github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-03 06:23:52 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
48,642 Commits 214 Branches 500 Tags 960 MiB
845000a6ce
Commit Graph

48642 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Discourse Translator Bot
845000a6ce
Update translations (#21146) 2023-04-25 17:23:28 +02:00
Ted Johansson
59dd20c415
Version bump to v3.0.3 (#21136) 2023-04-18 16:14:45 +08:00
Ted Johansson
0c11acf6cf
SECURITY: Encode embed url (#21134) 
The embed_url in "This is a companion discussion..." could be used for
XSS.

Co-authored-by: Blake Erickson <o.blakeerickson@gmail.com>
 2023-04-18 15:05:33 +08:00
Ted Johansson
bbc7746cef
SECURITY: Ensure site setting being updated is a configurable site setting (#21132) 2023-04-18 14:32:21 +08:00
Krzysztof Kotlarek
bd301c3f08
FIX: improve performance of UserStat.ensure_consistency (#21044) (#21121) 
Optimize `UserStatpost_read_count` calculation.

In addition, tests were updated to fail when code is not evaluated. Creation of PostTiming was updating `post_read_count`. Count it has to be reset to ensure that ensure_consitency correctly calculates result.

Extracting users seen in the last hour to separate Common Table Expression reduces the amount of processed rows.

Before
```
Update on user_stats  (cost=267492.07..270822.95 rows=2900 width=174) (actual time=12606.121..12606.127 rows=0 loops=1)
  ->  Hash Join  (cost=267492.07..270822.95 rows=2900 width=174) (actual time=12561.814..12603.689 rows=10 loops=1)
        Hash Cond: (user_stats.user_id = x.user_id)
        Join Filter: (x.c <> user_stats.posts_read_count)
        Rows Removed by Join Filter: 67
        ->  Seq Scan on user_stats  (cost=0.00..3125.34 rows=75534 width=134) (actual time=0.014..39.173 rows=75534 loops=1)
        ->  Hash  (cost=267455.80..267455.80 rows=2901 width=48) (actual time=12558.613..12558.617 rows=77 loops=1)
              Buckets: 4096  Batches: 1  Memory Usage: 39kB
              ->  Subquery Scan on x  (cost=267376.03..267455.80 rows=2901 width=48) (actual time=12168.601..12558.572 rows=77 loops=1)
                    ->  GroupAggregate  (cost=267376.03..267426.79 rows=2901 width=12) (actual time=12168.595..12558.525 rows=77 loops=1)
                          Group Key: pt.user_id
                          ->  Sort  (cost=267376.03..267383.28 rows=2901 width=4) (actual time=12100.490..12352.106 rows=2072830 loops=1)
                                Sort Key: pt.user_id
                                Sort Method: external merge  Disk: 28488kB
                                ->  Nested Loop  (cost=1.28..267209.18 rows=2901 width=4) (actual time=0.040..11528.680 rows=2072830 loops=1)
                                      ->  Nested Loop  (cost=0.86..261390.02 rows=13159 width=8) (actual time=0.030..3492.887 rows=3581648 loops=1)
                                            ->  Index Scan using index_users_on_last_seen_at on users u  (cost=0.42..89.71 rows=28 width=4) (actual time=0.010..0.201 rows=78 loops=1)
                                                  Index Cond: (last_seen_at > '2023-04-11 00:22:49.555537'::timestamp without time zone)
                                            ->  Index Scan using index_post_timings_on_user_id on post_timings pt  (cost=0.44..9287.60 rows=4455 width=8) (actual time=0.081..38.542 rows=45919 loops=78)
                                                  Index Cond: (user_id = u.id)
                                      ->  Index Scan using forum_threads_pkey on topics t  (cost=0.42..0.44 rows=1 width=4) (actual time=0.002..0.002 rows=1 loops=3581648)
                                            Index Cond: (id = pt.topic_id)
                                            Filter: ((deleted_at IS NULL) AND ((archetype)::text = 'regular'::text))
                                            Rows Removed by Filter: 0
Planning Time: 0.692 ms
Execution Time: 12612.587 ms
```
After
```
Update on user_stats  (cost=9473.60..12804.30 rows=2828 width=174) (actual time=677.724..677.729 rows=0 loops=1)
  ->  Hash Join  (cost=9473.60..12804.30 rows=2828 width=174) (actual time=672.536..677.706 rows=1 loops=1)
        Hash Cond: (user_stats.user_id = x.user_id)
        Join Filter: (x.c <> user_stats.posts_read_count)
        Rows Removed by Join Filter: 54
        ->  Seq Scan on user_stats  (cost=0.00..3125.34 rows=75534 width=134) (actual time=0.012..23.977 rows=75534 loops=1)
        ->  Hash  (cost=9438.24..9438.24 rows=2829 width=48) (actual time=647.818..647.822 rows=55 loops=1)
              Buckets: 4096  Batches: 1  Memory Usage: 37kB
              ->  Subquery Scan on x  (cost=9381.66..9438.24 rows=2829 width=48) (actual time=647.409..647.805 rows=55 loops=1)
                    ->  HashAggregate  (cost=9381.66..9409.95 rows=2829 width=12) (actual time=647.403..647.786 rows=55 loops=1)
                          Group Key: pt.user_id
                          Batches: 1  Memory Usage: 121kB
                          ->  Nested Loop  (cost=1.86..9367.51 rows=2829 width=4) (actual time=0.056..625.245 rows=120022 loops=1)
                                ->  Nested Loop  (cost=1.44..3692.96 rows=12832 width=8) (actual time=0.047..171.754 rows=217440 loops=1)
                                      ->  Nested Loop  (cost=1.00..254.63 rows=25 width=12) (actual time=0.030..1.407 rows=56 loops=1)
                                            Join Filter: (u.id = user_stats_1.user_id)
                                            ->  Nested Loop  (cost=0.71..243.08 rows=25 width=8) (actual time=0.018..1.207 rows=87 loops=1)
                                                  ->  Index Scan using index_users_on_last_seen_at on users u  (cost=0.42..86.71 rows=27 width=4) (actual time=0.009..0.156 rows=87 loops=1)
                                                        Index Cond: (last_seen_at > '2023-04-11 00:47:07.437568'::timestamp without time zone)
                                                  ->  Index Only Scan using user_stats_pkey on user_stats us  (cost=0.29..5.79 rows=1 width=4) (actual time=0.011..0.011 rows=1 loops=87)
                                                        Index Cond: (user_id = u.id)
                                                        Heap Fetches: 87
                                            ->  Index Scan using user_stats_pkey on user_stats user_stats_1  (cost=0.29..0.45 rows=1 width=4) (actual time=0.002..0.002 rows=1 loops=87)
                                                  Index Cond: (user_id = us.user_id)
                                                  Filter: (posts_read_count < 10000)
                                                  Rows Removed by Filter: 0
                                      ->  Index Scan using index_post_timings_on_user_id on post_timings pt  (cost=0.44..92.98 rows=4455 width=8) (actual time=0.036..2.492 rows=3883 loops=56)
                                            Index Cond: (user_id = user_stats_1.user_id)
                                ->  Index Scan using forum_threads_pkey on topics t  (cost=0.42..0.44 rows=1 width=4) (actual time=0.002..0.002 rows=1 loops=217440)
                                      Index Cond: (id = pt.topic_id)
                                      Filter: ((deleted_at IS NULL) AND ((archetype)::text = 'regular'::text))
                                      Rows Removed by Filter: 0
Planning Time: 1.406 ms
Execution Time: 677.817 ms
```
 2023-04-18 10:04:50 +10:00
Penar Musaraj
7468b78885
SECURITY: strip xlink:href from uploaded SVGs (#21058) 
This was inadvertently removed in 4c46c7e. In very specific scenarios,
this could be used execute arbitrary JavaScript.

Only affects instances where SVGs are allowed as uploads and CDN is not
configured.
 2023-04-11 14:15:41 -04:00
Discourse Translator Bot
dc3aaf852b
Update translations (#21056) 2023-04-11 15:44:29 +02:00
Discourse Translator Bot
b2c7e65f38
Update translations (#20862) 2023-04-05 09:12:44 +02:00
Alan Guo Xiang Tan
75446832b2
SECURITY: Update URI gem to 0.12.1 to address CVE-2023-28755 (#20907) 
See https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/
 2023-03-31 07:51:55 +08:00
David Taylor
428b0c91ac
SECURITY: Limit URL length for theme remote (stable) (#20788) 2023-03-23 12:07:02 +00:00
Discourse Translator Bot
8464573baa
Update translations (#20761) 2023-03-22 12:13:48 +01:00
Blake Erickson
e54f52a756
Version bump to v3.0.2 (#20714) 2023-03-16 18:12:53 -06:00
Blake Erickson
92ffbcaece SECURITY: Bump Rails to v7.0.4.3 (#20675) 2023-03-16 16:25:48 -06:00
Ted Johansson
d133692605 SECURITY: Add FinalDestination::FastImage that's SSRF safe 2023-03-16 16:25:48 -06:00
Alan Guo Xiang Tan
87032e87ea SECURITY: SSRF protection bypass with IPv4-mapped IPv6 addresses 
As part of this commit, we've also expanded our list of private IP
ranges based on
https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
and https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
 2023-03-16 16:25:48 -06:00
Alan Guo Xiang Tan
3c49c4ee35 SECURITY: Monkey-patch web-push gem to use safer HTTP client 
`FinalDestination::HTTP` is our patch of `Net::HTTP` which defend us
against SSRF and DNS rebinding attacks.
 2023-03-16 16:25:48 -06:00
Blake Erickson
3374457c44 SECURITY: Fix XSS in full name composer reply 
We are using htmlSafe when rendering the name field so we need to escape
any html being passed in.
 2023-03-16 16:25:48 -06:00
Loïc Guitaut
78a3efa710 SECURITY: Rate limit the creation of backups 2023-03-16 16:09:08 +01:00
Discourse Translator Bot
b5bee9d331
Update translations (#20672) 2023-03-14 15:29:08 +01:00
Alan Guo Xiang Tan
749a4c5937 DEV: Introduce stub_ip_lookup spec helper (#20571) 2023-03-09 08:46:41 +08:00
Sam
f6dc6da3f8 DEV: avoid mocking FinalDestination (#20570) 2023-03-09 08:46:41 +08:00
Discourse Translator Bot
05b03ca562
Update translations (#20560) 2023-03-07 14:58:27 +01:00
Gerhard Schlager
47d3df3fbf
DEV: Add digest to licensed's default gems list (#20480) 
Co-authored-by: Jarek Radosz <jradosz@gmail.com>
 2023-02-28 15:08:09 +01:00
Discourse Translator Bot
a73ca7acaa
Update translations (#20479) 2023-02-28 14:53:04 +01:00
Rafael dos Santos Silva
107a4da71b
Backport Nokogiri to stable for Ruby 3.2 (#20417) 
* Build(deps): Bump nokogiri from 1.13.10 to 1.14.0 (#19856)

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.13.10 to 1.14.0.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.10...v1.14.0)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Build(deps): Bump nokogiri from 1.14.0 to 1.14.1 (#20079)

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.14.0 to 1.14.1.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.14.0...v1.14.1)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Build(deps): Bump nokogiri from 1.14.1 to 1.14.2 (#20272)

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.14.1 to 1.14.2.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.14.1...v1.14.2)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-22 13:13:07 -03:00
Discourse Translator Bot
563fa14a89
Update translations (#20390) 2023-02-21 17:10:42 +01:00
Discourse Translator Bot
f58bca13d8
Update translations (#20284) 2023-02-15 11:24:44 +01:00
Discourse Translator Bot
f000f9c6ae
Update translations (#20194) 2023-02-07 14:37:15 +01:00
Andrei Prigorshnev
ded6aed15e
FIX: avoid race condition when setting user status (#19817) (#20182) 
This is a backport of 84e13e9.

We caught it in logs, race condition led to this error:

    ActiveRecord::RecordNotUnique 
    (PG::UniqueViolation: ERROR:  duplicate key value violates unique constraint "user_statuses_pkey"
    DETAIL:  Key (user_id)=(15) already exists.)


The reason the problem happened was that we were checking if a user has status and if not inserting status:

    if user_status
      ...
    else
      self.user_status = UserStatus.create!(status)
    end

The problem is that it's possible that another request will insert status just after we check if status exists and just before our request call `UserStatus.create!(status)`. Using `upsert` fixes the problem because under the hood `upsert` generates the only SQL request that uses "INSERT ... ON CONFLICT DO UPDATE". So we do everything in one SQL query, and that query takes care of resolving possible conflicts.
 2023-02-06 20:32:45 +04:00
Discourse Translator Bot
4395efc188
Update translations (#20184) 2023-02-06 16:50:11 +01:00
Keegan George
a409924425 FIX: Failing system spec for rate limited search (#20046) 2023-02-01 19:05:58 -08:00
Sam
1856ea83ec FEATURE: rate limit anon searches per second (#19708) 2023-02-01 19:05:58 -08:00
Alan Guo Xiang Tan
42d2cb2d4e
SECURITY: Hide PM count for tags by default (#20061) (#20090) 
Currently `Topic#pm_topic_count` is a count of all personal messages tagged for a given tag. As a result, any user with access to PM tags can poll a sensitive tag to determine if a new personal message has been created using that tag even if the user does not have access to the personal message. We classify this as a minor leak in sensitive information.

With this commit, `Topic#pm_topic_count` is hidden from users by default unless the `display_personal_messages_tag_counts` site setting is enabled.
 2023-02-01 06:43:58 +08:00
Discourse Translator Bot
a9f762550d
Update translations (#20102) 2023-01-31 15:21:19 +01:00
Jarek Radosz
df70c8bf1c FIX: Don't spam presence requests when getting 429 (#20084) 
The presence service would retry `/presence/update` requests every second (or immediately in tests) in case where server returns 429 (rate limit) errors. That could lead to infinite spamming (until user refreshed tab/tabs)

Co-authored-by: David Taylor <david@taylorhq.com>
 2023-01-31 14:04:21 +01:00
Jarek Radosz
78fe2656b4 DEV: Convert presence service tests to actual unit tests (#20076) 2023-01-31 14:04:21 +01:00
Arpit Jalan
29805b32ef
DEV: Move back to web-push gem (#19849) (#20091) 
Our fork was needed for OpenSSL 3 and Ruby 2.X compatibility.

The OpenSSL 3 part was merged into the gem for version 3.

Discourse dropped support for Ruby 2.X.

That means we don't need our fork anymore.

Co-authored-by: Rafael dos Santos Silva <xfalcox@gmail.com>
 2023-01-31 14:54:04 +05:30
David Taylor
8c97ae76e7
DEV: Fix GitHub CI permissions issues (stable) (#20093) 
The `git` version in our discourse_test docker image was recently updated to include a permissions check before running any git commands. For this to pass, the owner of the discourse directory needs to match the user running any git commands.

Under GitHub actions, by default the working directory is created with uid=1000 as the owner. We run all our tests as `root`, so this mismatch causes git to raise the permissions error. We can't switch to run the entire workflow as the `discourse (uid=1000)` user because our discourse_test image is not configured to allow `discourse` access to postgres/redis directories. For now, this commit updates the working directory's owner to match the user running the workflow.
 2023-01-31 09:06:56 +00:00
David Taylor
a3b01eaa62
FIX: Ensure anon-cached values are never returned for API requests (stable) (#20022) 
Under some situations, we would inadvertently return a public (unauthenticated) result to an authenticated API request. This commit adds the `Api-Key` header to our anonymous cache bypass logic.
 2023-01-30 14:42:51 +00:00
Bianca Nenciu
4571b10ee5
Version bump to v3.0.1 (#20010) 2023-01-25 13:55:40 -05:00
Bianca Nenciu
1a5a6f66cb
SECURITY: Prevent XSS in local oneboxes (#20009) 
Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com>
 2023-01-25 19:17:22 +02:00
Bianca Nenciu
15a2af1c21
SECURITY: Update to exclude tag topic filter (#20007) 
Ignores tags specified in exclude_tag topics param that a user does not
have access to.

Co-authored-by: Blake Erickson <o.blakeerickson@gmail.com>
 2023-01-25 18:56:28 +02:00
Bianca Nenciu
ecb9aa5dba
SECURITY: only show restricted tag lists to authorized users (#20005) 
Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
 2023-01-25 18:56:00 +02:00
Bianca Nenciu
3c6d938077
SECURITY: Prevent ReDoS in user agent parsing (#20003) 
Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
 2023-01-25 18:55:36 +02:00
Bianca Nenciu
ec4c302708
SECURITY: Prevent ReDOS by making the SSH url regex unambiguous (#20001) 
Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>
 2023-01-25 18:55:10 +02:00
Bianca Nenciu
5849c81f1d Revert "FIX: TL4 user can see deleted topics (#19946)" 
This reverts commit d725c41d18 which is
a 3.1 feature.
 2023-01-25 15:39:38 +02:00
Bianca Nenciu
87b95356f7 SECURITY: Remove bypass for base_url 
The check used to be necessary because we validated the referrer too and
this bypass was a workaround a bug that is present in some browsers that
do not send the correct referrer.
 2023-01-25 13:53:22 +02:00
Ted Johansson
3e0cc4a5d9 SECURITY: Limit the character count of group membership requests 
When creating a group membership request, there is no character
limit on the 'reason' field. This can be potentially be used by
an attacker to create enormous amount of data in the database.
 2023-01-25 13:53:07 +02:00
Loïc Guitaut
3dcd0bc544 SECURITY: Limit the length of drafts 2023-01-25 13:52:58 +02:00
Joffrey JAFFEUX
a02af9e6db SECURITY: Limit chat drafts length and preloaded count 
Only allow maximum of `50_000` characters for chat drafts. A hidden `max_chat_draft_length` setting can control this limit. A migration is also provided to delete any abusive draft in the database.

The number of drafts loaded on current user has also been limited and ordered by most recent update.

Note that spec files moved are not directly related to the fix.
 2023-01-25 13:52:49 +02:00