Update to package v4.0 broke login

[David 0]

Hey,

I just noticed that after the (automatic) update to v4.0 of the cloudron package some things wouldn't work anymore:

1. The login-Button has on the Splashscreen has disappeared. adding /admin to the URL showed a "Forbidden" site.
2. There was a new "All Pads" link on the splash screen, where anyone could just browse all created pads (which I do not want).
3. Localization (at least of the splashscreen) was set to english (was german before)

Thankfully, I was able to restore cloudronapp3.7.1 from the backup. But I wonder if these are bugs or just me having misconfigured the application.

best
David

[nebulon]

Right, we removed our custom cloudron plugin, which previously did auth and also other things like pad listing. We now use only upstream plugins so things are expected to be different. This was also the reason why it was a major package version update, so there shouldn't be any automatic update happening.

1. The app now uses https://github.com/ether/ep_openid_connect for auth and this is automatic, so there is no login button anymore but it will always redirect to the openid provider, which in most cases will perform an autologin with a redirect back to the app. So most likely if you visit etherpad you are simply already logged in. This is not obvious behavior but this is what upstream provides.

2. This is the same as pad listing before only different UI, only logged in users can see this.

3. Not sure where the German came from, but the UI was provided by our custom module https://git.cloudron.io/cloudron/ep_cloudron and that has no German either. Maybe you customized that one?

[nebulon]

Forgot to mention the admin permissions are also now handled by the regular etherpad settings and thus have to be adjusted if used. See https://docs.cloudron.io/apps/etherpad/#admin-user

[sparkwise]

Re #2, if you have "requireAuthentication" set to "false", the homepage links to the full index of pads even if the user isn't signed in at all (incognito window), which is surprising.

[girish]

@sparkwise that setting makes the documents public - https://docs.cloudron.io/apps/etherpad/#make-documents-public

[nebulon]

hm this list comes from the https://www.npmjs.com/package/ep_padlist2 plugin. I had put that as always for that version, but I will then make a new release without that plugin to be installed and then it is up to the admin to decide.

The plugins which will always be ensured are ep_openid_connect ep_user_displayname ep_health_check then.

[sparkwise]

@nebulon Sounds good! Agree that it makes sense to leave this up to the admin. Thank you!

[nebulon]

@sparkwise alright, the new package does not enforce ep_padlist2 still when updating it has to be manually removed if it was already installed.