Commit Graph

8917 Commits

Author SHA1 Message Date
Rudy ERCEK
e9b5931cad Add MAX_UPLOAD_SIZE environment variable 2026-05-19 15:49:21 +02:00
yu-i-i
3a844ff46a Fix style of Templates button in navbar 2026-05-19 15:49:21 +02:00
yu-i-i
0bc3dc35e1 Fix: always include repository prefix in sandboxed compiles image name 2026-05-19 15:49:19 +02:00
yu-i-i
83794e21a8 Remove OVERLEAF_OIDC_DISABLE_JIT_ACCOUNT_CREATION in favor of OVERLEAF_OIDC_ALLOWED_EMAIL_DOMAINS 2026-05-19 15:49:18 +02:00
yu-i-i
ad0b52dfda Introduce an environment variable to control user creation in OIDC authentication, closes #47 2026-05-19 15:49:18 +02:00
yu-i-i
1851e94357 Fix login page 2026-05-19 15:49:17 +02:00
yu-i-i
2ba545a33c Refactor Template Gallery; resolves #38 and #39
- Replace free-text license input with a select box
- Improve visual presentation of modals and enhance keyboard interaction
2026-05-19 15:49:17 +02:00
yu-i-i
444b277d6c Make Template Gallery optional; rename environment variables 2026-05-19 15:49:16 +02:00
yu-i-i
a321b54502 Add Template Gallery support 2026-05-19 15:49:15 +02:00
yu-i-i
fb3d7c9424 Re-export doLogout (was removed from exports in commit b9fb636). 2026-05-19 15:49:14 +02:00
yu-i-i
fb3570054e Refactor authentication code; add OIDC support 2026-05-19 15:49:14 +02:00
yu-i-i
fa145af363 Allow adding extra flags to LaTeX compiler through environment variable 2026-05-19 15:49:13 +02:00
yu-i-i
54368fe945 Enable LDAP and SAML authentication support 2026-05-19 15:49:13 +02:00
yu-i-i
a76b4019d7 Allow selecting a TeX Live image for a project 2026-05-19 15:49:13 +02:00
yu-i-i
2f14135b95 Enable track changes and comments feature 2026-05-19 15:49:12 +02:00
yu-i-i
38c70877ef Redirect non-existing links to Overleaf page 2026-05-19 15:49:12 +02:00
Jakob Ackermann
293d89a4cb [web] inline contacts service into web (#33546)
GitOrigin-RevId: d5e84d4f80f5ad4e951934d6dcdc332b0d26f3d0
2026-05-19 08:04:34 +00:00
Brian Gough
60860aa202 Merge pull request #33576 from overleaf/bg-jpa-convert-document-to-file
Modify convertDocToFile to bypass docstore

GitOrigin-RevId: 3ec789034a369d39d223450462394c8f303caa07
2026-05-19 08:04:13 +00:00
Eric Mc Sween
a3682af6e4 Merge pull request #33710 from overleaf/em-tpds-config
Clean up tpdsworker config from web and third-party-datastore

GitOrigin-RevId: 3856126d9dc856fea4bc4133b11402c35b10630b
2026-05-18 08:06:25 +00:00
Olzhas Askar
d388e48a99 Merge pull request #33679 from overleaf/oa-plan-names
[web] Get plan names from the settings

GitOrigin-RevId: 1e61975c3306c025f33e05686f9d2b57964b4f65
2026-05-18 08:05:52 +00:00
Olzhas Askar
6c267e68d3 Merge pull request #33707 from overleaf/oa-learn-links
[web] Learn Overleaf links

GitOrigin-RevId: af9f72da008ad8b8c86e4c355268123eb6c40bcd
2026-05-18 08:05:48 +00:00
Copilot
3980b9e580 Fix IDOR in exports by adding token verification (Issue #31637) (#32883)
* Fix IDOR in exports by adding token verification

Implement jdleesmiller's suggested fix for Issue #31637:
- V1: Return export token in create response
- V1: Verify token in get_export using secure_compare
- Web: Pass token through fetchExport and fetchDownload
- Web: Return token from exportProject to frontend
- Frontend: Pass token as query param on status/download requests
- Add tests for both services

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix window.location.pathname to .href to preserve query params

Code review correctly identified that window.location.pathname strips
query parameters. Switch to window.location.href so the token query
parameter is preserved in download URLs.

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/7ba5f535-fba2-49a8-91d4-c87bd332d3a0

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

Fix test mocks to include token in POST responses

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/0350c6ef-0fff-4e98-8464-812cd92c523f

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Fix token assignment in initiateExport to use pollResponse token if available

Add requireExportToken config setting and tests for invalid/missing token cases

Agent-Logs-Url: https://github.com/overleaf/internal/sessions/059bdba2-4f7a-4407-a5a5-cfcffd888739

Co-authored-by: briangough <7457354+briangough@users.noreply.github.com>

fix formatting

Add tests for export status and token validation in ExportsController and MockV1Api

Co-authored-by: Copilot <copilot@github.com>

* Update services/v1/main/app/controllers/api/v1/overleaf/exports_controller.rb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix linting

* fix fetchString response handling in ExportsHandler tests

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Brian Gough <briangough@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 399aef8eaa15ab3655f0905482f3a31fe94e2251
2026-05-15 08:08:04 +00:00
Miguel Serrano
5a886aa9fb [web] Add extra details to flexible license sales email (#32929)
* [web] Add extra details to flexible license sales email

GitOrigin-RevId: fbd41adae21c55c5e97f9531565100e1ae911808
2026-05-15 08:07:56 +00:00
Tim Down
248e149701 Default interstitial to monthly plans (#33706)
* Default interstitial to monthly plans except for upgrade, which defaults to user's existing subscription period

* Add tests for interstitial page period toggle defaults

GitOrigin-RevId: fa0ac41e7d8a7bf858b53e0940287b28ef21253d
2026-05-15 08:07:49 +00:00
Davinder Singh
a3a508d193 [WEB] Add analytics events for importing and exporting to different file types (#33614)
* adding events for success and failure for import and export from latex

* adding the operation property to capture the import/export keyword

GitOrigin-RevId: 2e5482b3c7517b402fc151966975ca8718729683
2026-05-14 08:06:30 +00:00
Jakob Ackermann
75a12dda17 [web] resync_projects: use the secondaries for all reads (#33684)
* [docstore] add useSecondary flag to projectHasRanges

The rev-check for unarchiving always consults with the primary.

Two extra changes:
- Add a projection argument to peekDoc in order to skip lines download
   from projectHasRanges.
- Add one retry to peekDoc to reduce chances of surfacing a rev-check
   violation.

* [web] resync_projects: use the secondaries for all reads

* [web] add default value for useSecondary

* [docstore] add default value for useSecondary

* [k8s] docstore: set MONGO_HAS_SECONDARIES=true

GitOrigin-RevId: f15ec4fdc1cabe74c1eab87bec85f28d6f7a587d
2026-05-14 08:06:26 +00:00
Jimmy Domagala-Tang
bc2f5ae746 Reject tracked changes notifications (#32917)
* [web] Reject tracked changes notifications

feat: adding new tests

feat: adding rejected changes notifications

feat: adding tests for rejectchanges

feat: updating tests for rejecting notifications;

feat: adding in rejecting user, and improving subject and activity line

fix: moving to a params object instead of positionals for email building

feat: updating to use events triggered from applyUpdate in document-updater

feat: updating to send rejected author ids with rejected change notification instead of change ids

feat: moving rejected author notification determination to updateManager instead of RangesManager, which is used by other paths

feat: only map to author if changes were made

* fix: gate by user status not project status

* fix: unit tests post-rebase

---------

Co-authored-by: Kristina Hjertberg <kristina.hjertberg@overleaf.com>
GitOrigin-RevId: f992e1885c47d1a6cf776740769d6d4763f3cb7c
2026-05-14 08:05:35 +00:00
Jakob Ackermann
7c50dc9990 [history-v1] add endpoint for downloading latest zip (#33181)
* [history-v1] add endpoint for downloading latest zip

* [web] address review feedback

* [web] tests: do not overwrite db.projects.overleaf, extend it

* [web] set includeReferer flag from downloading zip

GitOrigin-RevId: e63e549f004230086f82eccf03b43fd62bde6071
2026-05-13 08:06:53 +00:00
Jakob Ackermann
b1931d0b3b [web] cleanup archived split-test assignments from user record on login (#33365)
* [web] cleanup archived split-test assignments from user record on login

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [migrations] purge archived split tests from all users

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>

* [web] add missing mock and update snapshot test

* [web] gracefully access db.users.splitTests

---------

Co-authored-by: Anna Claire Fields <anna.fields@overleaf.com>
GitOrigin-RevId: bd185074a402556d7b7c812208cf834dd52b27a5
2026-05-13 08:06:49 +00:00
Antoine Clausse
13e426b14c [web] Share third-party integration icons + add Papers icon (#33537)
* [web] Add Papers/ReadCube icon to plans page integrations

Closes #33493

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Delete old 200kB zotero logo

* Allow png use in logos

* Allow wrap

* [web] Share third-party integration icon list across plans and onboarding pages

Extract the icons array to services/web/app/src/util/third-party-icons.mjs
so the plans-2026 feature table and the try_premium onboarding page render
from a single source. The try_premium page now also includes Papers and
follows the plans page ordering.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [web] Allow ciam try-premium logo row to wrap

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: f5a52418cbe01d9e343092b552183dffa3ae78bd
2026-05-13 08:06:44 +00:00
Jessica Lawshe
ba13ccdb11 Merge pull request #33202 from overleaf/jel-domain-captured-by-group-settings-page
[Domain capture] Check `domainCapturedByGroup` for existing emails on user settings

GitOrigin-RevId: 5ac86b89969b186cce0cac410c2957e5aa1b9703
2026-05-12 08:06:33 +00:00
Jakob Ackermann
6a911e4ec3 [web] do not send a second response from api error handler (#33526)
GitOrigin-RevId: 6974f5d5f7042d5170eb2a755715b2d139f06130
2026-05-12 08:06:25 +00:00
Jakob Ackermann
1df98c028d [web] add includeReferer flag to SplitTestHandler.getAssignment (#33235)
* [web] add includeReferer flag to SplitTestHandler.getAssignment

* [web] tests: migrate User.getSplitTestAssignment to async/await

I don't want to fight with callbacks and optional arguments. Just move
it to async/await. New tests should use async/await, so there is no
point in making this work in callback-hell.

* [web] remove unused URL import

GitOrigin-RevId: 6251001e6ba7354f704fa663be8ef365ca0b9d23
2026-05-12 08:06:21 +00:00
Mathias Jakobsen
62d92b70dd Merge pull request #33341 from overleaf/mj-two-step-export-web
[web] Add two-step pandoc conversion download

GitOrigin-RevId: 093f435a497a7583d2b4d23558415cc442f84553
2026-05-12 08:06:13 +00:00
Alf Eaton
b906de86db Add info to NotFoundError (#33440)
* Add info to errors in ProjectLocator

* Update ProjectLocator.test.mjs

* Add info to errors in SSOConfigManager

* Update SSOConfigManager.test.mjs

GitOrigin-RevId: 5a13350af1808f3a16a4bc8a9946cbe8f15e6b3a
2026-05-12 08:05:49 +00:00
Brian Gough
3940f8c2a7 Merge pull request #33504 from overleaf/bg-upgrade-yauzl
Upgrade yauzl library in web to version 3.3.0

GitOrigin-RevId: 82b4158db7a432f4257bd48402840f07801c6d07
2026-05-11 08:05:47 +00:00
Jimmy Domagala-Tang
c37e46e1ad Add audit log entries when users max out their AI usage (#32886)
* feat: adding audit log entries when users max out their AI usage

* feat: also log when user hits quota exactly, since support wants to know that

* feat: moving audit logging to the rate limiters themselves

* feat: moving to single quota breach event with tool in info

* feat: adding audit log for ai quota tests

GitOrigin-RevId: 64056632f142a9ea22a703b7621234f93e9f6ec7
2026-05-08 08:10:23 +00:00
Eric Mc Sween
2bb35fafb8 Merge pull request #33490 from overleaf/em-parse-req-errors-2
Reintroduce custom error types in request validation

GitOrigin-RevId: 1985ca04c8fe693fb836b042517d94700343bc46
2026-05-08 08:10:13 +00:00
Mathias Jakobsen
5dc67db403 Merge pull request #33089 from overleaf/ds-export-md-files-pandoc
[WEB + CLSI] Download as markdown

GitOrigin-RevId: 181eddf2513e9c5edacbab37e93f9cac2191ee1a
2026-05-08 08:09:07 +00:00
Mathias Jakobsen
eddcc5a42e Merge pull request #32857 from overleaf/ds-pandoc-import-md
[WEB + CLSI] Import markdown files using pandoc

GitOrigin-RevId: adad7831ddb13a8fcb8063871166bde13cbbf1b6
2026-05-08 08:09:02 +00:00
roo hutton
498af9b07b Merge pull request #33467 from overleaf/rh-cio-prev-plan-type-fix
Only set previous_plan_type when normalised plan type changes

GitOrigin-RevId: 43133fc248bfb32b921da68bee91b445ca44eb1f
2026-05-08 08:08:11 +00:00
Jessica Lawshe
fc4e17d30f Merge pull request #32816 from overleaf/jel-domain-captured-by-group
[web] Check `domainCapturedByGroup` on domain instead of `group.domainCaptureEnabled` only for project/dash redirect

GitOrigin-RevId: a6389da9c943327e5941eaa24eb274106526f80b
2026-05-07 08:08:07 +00:00
ilkin-overleaf
faec27d7b0 Merge pull request #33163 from overleaf/ii-share-modal-give-feedback
[web] Share modal give feedback link

GitOrigin-RevId: 5e83dec6c6b97c172b7600d8ded285db49178a64
2026-05-07 08:07:54 +00:00
roo hutton
5c348078c2 Merge pull request #33340 from overleaf/rh-pause-block
Prevent calls to pause endpoint if pause-subscription not enabled

GitOrigin-RevId: 6efd00391576441b3104e34def2e5ad110dcc853
2026-05-07 08:07:36 +00:00
Brian Gough
a6c8ce32c3 Merge pull request #33312 from overleaf/copilot/send-clear-site-data-header
Send `Clear-Site-Data` header on account deletion

GitOrigin-RevId: c3f0b5f27cc80a1927518c56436c3a808b144fb7
2026-05-07 08:07:20 +00:00
Domagoj Kriskovic
8f0979d6a2 Trigger reject tracked changes notification from document-updater
GitOrigin-RevId: 9ac47490d052b3058931ca250f4090e6576f56b2
2026-05-07 08:06:57 +00:00
Jakob Ackermann
d97a659f92 [web] make double compile test parameters configurable via env vars (#33406)
* [web] make double compile test parameters configurable via env vars

* [k8s] web: enable double compile test for free compiles on n4 instances

GitOrigin-RevId: 3a5cb8ed6d044fcf3f4c0d2b9d252326bac48511
2026-05-06 08:07:28 +00:00
Eric Mc Sween
3da2d53acb Merge pull request #33413 from overleaf/revert-33040-em-parse-req-errors
Revert "Replace isZodErrorLike with custom error types in request validation"

GitOrigin-RevId: 1f51fe9e14ffabf283f1229552d3887136420f8f
2026-05-06 08:06:41 +00:00
Eric Mc Sween
98def949ec Merge pull request #33040 from overleaf/em-parse-req-errors
Replace isZodErrorLike with custom error types in request validation

GitOrigin-RevId: 9cb453a2cde595a00f5049e4829ea9e3dbe17b28
2026-05-06 08:06:37 +00:00
Antoine Clausse
cff35c743f [web] Fix wrong price shown in future payments preview when upgrading over a pending downgrade (#33305)
* fix(web): show correct plan in future payments preview when upgrading over a pending downgrade

When a user had a scheduled plan downgrade and then immediately upgraded
to a higher plan, makeChangePreview() always used the pending (stale)
plan code/name/price for the future payments display rather than the
newly selected plan.

Check whether the current change is a plan change (premium-subscription
or group-plan-upgrade type) and if so use subscriptionChange's plan
details instead of pendingChange's, since the immediate upgrade overrides
the scheduled downgrade.

Closes #33299

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(web): add unit tests for makeChangePreview pending-change plan override

Covers the four cases: premium-subscription and group-plan-upgrade types
use subscriptionChange plan (not pendingChange), add-on-purchase type
defers to pendingChange plan, and no-pending-change falls back to
subscriptionChange as before.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: cc2f9c88e5dfdfb89370798e857ea98caf8fcf85
2026-05-06 08:05:49 +00:00