Skip to content

Commit f22d070

Browse files
seguinleoseguinleo
committed
v25.4.1
1 parent 43d6a37 commit f22d070

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+4256
-3464
lines changed

‎src/.editorconfig renamed to ‎.editorconfig

File renamed without changes.

‎.gitignore

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Logs
2+
logs
3+
*.log
4+
npm-debug.log*
5+
yarn-debug.log*
6+
yarn-error.log*
7+
pnpm-debug.log*
8+
lerna-debug.log*
9+
10+
node_modules
11+
.DS_Store
12+
dist
13+
dist-ssr
14+
coverage
15+
*.local
16+
17+
/cypress/videos/
18+
/cypress/screenshots/
19+
20+
# Editor directories and files
21+
.vscode/*
22+
!.vscode/extensions.json
23+
.idea
24+
*.suo
25+
*.ntvs*
26+
*.njsproj
27+
*.sln
28+
*.sw?
29+
30+
*.tsbuildinfo

‎CHANGELOG.txt

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
#----v25.4.1----#
2+
-Refractor client code in Vue.js 3
3+
-Better dependencies management
4+
-Better code structure
5+
-Better dev environnement
6+
-Add katex support for math expressions
7+
-UI/UX and accessibility fixes
8+
-Change shared notes url
9+
110
#----v25.3.1----#
211
-Add full theme customization
312

‎Dockerfile

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# !!!!!!!!!!!!!!!
2+
# EDIT DOCKER CONFIGURATION TO YOUR NEEDS FOR PRODUCTION
3+
# !!!!!!!!!!!!!!!
4+
5+
FROM node:22 AS build-stage
6+
7+
WORKDIR /app
8+
9+
COPY package*.json ./
10+
11+
RUN npm install
12+
13+
COPY . .
14+
15+
RUN npm run build
16+
17+
FROM php:8.3-apache
18+
19+
RUN apt update && apt upgrade -y && apt --purge autoremove -y && apt clean && \
20+
groupadd -r myuser && useradd -r -g myuser myuser && \
21+
cp /usr/local/etc/php/php.ini-production /usr/local/etc/php/php.ini && \
22+
sed -i -e "s/display_errors = On/display_errors = Off/g" /usr/local/etc/php/php.ini && \
23+
docker-php-ext-install pdo pdo_mysql
24+
25+
USER myuser
26+
27+
COPY --from=build-stage /app/dist /var/www/html
28+
COPY --chown=myuser:myuser api /var/www/html/api
29+
30+
EXPOSE 80

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ A fast, private and secure web notebook.
1919
* [Self-hosting](#self-hosting)
2020

2121
## Features
22-
Users can create task lists, reminders, tables, links, and code blocks using Markdown and HTML. They can add online images, audio, or videos via URL. Notes can be searched, sorted by category, or organized into folders.
22+
Users can create task lists, reminders, tables, links, math expressions or code blocks using Markdown and HTML. They can add online images, audio, or videos via URL. Notes can be searched, sorted by category, or organized into folders.
2323

2424
Users can sync notes across devices in a secure database after signing in without needing an email address, only a username and strong password. Public notes can be shared via random URLs.
2525

@@ -38,9 +38,9 @@ Users can lock the app using biometrics (fingerprints, face, etc.). These biomet
3838

3939
## Todo
4040
* 2FA login (may refractor backend to Node.js)
41-
* Markdown plugins (may add security or slowness issues)
4241
* WEB Notification for reminders
4342
* Calendar for reminders (have to find a light and fast library)
43+
* Offline mode for cloud notes (security problems)
4444

4545
## Community
4646
If you find [issues](https://github.com/seguinleo/Bloc-notes/issues), [vulnerabilities](https://github.com/seguinleo/Bloc-notes/security) or if you have any [suggestions](https://github.com/seguinleo/Bloc-notes/discussions) to improve this project, feel free to discuss!

‎SECURITY.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
# Security Policy
22

3+
## Node version
4+
5+
| Version | Supported |
6+
|---------|--------------------|
7+
| 22.x | :white_check_mark: |
8+
| 21.x | :white_check_mark: |
9+
| < 20 | :x: |
10+
311
## PHP version
412

513
| Version | Supported |

‎src/assets/php/addNote.php renamed to ‎api/addNote.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
'bg-red',
2323
'bg-orange',
2424
'bg-yellow',
25+
'bg-lime',
2526
'bg-green',
2627
'bg-cyan',
2728
'bg-light-blue',

‎src/assets/php/class/Encryption.php renamed to ‎api/class/Encryption.php

File renamed without changes.

‎src/assets/php/config/config.php renamed to ‎api/config/config.php

File renamed without changes.

‎src/assets/php/connectUser.php renamed to ‎api/connectUser.php

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,6 @@
1818
throw new Exception('Connection failed');
1919
return;
2020
}
21-
if (filter_input(INPUT_POST, 'csrf_token', FILTER_DEFAULT) !== $_SESSION['csrf_token']) {
22-
throw new Exception('Connection timeout, please reload the page');
23-
return;
24-
}
2521

2622
global $PDO;
2723
require_once __DIR__ . '/config/config.php';
@@ -63,7 +59,7 @@
6359
$cookieParams = [
6460
'path' => '/',
6561
'lifetime' => 604800,
66-
'secure' => false,
62+
'secure' => true,
6763
'httponly' => true,
6864
'samesite' => 'Lax',
6965
];
@@ -72,5 +68,4 @@
7268
session_regenerate_id();
7369
$_SESSION['name'] = $row['name'];
7470
$_SESSION['userId'] = $row['id'];
75-
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
7671
$_SESSION['lockApp'] = false;

‎src/assets/php/cookies.php renamed to ‎api/cookies.php

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
$cookieParams = [
44
'path' => '/',
55
'lifetime' => 604800,
6-
'secure' => false,
6+
'secure' => true,
77
'httponly' => true,
88
'samesite' => 'Lax',
99
];
@@ -12,5 +12,3 @@
1212
session_regenerate_id();
1313

1414
$name = $_SESSION['name'] ?? null;
15-
$csrf_token = bin2hex(random_bytes(32));
16-
$_SESSION['csrf_token'] = $csrf_token;

‎src/assets/php/createUser.php renamed to ‎api/createUser.php

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,6 @@
2424

2525
$id = bin2hex(random_bytes(12));
2626
$psswdCreateHash = password_hash($psswdCreate, PASSWORD_DEFAULT);
27-
28-
/**
29-
*
30-
* Store key in sql database or, use a secure vault like AWS KMS, Azure Key Vault or a self-hosted solution.
31-
*
32-
*/
3327
$key = bin2hex(random_bytes(32));
3428

3529
try {

‎src/assets/php/deleteAccount.php renamed to ‎api/deleteAccount.php

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,6 @@
66
$userId = $_SESSION['userId'];
77
$psswd = filter_input(INPUT_POST, 'psswd', FILTER_DEFAULT);
88

9-
if (filter_input(INPUT_POST, 'csrf_token', FILTER_DEFAULT) !== $_SESSION['csrf_token']) {
10-
throw new Exception('Connection timeout, please reload the page');
11-
return;
12-
}
139
if (isset($name, $userId) === false) {
1410
throw new Exception('Account deletion failed');
1511
return;

‎src/assets/php/deleteNote.php renamed to ‎api/deleteNote.php

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,6 @@
55
$name = $_SESSION['name'];
66
$noteId = filter_input(INPUT_POST, 'noteId', FILTER_DEFAULT);
77

8-
if (filter_input(INPUT_POST, 'csrf_token', FILTER_DEFAULT) !== $_SESSION['csrf_token']) {
9-
throw new Exception('Connection timeout, please reload the page');
10-
return;
11-
}
128
if (isset($name, $noteId) === false) {
139
throw new Exception('Note deletion failed');
1410
return;

‎src/assets/php/getKey.php renamed to ‎api/getKey.php

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,6 @@
55
$name = $_SESSION['name'];
66
$userId = $_SESSION['userId'];
77

8-
if (filter_input(INPUT_POST, 'csrf_token', FILTER_DEFAULT) !== $_SESSION['csrf_token']) {
9-
throw new Exception('Connection timeout, please reload the page');
10-
return;
11-
}
128
if (isset($name, $userId) === false) {
139
throw new Exception('Key retrieval failed');
1410
return;
@@ -22,11 +18,6 @@
2218
return;
2319
}
2420

25-
/**
26-
*
27-
* Get key from sql database or, using a secure vault like AWS KMS, Azure Key Vault or a self-hosted solution.
28-
*
29-
*/
3021
try {
3122
$query = $PDO->prepare("SELECT oneKey,lastLogin FROM users WHERE name=:CurrentUser AND id=:UserId LIMIT 1");
3223
$query->execute(

‎src/assets/php/getLockApp.php renamed to ‎api/getLockApp.php

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,6 @@
22
session_name('secureNotes');
33
session_start();
44

5-
if (filter_input(INPUT_POST, 'csrf_token', FILTER_DEFAULT) !== $_SESSION['csrf_token']) {
6-
throw new Exception('Connection timeout, please reload the page');
7-
return;
8-
}
9-
105
$lockApp = filter_var($_SESSION['lockApp'], FILTER_VALIDATE_BOOLEAN);
116

127
header('Content-Type: application/json');

‎src/assets/php/getNotes.php renamed to ‎api/getNotes.php

File renamed without changes.

‎src/assets/php/getSharedNote.php renamed to ‎api/getSharedNote.php

File renamed without changes.

‎api/getUser.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?php
2+
session_name('secureNotes');
3+
$cookieParams = [
4+
'path' => '/',
5+
'lifetime' => 604800,
6+
'secure' => true,
7+
'httponly' => true,
8+
'samesite' => 'Lax',
9+
];
10+
session_set_cookie_params($cookieParams);
11+
session_start();
12+
session_regenerate_id();
13+
14+
$name = $_SESSION['name'] ?? false;
15+
16+
header('Content-Type: application/json');
17+
print_r(json_encode(['name' => $name]));

‎api/lockApp.php

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?php
2+
session_name('secureNotes');
3+
session_start();
4+
5+
$lockApp = filter_input(INPUT_POST, 'lock_app', FILTER_VALIDATE_BOOLEAN);
6+
$_SESSION['lockApp'] = $lockApp;

‎src/assets/php/logout.php renamed to ‎api/logout.php

File renamed without changes.

‎src/assets/php/pinNote.php renamed to ‎api/pinNote.php

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,6 @@
55
$name = $_SESSION['name'];
66
$noteId = filter_input(INPUT_POST, 'noteId', FILTER_DEFAULT);
77

8-
if (filter_input(INPUT_POST, 'csrf_token', FILTER_DEFAULT) !== $_SESSION['csrf_token']) {
9-
throw new Exception('Connection timeout, please reload the page');
10-
return;
11-
}
128
if (isset($name, $noteId) === false) {
139
throw new Exception('Pin note failed');
1410
return;

‎src/assets/php/privateNote.php renamed to ‎api/privateNote.php

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,6 @@
66
$noteId = filter_input(INPUT_POST, 'noteId', FILTER_DEFAULT);
77
$noteLink = filter_input(INPUT_POST, 'noteLink', FILTER_DEFAULT);
88

9-
if (filter_input(INPUT_POST, 'csrf_token', FILTER_DEFAULT) !== $_SESSION['csrf_token']) {
10-
throw new Exception('Connection timeout, please reload the page');
11-
return;
12-
}
139
if (isset($name, $noteId, $noteLink) === false) {
1410
throw new Exception('Note modification failed');
1511
return;

‎src/assets/php/publicNote.php renamed to ‎api/publicNote.php

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,6 @@
55
$name = $_SESSION['name'];
66
$noteId = filter_input(INPUT_POST, 'noteId', FILTER_DEFAULT);
77

8-
if (filter_input(INPUT_POST, 'csrf_token', FILTER_DEFAULT) !== $_SESSION['csrf_token']) {
9-
throw new Exception('Connection timeout, please reload the page');
10-
return;
11-
}
128
if (isset($name, $noteId) === false) {
139
throw new Exception('Note modification failed');
1410
return;

‎src/assets/php/updateNote.php renamed to ‎api/updateNote.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
'bg-red',
2323
'bg-orange',
2424
'bg-yellow',
25+
'bg-lime',
2526
'bg-green',
2627
'bg-cyan',
2728
'bg-light-blue',

‎src/assets/php/updatePsswd.php renamed to ‎api/updatePsswd.php

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,6 @@
77
$psswdOld = filter_input(INPUT_POST, 'psswdOld', FILTER_DEFAULT);
88
$psswdNew = filter_input(INPUT_POST, 'psswdNew', FILTER_DEFAULT);
99

10-
if (filter_input(INPUT_POST, 'csrf_token', FILTER_DEFAULT) !== $_SESSION['csrf_token']) {
11-
throw new Exception('Connection timeout, please reload the page');
12-
return;
13-
}
1410
if (isset($name, $userId, $psswdOld) === false) {
1511
throw new Exception('Password update failed');
1612
return;

‎src/docker-compose.yml renamed to ‎docker-compose.yml

File renamed without changes.

‎src/dump.sql renamed to ‎dump.sql

File renamed without changes.

‎eslint.config.js

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
import { defineConfig } from "eslint/config";
2+
import globals from "globals";
3+
import js from "@eslint/js";
4+
import pluginVue from "eslint-plugin-vue";
5+
6+
export default defineConfig([
7+
{ files: ["**/*.{js,mjs,cjs,vue}"] },
8+
{ files: ["**/*.{js,mjs,cjs,vue}"], languageOptions: { globals: globals.browser } },
9+
{ files: ["**/*.{js,mjs,cjs,vue}"], plugins: { js }, extends: ["js/recommended"] },
10+
pluginVue.configs["flat/essential"],
11+
]);

‎index.html

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!DOCTYPE html>
2+
<html lang="">
3+
<head>
4+
<meta charset="utf-8">
5+
<title>Bloc-notes &#8211; Léo SEGUIN</title>
6+
<meta name="description" content="A fast, private and secure notebook with Markdown support.">
7+
<meta name="viewport" content="width=device-width, initial-scale=1">
8+
<meta name="theme-color" content="#000" class="theme-color">
9+
<meta name="mobile-web-app-capable" content="yes">
10+
<meta name="apple-mobile-web-app-capable" content="yes">
11+
<meta name="apple-mobile-web-app-status-bar-style" content="#000" class="theme-color">
12+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; connect-src 'self'; font-src 'self' data: https://cdnjs.cloudflare.com/; form-action 'self'; img-src http:; manifest-src 'self'; media-src https:; script-src 'self'; script-src-attr 'none'; style-src 'self' https://cdnjs.cloudflare.com/; style-src-attr 'unsafe-inline' 'self'; worker-src 'self'">
13+
<link rel="apple-touch-icon" href="./icons/apple-touch-icon.png">
14+
<link rel="icon" href="./favicon.ico">
15+
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.7.2/css/all.min.css">
16+
<link rel="manifest" href="./app.webmanifest">
17+
</head>
18+
<body>
19+
<div id="app"></div>
20+
<script type="module" src="/src/main.js"></script>
21+
</body>
22+
</html>

‎jsconfig.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"compilerOptions": {
3+
"paths": {
4+
"@/*": ["./src/*"]
5+
}
6+
},
7+
"exclude": ["node_modules", "dist"]
8+
}

0 commit comments

Comments
 (0)