Merge branch 'develop' of github.com:ONLYOFFICE/DocSpace into develop

build/build.document.server.docker.ps1

@@ -12,4 +12,4 @@ Write-Host "Run Document server" -ForegroundColor Green
 $DOCUMENT_SERVER_IMAGE_NAME = "onlyoffice/documentserver-de:latest"
 
 
-docker run -i -t -d -p 8085:80 -e JWT_ENABLED=false -e JWT_IN_BODY=false --restart=always -v $RootDir/Data:/var/www/onlyoffice/Data $DOCUMENT_SERVER_IMAGE_NAME
+docker run -i -t -d -p 8085:80 -e JWT_ENABLED=true -e JWT_SECRET=secret -e JWT_HEADER=AuthorizationJwt --restart=always -v $RootDir/Data:/var/www/onlyoffice/Data $DOCUMENT_SERVER_IMAGE_NAME

packages/client/src/components/panels/UploadPanel/FileRow.js

@@ -12,9 +12,6 @@ import ActionsUploadedFile from "./SubComponents/ActionsUploadedFile";
 import { isMobile } from "react-device-detect";
 import NoUserSelect from "@docspace/components/utils/commonStyles";
 import Button from "@docspace/components/button";
-import globalColors from "@docspace/components/utils/globalColors";
-
-const buttonColor = globalColors.blueDisabled;
 
 const StyledFileRow = styled(Row)`
   width: calc(100% - 16px);
@@ -228,8 +225,6 @@ class FileRow extends Component {
       t,
       item,
       uploaded,
-      //onMediaClick,
-      currentFileUploadProgress,
       fileIcon,
       isMedia,
       ext,
@@ -314,7 +309,7 @@ class FileRow extends Component {
                 data-id={item.uniqueId}
                 onClick={this.onCancelCurrentUpload}
               >
-                <LoadingButton percent={currentFileUploadProgress} />
+                <LoadingButton item={item} />
               </div>
             )}
             {showPasswordInput && (
@@ -365,7 +360,6 @@ export default inject(
     const { canViewedDocs, getIconSrc, isArchive } = settingsStore;
     const {
       uploaded,
-      primaryProgressDataStore,
       cancelCurrentUpload,
       cancelCurrentFileConversion,
       setUploadPanelVisible,
@@ -373,14 +367,12 @@ export default inject(
       convertFile,
       files: uploadedFiles,
       clearUploadedFilesHistory,
-      isParallel,
     } = uploadDataStore;
     const {
       playlist,
       setMediaViewerData,
       setCurrentItem,
     } = mediaViewerDataStore;
-    const { loadingFile: file } = primaryProgressDataStore;
 
     const isMedia =
       item.fileInfo?.viewAccessability?.ImageView ||
@@ -391,29 +383,16 @@ export default inject(
 
     const fileIcon = getIconSrc(ext, 24);
 
-    const loadingFile = !file || !file.uniqueId ? null : file;
-
-    const currentFileUploadProgress =
-      file && loadingFile.uniqueId === item.uniqueId
-        ? loadingFile.percent
-        : null;
-
     const downloadInCurrentTab = isArchive(ext) || !canViewedDocs(ext);
 
     return {
       isPersonal: personal,
       theme,
-      currentFileUploadProgress: isParallel
-        ? item?.percent
-          ? item.percent
-          : null
-        : currentFileUploadProgress,
       uploaded,
-      isMedia,
+      isMedia: !!isMedia,
       fileIcon,
       ext,
       name,
-      loadingFile,
       isMediaActive,
       downloadInCurrentTab,
       removeFileFromList,

packages/client/src/components/panels/UploadPanel/SubComponents/LoadingButton.js

@@ -1,7 +1,7 @@
 import React, { useState, useEffect } from "react";
+import { inject, observer } from "mobx-react";
 import {
   StyledCircle,
-  StyledCircleWrap,
   StyledLoadingButton,
 } from "@docspace/common/components/StyledLoadingButton";
 
@@ -16,7 +16,6 @@ const LoadingButton = (props) => {
     onClick,
     isConversion,
     inConversion,
-    ...rest
   } = props;
   const [isAnimation, setIsAnimation] = useState(true);
 
@@ -61,4 +60,20 @@ const LoadingButton = (props) => {
   );
 };
 
-export default LoadingButton;
+export default inject(({ uploadDataStore }, { item }) => {
+  const { primaryProgressDataStore, isParallel } = uploadDataStore;
+  const { loadingFile: file } = primaryProgressDataStore;
+
+  const loadingFile = !file || !file.uniqueId ? null : file;
+
+  const currentFileUploadProgress =
+    file && loadingFile.uniqueId === item.uniqueId ? loadingFile.percent : null;
+
+  return {
+    percent: isParallel
+      ? item?.percent
+        ? item.percent
+        : null
+      : currentFileUploadProgress,
+  };
+})(observer(LoadingButton));

packages/editor/package.json

@@ -72,6 +72,7 @@
     "compression": "^1.7.4",
     "date-and-time": "^2.4.1",
     "express": "^4.18.1",
+    "express-xss-sanitizer": "^1.1.6",
     "i18next-express-middleware": "^2.0.0",
     "i18next-fs-backend": "^1.1.4",
     "morgan": "^1.10.0",

packages/editor/src/server/index.js

@@ -14,6 +14,7 @@ import renderApp from "./lib/helpers/render-app";
 import dns from "dns";
 import { translations } from "SRC_DIR/autoGeneratedTranslations";
 import { getLanguage } from "@docspace/common/utils";
+import { xss } from "express-xss-sanitizer";
 
 dns.setDefaultResultOrder("ipv4first");
 
@@ -66,6 +67,7 @@ i18next.init({
 
 app.use(i18nextMiddleware.handle(i18next));
 app.use(compression());
+app.use(xss());
 app.use(
   "/doceditor/",
   express.static(path.resolve(path.join(__dirname, "client")), {

packages/login/package.json

@@ -114,6 +114,7 @@
     "cookie-parser": "^1.4.6",
     "date-and-time": "^2.4.1",
     "express": "^4.18.1",
+    "express-xss-sanitizer": "^1.1.6",
     "i18next-express-middleware": "^2.0.0",
     "i18next-fs-backend": "^1.1.4",
     "iconv-lite": "^0.6.3",

packages/login/src/server/index.ts

@@ -16,6 +16,7 @@ import { LANGUAGE, COOKIE_EXPIRATION_YEAR } from "@docspace/common/constants";
 import { getLanguage } from "@docspace/common/utils";
 import { initSSR } from "@docspace/common/api/client";
 import dns from "dns";
+import { xss } from "express-xss-sanitizer";
 
 let port = PORT;
 
@@ -32,6 +33,7 @@ const app = express();
 app.use(i18nextMiddleware.handle(i18next));
 app.use(compression());
 app.use(cookieParser());
+app.use(xss());
 app.use(
   "/login",
   express.static(path.resolve(path.join(__dirname, "client")), {

yarn.lock

@@ -2968,6 +2968,7 @@ __metadata:
     css-loader: ^6.7.1
     date-and-time: ^2.4.1
     express: ^4.18.1
+    express-xss-sanitizer: ^1.1.6
     external-remotes-plugin: ^1.0.0
     file-loader: ^6.2.0
     html-webpack-plugin: 5.3.2
@@ -3036,6 +3037,7 @@ __metadata:
     css-loader: ^6.2.0
     date-and-time: ^2.4.1
     express: ^4.18.1
+    express-xss-sanitizer: ^1.1.6
     external-remotes-plugin: ^1.0.0
     file-loader: ^6.2.0
     html-webpack-plugin: 5.3.2
@@ -12450,6 +12452,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"express-xss-sanitizer@npm:^1.1.6":
+  version: 1.1.6
+  resolution: "express-xss-sanitizer@npm:1.1.6"
+  dependencies:
+    sanitize-html: ~2.7.1
+  checksum: b5531c716490590721037eea2dcedc8989e03f0af00436ca15d10b9c18f2f3b47a6179dfbba18d5170537d3ab179f950c30894d2b66751833bb690ddabf83ae5
+  languageName: node
+  linkType: hard
+
 "express@npm:^4.17.1, express@npm:^4.18.1":
   version: 4.18.2
   resolution: "express@npm:4.18.2"
@@ -14312,7 +14323,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"htmlparser2@npm:^6.1.0":
+"htmlparser2@npm:^6.0.0, htmlparser2@npm:^6.1.0":
   version: 6.1.0
   resolution: "htmlparser2@npm:6.1.0"
   dependencies:
@@ -15244,7 +15255,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-plain-object@npm:5.0.0":
+"is-plain-object@npm:5.0.0, is-plain-object@npm:^5.0.0":
   version: 5.0.0
   resolution: "is-plain-object@npm:5.0.0"
   checksum: e32d27061eef62c0847d303125440a38660517e586f2f3db7c9d179ae5b6674ab0f469d519b2e25c147a1a3bc87156d0d5f4d8821e0ce4a9ee7fe1fcf11ce45c
@@ -19257,6 +19268,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"parse-srcset@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "parse-srcset@npm:1.0.2"
+  checksum: 3a0380380c6082021fcce982f0b89fb8a493ce9dfd7d308e5e6d855201e80db8b90438649b31fdd82a3d6089a8ca17dccddaa2b730a718389af4c037b8539ebf
+  languageName: node
+  linkType: hard
+
 "parse5-htmlparser2-tree-adapter@npm:^7.0.0":
   version: 7.0.0
   resolution: "parse5-htmlparser2-tree-adapter@npm:7.0.0"
@@ -19792,7 +19810,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"postcss@npm:^8.2.15, postcss@npm:^8.4.19":
+"postcss@npm:^8.2.15, postcss@npm:^8.3.11, postcss@npm:^8.4.19":
   version: 8.4.21
   resolution: "postcss@npm:8.4.21"
   dependencies:
@@ -22024,6 +22042,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"sanitize-html@npm:~2.7.1":
+  version: 2.7.3
+  resolution: "sanitize-html@npm:2.7.3"
+  dependencies:
+    deepmerge: ^4.2.2
+    escape-string-regexp: ^4.0.0
+    htmlparser2: ^6.0.0
+    is-plain-object: ^5.0.0
+    parse-srcset: ^1.0.2
+    postcss: ^8.3.11
+  checksum: 2399d1fdbbc3a263fb413c1fe1971b3dc2b51abc6cc5cb49490624539d1c57a8fe31e2b21408c118e2a957f4e673e3169b1f9a5807654408f17b130a9d78aed7
+  languageName: node
+  linkType: hard
+
 "sass-loader@npm:^12.1.0":
   version: 12.6.0
   resolution: "sass-loader@npm:12.6.0"