1063 Commits (8da89b0a3d26ba5a53f776cf5092cb088f7a871e)

Author	SHA1	Message	Date
Paul Fitzpatrick	bd6a54e901	(core) mitigate csrf by requiring custom header for unsafe methods ... Summary: For methods other than `GET`, `HEAD`, and `OPTIONS`, allow cookie-based authentication only if a certain custom header is present. Specifically, we check that `X-Requested-With` is set to `XMLHttpRequest`. This is somewhat arbitrary, but allows us to use https://expressjs.com/en/api.html#req.xhr. A request send from a browser that sets a custom header will prompt a preflight check, giving us a chance to check if the origin is trusted. This diff deals with getting the header in place. There will be more work to do after this: * Make sure that all important endpoints are checking origin. Skimming code, /api endpoint check origin, and some but not all others. * Add tests spot-testing origin checks. * Check on cases that authenticate differently. - Check the websocket endpoint - it can be connected to from an arbitrary site; there is per-doc access control but probably better to lock it down more. - There may be old endpoints that authenticate based on knowledge of a client id rather than cookies. Test Plan: added a test Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2631	4 years ago
Dmitry S	2d023377ce	(core) Fix CustomView css to take full height of widget on all browsers including Safari ... Summary: On Safari, in particular on mobile, the custom widget was truncated in height. Test Plan: Tested manually on FF, Chrome, Safari (desktop) and Safari, Firefox (mobile) Reviewers: paulfitz Reviewed By: paulfitz Subscribers: paulfitz Differential Revision: https://phab.getgrist.com/D2629	4 years ago
Dmitry S	90db5020c9	(core) Improve focus and keyboard shortcuts in modals. ... Summary: - Factor out focusing logic from Clipboard to FocusLayer. - Generalize FocusLayer to support adding a temporary layer while a modal is open. - Stop Mousetrap shortcuts while a modal is open. - Refactor how Mousetrap's custom stopCallback is implemented to avoid needing to bundle knockout for mousetrap. Test Plan: Added a test that Enter in a UserManager doesn't open a cell editor from underneath the modal. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2626	4 years ago
Paul Fitzpatrick	1654a2681f	(core) move client code to core ... Summary: This moves all client code to core, and makes minimal fix-ups to get grist and grist-core to compile correctly. The client works in core, but I'm leaving clean-up around the build and bundles to follow-up. Test Plan: existing tests pass; server-dev bundle looks sane Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2627	4 years ago
Dmitry S	a15187362c	(core) Enhancements to the Public Access UI. ... Summary: - Show a 'Copy Link' button in UserManager. - Add icons for Copy (to copy link), and also for Video (to open video tutorials in later onboarding changes) - Add to UserManager a 'Public Access' member-like line for greater visibility and to allow changing role. - In main document page, add a "public access" icon. - On saving UserManager, re-fetch DocInfo to update "public access" icon. Test Plan: TBD Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2617	4 years ago
Dmitry S	166143557a	(core) Show a welcome card when a user opens an example for the first time. ... Summary: - The card includes an image, a brief description, and a link to the tutorial. - The left panel includes a link to the tutorial, and a button to reopen card. - Card is collapsed and expanded with a little animation. - Add a seenExamples pref for whether an example has been seen. - Store the pref in localStorage for anon user. Separately, added clearing of prefs of test users between tests, to avoid tests affecting unrelated tests. Test Plan: Added a browser test. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2602	4 years ago
Dmitry S	8240f8b3f0	(core) Show in the UI when docs are inaccessible or publicly accessible. ... Summary: - Add icons to indicate a publicly-accessible document - Dim inaccessible DocMenu items Test Plan: Added a browser test for rendering inaccessible and public docs Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2594	4 years ago
Paul Fitzpatrick	20d8124f45	(core) support ?embed=true and &style=light for a clean embed experience ... Summary: This adds query parameters useful for tailoring the Grist experience, with an eye to embedding. Setting `style=light` removes side and top bars, as a first pass at a focused view of a single document page (this would benefit from refining). Setting `embed=true` has no significant effect just yet other than it restricts document access to viewer at most (this can be overridden by specifying `/m/default`). Test Plan: added tests Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2585	4 years ago
Dmitry S	4e20f7a8a2	(core) Add some media queries to improve printing ... Summary: - Hides left and right panels and the top bar - Hides cursor and active-section highlight - Hides "=" icon on formulas - Nudges browser to include background for row/column headers, which is not otherwise included. Still only what's visible is printed (e.g. large tables not paginated). Test Plan: Tried a few pages manually on Firefox and Chrome. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2579	4 years ago
Paul Fitzpatrick	c8c5afbbca	freshen app/client/ui2018/cssVars.ts ... The cssVars.ts file has changed to include some more knobs for custom theming. This commit updates the file, and introduces a `stubs` directory for stubbing code that is specific to our deployments of Grist and not of general interest.	4 years ago
Dmitry S	ad35f54b87	Update tsconfig files and switch to _build for outputs, for consistency with main grist repo	4 years ago
Dmitry S	a5fbc8fcd2	Add a fixture for the included component, to have something visible on the main page	4 years ago
Dmitry S	ec182792be	Initial config with a few files that build on client and server side.	4 years ago