Archives/gristlabs_grist-core
1
0
Fork 0
mirror of https://github.com/gristlabs/grist-core.git synced 2024-10-27 20:44:07 +00:00
Code Issues Projects Releases Wiki Activity
2,524 Commits 48 Branches 36 Tags 404 MiB
24ce54b586
Commit Graph

681 Commits

Author SHA1 Message Date
Leslie H
24ce54b586
Improve session ID security (#1059) 
Follow-up of #994. This PR revises the session ID generation logic to improve security in the absence of a secure session secret. It also adds a section in the admin panel "security" section to nag system admins when GRIST_SESSION_SECRET is not set.

Following is an excerpt from internal conversation.

TL;DR: Grist's current implementation generates semi-secure session IDs and uses a publicly known default signing key to sign them when the environment variable GRIST_SESSION_SECRET is not set. This PR generates cryptographically secure session IDs to dismiss security concerns around an insecure signing key, and encourages system admins to configure their own signing key anyway.

> The session secret is required by expressjs/session to sign its session IDs. It's designed as an extra protection against session hijacking by randomly guessing session IDs and hitting a valid one. While it is easy to encourage users to set a distinct session secret, this is unnecessary if session IDs are generated in a cryptographically secure way. As of now Grist uses version 4 UUIDs as session IDs (see app/server/lib/gristSessions.ts - it uses shortUUID.generate which invokes uuid.v4 under the hood). These contain 122 bits of entropy, technically insufficient to be considered cryptographically secure. In practice, this is never considered a real vulnerability. To compare, RSA2048 is still very commonly used in web servers, yet it only has 112 bits of security (>=128 bits = "secure", rule of thumb in cryptography). But for peace of mind I propose using crypto.getRandomValues to generate real 128-bit random values. This should render session ID signing unnecessary and hence dismiss security concerns around an insecure signing key.
 2024-06-25 15:43:25 -04:00
Roman Holinec
e007b38115
Translated using Weblate (Slovak) 
Currently translated at 29.7% (398 of 1336 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sk/
 2024-06-25 07:09:26 +02:00
Paul Janzen
3c7623b51b
Translated using Weblate (German) 
Currently translated at 100.0% (1336 of 1336 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/de/
 2024-06-25 07:09:26 +02:00
Paul Janzen
fbdd896f04
Translated using Weblate (Spanish) 
Currently translated at 100.0% (1336 of 1336 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/es/
 2024-06-25 07:09:25 +02:00
Paul Janzen
64dc9e13c9
Translated using Weblate (Portuguese (Brazil)) 
Currently translated at 100.0% (1336 of 1336 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/pt_BR/
 2024-06-25 07:09:25 +02:00
Roman Holinec
6c2079166c
Translated using Weblate (Slovak) 
Currently translated at 27.5% (368 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sk/
 2024-06-23 19:09:30 +00:00
github-actions[bot]
8bc8d60fca
automated update to translation keys (#1053) 
Co-authored-by: Paul's Grist Bot <paul+bot@getgrist.com>
 2024-06-18 10:54:52 -04:00
Roman Holinec
414e0c5e69
Translated using Weblate (Slovak) 
Currently translated at 13.7% (184 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sk/
 2024-06-11 16:09:26 +02:00
gallegonovato
f8a8684fe8
Translated using Weblate (Spanish) 
Currently translated at 100.0% (1334 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/es/
 2024-06-05 13:09:18 +02:00
Paul Janzen
ebdaadcb9c
Translated using Weblate (Spanish) 
Currently translated at 100.0% (1334 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/es/
 2024-06-05 13:09:17 +02:00
Florentina Petcu
7f88d11a25
Translated using Weblate (Romanian) 
Currently translated at 80.2% (1071 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/ro/
 2024-06-04 12:09:15 +02:00
Владимир В
b03a0d1639
Translated using Weblate (Russian) 
Currently translated at 99.6% (1329 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/ru/
 2024-06-04 12:09:15 +02:00
Paul Janzen
88e6a3e202
Translated using Weblate (German) 
Currently translated at 100.0% (1334 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/de/
 2024-06-04 12:09:15 +02:00
Paul Janzen
53238b3e7b
Translated using Weblate (Portuguese (Brazil)) 
Currently translated at 100.0% (1334 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/pt_BR/
 2024-06-04 12:09:15 +02:00
Roman Holinec
c27512fee7
Translated using Weblate (Slovak) 
Currently translated at 12.4% (166 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sk/
 2024-06-02 19:09:26 +00:00
Franček Prijatelj
7265735b37
Translated using Weblate (Slovenian) 
Currently translated at 100.0% (1334 of 1334 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sl/
 2024-06-02 19:09:25 +00:00
Florentina Petcu
940cff3d7a
Translated using Weblate (Romanian) 
Currently translated at 79.8% (1065 of 1333 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/ro/
 2024-06-01 10:09:27 +02:00
Franček Prijatelj
6e3c6d8a43
Translated using Weblate (Slovenian) 
Currently translated at 100.0% (1333 of 1333 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sl/
 2024-06-01 10:09:26 +02:00
gallegonovato
849022415b
Translated using Weblate (Spanish) 
Currently translated at 97.5% (1301 of 1333 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/es/
 2024-06-01 10:09:26 +02:00
Camille L
f00b4105e3
Translated using Weblate (French) 
Currently translated at 98.7% (1316 of 1333 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/fr/
 2024-06-01 10:09:25 +02:00
github-actions[bot]
d6ff2ec60b
automated update to translation keys (#987) 
Co-authored-by: Paul's Grist Bot <paul+bot@getgrist.com>
 2024-05-31 09:32:46 -04:00
Roman Holinec
992863b181
Translated using Weblate (Slovak) 
Currently translated at 7.2% (94 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sk/
 2024-05-31 03:40:05 +02:00
CamilleLegeron
5956c20c29
feat: add new translations (#1004) 2024-05-29 11:02:00 -07:00
Camille L
6cfcffc561
Translated using Weblate (French) 
Currently translated at 98.8% (1282 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/fr/
 2024-05-29 18:09:21 +02:00
Roman Holinec
418acb08a5
Translated using Weblate (Slovak) 
Currently translated at 5.7% (74 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sk/
 2024-05-27 19:09:20 +00:00
Florentina Petcu
de582516de
Translated using Weblate (Romanian) 
Currently translated at 81.4% (1056 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/ro/
 2024-05-27 19:09:19 +00:00
Camille L
135c975971
Translated using Weblate (French) 
Currently translated at 97.9% (1270 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/fr/
 2024-05-27 19:09:18 +00:00
Roman Holinec
eb76ec53c4
Added translation using Weblate (Slovak) 2024-05-26 20:12:53 +02:00
Marin Ivanov
549240e6fd
Translated using Weblate (Bulgarian) 
Currently translated at 99.1% (1286 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/bg/
 2024-05-26 00:09:24 +02:00
Paul Fitzpatrick
5dc4706dc7
reconcile boot and admin pages further (#963) 
This adds some remaining parts of the boot page to the admin panel, and then removes the boot page.
 2024-05-23 16:40:31 -04:00
Franček Prijatelj
1690b77d81
Translated using Weblate (Slovenian) 
Currently translated at 100.0% (1297 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sl/
 2024-05-23 20:09:16 +00:00
Marin Ivanov
53cfc6148d
Translated using Weblate (Bulgarian) 
Currently translated at 99.1% (1286 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/bg/
 2024-05-22 11:02:03 +02:00
Paul Janzen
45b5126275
Translated using Weblate (German) 
Currently translated at 100.0% (1297 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/de/
 2024-05-22 11:02:02 +02:00
Paul Janzen
a8ca5ffd85
Translated using Weblate (Spanish) 
Currently translated at 100.0% (1297 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/es/
 2024-05-22 11:02:01 +02:00
Paul Janzen
634635de09
Translated using Weblate (Portuguese (Brazil)) 
Currently translated at 100.0% (1297 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/pt_BR/
 2024-05-22 11:02:00 +02:00
Marin Ivanov
8a67d9f686
Translated using Weblate (Bulgarian) 
Currently translated at 99.1% (1286 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/bg/
 2024-05-21 10:44:07 +02:00
Marin Ivanov
5f2b01a9ee
Translated using Weblate (Bulgarian) 
Currently translated at 88.6% (1150 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/bg/
 2024-05-21 04:01:56 +02:00
Camille L
fc2f4578c0
Translated using Weblate (French) 
Currently translated at 97.2% (1261 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/fr/
 2024-05-21 04:01:56 +02:00
Franček Prijatelj
69ce9beb9c
Translated using Weblate (Slovenian) 
Currently translated at 98.0% (1272 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/sl/
 2024-05-19 17:01:57 +02:00
Riccardo Polignieri
a6ceecbbf6
Translated using Weblate (Italian) 
Currently translated at 100.0% (1297 of 1297 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/it/
 2024-05-19 17:01:56 +02:00
Marin Ivanov
6ed9648708
Translated using Weblate (Bulgarian) 
Currently translated at 76.9% (993 of 1290 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/bg/
 2024-05-18 09:02:04 +00:00
CamilleLegeron
6443c9f914
feat: add translation of vue types when added (#946) 2024-05-17 11:55:24 -07:00
Marin Ivanov
418ae03475
Translated using Weblate (Bulgarian) 
Currently translated at 59.9% (773 of 1290 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/bg/
 2024-05-17 10:11:24 +02:00
Marin Ivanov
8471e8f746
Translated using Weblate (Bulgarian) 
Currently translated at 49.1% (634 of 1290 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/bg/
 2024-05-17 06:02:04 +02:00
Paul Janzen
a69a1fa843
Translated using Weblate (German) 
Currently translated at 100.0% (1290 of 1290 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/de/
 2024-05-17 06:02:03 +02:00
Paul Janzen
a91d4dcdd3
Translated using Weblate (Portuguese (Brazil)) 
Currently translated at 100.0% (1290 of 1290 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/pt_BR/
 2024-05-17 06:02:02 +02:00
Grégoire Cutzach
d8f4e075fe
feat: ADD Terms of service link (#985) 
Adds an optional terms of service link for sites that need it.

---------

Co-authored-by: Jonathan Perret <j-github@jonathanperret.net>
 2024-05-16 11:31:37 -04:00
Marin Ivanov
1d55b5bcce
Added translation using Weblate (Bulgarian) 2024-05-16 09:44:00 +02:00
Владимир В
2beba65726
Translated using Weblate (Russian) 
Currently translated at 99.6% (1252 of 1257 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/ru/
 2024-05-15 23:02:31 +00:00
Camille L
f4f6c38701
Translated using Weblate (French) 
Currently translated at 99.3% (1249 of 1257 strings)

Translation: Grist/client
Translate-URL: https://hosted.weblate.org/projects/grist/client/fr/
 2024-05-15 23:02:30 +00:00