* Fix IDOR in exports by adding token verification Implement jdleesmiller's suggested fix for Issue #31637: - V1: Return export token in create response - V1: Verify token in get_export using secure_compare - Web: Pass token through fetchExport and fetchDownload - Web: Return token from exportProject to frontend - Frontend: Pass token as query param on status/download requests - Add tests for both services Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0 Co-authored-by: briangough <7457354+briangough@users.noreply.github.com> Fix window.location.pathname to .href to preserve query params Code review correctly identified that window.location.pathname strips query parameters. Switch to window.location.href so the token query parameter is preserved in download URLs. Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0 Co-authored-by: briangough <7457354+briangough@users.noreply.github.com> Fix test mocks to include token in POST responses Agent-Logs-Url: https://github.com/overleaf/internal/sessions/0350c6ef-0fff-4e98-8464-812cd92c523f Co-authored-by: briangough <7457354+briangough@users.noreply.github.com> fix formatting Fix token assignment in initiateExport to use pollResponse token if available Add requireExportToken config setting and tests for invalid/missing token cases Agent-Logs-Url: https://github.com/overleaf/internal/sessions/059bdba2-4f7a-4407-a5a5-cfcffd888739 Co-authored-by: briangough <7457354+briangough@users.noreply.github.com> fix formatting Add tests for export status and token validation in ExportsController and MockV1Api Co-authored-by: Copilot <copilot@github.com> * Update services/v1/main/app/controllers/api/v1/overleaf/exports_controller.rb Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix linting * fix fetchString response handling in ExportsHandler tests --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Brian Gough <briangough@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Brian Gough <brian.gough@overleaf.com> GitOrigin-RevId: 399aef8eaa15ab3655f0905482f3a31fe94e2251
overleaf/web
overleaf/web is the front-end web service of the open-source web-based collaborative LaTeX editor, Overleaf. It serves all the HTML pages, CSS and javascript to the client. overleaf/web also contains a lot of logic around creating and editing projects, and account management.
The rest of the Overleaf stack, along with information about contributing can be found in the overleaf/overleaf repository.
Running the app
The app runs natively using yarn and Node on the local system:
$ yarn install
$ yarn run start
Running Tests
To run all tests run:
make test
To run both unit and acceptance tests for a module run:
make test_module MODULE=saas-authentication
Unit Tests
The test suites run in Docker.
Unit tests can be run in the test_unit container defined in docker-compose.tests.yml.
The makefile contains a short cut to run these:
make test_unit
During development it is often useful to only run a subset of tests, which can be configured with arguments to the mocha CLI:
make test_unit MOCHA_GREP='AuthorizationManager'
To run only the unit tests for a single module do:
make test_unit_module MODULE=saas-authentication
Module tests can also use a MOCHA_GREP argument:
make test_unit_module MODULE=saas-authentication MOCHA_GREP=SSO
Acceptance Tests
Acceptance tests are run against a live service, which runs in the acceptance_test container defined in docker-compose.tests.yml.
To run the tests out-of-the-box, the makefile defines:
make test_acceptance
However, during development it is often useful to leave the service running for rapid iteration on the acceptance tests. This can be done with:
make test_acceptance_app_start_service
make test_acceptance_app_run # Run as many times as needed during development
make test_acceptance_app_stop_service
make test_acceptance just runs these three commands in sequence and then runs make test_acceptance_modules which performs the tests for each module in the modules directory. (Note that there is not currently an equivalent to the -start / -run x n / -stop series for modules.)
During development it is often useful to only run a subset of tests, which can be configured with arguments to the mocha CLI:
make test_acceptance_run MOCHA_GREP='AuthorizationManager'
To run only the acceptance tests for a single module do:
make test_acceptance_module MODULE=saas-authentication
Module tests can also use a MOCHA_GREP argument:
make test_acceptance_module MODULE=saas-authentication MOCHA_GREP=SSO
Routes
Run bin/routes to print out all routes in the project.
License and Credits
This project is licensed under the AGPLv3 license
Stylesheets
Overleaf is based on Bootstrap, which is licensed under the
MIT license.
All modifications (*.less files in public/stylesheets) are also licensed
under the MIT license.
Artwork
Silk icon set 1.3
We gratefully acknowledge Mark James for
releasing his Silk icon set under the Creative Commons Attribution 2.5 license. Some
of these icons are used within Overleaf inside the public/img/silk and
public/brand/icons directories.
IconShock icons
We gratefully acknowledge IconShock for use of the icons
in the public/img/iconshock directory found via
findicons.com