Merge pull request #54 from ONLYOFFICE/develop

Release/1.1.3

3rd-Party.license

@@ -104,6 +104,10 @@ Typescript    - TypeScript is a language for application-scale JavaScript. (http
 License:        Apache License 2.0
 License File:   typescript.license
 
+Useragent     - Go/Golang parser for user agent strings. (https://github.com/mileusna/useragent)
+License:        MIT
+License File:   useragent.license
+
 validator     - Package validator implements value validations for structs and individual fields based on tags. (https://github.com/go-playground/validator)
 License:        MIT
 License File:   validator.license

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Change Log
 
+## 1.1.3
+## Added
+- link to docs cloud
+
+## Changed
+- update of vulnerable dependencies
+
 ## 1.1.2
 ## Changed
 - update JWT lib

README.md

@@ -30,21 +30,29 @@ Community Edition vs Enterprise Edition comparison can be found [here](#onlyoffi
 
 ## Installing Mattermost ONLYOFFICE integration plugin
 
-1. Clone the [master branch](https://github.com/ONLYOFFICE/onlyoffice-mattermost).
-2. Go to the project root.
-3. Install the dependencies: 
+1. Install Node.js. [Check instructions](https://github.com/nodesource/distributions#installation-instructions)
+2. Install Go. [Check instructions](https://go.dev/doc/install)
+3. Install make: 
 
     ```sh
-    npm install --legacy-peer-deps
+    sudo apt install make
     ```
-    Please note: to build the plugin, you need to have Node.js v.15.14.0 installed on your machine.
-4. Run: 
+4. Clone the plugin branch: 
 
     ```sh
+    git clone https://github.com/ONLYOFFICE/onlyoffice-mattermost.git
+    ```
+5. Install the dependencies:
+    ```sh
+    cd onlyoffice-mattermost/webapp/
+    npm install --legacy-peer-deps
+    ```
+6. Go to the project root and start the build:
+    ```sh
+    cd onlyoffice-mattermost/
     make dist
     ```
-5. Go to `<your_mattermost_host>/admin_console/plugins/plugin_management`.
-6. Choose the compiled plugin from your dist folder and press Upload.
+    Please note: if `Error: error:0308010C:digital envelope routines::unsupported` occurs, add the `export NODE_OPTIONS=--openssl-legacy-provider` variable.
 
 ## Plugin settings
 

go.mod

@@ -14,4 +14,7 @@ require (
 	github.com/stretchr/testify v1.8.1
 )
 
-require github.com/golang-jwt/jwt/v5 v5.0.0
+require (
+	github.com/golang-jwt/jwt/v5 v5.0.0
+	github.com/mileusna/useragent v1.3.4 // indirect
+)

go.sum

@@ -1007,6 +1007,8 @@ github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKju
 github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4=
 github.com/miekg/dns v1.1.48/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
 github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/mileusna/useragent v1.3.4 h1:MiuRRuvGjEie1+yZHO88UBYg8YBC/ddF6T7F56i3PCk=
+github.com/mileusna/useragent v1.3.4/go.mod h1:3d8TOmwL/5I8pJjyVDteHtgDGcefrFUX4ccGOMKNYYc=
 github.com/minio/md5-simd v1.1.0/go.mod h1:XpBqgZULrMYD3R+M28PcmP0CkI7PEMzB3U77ZrKZ0Gw=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=

licenses/3rd-Party.license

@@ -4,10 +4,6 @@ Babel         - The compiler for writing next generation JavaScript. (https://gi
 License:        MIT
 License File:   babel.license
 
-Bootstrap     - Sleek, intuitive, and powerful front-end framework for faster and easier web development. (https://github.com/twbs/bootstrap)
-License:        MIT
-License File:   bootstrap.license
-
 Core-js       - Modular standard library for JavaScript. Includes polyfills for ECMAScript up to 2021: promises, symbols, collections, iterators, typed arrays, many other features, ECMAScript proposals, some cross-platform WHATWG / W3C features and proposals like URL. (https://github.com/zloirock/core-js)
 License:        MIT
 License File:   core-js.license
@@ -44,10 +40,6 @@ Jwt-go        - A go (or 'golang' for search engine friendliness) implementation
 License:        MIT
 License File:   jwt-go.license
 
-Lodash        - A modern JavaScript utility library delivering modularity, performance & extras. (https://github.com/lodash/lodash)
-License:        MIT
-License File:   lodash.license
-
 Mapstructure  - mapstructure is a Go library for decoding generic map values to structures and vice versa, while providing helpful error handling. (https://github.com/mitchellh/mapstructure)
 License:        MIT
 License File:   mapstructure.license
@@ -88,6 +80,10 @@ Redux         - Redux is a predictable state container for JavaScript apps. (htt
 License:        MIT
 License File:   redux.license
 
+Resty         - Simple HTTP and REST client library for Go. (https://github.com/go-resty/resty)
+License:        MIT
+License File:   resty.license
+
 Sass-loader   - Loads a Sass/SCSS file and compiles it to CSS. (https://github.com/webpack-contrib/sass-loader)
 License:        MIT
 License File:   sass-loader.license
@@ -108,6 +104,10 @@ Typescript    - TypeScript is a language for application-scale JavaScript. (http
 License:        Apache License 2.0
 License File:   typescript.license
 
+Useragent     - Go/Golang parser for user agent strings. (https://github.com/mileusna/useragent)
+License:        MIT
+License File:   useragent.license
+
 validator     - Package validator implements value validations for structs and individual fields based on tags. (https://github.com/go-playground/validator)
 License:        MIT
 License File:   validator.license

licenses/useragent.license

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Miloš Mileusnić
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

plugin.json

@@ -6,8 +6,8 @@
     "support_url": "https://github.com/ONLYOFFICE/onlyoffice-mattermost/issues",
     "release_notes_url": "https://github.com/ONLYOFFICE/onlyoffice-mattermost/releases/latest",
     "icon_path": "assets/logo.svg",
-    "version": "1.1.2",
-    "min_server_version": "5.37.2",
+    "version": "1.1.3",
+    "min_server_version": "8.1.0",
     "server": {
         "executables": {
             "linux-amd64": "server/dist/plugin-linux-amd64",
@@ -22,7 +22,7 @@
     },
     "settings_schema": {
         "header": "ONLYOFFICE Docs is an open-source office suite which comprises powerful collaborative editors for text documents, spreadsheets, and presentations highly compatible with OOXML formats. \n \n \n Please note! ONLYOFFICE script code will be downloaded and executed from the server at the given address.",
-        "footer": "Check https://www.onlyoffice.com/office-suite.aspx for more information.",
+        "footer": "**ONLYOFFICE Docs Cloud**\nEasily launch the editors in the cloud without downloading and installation\n \n[**Get now**](https://www.onlyoffice.com/docs-registration.aspx?referer=mattermost)",
         "settings": [
             {
                 "key": "DESAddress",

server/api/onlyoffice/model/config.go

@@ -64,6 +64,10 @@ type UserInfoResponse struct {
 }
 
 type DownloadToken struct {
-	FileID string
+	Payload DownloadTokenPayload `json:"payload"`
 	jwt.RegisteredClaims
 }
+
+type DownloadTokenPayload struct {
+	URL string `json:"url"`
+}

server/api/web/download.go

@@ -19,31 +19,46 @@ package web
 
 import (
 	"net/http"
+	"net/url"
+	"strings"
 
 	"github.com/ONLYOFFICE/onlyoffice-mattermost/server/api"
 	"github.com/ONLYOFFICE/onlyoffice-mattermost/server/api/onlyoffice/model"
 )
 
 func BuildDownloadHandler(plugin api.PluginAPI) func(rw http.ResponseWriter, r *http.Request) {
 	return func(rw http.ResponseWriter, r *http.Request) {
-		query := r.URL.Query()
 		var jwt model.DownloadToken
 
-		err := plugin.Manager.Verify(query.Get("token"), &jwt)
+		token := strings.ReplaceAll(r.Header.Get(plugin.Configuration.Header), "Bearer ", "")
+		if token == "" {
+			plugin.API.LogError(_OnlyofficeLoggerPrefix + "could not extract jwt with the header specified. Please validate your JWT Header settings")
+			rw.WriteHeader(http.StatusForbidden)
+			return
+		}
+
+		err := plugin.Manager.Verify(token, &jwt)
 		if err != nil {
 			plugin.API.LogError(err.Error())
 			rw.WriteHeader(http.StatusForbidden)
 			return
 		}
 
-		file, fileErr := plugin.API.GetFile(jwt.FileID)
+		u, err := url.Parse(jwt.Payload.URL)
+		if err != nil {
+			plugin.API.LogError(err.Error())
+			rw.WriteHeader(http.StatusBadRequest)
+			return
+		}
+
+		file, fileErr := plugin.API.GetFile(u.Query().Get("id"))
 		if fileErr != nil {
 			plugin.API.LogError(_OnlyofficeLoggerPrefix + "could not download file. Reason: " + fileErr.Message)
 			rw.WriteHeader(http.StatusForbidden)
 			return
 		}
 
-		plugin.API.LogDebug(_OnlyofficeLoggerPrefix + "downloading file " + jwt.FileID)
+		plugin.API.LogDebug(_OnlyofficeLoggerPrefix + "downloading file " + u.Query().Get("id"))
 		rw.Write(file)
 	}
 }

server/api/web/editor.go

@@ -95,23 +95,12 @@ func BuildEditorHandler(plugin api.PluginAPI) func(rw http.ResponseWriter, r *ht
 			permissions = plugin.OnlyofficeHelper.GetFilePermissionsByUserID(payload.UserID, payload.FileID, post)
 		}
 
-		dToken := &oomodel.DownloadToken{
-			FileID: payload.FileID,
-		}
-		dToken.IssuedAt, dToken.ExpiresAt = jwt.NewNumericDate(time.Now()),
-			jwt.NewNumericDate(time.Now().Add(3*time.Minute))
-		dsignature, dTokenErr := plugin.Manager.Sign(dToken)
-		if dTokenErr != nil {
-			plugin.API.LogError(dTokenErr.Error())
-			return
-		}
-
 		config := oomodel.Config{
 			Document: oomodel.Document{
 				FileType:    fileInfo.Extension,
 				Key:         docKey,
 				Title:       fileInfo.Name,
-				URL:         fmt.Sprintf("%s/download?token=%s", serverURL, dsignature),
+				URL:         fmt.Sprintf("%s/download?id=%s", serverURL, fileInfo.Id),
 				Permissions: permissions,
 			},
 			DocumentType: docType,

server/internal/validator/device.go

@@ -17,18 +17,15 @@
  */
 package validator
 
-import "strings"
+import (
+	"github.com/mileusna/useragent"
+)
 
-func IsMobile(useragent string) string {
-	mobiles := []string{"Mobile Explorer", "Palm", "Motorola", "Nokia", "Palm", "Apple iPhone", "iPad", "Apple iPod Touch", "Sony Ericsson", "Sony Ericsson", "BlackBerry", "O2 Cocoon", "Treo", "LG", "Amoi", "XDA", "MDA", "Vario", "HTC", "Samsung",
-		"Sharp", "Siemens", "Alcatel", "BenQ", "HP iPaq", "Motorola", "PlayStation Portable", "PlayStation 3", "PlayStation Vita", "Danger Hiptop", "NEC", "Panasonic", "Philips", "Sagem", "Sanyo", "SPV", "ZTE", "Sendo", "Nintendo DSi", "Nintendo DS", "Nintendo 3DS",
-		"Nintendo Wii", "Open Web", "OpenWeb", "Android", "Symbian", "SymbianOS", "Palm", "Symbian S60", "Windows CE", "Obigo", "Netfront Browser", "Openwave Browser", "Mobile Explorer", "Opera Mini", "Opera Mobile", "Firefox Mobile",
-		"Digital Paths", "AvantGo", "Xiino", "Novarra Transcoder", "Vodafone", "NTT DoCoMo", "O2", "mobile", "wireless", "j2me", "midp", "cldc", "up.link", "up.browser", "smartphone", "cellphone", "Generic Mobile"}
-
-	for _, device := range mobiles {
-		if strings.Contains(useragent, device) {
-			return "mobile"
-		}
+func IsMobile(agent string) string {
+	res := useragent.Parse(agent)
+	if res.Mobile {
+		return "mobile"
 	}
+
 	return "desktop"
 }

webapp/src/i18n/de.json

@@ -17,5 +17,5 @@
     "permissions.modal_search_no_options_placeholder": "Keine Optionen",
     "permissions.modal_fetch_error": "Abrufen von Benutzern ist unmöglich",
     "editor.close_button": "Schließen",
-    "editor.events.error": "Hoppla! in Fehler ist aufgetreten..."
+    "editor.events.error": "Hoppla! Ein Fehler ist aufgetreten..."
 }