Commit Graph

35572 Commits

Author SHA1 Message Date
Martin Brennan
edbc356593
FIX: Replace deprecated URI.encode, URI.escape, URI.unescape and URI.unencode (#8528)
The following methods have long been deprecated in ruby due to flaws in their implementation per http://blade.nagaokaut.ac.jp/cgi-bin/vframe.rb/ruby/ruby-core/29293?29179-31097:

URI.escape
URI.unescape
URI.encode
URI.unencode
escape/encode are just aliases for one another. This PR uses the Addressable gem to replace these methods with its own encode, unencode, and encode_component methods where appropriate.

I have put all references to Addressable::URI here into the UrlHelper to keep them corralled in one place to make changes to this implementation easier.

Addressable is now also an explicit gem dependency.
2019-12-12 12:49:21 +10:00
Sam Saffron
b6acfb7847 DEV: upgrade redis-namespace gem
New release has a few extra commands namespaced, nothing we use.

Also added a comment about why this is explicitly required.
2019-12-12 13:36:08 +11:00
dependabot-preview[bot]
61ac0d47ee DEV: Bump stackprof from 0.2.13 to 0.2.14 (#8531)
Bumps [stackprof](https://github.com/tmm1/stackprof) from 0.2.13 to 0.2.14.
- [Release notes](https://github.com/tmm1/stackprof/releases)
- [Changelog](https://github.com/tmm1/stackprof/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tmm1/stackprof/compare/v0.2.13...v0.2.14)

Minor upgrade to stackprof which is only used for diagnostics and not default required. Changes all look safe.
2019-12-12 13:29:00 +11:00
David Taylor
1e59371a4f DEV: Remove unused omit_stats variable from user serializer (#8513)
* DEV: Remove unused omit_stats variable from user serializer

This was hard-coded to true in a8b5192efd, and is no longer used anywhere

* Remove attribute declarations
2019-12-12 13:27:23 +11:00
Krzysztof Kotlarek
746ba0d8fd SECURITY: upgrade rack-mini-profiler to avoid possible XSS (#8537) 2019-12-12 13:15:40 +11:00
Kris
91a5731e7b UX: Small fixes for iOS signup modal 2019-12-11 15:47:25 -05:00
Kris
9c41b66996 UX: Tag combo box styles should match tags on topics 2019-12-11 14:49:39 -05:00
Mark VanLandingham
09d9baa6d7
FIX: Update S3 stubs for more aws-sdk API changes (#8534) 2019-12-11 11:26:52 -08:00
Régis Hanol
278d70f3eb FIX: Add new content type for theme/component
When uploading a theme/component, depending on the extension of the
file and the OS/Browser being used, the content type might differ.

This adds the "application/x-zip-compressed" content type that is being
sent by most Browsers on latest Windows when uploading a .zip file.
2019-12-11 19:50:23 +01:00
Kris
2f8a25b2d5 UX: Minor style updates for tag info 2019-12-11 13:34:01 -05:00
dependabot-preview[bot]
863d3f89de Build(deps): Bump aws-sdk-s3 from 1.36.1 to 1.59.0 (#8502)
* Build(deps): Bump aws-sdk-s3 from 1.36.1 to 1.59.0

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.36.1 to 1.59.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/compare/v1.36.1...v1.59.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

* Dependabot/bundler/aws sdk s3 1.59.0 (#8532)
2019-12-11 10:18:11 -08:00
David Taylor
584021ca38 DEV: Correct error handling in run-qunit
runAllTests is an async function, so the try/catch block does not help. The function always returns a promise, so we need to use `.catch` to handle errors. Previously, raised errors were ignored, and the process continued running until it timed out.
2019-12-11 16:50:31 +00:00
Dan Ungureanu
4e130f1e03
SECURITY: Remove event handlers from SVG files 2019-12-11 17:04:50 +02:00
Dan Ungureanu
adfa793731
SECURITY: Ensure only image uploads can be inlined
This prevents malicious files (for example special crafted XMLs) to be
used in XSS attacks.
2019-12-11 17:04:49 +02:00
Joffrey JAFFEUX
dc6b02f050
UX: attempts to make charts loading less laggy (#8529) 2019-12-11 15:49:17 +01:00
Mark VanLandingham
06c6062ed2
DEV: Lock sassc gem at version 2.0.1 with note (#8523) 2019-12-11 06:22:39 -08:00
dependabot-preview[bot]
b90a592146 DEV: Bump aws-sdk-sns from 1.13.0 to 1.21.0 (#8490)
Bumps [aws-sdk-sns](https://github.com/aws/aws-sdk-ruby) from 1.13.0 to 1.21.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-sns/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/compare/1.13.0...1.21.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2019-12-11 06:13:17 -08:00
Robin Ward
4abe4454dd
FEATURE: Create IE Support Plugin (#8520)
This core plugin, which could be split off in the future, allows us to load IE specific code on demand.

Co-authored-by: jjaffeux <j.jaffeux@gmail.com>
2019-12-11 09:07:22 -05:00
romanrizzi
5431ae0a17 FIX: Don't raise an error if the user is not present 2019-12-11 11:03:31 -03:00
David Taylor
e5ce2d97f6 DEV: Simplify Rubocop runner for GitHub actions
Once we are happy with basic behavior, we can try adding annotations again
2019-12-11 11:49:27 +00:00
Martin Brennan
c7c4124b82 Use sandbox.restore() to try improve bookmark-test 2019-12-11 19:00:37 +10:00
Martin Brennan
232eb685af Fix improved bookmark toggling/deleting bug
* i was incorrectly toggling the transformed post property
  instead of the actual property in the emberjs post model
  which broke the bookmark/unbookmark functionality
2019-12-11 15:48:27 +10:00
Martin Brennan
6261339da9
Improving bookmarks part 1 (#8466)
Note: All of this functionality is hidden behind a hidden, default false, site setting called `enable_bookmarks_with_reminders`. Also, any feedback on Ember code would be greatly appreciated!

This is part 1 of the bookmark improvements. The next PR will address the backend logic to send reminder notifications for bookmarked posts to users. This PR adds the following functionality:

* We are adding a new `bookmarks` table and `Bookmark` model to make the bookmarks a first-class citizen and to allow attaching reminders to them.
* Posts now have a new button in their actions menu that has the icon of an actual book
* Clicking the button opens the new bookmark modal.
* Both name and the reminder type are optional.
* If you close the modal without doing anything, the bookmark is saved with no reminder.
* If you click the Cancel button, no bookmark is saved at all.
* All of the reminder type tiles are dynamic and the times they show will be based on your user timezone set in your profile (this should already be set for you).
* If for some reason a user does not have their timezone set they will not be able to set a reminder, but they will still be able to create a bookmark.
* A bookmark can be deleted by clicking on the book icon again which will be red if the post is bookmarked.

This PR does NOT do anything to migrate or change existing bookmarks in the form of `PostActions`, the two features live side-by-side here. Also this does nothing to the topic bookmarking.
2019-12-11 14:04:02 +10:00
Blake Erickson
b73a133bb5 FIX: Prevent scientific notation in free space check (#8473)
It's possibly that when trying to upload a backup the free space check
will output scientific notation resulting in an incorrect "There is not
enough space on disk" error.

The free space check uses the Linux `print` command which could return a
number using scientific notation like `1.60459e+10` and when ruby
converts it to an integer it will have the value of `1` instead of
`16045879296`. Which means even though you have 16GB of free space you
could not upload a 1GB backup file.

This commit uses the `printf` command instead which allows you to
specify that you do not want scientific notation.

I'm not sure why this hasn't been an issue before, but I was
experiencing it locally in development.
2019-12-11 12:57:03 +11:00
Sam Saffron
1d16b34284 DEV: forgot to check in lockfile
updates lock file to properly match the generated one.
2019-12-11 12:45:42 +11:00
Sam Saffron
4de39f6596 DEV: hold back mocha upgrade
This breaks our test suite and we want to properly document this.
2019-12-11 12:43:07 +11:00
dependabot-preview[bot]
508b4c1e5e DEV: Bump css_parser from 1.7.0 to 1.7.1 (#8524)
Bumps [css_parser](https://github.com/premailer/css_parser) from 1.7.0 to 1.7.1.
- [Release notes](https://github.com/premailer/css_parser/releases)
- [Changelog](https://github.com/premailer/css_parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/premailer/css_parser/compare/v1.7.0...v1.7.1)

This minor update force UTF-8, this should have not impact on us as we only trade in UTF-8 strings for CSS anyway.
2019-12-11 10:56:53 +11:00
dependabot-preview[bot]
83175c9bfb DEV: Bump rspec-html-matchers from 0.9.1 to 0.9.2 (#8525)
Bumps [rspec-html-matchers](https://github.com/kucaahbe/rspec-html-matchers) from 0.9.1 to 0.9.2.
- [Release notes](https://github.com/kucaahbe/rspec-html-matchers/releases)
- [Changelog](https://github.com/kucaahbe/rspec-html-matchers/blob/master/CHANGELOG.md)
- [Commits](https://github.com/kucaahbe/rspec-html-matchers/compare/v0.9.1...v0.9.2)

Low risk update, only impacts tests.
2019-12-11 10:55:25 +11:00
Sam Saffron
7b0cbfc1f9 DEV: lint file
long story but we are sorting out our new GitHub actions so we missed this
2019-12-11 10:48:58 +11:00
Joffrey JAFFEUX
bc05d3bcdd
DEV: triggers github actions on pull_request (#8527) 2019-12-11 00:24:30 +01:00
Kyle Zhao
2720531750 FIX: Always add username span in quick access item (#8526)
Generate an empty `<span>` even if there is no username, because the
first `<span>` is styled differently.
2019-12-11 09:44:19 +11:00
dependabot-preview[bot]
505b8b76bc Build(deps): Bump webpush from 0.3.8 to 1.0.0 (#8511)
Bumps [webpush](https://github.com/zaru/webpush) from 0.3.8 to 1.0.0.
- [Release notes](https://github.com/zaru/webpush/releases)
- [Changelog](https://github.com/zaru/webpush/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zaru/webpush/compare/v0.3.8...v1.0.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2019-12-10 12:56:52 -08:00
David Taylor
424cda1433 DEV: Add timeouts to GitHub actions 2019-12-10 20:44:33 +00:00
Neil Lalonde
81a43f2c1e REFACTOR: use rest serializer for tag-info categories
But the "synonyms" can't use the TagSerializer yet. We still have some
code from the discourse-tagging plugin that uses "text" instead of
"name", "count" instead of "topic_count", etc. We should make the js
consistent with the TagSerializer and then stop using tag_counts_json.
2019-12-10 14:58:11 -05:00
Blake Erickson
f921909595 FIX: Reorder categories not working
Ember was throwing this error preventing the reorder categories feature
from working:

```
access theidproperty (of <(unknown):ember1803>). ... the object in question
is a special kind of Ember object (a proxy). Therefore, it is still necessary
to use.get('id')in this case.
```

So I updated it to use the `get` method

https://api.emberjs.com/ember/3.14/functions/@ember%2Fobject/get

Follow up to: 6e5fedb312
2019-12-10 12:36:47 -07:00
dependabot-preview[bot]
3309a2b564 Build(deps-dev): Bump webmock from 3.5.1 to 3.7.6 (#8512)
Bumps [webmock](https://github.com/bblimke/webmock) from 3.5.1 to 3.7.6.
- [Release notes](https://github.com/bblimke/webmock/releases)
- [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bblimke/webmock/compare/v3.5.1...v3.7.6)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2019-12-10 10:38:03 -08:00
Penar Musaraj
ba8d8a4f93 FIX: alphabetical tag sorting in mini-tag-chooser 2019-12-10 12:36:49 -05:00
dependabot-preview[bot]
31c6a1528b Build(deps-dev): Bump listen from 3.1.5 to 3.2.1 (#8498)
Bumps [listen](https://github.com/guard/listen) from 3.1.5 to 3.2.1.
- [Release notes](https://github.com/guard/listen/releases)
- [Commits](https://github.com/guard/listen/compare/v3.1.5...v3.2.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2019-12-10 08:48:40 -08:00
David Taylor
de69c3c921 DEV: Use push trigger for github actions, but ignore tests-passed
The pull_request trigger causes the rubocop annotations to fail
2019-12-10 16:25:45 +00:00
dependabot-preview[bot]
287ba20f3b Build(deps-dev): Bump parallel_tests from 2.29.2 to 2.30.0 (#8508)
Bumps [parallel_tests](https://github.com/grosser/parallel_tests) from 2.29.2 to 2.30.0.
- [Release notes](https://github.com/grosser/parallel_tests/releases)
- [Commits](https://github.com/grosser/parallel_tests/compare/v2.29.2...v2.30.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2019-12-10 16:11:49 +00:00
David Taylor
67605b55d5 DEV: Prevent plugin loading when running core db migrations in tests
This is required because bin/rake automatically loads plugins when migrating. In our continuous integration, we don't want plugins to break the core build. They should only be loaded for the plugin build.
2019-12-10 16:11:49 +00:00
Mark VanLandingham
148970ca9b
DEV: Revert parallel_tests bump (#8518)
parallel_tests with this version uses `bin/rake`, which auto-loads plugins
2019-12-10 07:58:12 -08:00
Neil Lalonde
20464116ae FIX: tag input doesn't show all top 5 permitted tags 2019-12-10 10:30:01 -05:00
dependabot-preview[bot]
2605adede0 Build(deps-dev): Bump parallel_tests from 2.29.2 to 2.30.0 (#8508)
Bumps [parallel_tests](https://github.com/grosser/parallel_tests) from 2.29.2 to 2.30.0.
- [Release notes](https://github.com/grosser/parallel_tests/releases)
- [Commits](https://github.com/grosser/parallel_tests/compare/v2.29.2...v2.30.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2019-12-10 07:12:38 -08:00
dependabot-preview[bot]
da62f87694 Build(deps): Bump rqrcode from 0.10.1 to 1.1.2 (#8497)
Bumps [rqrcode](https://github.com/whomwah/rqrcode) from 0.10.1 to 1.1.2.
- [Release notes](https://github.com/whomwah/rqrcode/releases)
- [Commits](https://github.com/whomwah/rqrcode/commits)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2019-12-10 06:49:20 -08:00
David Taylor
d2d7bed21d
DEV: Restrict branches for github actions
This avoids running duplicate checks when a commit lands in tests-passed
2019-12-10 14:41:55 +00:00
dependabot-preview[bot]
ee1f77d301 Build(deps-dev): Bump uglifier from 4.1.20 to 4.2.0 (#8510)
Bumps [uglifier](https://github.com/lautis/uglifier) from 4.1.20 to 4.2.0.
- [Release notes](https://github.com/lautis/uglifier/releases)
- [Changelog](https://github.com/lautis/uglifier/blob/master/CHANGELOG.md)
- [Commits](https://github.com/lautis/uglifier/compare/v4.1.20...v4.2.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
2019-12-10 06:28:15 -08:00
Joffrey JAFFEUX
bd17a3a8e7
DEV: introduces Github Actions for CI (#8441)
Co-Authored-By: David Taylor <david@taylorhq.com>
2019-12-10 14:45:47 +01:00
Gerhard Schlager
dfb9fa3b98 Update translations 2019-12-10 13:10:55 +01:00
David Taylor
5fbd52cf8a
DEV: Cleanup unused config files (#8515)
- codeclimate is not used for this repository
- .env.sample was added for Heroku deployment, which is no longer supported
2019-12-10 11:20:38 +00:00