5 Commits (9d62e67369e22c0f1c1477d3470114c672b9ea02)

Author	SHA1	Message	Date
Jarosław Sadziński	4ca47878ca	(core) Adding import from google drive to the home screen ... Summary: Importing from google drive from home screen (also for anonymous users) Test Plan: Browser tests Reviewers: dsagal, paulfitz Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2943	3 years ago
Dmitry S	526b0ad33e	(core) Configure more comprehensive eslint rules for Typescript ... Summary: - Update rules to be more like we've had with tslint - Switch tsserver plugin to eslint (tsserver makes for a much faster way to lint in editors) - Apply suggested auto-fixes - Fix all lint errors and warnings in core/, app/, test/ Test Plan: Some behavior may change subtly (e.g. added missing awaits), relying on existing tests to catch problems. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2785	3 years ago
Paul Fitzpatrick	45d2d5f897	(core) back-end support for tables that are accessible only by owners ... Summary: This makes it possible to serve a table or tables only to owners. * The _grist_ACLResources table is abused (temporarily) such that rows of the form `{colId: '~o', tableId}` are interpreted as meaning that `tableId` is private to owners. * Many websocket and api endpoints are updated to preserve the privacy of these tables. * In a document where some tables are private, a lot of capabilities are turned off for non-owners to avoid leaking info indirectly. * The client is tweaked minimally, to show '-' where a page with some private material would otherwise go. No attempt is made to protect data from private tables pulled into non-private tables via formulas. There are some known leaks remaining: * Changes to the schema of private tables are still broadcast to all clients (fixable). * Non-owner may be able to access snapshots or make forks or use other corners of API (fixable). * Changing name of table makes it public, since tableId in ACLResource is not updated (fixable). Security will require some work, the attack surface is large. Test Plan: added tests Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2604	4 years ago
Paul Fitzpatrick	4a545c9f2a	(core) make sharing with everyone@ on documents effective ... Summary: Sharing a document with everyone@ was effective at the api level, but had two flaws in the web client: * A logged in user with no access at the org level could not access a publically shared doc within that org. * Likewise, for the anonymous user (but for a different reason). This diff tweaks the web client to permit accessing a doc when org information is unavailable. It also changes how redirects happen for the anonymous user when accessing a doc. They now only happen once it has been confirmed that the user does not have access to the doc. Test Plan: added tests Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2591	4 years ago
Paul Fitzpatrick	5ef889addd	(core) move home server into core ... Summary: This moves enough server material into core to run a home server. The data engine is not yet incorporated (though in manual testing it works when ported). Test Plan: existing tests pass Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2552	4 years ago