Lucie GermainandClaude Opus 5
9cf4fa8bf5
* [web] gracefully handle failed oauth token exchange for reference managers Mendeley/ReadCube redirect back to /:ref_provider/oauth/token-exchange with `error` and `error_description` instead of `code` when a user declines consent. completeAuth forwarded the whole query string on to third-party-references, whose strict zod schema (d8c1679bb08) accepts only oauth_token, oauth_verifier and code, so the exchange failed and the user got a 500. The same forwarding also sent `state` on every callback, success or failure. `state` is web's own CSRF token and is never read by third-party-references, so it tripped the log-only schema on every single token exchange, and would have broken linking outright under REQ_VALIDATION_MODE=enforce. Forward only the credentials the exchange needs, and show a translated notification in the Reference managers section rather than erroring. Validate ref_provider against the known providers so the provider name can be interpolated into the message without reflecting a URL segment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * [web] fix providerName argument and validate before deriving refProvider Address Copilot review on #36377: - The token-exchange failure handler passed `false` positionally into the `providerName` slot of _redirectWithLinkingError, so a failed exchange would have rendered "your false account". Pass providerName and an explicit false. - _getRefProviderBackendKey(req) ran before parseReq, so refProvider was derived from raw, unvalidated req.params. Parse first and derive from the validated params via _toRefProviderBackendKey; _getRefProviderBackendKey now delegates to it so the other handlers are unchanged. The completeAuth tests kept their assertions inside ctx.res.callback without awaiting the controller, so the callback fired after the test had already returned and the assertions were never enforced — which is why the suite was green with the providerName bug in it. Await the controller and assert inline. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * [web] add logOnly to the completeAuth schema and guard the provider lookup logOnly returns the raw input on a schema failure, so ref_provider can be an arbitrary URL segment. Check it against the display-name table rather than trusting the schema: unknown providers 404 in both validation modes, and providerName is guaranteed non-null for the rest of the handler. Also covers the schema half under REQ_VALIDATION_MODE=enforce, so dropping ref_provider from completeAuthSchema fails a test rather than passing unnoticed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> GitOrigin-RevId: b98eb5414fe8b672f44aab8c3690f7637d434cd2
An open-source online real-time collaborative LaTeX editor.
Wiki • Server Pro • Contributing • Mailing List • Authors • License
Figure 1: A screenshot of a project being edited in Overleaf Community Edition.
Community Edition
Overleaf is an open-source online real-time collaborative LaTeX editor. We run a hosted version at www.overleaf.com, but you can also run your own local version, and contribute to the development of Overleaf.
Caution
Overleaf Community Edition is intended for use in environments where all users are trusted. Community Edition is not appropriate for scenarios where isolation of users is required due to Sandbox Compiles not being available. When not using Sandboxed Compiles, users have full read and write access to the
sharelatexcontainer resources (filesystem, network, environment variables) when running LaTeX compiles.
For more information on Sandbox Compiles check out our documentation.
Enterprise
If you want help installing and maintaining Overleaf in your lab or workplace, we offer an officially supported version called Overleaf Server Pro. It also includes more features for security (SSO with LDAP or SAML), administration and collaboration (e.g. tracked changes). Find out more!
Keeping up to date
Sign up to the mailing list to get updates on Overleaf releases and development.
Installation
We have detailed installation instructions in the Overleaf Toolkit.
Upgrading
If you are upgrading from a previous version of Overleaf, please see the Release Notes section on the Wiki for all of the versions between your current version and the version you are upgrading to.
Overleaf Docker Image
This repo contains two dockerfiles, Dockerfile-base, which builds the
sharelatex/sharelatex-base image, and Dockerfile which builds the
sharelatex/sharelatex (or "community") image.
The Base image generally contains the basic dependencies like wget, plus texlive.
We split this out because it's a pretty heavy set of
dependencies, and it's nice to not have to rebuild all of that every time.
The sharelatex/sharelatex image extends the base image and adds the actual Overleaf code
and services.
Use make build-base and make build-community from server-ce/ to build these images.
We use the Phusion base-image
(which is extended by our base image) to provide us with a VM-like container
in which to run the Overleaf services. Baseimage uses the runit service
manager to manage services, and we add our init-scripts from the server-ce/runit
folder.
Contributing
Please see the CONTRIBUTING file for information on contributing to the development of Overleaf.
Authors
License
The code in this repository is released under the GNU AFFERO GENERAL PUBLIC LICENSE, version 3. A copy can be found in the LICENSE file.
Copyright (c) Overleaf, 2014-2025.