github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-25 04:52:52 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
22,924 Commits 190 Branches 500 Tags 938 MiB
2d96a0785d
Commit Graph

3807 Commits

Author SHA1 Message Date
Robin Ward
0e3def7d2b Revert "SECURITY: Ensure oAuth authenticated email is the same as created user's email." 
This reverts commit 1060239e2d.
 2017-02-27 13:19:26 -05:00
Robin Ward
bf9626d031 FIX: Embedding was broken with non-english URLs and ports 2017-02-27 12:17:52 -05:00
Arpit Jalan
877957ae88 Merge pull request #4715 from techAPJ/login-per-ip 
FEATURE: new site setting for max logins per ip per hour/minute
 2017-02-27 18:24:53 +05:30
Arpit Jalan
cba51e1c38 FEATURE: new site setting for max logins per ip per hour/minute 2017-02-27 16:58:03 +05:30
jomaxro
f5673fbd47 Remove references to elder 
The use of the TL4 name Elder was changed in 2014 to Leader.  The spec function was changed to `:trust_level_4`, but the it statement was not changed.
 2017-02-26 17:40:42 -07:00
Sam Saffron
7e8f0dc967 FIX: attempt to handle ios edge case where token is seen but unsaved 
This relaxes our security in the following way

- prev auth token is always accepted as long as rotation
date is within our window of SiteSetting.maximum_session_age.hours
(previously old token expired within a minute of new one being seen)

- new auth token is marked unseen if we are presented with an old token
after we already saw new one

This attempts to fix an issue where ios webkit is not committing new cookies
 2017-02-26 17:09:57 -05:00
Blake Erickson
0e6cb752da Clean up valid order names 
Add a sortable mappings list to match other endpoints and so that you
don't have to use database column names.

Example: 'created' => 'created_at'

Also cleaned up some of the logic since a lot of it got moved into the
SORTABLE_MAPPING hash.
 2017-02-25 11:51:40 -07:00
Blake Erickson
e9d5c3265c Change param asc to ascending 
For consistency, change param asc to ascending:

https://meta.discourse.org/t/make-admin-users-list-sortable-suggestion/47649/17?u=oblakeerickson
 2017-02-25 09:13:31 -07:00
Blake Erickson
0a41da6bad FEATURE: Add order logic to admin users controller 
Added order and direction parameters for sorting admin user pages. This
commit only includes backend api changes.

https://meta.discourse.org/t/make-admin-users-list-sortable-suggestion/47649

Now you can pass in `order` and `asc` parameters to the
`/admin/users/list/<query>.json` endpoint.

Example:

`/admin/users/list/active.json?&order=post_count` which defaults to desc

and

`/admin/users/list/active.json?order=post_count&asc=true`
 2017-02-24 17:11:17 -07:00
Régis Hanol
ecdae9f863 FIX: i18n integrity specs 
FIX: check all .yml files in the project for integrity
FIX: ensure localized yamls are compatible with english
 2017-02-24 11:35:33 +01:00
Régis Hanol
a2c04be718 FIX: eradicate I18n fallback issues 💣 
FIX: client's translation overrides were not working when the current locale was missing a key
FIX: ExtraLocalesController.show was not properly handling multiple translations
FIX: JsLocaleHelper#output_locale was not properly handling multiple translations

FIX: ExtraLocalesController.show's spec which was randomly failing
FIX: JsLocaleHelper#output_locale was muting cached translations hashes

REFACTOR: move 'enableVerboseLocalization' to the 'localization' initializer
REFACTOR: remove unused I18n.js methods (getFallbacks, localize, parseDate, toTime, strftime, toCurrency, toPercentage)
REFACTOR: remove all I18n.pluralizationRules and instead use MessageFormat's pluralization rules

TEST: add tests for localization initializer
TEST: add tests for I18n.js
 2017-02-24 11:31:21 +01:00
Guo Xiang Tan
1060239e2d SECURITY: Ensure oAuth authenticated email is the same as created user's email. 2017-02-24 13:13:10 +08:00
Guo Xiang Tan
0847b4258a Revert "SECURITY: Ensure that user has been authenticated." 
This reverts commit fbe51d68a7.

Changing the commit message to correctly reflect what we're actually
fixing.
 2017-02-24 13:12:29 +08:00
Guo Xiang Tan
fbe51d68a7 SECURITY: Ensure that user has been authenticated. 2017-02-24 10:47:48 +08:00
Sam
f15f61da0a FEATURE: add immutable caching to rails site of things 2017-02-23 13:05:00 -05:00
Sam
ea1007e954 FEATURE: add support for same site cookies 
Defaults to Lax, can be disabled or set to Strict.

Strict will only work if you require login and use SSO. Otherwise when clicking on links to your site you will appear logged out till you refresh the page.
 2017-02-23 12:01:28 -05:00
Neil Lalonde
0551b3f5ee FEATURE: replace emoji with unicode in title and description meta tags 2017-02-22 16:24:13 -05:00
Sam Saffron
b7d2edc7dc FIX: allow some auth token misses prior to clearing cookie 
It appears that in some cases ios queues up requests up front
and "releases" them when tab gets focus, this allows for a certain
number of cookie misses for this case. Otherwise you get logged off.
 2017-02-22 12:37:11 -05:00
Arpit Jalan
213a496203 FIX: show all staff events related to the target user 2017-02-22 13:31:40 +05:30
Arpit Jalan
b32f33b3f0 FIX: allow staff members to send PMs when enable_private_messages is disabled 2017-02-22 11:32:09 +05:30
Neil Lalonde
c94fdcea38 FIX: admin dashboard posts count should not include system posts and whispers 2017-02-21 14:45:41 -05:00
Arpit Jalan
046cbad10b FEATURE: add a button on admin user page that links to action log 2017-02-21 21:38:37 +05:30
Jakub Macina
4a2f13348a ADD: Append tags bulk action for topics 2017-02-20 18:14:32 +01:00
Régis Hanol
f51e3b2131 FIX: should not be able to rename a system badge 2017-02-20 14:35:05 +01:00
Régis Hanol
cb99f59ec3 reset bounce score when email is successfully changed 2017-02-20 10:37:01 +01:00
Robin Ward
e62c0a42fa FIX: Support multiple embeddable host records with the same host 2017-02-17 12:41:34 -05:00
Sam
7a85469c4c SECURITY: inactive/suspended accounts should be banned from api 
Also fixes edge cases around users presenting multiple credentials
 2017-02-17 11:03:09 -05:00
Neil Lalonde
c0e1722ca6 fix intermittent spec failure due to Time comparison with TimeWithZone 2017-02-17 10:30:29 -05:00
Neil Lalonde
3fb50d587d FIX: invited users and new TL1 users will see their first notification highlighted 2017-02-17 10:30:29 -05:00
Jeff Atwood
9b263a0559 increase req min unique pw chars from 5 to 6 2017-02-16 17:06:19 -08:00
Neil Lalonde
4b28bfaa15 Merge pull request #4710 from ento/fix-s3-config-check 
FIX: admin dashboard shouldn't complain when using IAM profile for S3 access
 2017-02-15 17:02:07 -05:00
Neil Lalonde
d0fbb27f3e FEATURE: new invite acceptance page, where username can be chosen and password can be set 2017-02-15 16:51:57 -05:00
Sam
74d4209d24 FEATURE: allow plugins to register custom topic list filters 2017-02-15 15:25:43 -05:00
Sam
9c51e3e8e7 amend preloader api to supply topic list 2017-02-15 12:04:02 -05:00
Sam
2c59ffeb2c FIX: token rotation not accounting for overlapping tokens correctly 
also... freeze_time has no block form, correct all usages and specs
 2017-02-15 10:58:18 -05:00
Marica Odagaki
af9c97ec43 Add failing tests 2017-02-15 00:05:58 -08:00
Marica Odagaki
2c1279b740 Fix typo to be more consistent with other test descriptions 2017-02-15 00:04:10 -08:00
Sam
f2099c3811 adjust API 2017-02-14 16:32:33 -05:00
Sam
89d5e8ab4b FEATURE: allow plugins to preload data in topic list 2017-02-14 16:29:06 -05:00
Sam
8feb94e13f FIX: password validator was being too strict 2017-02-14 09:18:04 -05:00
Sam
783bac9ff7 less stubbing for better clarity and robustness 2017-02-13 14:34:15 -05:00
Sam
7652901b75 reduce mocking and stubbing in controller spec 2017-02-13 14:31:15 -05:00
Sam
0ab96a7691 FEATURE: add hidden setting for verbose auth token logging 
This is only needed to debug auth token issues, will result in lots
of logging
 2017-02-13 14:01:09 -05:00
Robin Ward
e1d358ffbf FIX: Don't clear the login hint when the system user is saved 2017-02-13 10:54:20 -05:00
Jeff Atwood
3ee7a9266c Merge pull request #4686 from tgxworld/group_is_visible_if_user_is_group_owner 
FIX: Show groups that user is owner of on groups page.
 2017-02-11 22:18:44 -08:00
Neil Lalonde
94e1105af7 fix unique char counting in password validator 2017-02-10 10:38:17 -05:00
Sam Saffron
4332f0dde1 FEATURE: allow user search API to restrict to group 2017-02-09 18:45:39 -05:00
Neil Lalonde
1bcb835446 FEATURE: passwords must have a minimum number of unique characters, configurable with a new setting 2017-02-09 15:00:22 -05:00
Robin Ward
9fe4427071 Clean up get_a_room following review 2017-02-08 12:24:26 -05:00
Neil Lalonde
5a8bbe663a FEATURE: include most popular tag in page title for webcrawlers of tagged uncategorized topics 2017-02-07 16:55:42 -05:00
Sam Saffron
df8f365d99 FEATURE: improve search so it searches sub categories by default 
If you want an exact category match use `category:=howto` or `#=howto"
 2017-02-07 15:53:37 -05:00
Régis Hanol
02bb7beaaf FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled 2017-02-07 18:06:44 +01:00
Sam
49e7124a5e clarify override semantics in spec 2017-02-07 10:41:27 -05:00
Sam
f34907b523 Merge pull request #4681 from vietqhoang/feature/add-user-title-to-sso-payload 
FEATURE: Add user title to SSO payload
 2017-02-07 10:25:32 -05:00
Sam
ff49f72ad9 FEATURE: per client user tokens 
Revamped system for managing authentication tokens.

- Every user has 1 token per client (web browser)
- Tokens are rotated every 10 minutes

New system migrates the old tokens to "legacy" tokens,
so users still remain logged on.

Also introduces weekly job to expire old auth tokens.
 2017-02-07 09:22:16 -05:00
Sam
2dec731da3 SECURITY: correctly validate input when admin searches for screened ips 2017-02-06 16:11:16 -05:00
Régis Hanol
84af84dc52 prevent inactive & staged users from being automatically added to a group 2017-02-06 17:49:27 +01:00
Régis Hanol
ba115480ba FIX: wasn't extracting links to quoted posts 2017-02-06 14:45:04 +01:00
Régis Hanol
27fb9c8804 FIX: bounce webhooks should also use recipient address 2017-02-05 19:06:35 +01:00
Robin Ward
f1e7bca3c9 FEATURE: Warn a user when they're replying to the same user too much 2017-02-03 17:00:54 -05:00
Neil Lalonde
c4e10f2a9d FEATURE: redesign the change password page to use javascript and validations 2017-02-03 16:09:24 -05:00
Robin Ward
b251d11518 FIX: If you make a new banner, clear the old dismissed values 2017-02-03 15:07:38 -05:00
Guo Xiang Tan
61111a3f9b FIX: Show groups that user is owner of on groups page. 2017-02-03 16:51:32 +08:00
Arpit Jalan
6b8691ecea Merge pull request #4685 from techAPJ/approve-users-invite-fix 
FIX: allow existing users to be invited to topic/message when must_approve_users is enabled
 2017-02-03 13:22:18 +05:30
Arpit Jalan
dc2171960b FIX: allow existing users to be invited to topic/message when must_approve_users is enabled 2017-02-03 13:01:23 +05:30
Guo Xiang Tan
c392994793 Fix specs. 2017-02-03 08:38:19 +08:00
Neil Lalonde
b91cb92af0 FIX: reports for time to first reply and topics without replies were counting whispers and moderator actions 2017-02-02 17:27:41 -05:00
Guo Xiang Tan
3c28d94706 FIX: Don't configure Redis connector if Redis slave config is not set. 2017-02-02 13:48:55 +08:00
Régis Hanol
82555ca761 FIX: mail threading wasn't working properly in Mac Mail 2017-02-01 23:02:41 +01:00
Viet Hoang
40164ccd4a Add user title to SSO payload 2017-01-31 16:42:27 -08:00
Arpit Jalan
a525563eea Optimize spec for ProcessPost job 2017-01-31 14:10:56 +05:30
Rimian Perkins
25516874b5 FIX: Escape regexp chars in SiteSetting.censored_words. 2017-01-31 10:14:51 +08:00
Régis Hanol
8fc7420f83 FIX: prevent huge custom emojis in emails 2017-01-30 18:06:48 +01:00
Arpit Jalan
19f7beaa2c FIX: topic links were getting dropped when post is rebaked 2017-01-30 14:55:53 +05:30
Arpit Jalan
28e8d32d53 Suppress console output when running RSpec 2017-01-28 11:04:47 +05:30
Guo Xiang Tan
0e5d490b05 No need for special helper to reset SiteSetting state. 
* SiteSetting in tests uses a local provider that resets it.
 2017-01-28 10:55:49 +08:00
Neil Lalonde
7ead3e1f18 fix failing specs 2017-01-27 16:17:10 -05:00
Arpit Jalan
c36dda70ae spec for posts:remap rake task 2017-01-28 00:13:08 +05:30
Leo McArdle
c76f6856ea FEATURE: reply as new message to the same recipients 2017-01-27 12:24:31 +08:00
Robin Ward
496682c442 Merge pull request #4662 from tgxworld/fix_localized_group_name_change 
Fix localized group name change
 2017-01-26 10:50:00 -05:00
Arpit Jalan
9dd09e453b FEATURE: add explicit confirmation button to accept the invite 2017-01-25 15:50:30 +05:30
Guo Xiang Tan
781d83a46f FIX: Toggling a post's wiki status should not skip revision. 2017-01-25 13:34:55 +08:00
Guo Xiang Tan
ce07da1d8b UX: Only display the words that fails censored words validations. 2017-01-24 13:11:05 +08:00
Régis Hanol
7e52d29a5b Merge pull request #4643 from LeoMcA/fix-pull-img 
FIX: Handle img src starting with "//" in pull_hotlinked_images job
 2017-01-23 17:56:53 +01:00
Guo Xiang Tan
32846aad2a FIX: Toggling post's wiki status should not create a new version. 2017-01-20 15:42:33 +08:00
Jeff Atwood
521ced38c5 fix spec for default email title 2017-01-19 14:01:51 -08:00
Neil Lalonde
6b93b09404 FIX: when blocking a user results in hiding their posts, only hide posts made in the last 24 hours 2017-01-19 15:56:22 -05:00
Régis Hanol
07660ecedb bump onebox 2017-01-19 00:28:37 +01:00
Guo Xiang Tan
706b4f6b9f FEATURE: Remap group mentions when group name has been changed. 2017-01-18 13:39:34 +08:00
Guo Xiang Tan
59dfb51a35 FIX: Don't change automatic group name if localized name has been taken. 2017-01-18 12:20:23 +08:00
Guo Xiang Tan
1e1e40c75f Dump the page's content as well on failure. 2017-01-17 18:40:46 +08:00
Régis Hanol
fbf9172db8 FIX: log backups download/destroy staff action 
FIX: clean up junk left by the specs
RENAME: 'backup_operation' to 'backup_create' to match other backup log types
 2017-01-16 19:53:31 +01:00
Robin Ward
86c52c72f6 FIX: Deleting a user was not deleting their directory items 2017-01-16 11:46:52 -05:00
Leo McArdle
b60e9b7330 FIX: Handle img src starting with "//" in pull_hotlinked_images job 2017-01-16 10:50:07 +00:00
Guo Xiang Tan
63954c1b33 FIX: Same user record being saved twice causing validation to fail. 2017-01-16 16:41:03 +08:00
Guo Xiang Tan
e3b6f9b8ae FIX: Do not update user stats like counts for private messages. 2017-01-16 11:07:53 +08:00
Guo Xiang Tan
ed5fa20b0c Revert "FIX: error during signup saying "Password is the same as your current password" due to automatic group membership granting a trust level" 
This reverts commit 9c40657ba4.

Calling this whenever a user is initialize is hurting us bad
on performance.
 2017-01-16 09:44:10 +08:00
Neil Lalonde
e8307ac24c FIX: mailing list mode digest emails included whispers 2017-01-13 13:46:33 -05:00
Robin Ward
adb73180f7 FEATURE: Let plugins register themes easily 2017-01-13 11:50:52 -05:00
Régis Hanol
499a83270a FIX: don't onebox to IP addresses 2017-01-12 22:35:33 +01:00
Guo Xiang Tan
38496985ef Fix syntax error. 2017-01-12 10:03:37 +08:00
Guo Xiang Tan
23d4435af1 Oops. 2017-01-12 09:56:20 +08:00
Guo Xiang Tan
515f50e42e FEATURE: Log admin action when readonly mode is changed. 2017-01-12 09:41:02 +08:00
Régis Hanol
887e9af84f FEATURE: new 'max_image_megapixels' site setting 2017-01-11 23:37:12 +01:00
Neil Lalonde
b177827841 more specs for staff action logging 2017-01-11 11:41:21 -05:00
Guo Xiang Tan
1758af9a1d FIX: Perform emoji unescape for topic titles in quotes. 2017-01-11 17:23:13 +08:00
Guo Xiang Tan
cdd550e947 Use a different Redis key when PG failover sets site to readonly mode. 2017-01-11 16:38:49 +08:00
Régis Hanol
185dcb2ca1 handle emails with localized headers 😠 2017-01-09 22:59:30 +01:00
Guo Xiang Tan
3d21ccd4a5 FIX: Add validation to disallow censored words in topic title. 2017-01-09 16:55:41 +08:00
Régis Hanol
98c62bccb5 FIX: mark forwarded email as read by the forwarder 
FIX: 'Re:' prefix is mostly used for replies and not forwarded emails
 2017-01-06 15:33:55 +01:00
Guo Xiang Tan
58f3a2e9a9 Fix randomly failing spec. 2017-01-06 15:25:49 +08:00
Guo Xiang Tan
68300f515c FIX: Return 404 if id is not valid. 2017-01-06 10:39:44 +08:00
Guo Xiang Tan
d10fe51b72 Fix broken specs since all urls will be oneboxed. 2017-01-06 10:05:51 +08:00
Guo Xiang Tan
f473a119ff Remove unnecessary stub. 2017-01-06 08:53:30 +08:00
Arpit Jalan
7a1ff59822 FIX: PM email to suspended member was broken 2017-01-05 13:58:14 +05:30
Guo Xiang Tan
a89f60b85b Merge pull request #4631 from tgxworld/prevent_users_from_changing_permissions_of_non_real_users 
FIX: Do not allow admins to meddle with admin and moderation access o…
 2017-01-04 09:10:27 +08:00
Robin Ward
cf7774bdd9 FEATURE: Block muted users from sending you PMs 2017-01-03 14:51:53 -05:00
Guo Xiang Tan
c68bcfeb72 Improve spec. 2017-01-03 15:36:36 +08:00
Guo Xiang Tan
ad4a96d387 FIX: Only send membership request to the last 5 active group owners. 2017-01-03 15:33:57 +08:00
Arpit Jalan
495a511862 simplify quote markup in emails 2017-01-02 21:37:01 +05:30
Guo Xiang Tan
f1beef43a8 Merge pull request #4618 from tgxworld/fix_invalid_emails 
FIX: Don't allow invalid email to be saved.
 2016-12-30 07:11:48 +08:00
Guo Xiang Tan
c7b151683d FIX: Do not allow admins to meddle with admin and moderation access of non real users. 2016-12-29 11:11:33 +08:00
Neil Lalonde
9c40657ba4 FIX: error during signup saying "Password is the same as your current password" due to automatic group membership granting a trust level 2016-12-28 17:36:04 -05:00
Sam
d28d8a1f85 FIX: order by op_likes leads to broken browsing 2016-12-27 19:08:54 +11:00
Arpit Jalan
d72cbcb2a4 FEATURE: new setting to validate user website 2016-12-26 21:29:27 +05:30
Guo Xiang Tan
5aee2673c7 FIX: Push null fields to last when sorting group members. 2016-12-22 14:55:24 +08:00
Guo Xiang Tan
8551d821a0 FEATURE: Add site setting to disable group directory. 2016-12-22 14:14:22 +08:00
Sam
c531f4ded5 remove rails-observers 
Rails yanked out observers many many years ago, instead the functionality
was yanked out to a gem that is very lightly maintained.

For example: if we want to upgrade to rails 5 there is no published gem

Internally the usage of observers had quite a few problem.

The series of refactors renamed a bunch of classes to give us more clarity
and removed some magic.
 2016-12-22 16:46:53 +11:00
Sam
019f1a1d06 UserEmailObserver is now removed 
no big surprises here was pretty straightforward

after_commit semantics sure are weird though
 2016-12-22 16:46:53 +11:00
Sam
2f6a4cc6de remove UserActionObserver, replace with after_save and service 
interestingly there was some left over dead code from when stars
existed in the topic_users table
 2016-12-22 16:46:53 +11:00
Sam
0a78ae739d Remove SearchObserver, aim is to remove all observers 
rails-observers gem is mostly unmaintained and is a pain to carry forward
new implementation contains significantly less magic as a bonus
 2016-12-22 13:13:14 +11:00
Guo Xiang Tan
28befcb5d4 Fix specs. 2016-12-21 21:21:39 +08:00
Guo Xiang Tan
076a08d8e1 FIX: Unactivated users should not be automatically added into groups as well. 2016-12-21 18:15:01 +08:00
Guo Xiang Tan
7228081820 FIX: Automatic group membership should not add staged or unactivated users. 2016-12-21 18:04:26 +08:00
Guo Xiang Tan
13c6191e89 FIX: Don't allow invalid email to be saved. 2016-12-21 17:47:11 +08:00
Guo Xiang Tan
5d7f3223f0 SECURITY: Users can only bookmark posts which they can see. 2016-12-21 12:01:26 +08:00
Neil Lalonde
c75bebdea2 FIX: uncategorized setting to control whether topic featured links are allowed 2016-12-20 15:55:30 -05:00
Guo Xiang Tan
9db5d5b6a7 FIX: Incorrect serializer for groups page. 2016-12-20 15:44:22 +08:00
Guo Xiang Tan
7c7c233c1c FIX: Can't update Groups#allow_membership_requests in admin. 2016-12-20 15:14:35 +08:00
Guo Xiang Tan
502e114c60 FIX: Incorrect count when loading more groups. 2016-12-20 14:39:44 +08:00
Guo Xiang Tan
193f8301a4 FIX: Do not show automatic groups to normal users. 2016-12-20 14:26:49 +08:00
Régis Hanol
52cd9972bb FIX: prevent DDoS with lots of _oneboxable_ links 
FIX: ensure the onebox route is only allowed to logged in users
FIX: only allow 1 outgoing onebox preview per user
FIX: client should only do 1 preview at a time
 2016-12-20 00:31:10 +01:00
Sam
2b808ad9da Merge pull request #4609 from joebuhlig/category-topics-wiki 
FEATURE: Category setting to make all topics wikis
 2016-12-20 09:15:51 +11:00
Neil Lalonde
74956694e5 If summary email finds no topics, show topics more than 1 day old from new users 2016-12-19 14:54:08 -05:00
Neil Lalonde
923cf73c6e Topic Featured Links: move data from custom fields to topics and categories tables. Invert behaviour of topic_featured_link_allowed checkbox. Fix a bug with invalid topic records due to changing that category checkbox. 2016-12-19 14:54:07 -05:00
Arpit Jalan
a2096a01fb add test case for handling uploads without extension 2016-12-20 00:46:47 +05:30
Robin Ward
e03d5e2140 Reapply Ember 2.10 for good this time! 
This reverts commit ddd299f4aa.
 2016-12-19 11:19:10 -05:00
Joe Buhlig
87251fded7 FEATURE: Category setting to make all topics wikis 
FEATURE: Category setting to make all topics wikis
 2016-12-19 06:42:18 -06:00
Guo Xiang Tan
18c8323987 FIX: Incorrect path for redirect. 2016-12-19 18:12:15 +08:00
Sam
e0ff57ca75 SECURITY: prevent reuse of password reset 2016-12-19 18:00:22 +11:00
Sam
eb2db23b40 FEATURE: remove email_token_grace_period_hours 
The site setting email_token_grace_period_hours just causes confusion and
should not be used anyway.

Out of the box, tokens stop working once confirmed, no need to add complexity here
 2016-12-19 17:15:20 +11:00
Sam
0599bd0154 FEATURE: add referrer never tag to password reset page 2016-12-19 11:01:58 +11:00
Sam
15b5fddd49 SECURITY: protect upload params, only allow very strict filenames 2016-12-19 10:16:18 +11:00
Arpit Jalan
ab6843dcde FIX: username route was broken 2016-12-16 23:56:22 +05:30
Guo Xiang Tan
d8541c589a FIX: Incorrect route for updating username. 2016-12-17 00:23:12 +08:00
Robin Ward
ddd299f4aa Revert "Revert "Revert Ember 2.10+ for a short while"" 
This reverts commit 76bbc481cb.
 2016-12-16 10:29:30 -05:00
Robin Ward
76bbc481cb Revert "Revert Ember 2.10+ for a short while" 
This reverts commit 21682fd60b.
 2016-12-16 09:52:29 -05:00
Sam
61eb134181 FEATURE: setting to allow arbitrary redirects from sso origin 
if sso_allows_all_return_paths is set to true you can redirect off-site from sso success
 2016-12-16 13:37:44 +11:00
Sam
6ff309aa80 SECURITY: don't grant same privileges to user_api and api access 
User API is no longer gets bypasses that standard API gets.
Only bypasses are CSRF and XHR requirements.
 2016-12-16 12:05:43 +11:00
Régis Hanol
197517d55e FIX: locally uploaded audio & video files should onebox even when the extension is uppercase 2016-12-15 23:21:44 +01:00
Robin Ward
21682fd60b Revert Ember 2.10+ for a short while 2016-12-15 16:43:38 -05:00
Robin Ward
ba8c6fd840 FIX: PhantomJS was crashing 2016-12-15 12:30:20 -05:00
Sam
98f4a2adcb FIX: on 404 from brotli asset path return a correctly encoded doc 
old implementation would cache the 404 for 1 year with incorrect encoding

hilarity would ensue
 2016-12-15 16:05:20 +11:00
Guo Xiang Tan
13c344245d Merge pull request #4603 from tgxworld/group_index_page 
FEATURE: Add groups page.
 2016-12-14 23:26:05 +08:00
Guo Xiang Tan
20f9aad539 Merge pull request #4599 from tgxworld/remove_rspec_given 
Remove RSpec given.
 2016-12-14 17:42:30 +08:00
Guo Xiang Tan
4b940dc8bd FEATURE: Add groups page. 2016-12-14 17:27:47 +08:00
Guo Xiang Tan
18f400e652 Remove RSpec given. 2016-12-14 10:29:22 +08:00
Neil Lalonde
2d61d7d644 update embed_controller_spec 2016-12-13 16:29:51 -05:00
Guo Xiang Tan
2686ee5ab2 FIX: Admin can't add/remove public group users. 2016-12-13 16:39:44 +08:00
Guo Xiang Tan
43ee9f884e FEATURE: Add Group#full_name. 2016-12-13 16:16:26 +08:00
Guo Xiang Tan
69330f8bc2 Add user_updated event to webhooks. 2016-12-13 11:26:26 +08:00
Guo Xiang Tan
da7009a968 FEATURE: Add request membership button for allowed groups. 2016-12-12 22:48:08 +08:00
Régis Hanol
664feca199 FIX: don't send emails from muted users in mailing list mode 2016-12-12 15:28:26 +01:00
Guo Xiang Tan
9a800107cb FIX: Associate category logo and background to uploads record. 2016-12-12 17:37:28 +08:00
Guo Xiang Tan
05f55dbc10 FEATURE: Group logs. 2016-12-12 17:29:54 +08:00
Guo Xiang Tan
be5b5f6bea FEATURE: Public groups. 2016-12-12 17:00:30 +08:00
Neil Lalonde
24d2973108 enable featured links by default 2016-12-09 16:08:17 -05:00
Neil Lalonde
fb2633366a FIX: featured link topics shouldn't require the same min post length 2016-12-09 15:46:26 -05:00
Neil Lalonde
a4c4f13901 Remove the topic_featured_link_onebox setting. We will always try to onebox a link and add it to the body if topic_featured_link_enabled is enabled. 2016-12-09 13:28:12 -05:00
Sam
846597f563 FIX: staff tags are stripped by non-staff 2016-12-09 17:24:26 +11:00
Guo Xiang Tan
b9b4b0c175 FIX: Members should be ordered by username. 2016-12-08 14:27:38 +08:00
Guo Xiang Tan
a2da2971af FEATURE: Allow columns on group members page to be sortable. 2016-12-08 10:49:12 +08:00
Guo Xiang Tan
545dfa7191 FEATURE: Allow group owners to edit title. 2016-12-07 10:26:28 +08:00
Sam
1135e00c83 FIX: regression unable to dismiss unread 2016-12-06 08:49:40 +11:00
Erick Guan
52763f5115
FEATURE: Allow posting a link with topics 2016-12-05 17:20:54 +01:00
Régis Hanol
06469ef0ce FIX: don't extract links from .elided parts 2016-12-05 15:19:15 +01:00
Guo Xiang Tan
37b256e7f2 Fix specs. 2016-12-05 17:13:58 +08:00
Arpit Jalan
431aa79bb3 Merge pull request #4587 from techAPJ/invite-upload 
FIX: simplify CSV file upload
 2016-12-05 14:30:13 +05:30
Guo Xiang Tan
adb7fcb6b3 FEATURE: Add bio to group page. 2016-12-05 16:58:04 +08:00
Arpit Jalan
ce974da9e5 FIX: simplify CSV file upload 2016-12-05 14:09:08 +05:30
Guo Xiang Tan
31acd311e5 FEATURE: Allow group owners to edit group name and avatar flair. 2016-12-05 14:27:46 +08:00
Guo Xiang Tan
b45fd21ed9 FIX: Clean up specs. 2016-12-05 13:37:33 +08:00
Sam
dc66f6681a add spec for brotli controller, ensure cached correctly 2016-12-05 16:08:36 +11:00
Guo Xiang Tan
22059d4df9 Add Rake task to clean up unused multisite Redis keys. 2016-12-05 11:46:34 +08:00
Sam
39a524aac8 FEATURE: brotli cdn bypass for assets 
Allow CDNS that strip out brotli encoding to use brotli regardless
 2016-12-05 13:57:09 +11:00
Sam
33d0a23d84 Merge branch 'fix_whisper' 2016-12-05 10:01:03 +11:00
Neil Lalonde
dafd1453d6 FIX: topic list filters for bookmarked, posted, and read now work with tag filter 2016-12-02 15:58:14 -05:00
Guo Xiang Tan
3971f96aa6 Merge pull request #4536 from fantasticfears/webhooks-edit 
FIX: missing post and topic edited webhooks
 2016-12-02 10:16:19 +01:00
Guo Xiang Tan
bc0a8142fe PERF: Only show members count on group page. 2016-12-02 16:28:54 +08:00
Sam
9b885c039a Merge branch 'master' into fix_whisper 2016-12-02 17:44:05 +11:00
Sam
c04d4171ff FIX: whisper no longer experimental 
- Regular users are not notified of whispers
- Regular users no longer have "stuck" topics in unread
- Additional tracking for staff highest post number
- Remove a bunch of unused columns in topics table
 2016-12-02 17:03:31 +11:00
Régis Hanol
eb453d0f82 the note in a FWed email should be a whisper only in PM and when the author is member of the group 2016-12-01 18:43:56 +01:00
Régis Hanol
62763f025c FIX: wasn't able to parse FROM email in the embedded email 2016-12-01 18:34:47 +01:00
Neil Lalonde
985daf5c72 FIX: summary should not include certain post types 2016-12-01 12:01:32 -05:00
Erick Guan
8c8549b27b
FIX: missing post and topic edited webhooks 2016-11-30 20:49:45 +01:00
Régis Hanol
dec8a861f0 FIX: don't raise exception when a quote was already extracted 2016-11-30 17:18:34 +01:00
Guo Xiang Tan
b8441fba27 Merge pull request #4546 from tgxworld/fix_postgresql_failover 
Fix postgresql failover
 2016-11-30 09:36:52 +01:00
Sam
b8dc58be90 got to be careful with integrity specs 2016-11-29 18:01:09 +11:00
Sam
266322ce2e FEATURE: add help text for no bookmarks in user page 2016-11-29 17:56:00 +11:00
Sam
0631a84ca0 Merge pull request #4576 from cpradio/min-posts-search 
FEATURE: Add min_post_count search filter
 2016-11-29 10:19:33 +11:00
cpradio
66ca6d622e FEATURE: Add min_post_count search filter 2016-11-28 11:43:12 -05:00
Régis Hanol
6edd3c347c FIX: automatically disable digests when enabling mailing list mode 2016-11-28 15:52:35 +01:00
Régis Hanol
a03287f2ee FIX: 'In-Reply-To' header should default to topic_message_id 2016-11-28 14:18:02 +01:00
Régis Hanol
74b6fe8739 FIX: respect RFCs when setting 'In-Reply-To' and 'References' email headers 2016-11-25 23:25:39 +01:00
Guo Xiang Tan
559918c6c6 PERF: Add endpoint to check if a group can be mentioned by user. 2016-11-26 02:20:46 +08:00
Guo Xiang Tan
5794f1619d PERF: Fix N+1 queries when loading groups. 2016-11-26 02:20:26 +08:00
Guo Xiang Tan
63a88ee6e7 Merge pull request #4566 from tgxworld/fix_perf_redirect_to_top 
Fix perf redirect to top
 2016-11-25 03:39:56 +01:00
Sam
88a46be051 FEATURE: display text excerpts when scrolling on mobile 2016-11-25 11:35:29 +11:00
Guo Xiang Tan
b889bfefbb PERF: Don't calculate the same query twice. 2016-11-24 14:05:26 +08:00
Neil Lalonde
79dc0518c9 FIX: popular posts in digest need to use same restrictions as topics 2016-11-23 11:24:18 -05:00
Guo Xiang Tan
02025207d5 FIX: Make sure Redis fallback don't fall into a permanent readonly state. 2016-11-23 11:31:20 +08:00
Sam
bfd0418f07 added a test for safe mode 2016-11-23 13:31:05 +11:00
Neil Lalonde
86deec3528 FIX: exclude popular posts from deleted topics 2016-11-22 13:23:21 -05:00
Guo Xiang Tan
3909f342f6 FEATURE: Allow options to be set when adding model callbacks. 2016-11-21 10:20:31 +08:00
Arpit Jalan
2d0c99636a do not add rel noreferrer 2016-11-20 18:19:14 +05:30
Arpit Jalan
7cb76f7333 FIX: add rel noopener and noreferrer in addition to nofollow 2016-11-20 17:07:27 +05:30
Guo Xiang Tan
f824afb4d3 FEATURE: Allow date_of_field column to be updated. 2016-11-17 15:16:58 +08:00
Guo Xiang Tan
e8a3043129 Spawn a single thread that checks for PostgreSQL fallback. 2016-11-17 13:52:08 +08:00
Guo Xiang Tan
8c6d8c85db Stop showing first notification prompt once user sees the notification. 2016-11-17 09:44:00 +08:00
Guo Xiang Tan
98c1e0832c FIX: Track first notification read using Redis. 2016-11-16 16:20:38 +08:00
Guo Xiang Tan
16fdcdfc00 FIX: Add conditions on when to show first pm notification. 2016-11-16 14:17:47 +08:00
Guo Xiang Tan
b5dc68cd52 Merge pull request #4552 from tgxworld/extract_test_logic 
Ensure we don't run `$redis.keys` in production.
 2016-11-16 10:05:02 +08:00
Robin Ward
32a8d5ed1f Merge pull request #4550 from cpradio/cannot-see-mention 
FEATURE: Notify user when mention can't see the reply they were mentioned in
 2016-11-15 16:40:47 -05:00
Guo Xiang Tan
95c6e97587 Ensure we don't run $redis.keys in production. 2016-11-15 23:23:41 +08:00
Sam
63d9d4f301 FIX: properly specify default on no cache on all resources 2016-11-15 17:00:44 +11:00
cpradio
824c235760 FEATURE: Notify user when mention can't see the reply they were mentioned in 
FIX: Group Mention Notifications
 2016-11-14 22:03:16 -05:00
Sam
f4c754b389 FEATURE: split JavaScript application bundle, so plugins live in own file 
This adds plugin.js and plugin_third_party.js files
 2016-11-15 11:43:13 +11:00
Leo McArdle
784366f1a0 FIX: display only 1 trust level badge on user card 
refactoring graciously provided by @xfalcox
 2016-11-14 20:53:24 +00:00
Sam
115c454002 FIX: if prioritizing names in ux choose name over username in email 2016-11-14 11:09:24 +11:00
Sam
3d76ce1421 FEATURE: SSO support for adding and removing a user to groups 
Use: add_groups with a comma delimited list to ensure a user is in groups (using group names)

Use: remove_groups with a comma delimited list to ensure a user is removed from groups (using group names)
 2016-11-11 16:57:31 +11:00
Arpit Jalan
9e69798285 FEATURE: watch first post default site setting 2016-11-10 00:09:52 +05:30
Guo Xiang Tan
2d2998f5e0 Fix specs. 2016-11-09 11:31:53 +08:00
Neil Lalonde
86522a52b7 FEATURE: add censored_pattern setting to censor posts using regex 2016-11-08 16:39:26 -05:00
Guo Xiang Tan
b18439a1e2 Fix build. 2016-11-08 17:00:44 +08:00
Guo Xiang Tan
a8b7599d4a FEATURE: Add a radial ping when user's first notification has not been read. 2016-11-08 16:23:12 +08:00
Sam
ac2c035856 FIX: stop raising exceptions when a post goes missing 2016-11-08 14:51:56 +11:00
Sam
a1a7094604 Merge pull request #4539 from tgxworld/use_a_time_task_for_redis_failover 
PERF: Spawn a seperate timer task to check if Redis master is up.
 2016-11-08 11:18:54 +11:00
Régis Hanol
9ef724a065 FIX: self-onebox in read protected categories 2016-11-07 18:14:28 +01:00
Guo Xiang Tan
fbbcde1230 FIX: Don't treat master as up if it is still loading data. 2016-11-07 15:28:10 +08:00
Guo Xiang Tan
9375dcb6fe PERF: Spawn a seperate timer task to check if Redis master is up. 2016-11-07 15:04:28 +08:00
Sam
2ddabc3928 FIX: protect against future regressions of google omniauth 2016-11-07 12:48:00 +11:00
Guo Xiang Tan
9fd317306c FIX: Do not show educational message for PMs. 2016-11-04 17:06:53 +08:00
Régis Hanol
a655e4b092 ensure we allow self oneboxing of login required sites 2016-11-03 22:48:32 +01:00
Neil Lalonde
764a572070 FIX: when subcategories with the same name exist, filtering by tags might use the wrong subcategory 2016-11-02 15:29:33 -04:00
Guo Xiang Tan
f03d9cad06 PERF: NOT IN query is really inefficient for large tables. 2016-11-02 13:09:18 +08:00
Neil Lalonde
9ef1688a76 FEATURE: per-category default topic list sort order 2016-11-01 12:18:41 -04:00
Arpit Jalan
382803cb05 FEATURE: include post image in OpenGraph image tag 2016-10-31 15:11:33 +05:30
Régis Hanol
f8caae0be7 FIX: don't overwrite custom email headers when using mandrill/sparkpost 2016-10-30 11:38:55 +01:00
Neil Lalonde
092ad7810d add the spec for unused tag count 2016-10-28 16:14:20 -04:00
Neil Lalonde
8c9d390cac FIX: Tags used only on deleted topics could not be used again 2016-10-28 15:11:50 -04:00
Régis Hanol
71f940d478 FIX: use metadata to hold the message_id with sparkpost 2016-10-27 19:35:50 +02:00
Guo Xiang Tan
49c27d9a88 FEATURE: Add interface in Plugin::Instance to register a seedfu fixture. 2016-10-25 14:57:31 +08:00
Régis Hanol
01001b167e fix the build 2016-10-25 01:55:47 +02:00
Régis Hanol
750338954c FIX: download SSO avatars in a background job to prevent hangs when avatars are huge 2016-10-24 19:55:30 +02:00
Régis Hanol
3841cd9a7f FEATURE: onebox everything by default 
FEATURE: new 'max_oneboxes_per_post' site setting
FEATURE: change onebox whitelist to a blacklist
PERF: debounce the loading of oneboxes
PERF: improve perf of mention links in preview
FIX: sort loading of custom oneboxer
 2016-10-24 12:46:22 +02:00
Régis Hanol
81e2a0099f FIX: ensure the group 'everyone' is never shown when using a different locale 2016-10-24 10:53:31 +02:00
Guo Xiang Tan
efea296c7a FIX: Do not cook post if Post#raw has not been changed. 2016-10-24 12:02:38 +08:00
Guo Xiang Tan
ee9946388c Merge pull request #4507 from ming-relax/feat-delete-by-email 
Remove user from a group by user email
 2016-10-24 11:28:27 +08:00
Ming HU
7803a06e50 Use expect change for groups_controller_spec.rb 2016-10-24 10:32:21 +08:00
Sam
9a94d1b212 FIX: everyone is not a visible group 2016-10-24 13:03:22 +11:00
Régis Hanol
3c8e0a8348 Merge pull request #4508 from kstaikov/mailing_list_exclude_own_replies 
FEATURE:'No Echo' option for mailing list mode.
 2016-10-22 10:45:14 +02:00
Robin Ward
19e2eec219 Allow step 0 to resend the confirmation email 2016-10-21 11:34:19 -04:00
Régis Hanol
2a61cc8c88 FIX: email styling with blacklisted iframes 2016-10-21 12:37:03 +02:00
Jeff Atwood
febbd27ba6 remove gmail/live SMTP warning 2016-10-20 14:49:06 -07:00
Régis Hanol
8d48779b5c FIX: don't 💥 with an invalid URI 2016-10-20 12:34:42 +02:00
Kiril Staikov
aee943486a FEATURE:'No Echo' option for mailing list mode. 
Mailing list mode now includes the 'no echo' option: to only receive emails of posts not created
by you.  If you reply to an email thread in mailing list mode, your reply will not then be echoed
back to you in a duplicate email by the system.
 2016-10-19 13:14:36 -04:00
Robin Ward
c03d25f170 FEATURE: Configure Admin Account 
Adds a "Step 0" to the wizard if the site has no admin accounts where
the user is prompted to finish setting up their admin account from the
list of acceptable email addresses.

Once confirmed, the wizard begins.
 2016-10-19 11:27:56 -04:00
Sam
674264726d FIX: should not be allowed to see users list of people who started a PM 2016-10-19 17:36:35 +11:00
Ming HU
dffd8baa91 Remove user from a group by user email 2016-10-18 17:10:47 +08:00
Guo Xiang Tan
7db33cc512 FIX: Videos and audio files were not associated to the post. 2016-10-18 16:13:39 +08:00
Guo Xiang Tan
2a9331d061 Remove stubs from tests. 2016-10-18 13:39:16 +08:00
Régis Hanol
3949c24f80 FIX: sparkpost webhooks support 2016-10-17 11:26:49 +02:00
Sam
aaf947356b correct regression where notifications scope is not pushing to push server 2016-10-14 22:52:39 +11:00
Régis Hanol
bd1328c189 FIX: show the wizard to developers too 2016-10-14 11:09:55 +02:00
Sam
f4f5524190 FEATURE: user API now contains scopes so permission is granular 
previously we supported blanket read and write for user API, this
change amends it so we can define more limited scopes. A scope only
covers a few routes. You can not grant access to part of the site and
leave a large amount of the information hidden to API consumer.
 2016-10-14 16:05:42 +11:00
Régis Hanol
2826d4eb88 Merge pull request #4487 from cpradio/use-top-default-for-new-users 
FEATURE: Use the top period default for users who have been inactive or are new
 2016-10-13 10:47:18 +02:00
cpradio
489e1bf643 Stub the TopTopic.topics_per_period so the logic is fully tested 2016-10-12 19:28:54 -04:00
Neil Lalonde
0328141e05 FIX: prevent creation of tags with invalid characters 2016-10-12 15:44:36 -04:00
Sam
3ad8616f44 Merge pull request #4476 from xfalcox/localize-badge-notifications 
FIX: Properly localize badge notification on batch grant
 2016-10-12 15:16:35 +11:00
Rafael dos Santos Silva
48fa1f141f Add specs for localized notifications on backfilled badges 2016-10-11 19:15:36 -03:00
cpradio
9cbf7d036a FEATURE: Use the top period default for users who have been inactive or are new 2016-10-11 13:22:43 -04:00
Régis Hanol
ddcc084d22 Revert "FEATURE: Use the top period default for users who have been inactive or are new" 2016-10-11 17:56:46 +02:00
cpradio
2de50a616d FEATURE: Use the top period default for users who have been inactive or are new 2016-10-11 09:55:15 -04:00
Sam
89daa43754 FEATURE: remap emojis back for push notifications and desktop alerts 2016-10-11 13:03:48 +11:00
Sam
6031e692f0 Merge pull request #4366 from xfalcox/print 
Print Support
 2016-10-11 11:47:20 +11:00
Sam
0f0b657182 Merge pull request #4447 from pmusaraj/approve_new_topics_setting 
FEATURE: add "Approve new topics unless user level" setting
 2016-10-11 10:14:28 +11:00
Sam
ea1f0683c8 Merge pull request #4477 from cpradio/watching-state-on-reply 
FEATURE: Add notification level user preference when replying to a topic
 2016-10-11 10:05:37 +11:00
Régis Hanol
8f68a95e56 FIX: trim leading & trailing whitespaces in admin user search 2016-10-10 16:18:57 +02:00
Sam
3e513f5c05 Merge pull request #4459 from vibol/master 
FEATURE: sparkpost webhook
 2016-10-10 17:17:17 +11:00
Sam Saffron
647ee46edf FIX: don't stem the search term 
Search for "canned" not working correctly and "butted", "ands" and many more :)
 2016-10-07 12:40:57 +11:00