* Verify token signature in constant time
To prevent timing side channel attacks
* Run cheap checks first in token validation process
Expensive checks such as the nonce lookup on the database or the
signature check can be run after cheap/fast checks.
* docker: do not require password for PostgreSQL superuser
A password is now required by the postgres Docker image which makes
initial setup (and our CI build) fail with the following error:
postgres_1 | Error: Database is uninitialized and superuser password is not specified.
postgres_1 | You must specify POSTGRES_PASSWORD for the superuser. Use
postgres_1 | "-e POSTGRES_PASSWORD=password" to set it in "docker run".
postgres_1 |
postgres_1 | You may also use POSTGRES_HOST_AUTH_METHOD=trust to allow all connections
postgres_1 | without a password. This is *not* recommended. See PostgreSQL
postgres_1 | documentation about "trust":
postgres_1 | https://www.postgresql.org/docs/current/auth-trust.html
See https://github.com/docker-library/postgres/issues/681.
* docker,kubernetes: create PostgreSQL "privacy" type before using it
Fixes the following error when setting up the database:
postgres_1 | 2020-02-21 01:01:22.371 UTC [172] ERROR: type "privacy" does not exist at character 200
postgres_1 | 2020-02-21 01:01:22.371 UTC [172] STATEMENT: CREATE TABLE public.playlists
postgres_1 | (
postgres_1 | title text,
postgres_1 | id text primary key,
postgres_1 | author text,
postgres_1 | description text,
postgres_1 | video_count integer,
postgres_1 | created timestamptz,
postgres_1 | updated timestamptz,
postgres_1 | privacy privacy,
postgres_1 | index int8[]
postgres_1 | );
postgres_1 | ERROR: type "privacy" does not exist
postgres_1 | LINE 10: privacy privacy,
* travis: do not run "docker-compose up" in detached mode
Rather, allow database to finish its setup procedure and grant
Invidious time to launch.
Try to read app config from the "INVIDIOUS_CONFIG" environment variable.
If the variable is undefined, read config from config.yml file as before.
Required by https://github.com/omarroth/invidious/pull/1015 et al.
This fixes a compilation error if too many commits were made after the
most recent tag:
fatal: No names found, cannot describe anything.
In src/invidious.cr:60:19
60 | CURRENT_VERSION = {{ "#{`git describe --tags --abbrev=0`.strip}" }}
Error: expanding macro
See https://travis-ci.org/leonklingele/invidious/jobs/588672881#L275-L290.
* shard: update to crystal 0.31.0
Additionally, no longer use the Crystal "markdown" library which has
been removed from the Crystal stdlib in version 0.31.0.
See https://github.com/crystal-lang/crystal/pull/8115.
Also fix some deprecation warnings using the following commands:
find . \( -type d -name .git -prune \) -o -type f -exec sed -i 's/URI\.escape/URI\.encode_www_form/g' "{}" \;
find . \( -type d -name .git -prune \) -o -type f -exec sed -i 's/URI\.unescape/URI\.decode_www_form/g' "{}" \;
sed -i 's/while \%pull\.kind \!\= \:end_object/until \%pull\.kind\.end_object\?/g' src/invidious/helpers/patch_mapping.cr
This fixes a quite severe user experience issue where pressing the
'alt', 'meta' and/or 'ctrl' key along with one of the supported keys
(e.g. 'f' to enter video fullscreen mode) would overwrite the default
browser behavior. In the case of 'f+meta' we would enter fullscreen
mode, and not open the browser search panel as one might expect.
This change is required to stay consistent with the way YouTube
handles keydown events.
This fixes currently failing Docker builds.
kemalcr/kemal in version 0.26.0 requires Crystal 0.30.0 which is not
yet available on Alpine 3.10 (previously used as the Docker base image).
Crystal 0.30.1 apparently introduced some breaking changes to their
code formatter which made CI fail.
The code was automatically formatted by running
crystal tool format
leonklingele