From ab67680290580c5c60423db8e86e36f9269e5965 Mon Sep 17 00:00:00 2001 From: David Rotermund Date: Fri, 23 Oct 2026 20:25:55 +0000 Subject: [PATCH] Adds env parameter SHOW_UNSUPPORT_WARNING (default true) to show the unsupported CE software warning and env parameter ENABLE_LOCAL_LOGIN_MASK(default true) to control visibility of the local login mask on the login page. i.e. SSO may don't need a local login mask. --- .../src/Features/User/UserPagesController.mjs | 1 + services/web/app/views/layout/thin-footer.pug | 2 +- services/web/app/views/user/login.pug | 71 ++++++++++--------- services/web/config/settings.defaults.js | 4 ++ 4 files changed, 42 insertions(+), 36 deletions(-) diff --git a/services/web/app/src/Features/User/UserPagesController.mjs b/services/web/app/src/Features/User/UserPagesController.mjs index e94c2e0380..14edd54b31 100644 --- a/services/web/app/src/Features/User/UserPagesController.mjs +++ b/services/web/app/src/Features/User/UserPagesController.mjs @@ -306,6 +306,7 @@ const UserPagesController = { title: Settings.nav?.login_support_title || 'login', login_support_title: Settings.nav?.login_support_title, login_support_text: Settings.nav?.login_support_text, + local_login_mask_enable: Settings.enableLocalLoginMask, metadata, }) }, diff --git a/services/web/app/views/layout/thin-footer.pug b/services/web/app/views/layout/thin-footer.pug index d8c68ccc8c..947a5eef94 100644 --- a/services/web/app/views/layout/thin-footer.pug +++ b/services/web/app/views/layout/thin-footer.pug @@ -36,7 +36,7 @@ footer.site-footer a(href=item.url class=item.class aria-label=item.label) !{item.text} else | !{item.text} - if settings.env === 'server-ce' + if settings.env === 'server-ce' && settings.show_unsupport_warning .row .col-12 p.copyright-notice diff --git a/services/web/app/views/user/login.pug b/services/web/app/views/user/login.pug index 9d3c944e42..a1d6cce386 100644 --- a/services/web/app/views/user/login.pug +++ b/services/web/app/views/user/login.pug @@ -14,41 +14,42 @@ block content h1 !{login_support_title} else h1 #{translate("log_in")} - form(name='loginForm' data-ol-async-form action='/login' method='POST') - input(name='_csrf' type='hidden' value=csrfToken) - +formMessagesNewStyle - +customFormMessageNewStyle('invalid-password-retry-or-reset', 'danger') - | !{translate('email_or_password_wrong_try_again_or_reset', {}, [{ name: 'a', attrs: { href: '/user/password/reset', 'aria-describedby': 'resetPasswordDescription' } }])} - span.visually-hidden(id='resetPasswordDescription') - | #{translate('reset_password_link')} - +customFormMessageNewStyle('password-compromised') - | !{translate('password_compromised_try_again_or_use_known_device_or_reset', {}, [{name: 'a', attrs: {href: 'https://haveibeenpwned.com/passwords', rel: 'noopener noreferrer', target: '_blank'}}, {name: 'a', attrs: {href: '/user/password/reset', target: '_blank'}}])}. - .form-group - label(for='email') #{translate("email")} - input#email.form-control( - name='email' - type=(settings.ldap && settings.ldap.enable) ? 'text' : 'email' - required - placeholder=(settings.ldap && settings.ldap.enable) ? settings.ldap.placeholder : 'email@example.com' - autofocus='true' - autocomplete='username' - ) - .form-group - label(for='password') #{translate("password")} - input#password.form-control( - name='password' - type='password' - autocomplete='current-password' - required - ) - .actions - button.btn-primary.btn(type='submit' data-ol-disabled-inflight) - span(data-ol-inflight='idle') #{translate("login")} - span(hidden data-ol-inflight='pending') #{translate("logging_in")}… - a.float-end(href='/user/password/reset') #{translate("forgot_your_password")}? - if login_support_text - hr - p.text-center !{login_support_text} + if local_login_mask_enable + form(name='loginForm' data-ol-async-form action='/login' method='POST') + input(name='_csrf' type='hidden' value=csrfToken) + +formMessagesNewStyle + +customFormMessageNewStyle('invalid-password-retry-or-reset', 'danger') + | !{translate('email_or_password_wrong_try_again_or_reset', {}, [{ name: 'a', attrs: { href: '/user/password/reset', 'aria-describedby': 'resetPasswordDescription' } }])} + span.visually-hidden(id='resetPasswordDescription') + | #{translate('reset_password_link')} + +customFormMessageNewStyle('password-compromised') + | !{translate('password_compromised_try_again_or_use_known_device_or_reset', {}, [{name: 'a', attrs: {href: 'https://haveibeenpwned.com/passwords', rel: 'noopener noreferrer', target: '_blank'}}, {name: 'a', attrs: {href: '/user/password/reset', target: '_blank'}}])}. + .form-group + label(for='email') #{translate("email")} + input#email.form-control( + name='email' + type=(settings.ldap && settings.ldap.enable) ? 'text' : 'email' + required + placeholder=(settings.ldap && settings.ldap.enable) ? settings.ldap.placeholder : 'email@example.com' + autofocus='true' + autocomplete='username' + ) + .form-group + label(for='password') #{translate("password")} + input#password.form-control( + name='password' + type='password' + autocomplete='current-password' + required + ) + .actions + button.btn-primary.btn(type='submit' data-ol-disabled-inflight) + span(data-ol-inflight='idle') #{translate("login")} + span(hidden data-ol-inflight='pending') #{translate("logging_in")}… + a.float-end(href='/user/password/reset') #{translate("forgot_your_password")}? + if login_support_text + hr + p.text-center !{login_support_text} if settings.saml && settings.saml.enable .actions(style='margin-top: 30px;') a.button.btn-secondary.btn( diff --git a/services/web/config/settings.defaults.js b/services/web/config/settings.defaults.js index 35c7ac477f..07ce05c5bd 100644 --- a/services/web/config/settings.defaults.js +++ b/services/web/config/settings.defaults.js @@ -79,6 +79,8 @@ const safeCompilers = ['xelatex', 'pdflatex', 'latex', 'lualatex'] module.exports = { env: 'server-ce', + // show the CE "free unsupported software" disclaimer in the footer; set SHOW_UNSUPPORT_WARNING=false to hide it + show_unsupport_warning: process.env.SHOW_UNSUPPORT_WARNING !== 'false', limits: { httpGlobalAgentMaxSockets: 300, @@ -1232,6 +1234,8 @@ module.exports = { }, enablePandocConversions: process.env.ENABLE_PANDOC_CONVERSIONS === 'true', + // local login form is shown by default; set ENABLE_LOCAL_LOGIN_MASK=false to hide it (e.g. SSO-only login) + enableLocalLoginMask: process.env.ENABLE_LOCAL_LOGIN_MASK !== 'false', oauthProviders: { ...(process.env.EXTERNAL_AUTH && process.env.EXTERNAL_AUTH.includes('oidc') && {