Abdullah Atta
3f1406a05b
monograph: bump version to v1.2.4
2025-02-15 23:39:37 +05:00
Abdullah Atta
21760b2b74
monograph: add a strict csp
2025-02-15 23:38:52 +05:00
Ammar Ahmed
d8011f0239
mobile: release v3.0.31
2025-02-14 15:07:12 +05:00
Ammar Ahmed
b9a8b054e2
Fix sharing screenshot on iOS does not work ( #7589 )
2025-02-14 15:05:18 +05:00
Abdullah Atta
2ab321869e
web: bump version to v3.0.26
2025-02-14 10:08:43 +05:00
Abdullah Atta
fcb45a24d6
monograph: use latest version of bun in prod
2025-02-14 09:57:07 +05:00
Abdullah Atta
7cdb13def6
Merge pull request #7588 from streetwriters/fix/tighten-iframe-security
...
This fixes a potential security vulnerability where pasting unknown content into the editor could create an RCE risk.
This PR fixes two issues:
1. Potential RCE when pasting/inserting an `iframe` containing a `javascript` link.
2. Potential RCE when pasting/inserting an `svg` containing JavaScript (why do SVGs allow JS in the first place?).
Mitigations include disallowing all execution of JS inside an SVG by rendering it in a sandboxed `iframe`. While we cannot disallow JS execution in embeds (that would break all embeds like YouTube videos), we have disallowed access to the parent window to all `iframe`s, again, by using a sandboxed `iframe` and by disallowing embedding of `javascript:` links.
To be clear, both of these issues can only be triggered when pasting/importing untrusted content (which you shouldn't be doing anyway).
**These cannot be used to steal or access your notes or any other data. They could be used to access what's shown in the window or do automated clicks etc. but since everything is stored and access from an encrypted SQLite database, your data would be 100% safe and isolated from such an attack.**
2025-02-14 09:50:43 +05:00
Abdullah Atta
2ab58f9203
editor: use sandboxed iframe to render SVGs
2025-02-14 09:31:06 +05:00
Abdullah Atta
df74448e17
editor: disallow embedding javascript code in iframes
2025-02-13 20:27:21 +05:00
01zulfi
ada98fca93
web: hide undo & redo buttons for readonly notes ( #7541 )
...
Signed-off-by: 01zulfi <85733202+01zulfi@users.noreply.github.com >
2025-02-13 10:13:44 +05:00
Yash Kumar
1d3650659f
editor: select language by pressing enter ( #7484 )
...
Signed-off-by: Yash Kumar <kyash03@student.ubc.ca >
2025-02-13 10:12:37 +05:00
Ammar Ahmed
9b43af475b
mobile: release v3.0.31
2025-02-11 14:01:11 +05:00
Ammar Ahmed
d9c592c7fb
common: always remove the last session from history ( #7555 )
2025-02-11 13:31:39 +05:00
Ammar Ahmed
f10ac9fbb5
Merge pull request #7556 from streetwriters/fix-tabs-mobile
...
Fix tabs on mobile
2025-02-11 13:12:12 +05:00
Ammar Ahmed
b7334c09d4
Merge branch 'master' into fix-tabs-mobile
...
Signed-off-by: Ammar Ahmed <40239442+ammarahm-ed@users.noreply.github.com >
2025-02-11 13:11:55 +05:00
Ammar Ahmed
0cd3bd5739
mobile: fix dialog calling onClose after pressing positive button
2025-02-11 13:11:13 +05:00
Ammar Ahmed
33d69480eb
mobile: fix ts errors
2025-02-11 13:11:02 +05:00
Ammar Ahmed
5cae4eb0d9
mobile: add null checks before setting items on storage
2025-02-11 12:18:28 +05:00
Ammar Ahmed
840c7fda5e
mobile: fix loading placeholder
2025-02-11 12:17:45 +05:00
Ammar Ahmed
4ce24ac8fd
mobile: do not show sheet in uncaught errors in editor
2025-02-11 12:17:11 +05:00
Ammar Ahmed
ae9e80e12e
mobile: fix stuck at loading in editor
2025-02-11 12:16:51 +05:00
luis-411
43356e5b6a
core: escape special characters in SQL search query ( #7418 )
...
Signed-off-by: Luis Kriner <luis@kriner.info >
2025-02-11 11:00:51 +05:00
xa4hf8
7b13f35424
desktop: replace corrupt Mac icons bundle ( #7542 )
...
There is a long-standing bug in Electron builder that generates corrupt Macintosh icon bundles. The issue is visible in Finder "list" view. This file is correct and was created on Mac with https://github.com/alptugan/icns-creator/
Signed-off-by: xa4hf8 <174972649+xa4hf8@users.noreply.github.com >
2025-02-11 10:54:50 +05:00
luis-411
0517c6ce41
web: fix status-bar not visible on medium sized screens ( #7493 )
...
Signed-off-by: Luis Kriner <luis@kriner.info >
2025-02-08 19:31:37 +05:00
01zulfi
54d06328c1
web: add tab keyboard shortcuts ( #7322 )
...
Signed-off-by: 01zulfi <85733202+01zulfi@users.noreply.github.com >
2025-02-08 19:30:20 +05:00
Ammar Ahmed
c74677acd4
mobile: restore settings on logout ( #7423 )
2025-02-05 09:30:00 +05:00
01zulfi
7689e1a7c5
web: keep some configs in local storage on logout ( #7436 )
...
Signed-off-by: 01zulfi <85733202+01zulfi@users.noreply.github.com >
2025-02-05 09:29:36 +05:00
luzpaz
5ffae2a08b
global: fix various typos ( #7463 )
...
Found via `codespell -q 3 -D ../dictionary.txt -S "*.patch,*.po" -L actualy,childs,modifer,ontext,ontop,ony,recieved,reciever,se,seperator,te`
Signed-off-by: Luz Paz <luzpaz@pm.me >
2025-02-05 09:28:06 +05:00
Ammar Ahmed
5fa80abdc8
mobile: update changelog
2025-02-04 19:25:16 +05:00
Ammar Ahmed
a30598fedf
mobile: release v3.0.30
2025-02-04 19:23:49 +05:00
Ammar Ahmed
48ffecfb5f
mobile: fix e2e tests
2025-02-04 19:23:11 +05:00
Ammar Ahmed
89fe712104
mobile: fix file size is 0 errors when downloading attachments
2025-02-04 17:36:46 +05:00
Ammar Ahmed
5dd298ee86
mobile: fix unlocking note with biometrics
2025-02-04 17:36:32 +05:00
Ammar Ahmed
275b285a8b
mobile: release v3.0.29
2025-02-04 12:39:04 +05:00
Ammar Ahmed
96310a46e9
mobile: fix configure note activity not showing biometric unlock prompt
2025-02-04 12:33:05 +05:00
Ammar Ahmed
42f9bf1593
mobile: fix opening widget note on app launch
2025-02-04 12:33:05 +05:00
Ammar Ahmed
25aab6913a
mobile: show progress when taking backup and allow to hide backup dialog
2025-02-04 12:32:51 +05:00
Ammar Ahmed
3bd7da68be
mobile: fix crash on app launch with new tabs
2025-02-04 12:32:30 +05:00
Abdullah Atta
a218738eff
web: improve unfocused window ui
2025-02-04 11:11:51 +05:00
Abdullah Atta
8bf283b3bc
config: add *.patch files to .gitignore
2025-02-04 10:14:59 +05:00
luis-411
cb09430ff4
web: fix subnotebook title not updating on navigate ( #7286 )
...
Signed-off-by: Luis Kriner <luis@kriner.info >
2025-02-04 10:06:59 +05:00
luis-411
66d75492bb
editor: fix task list stats 0/0 on app reload ( #7327 )
...
Signed-off-by: Luis Kriner <luis@kriner.info >
2025-02-04 10:04:16 +05:00
Abdullah Atta
d772d38dc7
web: fix collapsed pane expanding on app reload
2025-02-04 09:35:04 +05:00
Ammar Ahmed
46a74f9512
mobile: release v3.0.28
2025-02-03 15:45:54 +05:00
Ammar Ahmed
7df1037e3f
mobile: fix realtime sync editor updates in tabs
2025-02-03 15:38:32 +05:00
Abdullah Atta
5c3136d07d
ci: run actions on ubuntu-22.04
2025-02-03 14:57:30 +05:00
Abdullah Atta
6a9ddb770e
web: bump version to 3.0.25
2025-02-03 14:39:44 +05:00
Abdullah Atta
f4c54fd27f
web: fix crash on setting a reminder
2025-02-03 14:22:58 +05:00
Ammar Ahmed
05b12df7d7
mobile: cache password when restoring backup
2025-02-03 14:16:46 +05:00
Ammar Ahmed
dcf053eede
mobile: call onClose when closing dialog
2025-02-03 14:16:46 +05:00
