1239 Commits

Author	SHA1	Message	Date
Arpit Jalan	295cf8839e	FIX: better error message when invited user already exists	2017-03-22 13:55:28 +05:30
Arpit Jalan	8cbfa24ca2	Fix failing test	2017-03-20 20:14:25 +05:30
Arpit Jalan	521c88fe58	FIX: enqueue activation email for invited user that has password set	2017-03-20 17:13:21 +05:30
Guo Xiang Tan	6057e17ae7	Fix weird test failure.	2017-03-20 12:06:37 +08:00
Robin Ward	fd591257a8	Merge pull request #4759 from kennym/support-ports-for-ip-addresses-in-embedding ... FIX: Allow ports for embed host IPs	2017-03-16 11:23:42 -04:00
Guo Xiang Tan	bf78c228f4	FIX: User created web hook being enqueued before record has been saved. ... * Improve web hook tests as well.	2017-03-16 14:44:09 +08:00
Erick Guan	cfbfea0596	FEATURE: Allow easier customization to the web hook event serialization.	2017-03-16 10:09:05 +08:00
Kenny Meyer	ae957bca25	Allow ports for embed host IPs	2017-03-15 18:16:34 -03:00
Guo Xiang Tan	d173473509	Fix randomly failing specs.	2017-03-14 14:43:48 +08:00
Sam	64680286f4	correct logic, so revalidation is reset ... correct test so it can run at any point	2017-03-13 10:47:43 -04:00
Sam	ef24fd54ba	FEATUE: automatically validate token is stored in redis ... This ensures we have some handling for redis flushall We attempt to recover our in-memory session token once every 30 seconds Code is careful to only set the token if it is nil, to allow for manual cycling to remain safe if needed	2017-03-13 10:19:02 -04:00
Guo Xiang Tan	4d4a1a1552	Add scope for human users.	2017-03-11 14:25:09 +08:00
Sam	99f4d5082b	FIX: Improve token rotation and increase logging ... - avoid access denied on bad cookie, instead just nuke it - avoid marking a token unseen for first minute post rotation - log path in user auth token logs	2017-03-07 13:27:43 -05:00
Robin Ward	dad57fa033	FIX: More errors with non-ascii URLs	2017-03-07 11:21:41 -05:00
Guo Xiang Tan	d1e587c10a	Merge pull request #4737 from oblakeerickson/approve_invited_user ... FIX: approve invited user	2017-03-07 21:14:34 +08:00
Guo Xiang Tan	7d82a53dfe	FIX: Group#name is case insensitive.	2017-03-06 17:24:03 +08:00
Guo Xiang Tan	8aea3caf00	FIX: Ensure that we only move posts that belong to the original topic.	2017-03-06 15:04:10 +08:00
Blake Erickson	dbb3ddc7a6	FIX: approve invited user ... This commit fixes the case where invited users who typed in a password would not be approved by default. Because we moved the user create logic for an invited user there was a clash with the `save` in the user model and the `save` in the invite_redeemer class. - added approve logic into invite_redeemer class. - added tests to verify that the user is approved - added a check to see if must_approve_users is on - added a check to see if the inviter is staff - go ahead and approve the user if must_approve_users is off - keep existing User.approve workflow if user exists - improve if/else logic to remove duplicate code - use `Time.zone.now`	2017-03-05 06:58:23 -07:00
Guo Xiang Tan	bcf634ca85	Merge pull request #4728 from nbianca/username-regex ... Add support for username regex.	2017-03-03 22:59:23 +08:00
Bianca Nenciu	30909ec54e	Add support for username regex.	2017-03-02 13:53:45 +02:00
Neil Lalonde	262016604d	FEATURE: each category can control how many topics to show on categories page	2017-03-01 15:12:57 -05:00
Sam	3ac4709903	FIX: on initial token issue stop unmarking token as unseen ... prev and current are the same so we need special logic to bypass	2017-02-28 10:38:22 -05:00
Robin Ward	bf9626d031	FIX: Embedding was broken with non-english URLs and ports	2017-02-27 12:17:52 -05:00
Sam Saffron	7e8f0dc967	FIX: attempt to handle ios edge case where token is seen but unsaved ... This relaxes our security in the following way - prev auth token is always accepted as long as rotation date is within our window of SiteSetting.maximum_session_age.hours (previously old token expired within a minute of new one being seen) - new auth token is marked unseen if we are presented with an old token after we already saw new one This attempts to fix an issue where ios webkit is not committing new cookies	2017-02-26 17:09:57 -05:00
Neil Lalonde	c94fdcea38	FIX: admin dashboard posts count should not include system posts and whispers	2017-02-21 14:45:41 -05:00
Régis Hanol	cb99f59ec3	reset bounce score when email is successfully changed	2017-02-20 10:37:01 +01:00
Robin Ward	e62c0a42fa	FIX: Support multiple embeddable host records with the same host	2017-02-17 12:41:34 -05:00
Neil Lalonde	c0e1722ca6	fix intermittent spec failure due to Time comparison with TimeWithZone	2017-02-17 10:30:29 -05:00
Neil Lalonde	3fb50d587d	FIX: invited users and new TL1 users will see their first notification highlighted	2017-02-17 10:30:29 -05:00
Neil Lalonde	4b28bfaa15	Merge pull request #4710 from ento/fix-s3-config-check ... FIX: admin dashboard shouldn't complain when using IAM profile for S3 access	2017-02-15 17:02:07 -05:00
Neil Lalonde	d0fbb27f3e	FEATURE: new invite acceptance page, where username can be chosen and password can be set	2017-02-15 16:51:57 -05:00
Sam	9c51e3e8e7	amend preloader api to supply topic list	2017-02-15 12:04:02 -05:00
Sam	2c59ffeb2c	FIX: token rotation not accounting for overlapping tokens correctly ... also... freeze_time has no block form, correct all usages and specs	2017-02-15 10:58:18 -05:00
Marica Odagaki	af9c97ec43	Add failing tests	2017-02-15 00:05:58 -08:00
Marica Odagaki	2c1279b740	Fix typo to be more consistent with other test descriptions	2017-02-15 00:04:10 -08:00
Sam	f2099c3811	adjust API	2017-02-14 16:32:33 -05:00
Sam	89d5e8ab4b	FEATURE: allow plugins to preload data in topic list	2017-02-14 16:29:06 -05:00
Sam	0ab96a7691	FEATURE: add hidden setting for verbose auth token logging ... This is only needed to debug auth token issues, will result in lots of logging	2017-02-13 14:01:09 -05:00
Robin Ward	e1d358ffbf	FIX: Don't clear the login hint when the system user is saved	2017-02-13 10:54:20 -05:00
Jeff Atwood	3ee7a9266c	Merge pull request #4686 from tgxworld/group_is_visible_if_user_is_group_owner ... FIX: Show groups that user is owner of on groups page.	2017-02-11 22:18:44 -08:00
Sam Saffron	4332f0dde1	FEATURE: allow user search API to restrict to group	2017-02-09 18:45:39 -05:00
Sam	49e7124a5e	clarify override semantics in spec	2017-02-07 10:41:27 -05:00
Sam	f34907b523	Merge pull request #4681 from vietqhoang/feature/add-user-title-to-sso-payload ... FEATURE: Add user title to SSO payload	2017-02-07 10:25:32 -05:00
Sam	ff49f72ad9	FEATURE: per client user tokens ... Revamped system for managing authentication tokens. - Every user has 1 token per client (web browser) - Tokens are rotated every 10 minutes New system migrates the old tokens to "legacy" tokens, so users still remain logged on. Also introduces weekly job to expire old auth tokens.	2017-02-07 09:22:16 -05:00
Régis Hanol	84af84dc52	prevent inactive & staged users from being automatically added to a group	2017-02-06 17:49:27 +01:00
Robin Ward	b251d11518	FIX: If you make a new banner, clear the old dismissed values	2017-02-03 15:07:38 -05:00
Guo Xiang Tan	61111a3f9b	FIX: Show groups that user is owner of on groups page.	2017-02-03 16:51:32 +08:00
Arpit Jalan	6b8691ecea	Merge pull request #4685 from techAPJ/approve-users-invite-fix ... FIX: allow existing users to be invited to topic/message when must_approve_users is enabled	2017-02-03 13:22:18 +05:30
Arpit Jalan	dc2171960b	FIX: allow existing users to be invited to topic/message when must_approve_users is enabled	2017-02-03 13:01:23 +05:30
Guo Xiang Tan	c392994793	Fix specs.	2017-02-03 08:38:19 +08:00
Neil Lalonde	b91cb92af0	FIX: reports for time to first reply and topics without replies were counting whispers and moderator actions	2017-02-02 17:27:41 -05:00
Guo Xiang Tan	3c28d94706	FIX: Don't configure Redis connector if Redis slave config is not set.	2017-02-02 13:48:55 +08:00
Viet Hoang	40164ccd4a	Add user title to SSO payload	2017-01-31 16:42:27 -08:00
Rimian Perkins	25516874b5	FIX: Escape regexp chars in SiteSetting.censored_words.	2017-01-31 10:14:51 +08:00
Guo Xiang Tan	0e5d490b05	No need for special helper to reset SiteSetting state. ... * SiteSetting in tests uses a local provider that resets it.	2017-01-28 10:55:49 +08:00
Neil Lalonde	7ead3e1f18	fix failing specs	2017-01-27 16:17:10 -05:00
Robin Ward	496682c442	Merge pull request #4662 from tgxworld/fix_localized_group_name_change ... Fix localized group name change	2017-01-26 10:50:00 -05:00
Guo Xiang Tan	ce07da1d8b	UX: Only display the words that fails censored words validations.	2017-01-24 13:11:05 +08:00
Guo Xiang Tan	59dfb51a35	FIX: Don't change automatic group name if localized name has been taken.	2017-01-18 12:20:23 +08:00
Guo Xiang Tan	63954c1b33	FIX: Same user record being saved twice causing validation to fail.	2017-01-16 16:41:03 +08:00
Guo Xiang Tan	e3b6f9b8ae	FIX: Do not update user stats like counts for private messages.	2017-01-16 11:07:53 +08:00
Guo Xiang Tan	ed5fa20b0c	Revert "FIX: error during signup saying "Password is the same as your current password" due to automatic group membership granting a trust level" ... This reverts commit 9c40657ba4. Calling this whenever a user is initialize is hurting us bad on performance.	2017-01-16 09:44:10 +08:00
Régis Hanol	887e9af84f	FEATURE: new 'max_image_megapixels' site setting	2017-01-11 23:37:12 +01:00
Guo Xiang Tan	3d21ccd4a5	FIX: Add validation to disallow censored words in topic title.	2017-01-09 16:55:41 +08:00
Guo Xiang Tan	f1beef43a8	Merge pull request #4618 from tgxworld/fix_invalid_emails ... FIX: Don't allow invalid email to be saved.	2016-12-30 07:11:48 +08:00
Neil Lalonde	9c40657ba4	FIX: error during signup saying "Password is the same as your current password" due to automatic group membership granting a trust level	2016-12-28 17:36:04 -05:00
Arpit Jalan	d72cbcb2a4	FEATURE: new setting to validate user website	2016-12-26 21:29:27 +05:30
Sam	c531f4ded5	remove rails-observers ... Rails yanked out observers many many years ago, instead the functionality was yanked out to a gem that is very lightly maintained. For example: if we want to upgrade to rails 5 there is no published gem Internally the usage of observers had quite a few problem. The series of refactors renamed a bunch of classes to give us more clarity and removed some magic.	2016-12-22 16:46:53 +11:00
Sam	019f1a1d06	UserEmailObserver is now removed ... no big surprises here was pretty straightforward after_commit semantics sure are weird though	2016-12-22 16:46:53 +11:00
Sam	2f6a4cc6de	remove UserActionObserver, replace with after_save and service ... interestingly there was some left over dead code from when stars existed in the topic_users table	2016-12-22 16:46:53 +11:00
Sam	0a78ae739d	Remove SearchObserver, aim is to remove all observers ... rails-observers gem is mostly unmaintained and is a pain to carry forward new implementation contains significantly less magic as a bonus	2016-12-22 13:13:14 +11:00
Guo Xiang Tan	13c6191e89	FIX: Don't allow invalid email to be saved.	2016-12-21 17:47:11 +08:00
Guo Xiang Tan	5d7f3223f0	SECURITY: Users can only bookmark posts which they can see.	2016-12-21 12:01:26 +08:00
Neil Lalonde	74956694e5	If summary email finds no topics, show topics more than 1 day old from new users	2016-12-19 14:54:08 -05:00
Neil Lalonde	923cf73c6e	Topic Featured Links: move data from custom fields to topics and categories tables. Invert behaviour of topic_featured_link_allowed checkbox. Fix a bug with invalid topic records due to changing that category checkbox.	2016-12-19 14:54:07 -05:00
Sam	eb2db23b40	FEATURE: remove email_token_grace_period_hours ... The site setting email_token_grace_period_hours just causes confusion and should not be used anyway. Out of the box, tokens stop working once confirmed, no need to add complexity here	2016-12-19 17:15:20 +11:00
Sam	15b5fddd49	SECURITY: protect upload params, only allow very strict filenames	2016-12-19 10:16:18 +11:00
Guo Xiang Tan	69330f8bc2	Add user_updated event to webhooks.	2016-12-13 11:26:26 +08:00
Guo Xiang Tan	9a800107cb	FIX: Associate category logo and background to uploads record.	2016-12-12 17:37:28 +08:00
Guo Xiang Tan	05f55dbc10	FEATURE: Group logs.	2016-12-12 17:29:54 +08:00
Neil Lalonde	24d2973108	enable featured links by default	2016-12-09 16:08:17 -05:00
Sam	846597f563	FIX: staff tags are stripped by non-staff	2016-12-09 17:24:26 +11:00
Erick Guan	52763f5115	FEATURE: Allow posting a link with topics	2016-12-05 17:20:54 +01:00
Régis Hanol	06469ef0ce	FIX: don't extract links from .elided parts	2016-12-05 15:19:15 +01:00
Guo Xiang Tan	adb7fcb6b3	FEATURE: Add bio to group page.	2016-12-05 16:58:04 +08:00
Sam	33d0a23d84	Merge branch 'fix_whisper'	2016-12-05 10:01:03 +11:00
Guo Xiang Tan	3971f96aa6	Merge pull request #4536 from fantasticfears/webhooks-edit ... FIX: missing post and topic edited webhooks	2016-12-02 10:16:19 +01:00
Sam	9b885c039a	Merge branch 'master' into fix_whisper	2016-12-02 17:44:05 +11:00
Sam	c04d4171ff	FIX: whisper no longer experimental ... - Regular users are not notified of whispers - Regular users no longer have "stuck" topics in unread - Additional tracking for staff highest post number - Remove a bunch of unused columns in topics table	2016-12-02 17:03:31 +11:00
Erick Guan	8c8549b27b	FIX: missing post and topic edited webhooks	2016-11-30 20:49:45 +01:00
Régis Hanol	dec8a861f0	FIX: don't raise exception when a quote was already extracted	2016-11-30 17:18:34 +01:00
Guo Xiang Tan	b889bfefbb	PERF: Don't calculate the same query twice.	2016-11-24 14:05:26 +08:00
Arpit Jalan	2d0c99636a	do not add rel noreferrer	2016-11-20 18:19:14 +05:30
Arpit Jalan	7cb76f7333	FIX: add rel noopener and noreferrer in addition to nofollow	2016-11-20 17:07:27 +05:30
Guo Xiang Tan	8c6d8c85db	Stop showing first notification prompt once user sees the notification.	2016-11-17 09:44:00 +08:00
Guo Xiang Tan	98c1e0832c	FIX: Track first notification read using Redis.	2016-11-16 16:20:38 +08:00
Guo Xiang Tan	16fdcdfc00	FIX: Add conditions on when to show first pm notification.	2016-11-16 14:17:47 +08:00
Leo McArdle	784366f1a0	FIX: display only 1 trust level badge on user card ... refactoring graciously provided by @xfalcox	2016-11-14 20:53:24 +00:00
Sam	3d76ce1421	FEATURE: SSO support for adding and removing a user to groups ... Use: add_groups with a comma delimited list to ensure a user is in groups (using group names) Use: remove_groups with a comma delimited list to ensure a user is removed from groups (using group names)	2016-11-11 16:57:31 +11:00
Arpit Jalan	9e69798285	FEATURE: watch first post default site setting	2016-11-10 00:09:52 +05:30