Kalista Payne
9462e90f4f feat(security): implement CSP 2025-12-10 16:41:29 -06:00
Phillip Thelen
12773d539e Add interface to block ip-addresses or clients due to abuse (#15484)
* Read IP blocks from database

* begin building general blocking solution

* add new frontend files

* Add UI for managing blockers

* correctly reset local data after creating blocker

* Tweak wording

* Add UI for managing blockers

* restructure admin pages

* improve test coverage

* Improve blocker UI

* add blocker to block emails from registration

* lint fix

* fix

* lint fixes

* fix import

* add new permission for managing blockers

* improve permission check

* fix managing permissions from admin

* improve navbar display for non fullAccess admin

* update block error strings

* lint fix

* add option to errorHandler to skip logging

* validate blocker value during input

* improve blocker form display

* chore(subproj): reconcile habitica-images

* fix(scripts): use same Mongo version for dev/test

* fix(whitespace): eof

* documentation improvements

* remove nconf import

* remove old test

---------

Co-authored-by: Kalista Payne <kalista@habitica.com>
Co-authored-by: Kalista Payne <sabrecat@gmail.com>
2025-08-06 15:08:07 -05:00
Phillip Thelen
29eb8ca10b log slow requests to loggly (#15364) 2025-02-11 12:05:06 -06:00
Phillip Thelen
4da53f83c9 Add option to log every request start and end to loggly (#15243) 2024-06-14 08:51:10 -05:00
Sabe Jones
8fa91a3805 chore(node): upgrade to Node 20 2024-03-11 09:59:57 -05:00
Phillip Thelen
0754c0ff05 correctly set limit 2023-03-02 18:04:02 +01:00
Matteo Pagliazzi
6d34319455 Stripe: upgrade module and API, switch to Checkout (#12785)
* upgrade stripe module

* switch stripe api to latest version

* fix api version in tests

* start upgrading client and server

* client: switch to redirect

* implement checkout session creation for gems, start implementing webhooks

* stripe: start refactoring one time payments

* working gems and gift payments

* start adding support for subscriptions

* stripe: migrate subscriptions and fix cancelling sub

* allow upgrading group plans

* remove console.log statements

* group plans: upgrade from static page / create new one

* fix #11885, correct group plan modal title

* silence more stripe webhooks

* fix group plans redirects

* implement editing payment method

* start cleaning up code

* fix(stripe): update in-code docs, fix eslint issues

* subscriptions tests

* remove and skip old tests

* skip integration tests

* fix client build

* stripe webhooks: throw error if request fails

* subscriptions: correctly pass groupId

* remove console.log

* stripe: add unit tests for one time payments

* wip: stripe checkout tests

* stripe createCheckoutSession unit tests

* stripe createCheckoutSession unit tests

* stripe createCheckoutSession unit tests (editing card)

* fix existing webhooks tests

* add new webhooks tests

* add more webhooks tests

* fix lint

* stripe integration tests

* better error handling when retrieving customer from stripe

* client: remove unused strings and improve error handling

* payments: limit gift message length (server)

* payments: limit gift message length (client)

* fix redirects when payment is cancelled

* add back "subUpdateCard" string

* fix redirects when editing a sub card, use proper names for products, check subs when gifting
2020-12-14 15:59:17 +01:00
Matteo Pagliazzi
6a658c45b5 Upgrade some deps: helmet, slack, amplitude and short-uuid (#12817)
* upgrade helmet to version 4

* deps(short-uuid): upgrade to version 4, closes #12573

* deps(slack): upgrade to version 4

* deps(slack): upgrade to version 5, closes #11442

* deps(amplitude): upgrade to latest version use api v2

* fix tests

* slack tests: return promise

* refactor slack setup for tests

* fix slack unit tests
2020-11-30 20:03:04 +01:00
Matteo Pagliazzi
e7c8833c9a API v3 Rate Limiter (#12117)
* simplify ip address management by using the trust proxy express option

* add setupExpress file

* fix redirects middleware tests

* fix lint

* short circuit the ip blocking middleware

* basic implementation with ip based limiting

* improve logging

* upgrade apidoc

* apidoc: add introduction section

* fix lint

* fix tests

* fix lint

* add unit tests for rate limiter

* do not send retry-after header when points are available

* automatically fix lint

* fix more lint issues

* use userId as key for rate limit when available
2020-07-18 15:00:09 +02:00
Sabe Jones
e39eafd3f0 feat(event): April Foolin 2020-04-01 06:31:39 -05:00
Matteo Pagliazzi
621787915c start upgrading eslint 2019-10-08 16:57:10 +02:00
Matteo Pagliazzi
45f7cf04ab remove old module.exports from server aswell 2019-10-02 19:45:27 +02:00
Matteo Pagliazzi
d93d295d9f security: add default security headers provided by helmet.js (#11358) 2019-09-20 18:10:38 +02:00
Sabe Jones
12250a93f1 feat(basic-auth): allow multiple auth pairs (#11204) 2019-06-04 15:52:25 -05:00
Matteo Pagliazzi
8441b0a3d6 fix http auth env var 2018-12-09 20:12:50 +01:00
Matteo Pagliazzi
8be9964483 API v4 (WIP) (#10453)
API v4
2018-06-18 14:40:25 +02:00
Matteo Pagliazzi
2d6a1fe709 remove jade, upgrade pug (#9940) 2018-02-04 14:39:46 +01:00
Matteo Pagliazzi
bd46e3e195 Client: i18n (#8972)
* wip: client: i18n

* remove maxAge from cookies to get same expiration ad localStorage

* set cookies expiration to 10 years

* moment: load translations in browser, moment: only load necessary data, remove jquery, remove bluebird

* ability to change language

* fix logout

* add some requiresLogin: false to static pages

* fix tests
2017-08-22 18:26:53 +02:00
Keith Holliday
0d28e663e4 New client edit avatar (#8955)
* Fixed some purchasing issues with backgrounds

* Added more background styles

* Fixed some menu styles

* Initial old client removal

* Added cross-env

* removed bower and fixed lint

* Made interceptor errors use notify

* Removed old client tests and fixed lint
2017-08-16 15:51:48 -06:00
Matteo Pagliazzi
258742f6b7 Optional HTTP Basic Auth (#8586)
* add ability to add http basic auth to the website

* debug

* remove console.log
2017-03-20 15:02:48 +01:00
Matteo Pagliazzi
acad3b8873 Migrate to bcrypt (#8446)
* start migrating to bcrypt

* added method to convert the password to bcrypt when logging in, added method to compare password without knowing the hashing algorhytm, remove default

* travis: try to upgrade to container based infrastructure

* travis: add deps to build bcrypt.js

* travis: add deps to build bcrypt.js

* travis: add deps to build bcrypt.js

* travis: add deps to build bcrypt.js

* use bcryptjs until bcrypt can be installed on travis, see https://github.com/kelektiv/node.bcrypt.js/issues/476

* correct sha1 unit tests

* try different mongodb repo

* try without mognodb services

* try again with bcrypt

* disable request logging in travis

* migrate missing routes

* simplify code

* remove bcryptjs

* fix typo

* fix typo

* fix typo in comment

* add unit tests for new passwords utility emthods

* travis: back to old infrastructure, containers often have timeouts

* add integration test for passwordHashMethod

* update shrinkwrap

* clarify code and add comments

* add integration tests

* fix linting

* fix integration tests
2017-01-24 12:28:42 +01:00
Matteo Pagliazzi
4b48b7a5f6 rename website/client to website/client-old 2016-09-14 15:06:32 +02:00
Matteo Pagliazzi
60f34dafb0 Deprecate API v2 (was Revert "Revert "Deprecate API v2"") (#7802)
* Revert "Revert "Deprecate API v2""

* fix path in shops controller
2016-08-01 22:36:10 +02:00
Matteo Pagliazzi
590adb3438 Revert "Deprecate API v2" (#7801) 2016-07-17 18:15:25 +02:00
Matteo Pagliazzi
45c31a2bcf Deprecate API v2 (#7761)
* deprecate api-v2

* remove v2 test helpers

* remove unused string
2016-07-16 19:56:18 +02:00