Merge branch 'develop' into fb-leap-33/taxonomy-labels

Author: hlomzik

.github/workflows/invite-check.yml

@@ -9,7 +9,7 @@ env:
   INVITE_LINK: 'https://slack.labelstud.io/'
 
 jobs:
-  check:
+  check_link:
     runs-on: ubuntu-latest
     steps:
       - name: Check if the invite link is valid
@@ -27,17 +27,20 @@ jobs:
         env:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_LS_BOT_TOKEN }}
 
+  check_domains:
+    runs-on: ubuntu-latest
+    steps:
       - name: Check if the invite link has teamDomains arg
         id: invite_link_has_teamdomains
         run: |
           grep -Eo '(&quot;|")teamSignupDomains(&quot;|")\s*:\s*\[\]' <(
               curl --silent --location ${{ env.INVITE_LINK }} -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:96.0) Gecko/20100101 Firefox/96.0' -H "Accept: application/json"
           )
-      - name: Notify to Slack
-        if: always() && steps.invite_link_has_teamdomains.outcome == 'failure'
-        uses: slackapi/slack-github-action@v1.24
-        with:
-          channel-id: '${{ secrets.SLACK_LS_MONITORING_CHANNEL }}'
-          slack-message: "Our <${{ env.INVITE_LINK }}|public invite link> was configured to allow signups only from a list of allowed domains:\n1. Go to <https://label-studio.slack.com/admin/settings|Workspace settings>, next to `Joining This Workspace`, click `Expand`.\n2. Delete all domains from the list, select `Allow invitations` and click `Save`."
-        env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_LS_BOT_TOKEN }}
+#      - name: Notify to Slack
+#        if: always() && steps.invite_link_has_teamdomains.outcome == 'failure'
+#        uses: slackapi/slack-github-action@v1.24
+#        with:
+#          channel-id: '${{ secrets.SLACK_LS_MONITORING_CHANNEL }}'
+#          slack-message: "Our <${{ env.INVITE_LINK }}|public invite link> was configured to allow signups only from a list of allowed domains:\n1. Go to <https://label-studio.slack.com/admin/settings|Workspace settings>, next to `Joining This Workspace`, click `Expand`.\n2. Delete all domains from the list, select `Allow invitations` and click `Save`."
+#        env:
+#          SLACK_BOT_TOKEN: ${{ secrets.SLACK_LS_BOT_TOKEN }}

docs/scripts/index.js

@@ -1,3 +1,5 @@
-var breadcrumb = require('./breadcrumb')(hexo);
+var breadcrumb = require("./breadcrumb")(hexo);
+var removeContent = require("./removeContent")(hexo);
 
-hexo.extend.helper.register('breadcrumb', breadcrumb, {async: true});
+hexo.extend.helper.register("breadcrumb", breadcrumb, { async: true });
+hexo.extend.helper.register("removeContent", removeContent, { async: true });

docs/scripts/removeContent.js

@@ -1,17 +1,21 @@
-var HTMLParser = require('node-html-parser');
+var HTMLParser = require("node-html-parser");
 
-hexo.extend.filter.register('after_render:html', function(data) {
+module.exports = function (ctx) {
+  return function includeTag(content) {
+    const { config } = ctx;
 
-  const { config } = this;
+    /* If you’re on the OSS site, remove every `.enterprise-only` element. Opposite for the ENT site */
+    const classToRemove =
+      config.theme_config.tier === "opensource"
+        ? ".enterprise-only"
+        : ".opensource-only";
 
-  /* If you’re on the OSS site, remove every `.enterprise-only` element. Opposite for the ENT site */
-  const classToRemove = config.theme_config.tier === "opensource" ? ".enterprise-only" : ".opensource-only";
+    const template = HTMLParser.parse(content);
 
-  const template = HTMLParser.parse(data);
+    template.querySelectorAll(classToRemove).forEach((x) => x.remove());
 
-  template.querySelectorAll(classToRemove).forEach(x=> x.remove()); 
+    content = template.toString();
 
-  data = template.toString();
-
-  return data;
-})
+    return content;
+  };
+};

docs/source/guide/helm_values.md

@@ -174,8 +174,8 @@ Parameters specific to the `app` portion of the Label Studio deployment.
 | `app.nginx.livenessProbe.periodSeconds`        | Nginx sidecar container: How often (in seconds) to perform the probe                                                 | `5`                      |
 | `app.nginx.livenessProbe.successThreshold`     | Nginx sidecar container: Minimum consecutive successes for the probe to be considered successful after having failed | `1`                      |
 | `app.nginx.livenessProbe.timeoutSeconds`       | Nginx sidecar container: Number of seconds after which the probe times out                                           | `3`                      |
-| `app.nginx.readinessProbe.enabled`             | Nginx sidecar container: Enable redinessProbe                                                                        | `true`                   |
-| `app.nginx.readinessProbe.path`                | Nginx sidecar container: Path for reasinessProbe                                                                     | `/version`               |
+| `app.nginx.readinessProbe.enabled`             | Nginx sidecar container: Enable readinessProbe                                                                        | `true`                   |
+| `app.nginx.readinessProbe.path`                | Nginx sidecar container: Path for readinessProbe                                                                     | `/version`               |
 | `app.nginx.readinessProbe.failureThreshold`    | Nginx sidecar container: When a probe fails, Kubernetes will try failureThreshold times before giving up             | `2`                      |
 | `app.nginx.readinessProbe.initialDelaySeconds` | Nginx sidecar container: Number of seconds after the container has started before probe initiates                    | `60`                     |
 | `app.nginx.readinessProbe.periodSeconds`       | Nginx sidecar container: How often (in seconds) to perform the probe                                                 | `10`                     |
@@ -294,8 +294,9 @@ Parameters specific to the `rqworkers` service of your Label Studio Enterprise d
 ## The `global.extraEnvironmentVars` usage
 
 The `global.extraEnvironmentVars` section can be used to configure environment properties of Label Studio.
-Any key value put under this section translates to environment variables
-used to control Label Studio's configuration. Every key is upper-cased before setting the environment variable.
+
+Any key value put under this section translates to environment variables used to control Label Studio's configuration. Every key is upper-cased before setting the environment variable.
+
 An example:
 
 ```yaml
@@ -304,11 +305,16 @@ global:
      PG_USER: labelstudio
 ```
 
+!!! note
+    If you are deploying to a production environment, you should set `SSRF_PROTECTION_ENABLED: true`. See [Secure Label Studio](security#Enable-SSRF-protection-for-production-environments). 
+
+
 ## The `global.featureFlags` usage
 
 The `global.featureFlags` section can be used to set feature flags of Label Studio.
-Any key value put under this section translates to environment variables
-used to control Label Studio's feature flags configuration. Every key should start from `ff_` or `fflag_` in lower case.
+
+Any key value put under this section translates to environment variables used to control Label Studio's feature flags configuration. Every key should start from `ff_` or `fflag_` in lower case.
+
 An example:
 
 ```yaml

docs/source/guide/install_enterprise_k8s.md

@@ -309,10 +309,13 @@ global:
 
 4. Install or upgrade Label Studio Enterprise using Helm.
 
-### Use Helm to install Label Studio Enterprise on your Kubernetes cluster
+## Use Helm to install Label Studio Enterprise on your Kubernetes cluster
 
 Use Helm to install Label Studio Enterprise on your Kubernetes cluster. Provide your custom resource definitions YAML file. Specify any environment variables that you need to set for your Label Studio Enterprise installation using the `--set` argument with the `helm install` command.
 
+!!! note
+    If you are deploying to a production environment, you should set the `SSRF_PROTECTION_ENABLED: true` environment variable. See [Secure Label Studio](security#Enable-SSRF-protection-for-production-environments).
+
 From the command line, run the following:
 ```shell
 helm install <RELEASE_NAME> heartex/label-studio -f ls-values.yaml

docs/source/guide/install_k8s.md

@@ -150,10 +150,13 @@ global:
 
 4. Install or upgrade Label Studio using Helm.
 
-### Use Helm to install Label Studio on your Kubernetes cluster
+## Use Helm to install Label Studio on your Kubernetes cluster
 
 Use Helm to install Label Studio on your Kubernetes cluster. Provide your custom resource definitions YAML file. Specify any environment variables that you need to set for your Label Studio installation using the `--set` argument with the `helm install` command.
 
+!!! note
+    If you are deploying to a production environment, you should set the `SSRF_PROTECTION_ENABLED: true` environment variable. See [Secure Label Studio](security#Enable-SSRF-protection-for-production-environments).
+
 From the command line, run the following:
 
 ```shell

docs/source/guide/security.md

@@ -61,6 +61,13 @@ If you're using Label Studio Enterprise, you can further secure user access in m
 
 Access to the REST API is restricted by user role and requires an access token that is specific to a user account. Access tokens can be reset at any time from the Label Studio UI or using the API.
 
+## Enable SSRF protection for production environments
+
+When deploying Label Studio into a production environment, set the `SSRF_PROTECTION_ENABLED` environment variable to `true`. 
+
+This variable is disabled by default to support users who are working with data in their local environments. However, it should be enabled in production usage. 
+
+
 ## Secure access to data in Label Studio
 
 Data in Label Studio is stored in one or two places, depending on your deployment configuration.

docs/source/guide/ts+video.md

@@ -3,6 +3,8 @@
 
 <% const showToc = pageContainsHeadings && tocPageTypes %>
 
+<% const formattedContent = removeContent(page.content) %>
+
 <div class="content-grid">
   <div class="content-markdown">
     <% if(page.type && page.parent !== undefined) { %>
@@ -11,18 +13,18 @@
     <% if (page.title.trim()) { %>
       <%- partial("component/heading", {text: page.title, size: "XLarge", tag: "h1", customClass: "home-page-title"}) %>
     <% } %>
-    <%- page.content %>
+    <%- formattedContent %>
   </div>
   <div class="page-rightsidebar">
     <% if (showToc) { %>
       <div class="toc">
         <%- partial("component/text", {text: "In this article", tag: "h3", size: "Eyebrow"}) %>
-        <%- toc(page.content, {max_depth: 2, list_number: false, class: "toc-list"}) %>
+        <%- toc(formattedContent, {max_depth: 2, list_number: false, class: "toc-list"}) %>
       </div>
     <% } %>
     <div class="toc-enterprise-cta">
       <span class="toc-enterprise-cta-copy">Try Enterprise Cloud for free</span>
       <%- partial("component/button", { url: "https://humansignal.com/free-trial", label: "Get Started", theme: "Tertiary" }) %>
     </div>
   </div>
-</div>
+</div>

docs/themes/v2/layout/page.ejs

@@ -4,7 +4,7 @@
 package_name = 'label-studio'
 
 # Package version
-__version__ = '1.10.1dev'
+__version__ = '1.9.2dev'
 
 # pypi info
 __latest_version__ = None