rm3

rm3

What is it?

rm3 is a system for managing stuff on the web. It's a little more than just a blog engine, but a little less than an enterprise CMS. It is to Drupal as Ghost is to WordPress. It can be a blog, a wiki, a photo archive, or a combination of all of that and more. Like a blog, it lets you create a series of blog articles in a collection. Like a wiki, it maintains a history of all changes. Like a CMS, it lets you create a site with more structure than a mere list of posts. It has good support for both SVG vector graphics and photos.

Release Status

This is currently in PRE-ALPHA state, defined as:

• I'm not yet trying to run this in production, so you definitely shouldn't.
• Any data you put in here you should be prepared to reconstruct without the benefit of a migration tool.
• Security and stability bugs are to be expected.
• Key features are missing.
• The basic structure of code is assumed to be unstable and any APIs are subject to change

The next milestone is ALPHA, defined as:

• Key features are not missing
• Any data you put in here you should be prepared to reconstruct without the benefit of a migration tool.
• Security and stability bugs are to be expected.
• Some stable internal APIs will be present.

How to get started?

Automated Setup

Docker Compose

Manual Setup

• Install PostgreSQL 9.4 or later. See PostgreSQL installation -- you want to install it off of the PostgreSQL Apt Repository if your operating system doesn't package 9.5 or newer
• Install node.js 4.4 or later (node.js 6.0 is not yet supported). See NodeJS install via package manager
• Install Redis 2.0 or later.
• Install LibRSVG library and header files (see https://www.npmjs.com/package/librsvg)
• Git clone this repo
• npm install
• Create the database in postgresql
  • Set up a password and user.
    • The default setup is to assume it can connect to a database named rm3test with username wirehead and password rm3test. An example database setup sequence, assuming that the default installed admin PostgreSQL user is postgres:
      • psql -c 'create database rm3test;' -U postgres
      • psql -c "CREATE USER wirehead WITH PASSWORD 'rm3test';" -U postgres
      • psql -c "GRANT ALL PRIVILEGES ON database rm3test TO wirehead;" -U postgres
      • psql -c "ALTER USER wirehead WITH SUPERUSER;" -U postgres
    • You can set the RM3_PG environment variable to something different if you want a different database username and password (and definitely should, if you want to run this in production)
  • createdb rm3test
  • psql rm3test -U wirehead < db-schema.sql
• Load some default content
  • ./bin/rm3load -f default_frontpage.json
  • ./bin/rm3load -f default_users.json
• Add a user and assign them to the root group
  • ./bin/rm3admin adduser wirehead "Some New User" -p "Some profile text" -u http://www.wirewd.com/ -e [e-mail] --password password
  • ./bin/rm3admin assign wirehead root
• Add permissions for the root group
  • ./bin/rm3admin permit root edit \*
  • ./bin/rm3admin permit root delete \*
  • ./bin/rm3admin permit root view \*
• Add permissions for the special 'nobody' group
  • ./bin/rm3admin permit nobody view wh.!users
• Run it
  • ./node_modules/.bin/gulp develop

Docs

• How to administer your rm3 install
• CLI Commands
• Environment Variables useful for configuring rm3
• And more..

To generate API docs:

• npm run docs

Tests

To test:

• npm test

To lint:

• npm run lint

To check coverage

• npm run coverage

If you want to do some development and not want to log in:

• RM3_DANGER_FORCE_AUTH='wirehead' gulp develop
  • Warning: If you try to do this on a publicly accessible Internet port, you will get hacked

Benchmarks

• npm run benchmark

Contributing

There are a wide variety of ways to contribute. Documentation, bug triage, detailed issues (including UI/UX, bug reports, etc), test cases, refactoring, artwork, schemes, and so on are all just as important as features.

Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms.

CONTRIBUTING.md contains more details.

License

GPL, see LICENSE

Changelog

[0.2.0] - High - 2016-7-17: Special Sunny July with Poison Ivy edition

This version is incompatable with 0.1.x databases.

Added

• Updated environment variable manual.
• Changed security warnings in the logs.
• Tombstones for deleted entities.
• Persistant storage of sessions in Redis
• Unit tests for the CLI tooling
• Templates can now create all of the RBAC entities and users.
• Blob store for binary objects (photos, audio, videos, etc).
• SVG support via Vector Graphics proto.
• JPEG support via Photograph proto.
• Workflow engine
• rm3backup generates a catalog file and dumps permissions, credentials, and blobs
• rm3load can load a backup folder generated by rm3backup in one step
• rm3admin can peek into identities
• Improved logging.
• Predicates can have a URI (For eventual JSON-LD / RDF goodness)
• Templates can now have an 'index' type

Changed

• BREAKING: updated to textblocks 0.0.10, which is incompatible with previous versions.
• Gulpfile refactored into smaller chunks.
• gulp-clean-css replaces gulp-minify-css.
• User proto refactored
• Password paths shuffled
• Improved default page text to be a bit more beginner-friendly.
• Default behaviour after editing a page is to redirect back to the page, instead of showing edit again.

Removed

• node 0.12 support removed.
• postgres 9.3 support removed. postgres 9.4 now recommended.

Fixed

• Coverage collection fixed.
• Icon generation uses picture polyfill instead of accidentally invalid html.
• If a user provides an invalid cookie for user deserialization (e.g. trying to log in after clearing the databse but not the Redis session cache) the error is logged and the request continues as if the user is unauthenticated.

Security

• RM3_SESSION_SECRET to store the session secret, instead of known hardcoded secret.
• A bunch of views weren't checking for read access.
• Password changing has been protected differently from editing a user profile.
• Passwords are stored as credentials, instead of in the user object.
• TOTP Two-Factor authentication.
• CVE-2015-8851: node-uuid prior to 1.4.4 uses insecure random number generator.
• CVE-2016-5118: sharp prior to 0.15.0 uses insecure Magick.
• CWE-400: negotiator prior to 0.6.1 are vulnerable to ReDoS.