Merge pull request #1642 from hackmdio/release/2.3.0

Release 2.3.0

.sequelizerc.example

@@ -2,8 +2,8 @@ const path = require('path')
 const config = require('./lib/config')
 
 module.exports = {
-  config: path.resolve('config.json'),
+  config: path.resolve('config.js'),
   'migrations-path': path.resolve('lib', 'migrations'),
   'models-path': path.resolve('lib', 'models'),
-  url: process.env['CMD_DB_URL'] || config.dbURL
+  url: config.dbURL
 }

config.js

@@ -0,0 +1,3 @@
+const config = require('./lib/config')
+
+module.exports = config.db

lib/config/index.js

@@ -189,7 +189,9 @@ switch (config.imageUploadType) {
       'image/png',
       'image/jpg',
       'image/gif',
-      'image/svg+xml'
+      'image/svg+xml',
+      'image/bmp',
+      'image/tiff'
     ]
 }
 

lib/imageRouter/index.js

@@ -1,15 +1,30 @@
 'use strict'
 
 const fs = require('fs')
+const path = require('path')
 const Router = require('express').Router
 const formidable = require('formidable')
 
+const readChunk = require('read-chunk')
+const imageType = require('image-type')
+const mime = require('mime-types')
+
 const config = require('../config')
 const logger = require('../logger')
 const response = require('../response')
 
 const imageRouter = module.exports = Router()
 
+function checkImageValid (filepath) {
+  const buffer = readChunk.sync(filepath, 0, 12)
+  /** @type {{ ext: string, mime: string } | null} */
+  const mimetypeFromBuf = imageType(buffer)
+  const mimeTypeFromExt = mime.lookup(path.extname(filepath))
+
+  return mimetypeFromBuf && config.allowedUploadMimeTypes.includes(mimetypeFromBuf.mime) &&
+         mimeTypeFromExt && config.allowedUploadMimeTypes.includes(mimeTypeFromExt)
+}
+
 // upload image
 imageRouter.post('/uploadimage', function (req, res) {
   var form = new formidable.IncomingForm()
@@ -24,6 +39,10 @@ imageRouter.post('/uploadimage', function (req, res) {
         logger.info('SERVER received uploadimage: ' + JSON.stringify(files.image))
       }
 
+      if (!checkImageValid(files.image.path)) {
+        return response.errorForbidden(req, res)
+      }
+
       const uploadProvider = require('./' + config.imageUploadType)
       uploadProvider.uploadImage(files.image.path, function (err, url) {
         // remove temporary upload file, and ignore any error

lib/note/index.js

@@ -2,11 +2,12 @@
 
 const config = require('../config')
 const logger = require('../logger')
-const { Note, User } = require('../models')
+const { Note, User, Revision } = require('../models')
 
 const { newCheckViewPermission, errorForbidden, responseCodiMD, errorNotFound, errorInternalError } = require('../response')
-const { updateHistory } = require('../history')
+const { updateHistory, historyDelete } = require('../history')
 const { actionPublish, actionSlide, actionInfo, actionDownload, actionPDF, actionGist, actionRevision, actionPandoc } = require('./noteActions')
+const realtime = require('../realtime/realtime')
 
 async function getNoteById (noteId, { includeUser } = { includeUser: false }) {
   const id = await Note.parseNoteIdAsync(noteId)
@@ -232,7 +233,106 @@ function listMyNotes (req, res) {
   }
 }
 
+const deleteNote = async (req, res) => {
+  if (req.isAuthenticated()) {
+    const noteId = await Note.parseNoteIdAsync(req.params.noteId)
+    try {
+      const destroyed = await Note.destroy({
+        where: {
+          id: noteId,
+          ownerId: req.user.id
+        }
+      })
+      if (!destroyed) {
+        logger.error('Delete note failed: Make sure the noteId and ownerId are correct.')
+        return errorNotFound(req, res)
+      }
+
+      historyDelete(req, res)
+
+      if (realtime.isNoteExistsInPool(noteId)) {
+        const note = realtime.getNoteFromNotePool(noteId)
+        realtime.disconnectSocketOnNote(note)
+      }
+
+      res.send({
+        status: 'ok'
+      })
+    } catch (err) {
+      logger.error('Delete note failed: Internal Error.')
+      return errorInternalError(req, res)
+    }
+  } else {
+    return errorForbidden(req, res)
+  }
+}
+
+const updateNote = async (req, res) => {
+  if (req.isAuthenticated()) {
+    const noteId = await Note.parseNoteIdAsync(req.params.noteId)
+    try {
+      const note = await Note.findOne({
+        where: {
+          id: noteId
+        }
+      })
+      if (!note) {
+        logger.error('Update note failed: Can\'t find the note.')
+        return errorNotFound(req, res)
+      }
+
+      if (realtime.isNoteExistsInPool(noteId)) {
+        logger.error('Update note failed: There are online users opening this note.')
+        return res.status('403').json({ status: 'error', message: 'Update API can only be used when no users is online' })
+      }
+
+      const now = Date.now()
+      const content = req.body.content
+      const updated = await note.update({
+        title: Note.parseNoteTitle(content),
+        content: content,
+        lastchangeAt: now,
+        authorship: [
+          [
+            req.user.id,
+            0,
+            content.length,
+            now,
+            now
+          ]
+        ]
+      })
+
+      if (!updated) {
+        logger.error('Update note failed: Write note content error.')
+        return errorInternalError(req, res)
+      }
+
+      updateHistory(req.user.id, note.id, content)
+
+      Revision.saveNoteRevision(note, (err, revision) => {
+        if (err) {
+          logger.error(err)
+          return errorInternalError(req, res)
+        }
+        if (!revision) return errorNotFound(req, res)
+        res.send({
+          status: 'ok'
+        })
+      })
+    } catch (err) {
+      logger.error(err)
+      logger.error('Update note failed: Internal Error.')
+      return errorInternalError(req, res)
+    }
+  } else {
+    return errorForbidden(req, res)
+  }
+}
+
 exports.showNote = showNote
 exports.showPublishNote = showPublishNote
 exports.noteActions = noteActions
 exports.listMyNotes = listMyNotes
+exports.deleteNote = deleteNote
+exports.updateNote = updateNote

lib/routes.js

@@ -12,6 +12,7 @@ const historyController = require('./history')
 const userController = require('./user')
 const noteController = require('./note')
 const response = require('./response')
+const bodyParser = require('body-parser')
 const appRouter = Router()
 
 // register route
@@ -72,6 +73,10 @@ appRouter.get('/p/:shortid', response.showPublishSlide)
 appRouter.get('/p/:shortid/:action', response.publishSlideActions)
 // gey my note list
 appRouter.get('/api/notes/myNotes', noteController.listMyNotes)
+// delete note by id
+appRouter.delete('/api/notes/:noteId', noteController.deleteNote)
+// update note content by id
+appRouter.put('/api/notes/:noteId', bodyParser.json(), noteController.updateNote)
 // get note by id
 appRouter.get('/:noteId', wrap(noteController.showNote))
 // note actions

lib/utils.js

@@ -2,29 +2,14 @@
 const fs = require('fs')
 const path = require('path')
 const bodyParser = require('body-parser')
+const mime = require('mime-types')
 
 exports.isSQLite = function isSQLite (sequelize) {
   return sequelize.options.dialect === 'sqlite'
 }
 
 exports.getImageMimeType = function getImageMimeType (imagePath) {
-  const fileExtension = /[^.]+$/.exec(imagePath)
-
-  switch (fileExtension[0]) {
-    case 'bmp':
-      return 'image/bmp'
-    case 'gif':
-      return 'image/gif'
-    case 'jpg':
-    case 'jpeg':
-      return 'image/jpeg'
-    case 'png':
-      return 'image/png'
-    case 'tiff':
-      return 'image/tiff'
-    default:
-      return undefined
-  }
+  return mime.lookup(path.extname(imagePath))
 }
 
 exports.isRevealTheme = function isRevealTheme (theme) {