Can the new external link warning be disabled?

Support
1

My version of HedgeDoc is: 1.11.0

The new version of hedgedoc added a warning when a user clicks on an external link. Can this feature be disabled? We mainly use Hedgedoc to link externally and this feature makes using it this was irritating.

2

Hi @mikul and welcome to the HedgeDoc community!

This feature was introduced to harden the security. In theory someone could otherwise use CSS tricks to make a legit looking link or interface button point to a malicious domain. For this reason we didn’t add an option to disable it.

We’d like to understand your usage a bit more: Do you often open the same external links, or are the link targets rather mixed?

We could add an option to disable the feature on your own risk or an option to remember certain links/domains to not ask again on these.

Both options however are low-priority for us right now and could be included in the next 1.x release but there is no urge to rush that from our side since we want to focus development efforts more onto version 2.0.

Thanks for your understanding.

3

One of our uses for HedgeDoc is a place to store desired destinations. HedgeDoc provides an editable list our group can use to document places to visit along with links to directions and more information. We then review them when on location. These links are often to google maps, but frequently to web sites of commercial destinations.

For this use case, we’re using it as a glorified bookmark list. Creating a page full of external links and getting an external link warning for each is silly and makes it painful to look through a number of them as we plan our itinerary.

A site-wide disable would be fine. For a self-hosted instance with known users, this is more annoyance than security. A per-page disabling feature would also be fine.

4

Thanks for the insights, I understand your annoyance with the link warning in your usage scenario with HedgeDoc as a sort of bookmark collection.

There’s currently an open PR to add a config option to whitelist certain domains.

This could help already a bit for links to known domains like Google Maps.

We’ll further might look into options to disable the link warning instance-wide or on a per-browser approach. However, I don’t want to promise anything specific yet.

5

Thanks for getting back to me and taking the time to listen. A per browser option would be good. Showing the warning with an option to disable future warnings would also be a great solution.

6

One of my users noted that link copying is now broken. They are collecting news sources from all over the internet for a podcast and I am thinking about just patching this new feature out.

1 Like
8

Using HD 1.11 with Yunohost. Our users are prompted to login to Yunohost every time an external link is clicked. “Freely” page access is set (no login required for edits, etc.). Is this a bug? Any workarounds available? Desired behavior is to turn off the “feature” or re-direct to the warning page and not to the login page. Thank you for the great software.

9

@Vexos
Thanks for reporting this, this is indeed not expected, we’ll look to verify and fix this.

10

A behavior to consider on external links is to have “warning: external link” be rendered on the page for each external link. A number of email systems have this behavior for external email addresses (warning the employee that the email message sender is not within the organization).

11

We were not able to verify your bug report. Under no circumstances we could reproduce a login enforcement on the external link page. If you have a specific way to reproduce this, please share this together with your configuration.