Commit Graph

25279 Commits

Author SHA1 Message Date
Alan Guo Xiang Tan
aed65ec16d SECURITY: User's read state for topic is leaked to unauthorized clients.
A user's read state for a topic such as the last read post number and the notification level is exposed.
2021-08-12 12:16:45 +08:00
Alan Guo Xiang Tan
9a60c83535 FIX: TopicTrackingState.report not including unread for staff posts.
Follow-up to e15c86e8c5
2021-08-12 11:10:49 +08:00
Alan Guo Xiang Tan
2fb17b7b17 DEV: Remove code that is not being used.
Code was added in e15c86e8c5 but it isn't
necessary anymore.

Follow-up to e15c86e8c5
2021-08-12 07:56:38 +08:00
Martin Brennan
814aa64a5d
FIX: Notification menu broken on older browsers (#14019)
replaceAll is not available in all versions of Chrome/Firefox/Edge
that we support, so we need to use replace instead
2021-08-12 09:54:15 +10:00
Roman Rizzi
630d485f0f
DEV: Remove unused server-side route. (#14011)
We no longer use this route. When a staff member wants to see a user flagged posts, we redirect them to the review queue.
2021-08-11 17:29:19 -03:00
Kris
f848f6cbb6
UX: Fix mobile PM nav for regular users (#14007) 2021-08-11 12:47:03 -04:00
David Taylor
b3c1cb6df6
DEV: Add caret_position.js to ember-cli build (#14009)
This is used when positioning autocompletes in the composer, and elsewhere
2021-08-11 16:42:04 +01:00
Mark VanLandingham
3119b881aa
DEV: Define --footer-nav-height css var (#14008) 2021-08-11 10:29:16 -05:00
David Taylor
70f8fdbe45
FEATURE: Allow linking an existing account from invite acceptance (#13998)
The invite acceptance page is an alternative signup flow, so it makes sense to include the new 'link' functionality there as well.

Followup to 7dc8f8b794
2021-08-11 10:26:37 +01:00
Arpit Jalan
e9b2415e7d
UX: show flair help text for private member visibility only (#14005) 2021-08-11 16:23:58 +10:00
Alan Guo Xiang Tan
e157925308 DEV: Remove unused attributes when publishing read/new. 2021-08-11 11:12:23 +08:00
Osama Sayegh
bdcb96ad1b
UX: Indicate capped history revisions only when they're actually capped (#14000)
We've recently added a limit to the posts history modal so it displays the last 100 revisions only for performance reasons. However, the title of the modal now always says `History, last 100 revisions` even when the post has fewer than 100 revisions which can be a bit noisy.

This PR amends the history modal so the title of the modal says `History` when the post's revisions count is ≤100, and `History, last 100 revisions` when it has more >100 revisions.
2021-08-11 00:24:37 +03:00
Jordan Vidrine
8569895f71
FIX: Fix rtl style for pull right (#13999)
* FIX: RTL fix for pull right
2021-08-10 15:31:04 -05:00
David Taylor
7dc8f8b794 FEATURE: Allow linking an existing account during external-auth signup
When a user signs up via an external auth method, a new link is added to the signup modal which allows them to connect an existing Discourse account. This will only happen if:

- There is at least 1 other auth method available

and

- The current auth method permits users to disconnect/reconnect their accounts themselves
2021-08-10 15:07:40 +01:00
David Taylor
46dc189850 DEV: Improve robustness of associate_accounts_controller
This handles a few edge cases which are extremely rare (due to the UI layout), but still technically possible:

- Ensure users are authenticated before attempting association.

- Add a message and logic for when a user already has an association for a given auth provider.
2021-08-10 15:07:40 +01:00
David Taylor
2cae29f644 DEV: Update associate_accounts_controller to use secure_session
This is much cleaner than using redis directly. It also opens the door to more complex association change flows which may happen during login.
2021-08-10 15:07:40 +01:00
Arpit Jalan
97f701bc4c
UX: update member visibility help text to include flair information (#13995) 2021-08-10 19:31:29 +05:30
Joffrey JAFFEUX
6d41c37c16
DEV: stop propagation of events on button click (#13993) 2021-08-10 15:52:59 +02:00
Arpit Jalan
3006de39d1
REVERT "FIX: do not show private group flair on user avatars" (#13991)
This reverts commit fe3e18f981 and 0d8fd9ace6
2021-08-10 17:25:11 +05:30
Joffrey JAFFEUX
2efe91f49f
UI: fixes sidebar settings border and active styles (#13990)
- active setting should now correctly show an arrow which was previously floating in the middle of nowhere
- uses a correct color for border separation, previously the border was present but invisible as similar to the background
- slighty tweak padding
- makes arrow computation based on a variable
2021-08-10 08:53:22 +02:00
Alan Guo Xiang Tan
fa952c036c UX: Missing translation for title attribute for PM tag route. 2021-08-10 09:58:59 +08:00
Bianca Nenciu
d68f2de4c7
FIX: Reuse avatar-flair component in group preview (#13961)
Sometimes the group flair preview was different than the real group
flair because different components were used for rendering.
2021-08-09 15:38:49 -03:00
Robin Ward
5c07e544af Revert "DEV: Discourse.User has been deprecated since 2.6"
This reverts commit 3edf24437a.

Too many plugins rely on this right now and need to be updated.
2021-08-09 13:42:26 -04:00
Robin Ward
3edf24437a DEV: Discourse.User has been deprecated since 2.6 2021-08-09 12:40:42 -04:00
Jarek Radosz
e68c1d5ba5
DEV: Use key over the deprecated keyCode (#13795)
Makes the code a bit more readable. Inspired by https://github.com/emberjs/ember.js/pull/19185
2021-08-09 11:41:36 +02:00
Joffrey JAFFEUX
8df48b516f
DEV: ensures click listeners are reset between tests (#13900) 2021-08-09 10:00:56 +02:00
Joffrey JAFFEUX
800926fcce
FIX: prevents s shortcut to generate an error (#13974)
When no element is selected, on the homepage for example, pressing `s` would generate the following error:

```
Uncaught TypeError: Cannot read property 'click' of undefined
```

Note that this commit also removes jquery usage.
2021-08-09 09:39:01 +02:00
Vinoth Kannan
8c27e69523
UX: disable "Queue For Review" button if user can't perform action. (#13966)
Currently, it's returning JS error when trying to click the button when the action is already performed by the same staff user.
2021-08-07 12:36:56 +05:30
Andrei Prigorshnev
09ad3ed41d
FEATURE: revert disallowing putting URLs in titles for TL0 users (#13970)
This reverts a part of changes introduced by https://github.com/discourse/discourse/pull/13947

In that PR I:
1. Disallowed topic feature links for TL-0 users
2. Additionally, disallowed just putting any URL in topic titles for TL-0 users

Actually, we don't need the second part. It introduced unnecessary complexity for no good reason. In fact, it tries to do the job that anti-spam plugins (like Akismet plugin) should be doing.

This PR reverts this second change.
2021-08-06 20:07:42 +04:00
Arpit Jalan
0d8fd9ace6
FIX: do not show flair bg color if flair is not visible (#13969)
follow up to fe3e18f981
2021-08-06 20:53:23 +05:30
Roman Rizzi
044de6d670
DEV: Give callback listeners access to the request object. (#13965)
Plugins listening on the `before_auth` callback can interact with the request object and access data like the user agent or the remote IP address. We'll later store this data in the user record, but it might not exist at this point if we're authenticating a new account.
2021-08-06 11:26:11 -03:00
Joffrey JAFFEUX
bf43d8eb40
DEV: uses vanilla js and DOM to replace link mentions (#13959)
- uses DOM apis
- do not concat strings
- ensures string is set as innerText and not HTML
- do not work on jquery objects
2021-08-06 09:26:54 +02:00
Robin Ward
844c05b70b DEV: New Plugin API method for delegating an app event 2021-08-05 14:44:26 -04:00
Bianca Nenciu
38199424bc
SECURITY: Sanitize d-popover attributes (#13958) 2021-08-05 16:39:17 +03:00
Robin Ward
18c5e9338f DEV: Allow us to use Ember CLI assets in production
This adds an optional ENV variable, `EMBER_CLI_PROD_ASSETS`. If truthy,
compiling production assets will be done via Ember CLI and will replace
the assets Rails would otherwise use.
2021-08-05 08:32:33 -04:00
Andrei Prigorshnev
0c0a11b66a
FEATURE: Disallow putting urls in the title for TL-0 users (#13947)
This disallows putting URLs in topic titles for TL0 users, which means that:

If a TL-0 user puts a link into the title, a topic featured link won't be generated (as if it was disabled in the site settings)
Server methods for creating and updating topics will be refusing featured links when they are called by TL-0 users
TL-0 users won't be able to put any link into the topic title. For example, the title "Hey, take a look at https://my-site.com" will be rejected.

Also, it improves a bit server behavior when creating or updating feature links on topics in the categories with disabled featured links. Before the server just silently ignored a featured link field that was passed to him, now it will be returning 422 response.
2021-08-05 13:38:39 +04:00
Alan Guo Xiang Tan
3f59ccefd7 FIX: Remove limit on dismissing unread and new messages.
Follow-up to 2c046cc670
2021-08-05 14:55:38 +08:00
Alan Guo Xiang Tan
2c046cc670 FEATURE: Dismiss new and unread for PM inboxes. 2021-08-05 12:56:15 +08:00
Martin Brennan
d3779d4cf7
FIX: Wrong default notification level shown for group (#13952)
In the group interaction UI, if the default_notification_level for
a group was set to 0 (muted) it incorrectly showed as Watching in
the UI because of the ember or() helper, using JS comparison, considered
0 to be a falsey value and always showed 3 (watching) instead.
2021-08-05 13:17:36 +10:00
Krzysztof Kotlarek
7063933755
FEATURE: send user-card:show event (#13910)
Send user-card:show event when card is opened. Other parts may listen, for example, for analytic purpose.
2021-08-05 11:52:28 +10:00
Joffrey JAFFEUX
2ebe900914
DEV: resets post menu extra buttons between tests (#13939)
This ensures we do not leak buttons in acceptance tests
2021-08-05 11:47:49 +10:00
jbrw
fb14e50741
SECURITY: Destroy EmailToken when EmailChangeRequest is destroyed (#13950) 2021-08-04 19:14:56 -04:00
Martin Brennan
d8a0d2262c
DEV: Update pretender and fake-xml-http-request (#13937)
We are still on a version of pretender since 2017
https://github.com/pretenderjs/pretender/releases/tag/v1.6.1

Since then many changes have been made, including adding support
for xhr.upload. Upgrading will let us write proper acceptance
tests for uppy, which uses XmlHTTPRequest internally including
xhr.upload.

Updates pretender to 3.4.7 and fake-xml-http-request to 2.1.2.

Note: There have been no breaking changes in the releases that would
affect us, mainly dropping support for old node versions.
2021-08-05 08:23:01 +10:00
Robin Ward
17f28d4018 DEV: Add a widget API for injecting services
When declaring your widget you can now add an option like: `services: ['cool']`

And your widget instances will automatically get a `this.cool` property
which will resolve to the service. This saves having to look it up
yourself.
2021-08-04 16:27:19 -04:00
Jarek Radosz
07c6b720bc
DEV: Remove PostProcessed trigger option (#13916)
It was deprecated 5 years ago in e55e2aff94

I've seen it still being used in the wild, even though it doesn't do anything anymore as I understand it.
2021-08-04 22:24:47 +02:00
Jarek Radosz
fbd1cd5fe1
DEV: Prevent npm usage (#13945)
We rely on yarn workspaces so we don't want people using npm in the repo by accident.

Also updated the required node version to 12+.

~~Not sure about the min yarn version – the latest one could be missing in various CI-like envs, so I might change it yet.~~
Downgraded yarn to ">= 1.21.1" (the oldest of "current" versions, tagged "legacy")
2021-08-04 22:04:58 +02:00
Joffrey JAFFEUX
5b85b254db
DEV: do not process composer preview when collapsed (#13941) 2021-08-04 16:40:31 +02:00
Bianca Nenciu
d9843d757a
FIX: Update draft count when sequence is increased (#13940)
* FIX: Update draft count when sequence is increased

Sometimes users ended up having a draft count higher than the actual
number of drafts.

* FIX: Do not update draft count twice

The call to DraftSequence.next! above already does it.
2021-08-04 13:30:37 +03:00
Arpit Jalan
4122affc0f
FIX: use search message context on group message page (#13936) 2021-08-04 13:42:17 +05:30
Vinoth Kannan
1da0aa838f
FIX: use update_attribute method to trigger callbacks. (#13930)
Group flair is not removed while removing a user from the group since the `before_save` callback methods are not triggered while using the `update_columns` method.
2021-08-04 11:54:46 +05:30