diff --git a/.mailmap b/.mailmap index b50bae079a..42f74158ab 100644 --- a/.mailmap +++ b/.mailmap @@ -8,7 +8,10 @@ # For any emails that show up in the shortlog that aren't in one of # these lists, figure out their GitHub username and add them. +GITHUB: aldeed GITHUB: AlexeyMK +GITHUB: apendua +GITHUB: arbesfeld GITHUB: DenisGorbachev GITHUB: EOT GITHUB: FooBarWidget @@ -20,10 +23,12 @@ GITHUB: awwx GITHUB: cmather GITHUB: codeinthehole GITHUB: dandv +GITHUB: davegonzalez GITHUB: emgee3 GITHUB: icellan GITHUB: jacott GITHUB: jfhamlin +GITHUB: justinsb GITHUB: marcandre GITHUB: mart-jansink GITHUB: meawoppl @@ -33,7 +38,9 @@ GITHUB: mitar GITHUB: mizzao GITHUB: mquandalle GITHUB: nathan-muir +GITHUB: Neftedollar GITHUB: paulswartz +GITHUB: Pent GITHUB: queso GITHUB: rdickert GITHUB: rgould @@ -50,6 +57,7 @@ METEOR: dgreensp METEOR: estark37 METEOR: estark37 METEOR: glasser +METEOR: glasser METEOR: gschmidt METEOR: karayu METEOR: n1mmy @@ -57,3 +65,4 @@ METEOR: sixolet METEOR: Slava METEOR: stubailo METEOR: ekatek + diff --git a/History.md b/History.md index 2fc9926153..ec6b87b515 100644 --- a/History.md +++ b/History.md @@ -1,5 +1,130 @@ ## v.NEXT +#### Meteor Accounts + +* Fix a security flaw in OAuth1 and OAuth2 implementations. If you are + using any OAuth accounts packages (such as `accounts-google` or + `accounts-twitter`), we recommend that you update immediately and log + out your users' current sessions with the following MongoDB command: + + $ db.users.update({}, { $set: { 'services.resume.loginTokens': [] } }, { multi: true }); + +* OAuth redirect URLs are now required to be on the same origin as your app. + +* Log out a user's other sessions when they change their password. + +* Store pending OAuth login results in the database instead of + in-memory, so that an OAuth flow succeeds even if different requests + go to different server processes. + +* When validateLoginAttempt callbacks return false, don't override a more + specific error message. + +* Add `Random.secret()` for generating security-critical secrets like + login tokens. + +* `Meteor.logoutOtherClients` now calls the user callback when other + login tokens have actually been removed from the database, not when + they have been marked for eventual removal. #1915 + +* Rename `Oauth` to `OAuth`. `Oauth` is now an alias for backwards + compatibility. + +* Add `oauth-encryption` package for encrypting sensitive account + credentials in the database. + +* A validate login hook can now override the exception thrown from + `beginPasswordExchange` like it can for other login methods. + +* Remove an expensive observe over all users in the `accounts-base` + package. + + +#### Blaze + +* Disallow `javascript:` URLs in URL attribute values by default, to + help prevent cross-site scripting bugs. Call + `UI._allowJavascriptUrls()` to allow them. + +* Fix `UI.toHTML` on templates containing `{{#with}}`. + +* Fix `{{#with}}` over a data context that is mutated. #2046 + +* Clean up autoruns when calling `UI.toHTML`. + +* Add support for `{{!-- block comments --}}` in Spacebars. Block comments may + contain `}}`, so they are more useful than `{{! normal comments}}` for + commenting out sections of Spacebars templates. + +* Don't dynamically insert `` tags in reactive tables + +* When handling a custom jQuery event, additional arguments are + no longer lost -- they now come after the template instance + argument. #1988 + + +#### DDP and MongoDB + +* Extend latency compensation to support an arbitrary sequence of + inserts in methods. Previously, documents created inside a method + stub on the client would eventually be replaced by new documents + from the server, causing the screen to flicker. Calling `insert` + inside a method body now generates the same ID on the client (inside + the method stub) and on the server. A sequence of inserts also + generates the same sequence of IDs. Code that wants a random stream + that is consistent between method stub and real method execution can + get one with `DDP.randomStream`. + https://trello.com/c/moiiS2rP/57-pattern-for-creating-multiple-database-records-from-a-method + +* DDP now has an implementation of bidirectional heartbeats which is consistent + across SockJS and websocket transports. This enables connection keepalive and + allows servers and clients to more consistently and efficiently detect + disconnection. + +* The DDP protocol version number has been incremented to "pre2" (adding + randomSeed and heartbeats). + +* The oplog observe driver handles errors communicating with MongoDB + better and knows to re-poll all queries after a MongoDB failover. + +* Fix bugs involving mutating DDP method arguments. + + +#### meteor command-line tool + +* Move boilerplate HTML from tools to webapp. Change internal + `Webapp.addHtmlAttributeHook` API. + +* Add `meteor list-sites` command for listing the sites that you have + deployed to meteor.com with your Meteor developer account. + +* Third-party template languages can request that their generated source loads + before other JavaScript files, just like *.html files, by passing the + isTemplate option to Plugin.registerSourceHandler. + +* You can specify a particular interface for the dev mode runner to bind to with + `meteor -p host:port`. + +* Don't include proprietary tar tags in bundle tarballs. + +* Convert relative URLs to absolute URLs when merging CSS files. + + +#### Upgraded dependencies + +* Node.js from 0.10.25 to 0.10.26. +* MongoDB driver from 1.3.19 to 1.4.1 +* stylus: 0.42.3 (from 0.42.2) +* showdown: 0.3.1 +* css-parse: an unreleased version (from 1.7.0) +* css-stringify: an unreleased version (from 1.4.1) + + +Patches contributed by GitHub users aldeed, apendua, arbesfeld, awwx, dandv, +davegonzalez, emgee3, justinsb, mquandalle, Neftedollar, Pent, sdarnell, +and timhaines. + + ## v0.8.0.1 * Fix security flaw in OAuth1 implementation. Clients can no longer diff --git a/LICENSE.txt b/LICENSE.txt index afa98ec4df..448afeb0e4 100644 --- a/LICENSE.txt +++ b/LICENSE.txt @@ -561,6 +561,65 @@ html5: https://github.com/aredridel/html5 Copyright (c) 2010 Aria Stewart +---------- +node-aes-gcm: https://github.com/xorbit/node-aes-gcm +---------- + +Copyright (c) 2013 Patrick Van Oosterwijck + + +---------- +nan: https://github.com/rvagg/nan +---------- + +Copyright 2013, NAN contributors: + - Rod Vagg + - Benjamin Byholm + - Trevor Norris + - Nathan Rajlich + - Brett Lawson + - Ben Noordhuis +(the "Original Author") +All rights reserved. + +MIT +no-false-attribs License + +Permission is hereby granted, free of charge, to any person +obtaining a copy of this software and associated documentation +files (the "Software"), to deal in the Software without +restriction, including without limitation the rights to use, +copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the +Software is furnished to do so, subject to the following +conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +Distributions of all or part of the Software intended to be used +by the recipients as they would use the unmodified Software, +containing modifications that substantially alter, remove, or +disable functionality of the Software, outside of the documented +configuration mechanisms provided by the Software, shall be +modified such that the Original Author's bug reporting email +addresses and urls are either replaced with the contact information +of the parties responsible for the changes, or removed entirely. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES +OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT +HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR +OTHER DEALINGS IN THE SOFTWARE. + + +Except where noted, this license applies to any and all software +programs and associated documentation files created by the +Original Author, when distributed with the Software. + + ============== Apache License @@ -1509,6 +1568,39 @@ OTHER DEALINGS IN THE SOFTWARE. For more information, please refer to +---------- +npm-install-checks: https://github.com/npm/npm-install-checks +---------- + +Copyright (c) Robert Kowalski and Isaac Z. Schlueter ("Authors") +All rights reserved. + +The BSD License + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: + +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS +BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + ---------- tough-cookie: https://github.com/goinstant/tough-cookie ---------- diff --git a/docs/.meteor/release b/docs/.meteor/release index 4b324f2d8f..6f4eebdf6f 100644 --- a/docs/.meteor/release +++ b/docs/.meteor/release @@ -1 +1 @@ -0.8.0.1 +0.8.1 diff --git a/docs/client/api.html b/docs/client/api.html index 41c88d2f72..ff1f70e001 100644 --- a/docs/client/api.html +++ b/docs/client/api.html @@ -1710,6 +1710,11 @@ example, to support GitHub login, run `$ meteor add accounts-github` and use the Session.set('errorMessage', err.reason || 'Unknown error'); }); +Login service configuration is sent from the server to the client over DDP when +your app starts up; you may not call the login function until the configuration +is loaded. The function `Accounts.loginServicesConfigured()` is a reactive data +source that will return true once the login service is configured; you should +not make login buttons visible or active until it is true. {{> api_box currentUser}} @@ -1848,10 +1853,18 @@ proceed. If the callback returns a falsy value or throws an exception, the login is aborted. Throwing a `Meteor.Error` will report the error reason to the user. -All registered validate login callbacks are called, even if one of the -callbacks aborts the login. The later callbacks will see the -`allowed` field set to `false` since the login will now not be -successful. +All registered validate login callbacks are called, even if one of the callbacks +aborts the login. The later callbacks will see the `allowed` field set to +`false` since the login will now not be successful. This allows later callbacks +to override an error from a previous callback; for example, you could override +the "Incorrect password" error with a different message. + +Validate login callbacks that aren't explicitly trying to override a previous +error generally have no need to run if the attempt has already been determined +to fail, and should start with + + if (!attempt.allowed) + return false; {{> api_box accounts_onLogin}} diff --git a/docs/client/api.js b/docs/client/api.js index 4d83217bb5..4bffbeb556 100644 --- a/docs/client/api.js +++ b/docs/client/api.js @@ -58,12 +58,18 @@ Template.api.settings = { id: "meteor_settings", name: "Meteor.settings", locus: "Anywhere", - descr: ["`Meteor.settings` contains deployment-specific configuration options. " + - "You can initialize settings by passing the `--settings` option (which takes a file containing JSON data) to " + - "`meteor run` or `meteor deploy`, " + - "or by setting your server process's `METEOR_SETTINGS` environment variable to a JSON string. " + - "If you don't provide any settings, `Meteor.settings` will be an empty object. If the settings object contains a key named `public`, then " + - "`Meteor.settings.public` will be available on the client as well as the server. All other properties of `Meteor.settings` are only defined on the server."] + descr: ["`Meteor.settings` contains deployment-specific configuration " + + "options. You can initialize settings by passing the `--settings` " + + "option (which takes the name of a file containing JSON data) to " + + "`meteor run` or `meteor deploy`. When running your server " + + "directly (e.g. from a bundle), you instead specify settings by " + + "putting the JSON directly into the `METEOR_SETTINGS` environment " + + "variable. " + + "If you don't provide any settings, `Meteor.settings` will be an " + + "empty object. If the settings object contains a key named " + + "`public`, then `Meteor.settings.public` will be available on the " + + "client as well as the server. All other properties of " + + "`Meteor.settings` are only defined on the server."] }; Template.api.release = { @@ -1158,6 +1164,11 @@ Template.api.accounts_config = { name: "loginExpirationInDays", type: "Number", descr: "The number of days from when a user logs in until their token expires and they are logged out. Defaults to 90. Set to `null` to disable login expiration." + }, + { + name: "oauthSecretKey", + type: "String", + descr: "When using the `oauth-encryption` package, the 16 byte key using to encrypt sensitive account credentials in the database, encoded in base64. This option may only be specifed on the server. See packages/oauth-encryption/README.md for details." } ] }; @@ -1678,7 +1689,7 @@ Template.api.httpcall = { args: [ {name: "method", type: "String", - descr: 'The HTTP method to use: "`GET`", "`POST`", "`PUT`", or "`DELETE`".'}, + descr: 'The [HTTP method](http://en.wikipedia.org/wiki/HTTP_method) to use, such as "`GET`", "`POST`", or "`HEAD`".'}, {name: "url", type: "String", descr: 'The URL to retrieve.'}, @@ -1713,7 +1724,7 @@ Template.api.httpcall = { descr: "Maximum time in milliseconds to wait for the request before failing. There is no timeout by default."}, {name: "followRedirects", type: "Boolean", - descr: "If true, transparently follow HTTP redirects. Cannot be set to false on the client."} + descr: "If `true`, transparently follow HTTP redirects. Cannot be set to `false` on the client. Default `true`."} ] }; diff --git a/docs/client/concepts.html b/docs/client/concepts.html index 30df284a68..6edef8e354 100644 --- a/docs/client/concepts.html +++ b/docs/client/concepts.html @@ -741,7 +741,7 @@ To get started, run This command will generate a fully-contained Node.js application in the form of a tarball. To run this application, you need to provide Node.js 0.10 and a MongoDB server. (The current release of Meteor has been tested with Node -0.10.25; older versions contain a serious bug that can cause production servers +0.10.26; older versions contain a serious bug that can cause production servers to stall.) You can then run the application by invoking node, specifying the HTTP port for the application to listen on, and the MongoDB endpoint. If you don't already have a MongoDB server, we can recommend our friends at diff --git a/docs/client/docs.css b/docs/client/docs.css index 70afcfd9cd..5240351084 100644 --- a/docs/client/docs.css +++ b/docs/client/docs.css @@ -173,7 +173,7 @@ a:hover { /** Main pane **/ #main { - margin: 10px; + margin: 10px 10px 10px 60px; line-height: 1.3; color: #333333; } @@ -407,10 +407,34 @@ dl.callbacks { /** layout control **/ -/* default to no sidebar */ -#nav { +#menu-ico { + font-size: 30px; + float: right; + position: fixed; + top: 3px; + left: 6px; +} + +#menu-ico.hidden { display: none; } + +/* default to no sidebar */ +#nav { + display: block; + background: #FFF; + position: fixed; + width: 260px; + height: 100%; + top: 0; + left: -220px; +} + +#nav.show { + left: 0; + overflow: auto; +} + .github-ribbon { display: none; } @@ -419,37 +443,44 @@ pre { } @media (min-width: 768px) { -/* ipad portrait or better */ -#main { - width: 440px; - height: 100%; - margin-left: 260px; /* nav width + padding */ - padding: 30px; -} -#nav { - display: block; - width: 200px; - position: fixed; - overflow: auto; - height: 100%; - top: 0; - left: 0; -} -.main-headline { - display: none; -} + /* ipad portrait or better */ + #main { + width: 440px; + height: 100%; + margin-left: 260px; /* nav width + padding */ + padding: 30px; + } + #nav { + display: block; + width: 200px; + position: fixed; + overflow: auto; + height: 100%; + top: 0; + left: 0; + } + .main-headline { + display: none; + } + + #menu-ico { + display: none; + } } @media (min-width: 1024px) { -/* ipad landscape and desktop */ -#main { - width: 610px; - margin-left: 330px; /* nav width + padding */ -} -#nav { - width: 270px; -} -.github-ribbon { - display: block; -} + /* ipad landscape and desktop */ + #main { + width: 610px; + margin-left: 330px; /* nav width + padding */ + } + #nav { + width: 270px; + } + .github-ribbon { + display: block; + } + #menu-ico { + display: none; + } } diff --git a/docs/client/docs.html b/docs/client/docs.html index c67d0b6139..b2bcfe2f78 100644 --- a/docs/client/docs.html +++ b/docs/client/docs.html @@ -8,7 +8,7 @@ -