Can the new external link warning be disabled?

Support
1

My version of HedgeDoc is: 1.11.0

The new version of hedgedoc added a warning when a user clicks on an external link. Can this feature be disabled? We mainly use Hedgedoc to link externally and this feature makes using it this was irritating.

2

Hi @mikul and welcome to the HedgeDoc community!

This feature was introduced to harden the security. In theory someone could otherwise use CSS tricks to make a legit looking link or interface button point to a malicious domain. For this reason we didnā€™t add an option to disable it.

Weā€™d like to understand your usage a bit more: Do you often open the same external links, or are the link targets rather mixed?

We could add an option to disable the feature on your own risk or an option to remember certain links/domains to not ask again on these.

Both options however are low-priority for us right now and could be included in the next 1.x release but there is no urge to rush that from our side since we want to focus development efforts more onto version 2.0.

Thanks for your understanding.

3

One of our uses for HedgeDoc is a place to store desired destinations. HedgeDoc provides an editable list our group can use to document places to visit along with links to directions and more information. We then review them when on location. These links are often to google maps, but frequently to web sites of commercial destinations.

For this use case, weā€™re using it as a glorified bookmark list. Creating a page full of external links and getting an external link warning for each is silly and makes it painful to look through a number of them as we plan our itinerary.

A site-wide disable would be fine. For a self-hosted instance with known users, this is more annoyance than security. A per-page disabling feature would also be fine.

4

Thanks for the insights, I understand your annoyance with the link warning in your usage scenario with HedgeDoc as a sort of bookmark collection.

Thereā€™s currently an open PR to add a config option to whitelist certain domains.

This could help already a bit for links to known domains like Google Maps.

Weā€™ll further might look into options to disable the link warning instance-wide or on a per-browser approach. However, I donā€™t want to promise anything specific yet.

5

Thanks for getting back to me and taking the time to listen. A per browser option would be good. Showing the warning with an option to disable future warnings would also be a great solution.

6

One of my users noted that link copying is now broken. They are collecting news sources from all over the internet for a podcast and I am thinking about just patching this new feature out.

1 Like
8

Using HD 1.11 with Yunohost. Our users are prompted to login to Yunohost every time an external link is clicked. ā€œFreelyā€ page access is set (no login required for edits, etc.). Is this a bug? Any workarounds available? Desired behavior is to turn off the ā€œfeatureā€ or re-direct to the warning page and not to the login page. Thank you for the great software.

9

@Vexos
Thanks for reporting this, this is indeed not expected, weā€™ll look to verify and fix this.

10

A behavior to consider on external links is to have ā€œwarning: external linkā€ be rendered on the page for each external link. A number of email systems have this behavior for external email addresses (warning the employee that the email message sender is not within the organization).

11

We were not able to verify your bug report. Under no circumstances we could reproduce a login enforcement on the external link page. If you have a specific way to reproduce this, please share this together with your configuration.

12

weā€™re also in the situation where working with URLs (thatā€™s dozens of links in a trusted environment per week) is putting an unneeded extra barrier to get to the referenced resource w/ a web browser, but most frustratingly puts extra efforts into editing processes b/c the URLs have to be edited before using them in other systems.

13

This feature was introduced to harden the security. In theory someone could otherwise use CSS tricks to make a legit looking link or interface button point to a malicious domain. For this reason we didnā€™t add an option to disable it.

I do understand the desire to improve security. But with that argument, every web page anywhere should add such a warning page when linking to something they consider ā€œexternalā€ - but the web is meant to be exactly that: interconnected pages.

The more warning pages like these exist, the more users will just ā€˜quick-clickā€™ those away, rendering ineffective from a security-point-of-view. However, the disadvantages remain, and others have already mentioned how disruptive they are to users.

Please: give users a possibility to disable that warning page, ideally both site-side and using front-matter on each page.

14

Due to popular demand, weā€™ll add an option to disable the warning. It will be part of the next release, coming up very soon.

We recommend to disable this only with a known and trusted user base, but of course the decision lays at the instance hosters.

15

Just as a follow-up: The recent release HedgeDoc 1.11.1 adds two configuration options regarding the link warning:

  1. externalLinkWarning (CMD_EXTERNAL_LINK_WARNING) can be used to disable the warning entirely by setting it to false. However, we recommend doing so only for closed instances with a known user base.
  2. externalLinkWhitelist (CMD_EXTERNAL_LINK_WHITELIST) can be used to configure domains that are exempt from the link warning. Thereā€™s support for strict domains as well as wildcards (like *.example.com).
1 Like
16

This works! No more warnings.Thank you for addressing this so quickly.

1 Like