Commit Graph

48632 Commits

Author SHA1 Message Date
Discourse Translator Bot
8464573baa
Update translations (#20761) 2023-03-22 12:13:48 +01:00
Blake Erickson
e54f52a756
Version bump to v3.0.2 (#20714) 2023-03-16 18:12:53 -06:00
Blake Erickson
92ffbcaece SECURITY: Bump Rails to v7.0.4.3 (#20675) 2023-03-16 16:25:48 -06:00
Ted Johansson
d133692605 SECURITY: Add FinalDestination::FastImage that's SSRF safe 2023-03-16 16:25:48 -06:00
Alan Guo Xiang Tan
87032e87ea SECURITY: SSRF protection bypass with IPv4-mapped IPv6 addresses
As part of this commit, we've also expanded our list of private IP
ranges based on
https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
and https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
2023-03-16 16:25:48 -06:00
Alan Guo Xiang Tan
3c49c4ee35 SECURITY: Monkey-patch web-push gem to use safer HTTP client
`FinalDestination::HTTP` is our patch of `Net::HTTP` which defend us
against SSRF and DNS rebinding attacks.
2023-03-16 16:25:48 -06:00
Blake Erickson
3374457c44 SECURITY: Fix XSS in full name composer reply
We are using htmlSafe when rendering the name field so we need to escape
any html being passed in.
2023-03-16 16:25:48 -06:00
Loïc Guitaut
78a3efa710 SECURITY: Rate limit the creation of backups 2023-03-16 16:09:08 +01:00
Discourse Translator Bot
b5bee9d331
Update translations (#20672) 2023-03-14 15:29:08 +01:00
Alan Guo Xiang Tan
749a4c5937 DEV: Introduce stub_ip_lookup spec helper (#20571) 2023-03-09 08:46:41 +08:00
Sam
f6dc6da3f8 DEV: avoid mocking FinalDestination (#20570) 2023-03-09 08:46:41 +08:00
Discourse Translator Bot
05b03ca562
Update translations (#20560) 2023-03-07 14:58:27 +01:00
Gerhard Schlager
47d3df3fbf
DEV: Add digest to licensed's default gems list (#20480)
Co-authored-by: Jarek Radosz <jradosz@gmail.com>
2023-02-28 15:08:09 +01:00
Discourse Translator Bot
a73ca7acaa
Update translations (#20479) 2023-02-28 14:53:04 +01:00
Rafael dos Santos Silva
107a4da71b
Backport Nokogiri to stable for Ruby 3.2 (#20417)
* Build(deps): Bump nokogiri from 1.13.10 to 1.14.0 (#19856)

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.13.10 to 1.14.0.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.10...v1.14.0)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Build(deps): Bump nokogiri from 1.14.0 to 1.14.1 (#20079)

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.14.0 to 1.14.1.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.14.0...v1.14.1)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Build(deps): Bump nokogiri from 1.14.1 to 1.14.2 (#20272)

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.14.1 to 1.14.2.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.14.1...v1.14.2)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-22 13:13:07 -03:00
Discourse Translator Bot
563fa14a89
Update translations (#20390) 2023-02-21 17:10:42 +01:00
Discourse Translator Bot
f58bca13d8
Update translations (#20284) 2023-02-15 11:24:44 +01:00
Discourse Translator Bot
f000f9c6ae
Update translations (#20194) 2023-02-07 14:37:15 +01:00
Andrei Prigorshnev
ded6aed15e
FIX: avoid race condition when setting user status (#19817) (#20182)
This is a backport of 84e13e9.

We caught it in logs, race condition led to this error:

    ActiveRecord::RecordNotUnique 
    (PG::UniqueViolation: ERROR:  duplicate key value violates unique constraint "user_statuses_pkey"
    DETAIL:  Key (user_id)=(15) already exists.)


The reason the problem happened was that we were checking if a user has status and if not inserting status:

    if user_status
      ...
    else
      self.user_status = UserStatus.create!(status)
    end

The problem is that it's possible that another request will insert status just after we check if status exists and just before our request call `UserStatus.create!(status)`. Using `upsert` fixes the problem because under the hood `upsert` generates the only SQL request that uses "INSERT ... ON CONFLICT DO UPDATE". So we do everything in one SQL query, and that query takes care of resolving possible conflicts.
2023-02-06 20:32:45 +04:00
Discourse Translator Bot
4395efc188
Update translations (#20184) 2023-02-06 16:50:11 +01:00
Keegan George
a409924425 FIX: Failing system spec for rate limited search (#20046) 2023-02-01 19:05:58 -08:00
Sam
1856ea83ec FEATURE: rate limit anon searches per second (#19708) 2023-02-01 19:05:58 -08:00
Alan Guo Xiang Tan
42d2cb2d4e
SECURITY: Hide PM count for tags by default (#20061) (#20090)
Currently `Topic#pm_topic_count` is a count of all personal messages tagged for a given tag. As a result, any user with access to PM tags can poll a sensitive tag to determine if a new personal message has been created using that tag even if the user does not have access to the personal message. We classify this as a minor leak in sensitive information.

With this commit, `Topic#pm_topic_count` is hidden from users by default unless the `display_personal_messages_tag_counts` site setting is enabled.
2023-02-01 06:43:58 +08:00
Discourse Translator Bot
a9f762550d
Update translations (#20102) 2023-01-31 15:21:19 +01:00
Jarek Radosz
df70c8bf1c FIX: Don't spam presence requests when getting 429 (#20084)
The presence service would retry `/presence/update` requests every second (or immediately in tests) in case where server returns 429 (rate limit) errors. That could lead to infinite spamming (until user refreshed tab/tabs)

Co-authored-by: David Taylor <david@taylorhq.com>
2023-01-31 14:04:21 +01:00
Jarek Radosz
78fe2656b4 DEV: Convert presence service tests to actual unit tests (#20076) 2023-01-31 14:04:21 +01:00
Arpit Jalan
29805b32ef
DEV: Move back to web-push gem (#19849) (#20091)
Our fork was needed for OpenSSL 3 and Ruby 2.X compatibility.

The OpenSSL 3 part was merged into the gem for version 3.

Discourse dropped support for Ruby 2.X.

That means we don't need our fork anymore.

Co-authored-by: Rafael dos Santos Silva <xfalcox@gmail.com>
2023-01-31 14:54:04 +05:30
David Taylor
8c97ae76e7
DEV: Fix GitHub CI permissions issues (stable) (#20093)
The `git` version in our discourse_test docker image was recently updated to include a permissions check before running any git commands. For this to pass, the owner of the discourse directory needs to match the user running any git commands.

Under GitHub actions, by default the working directory is created with uid=1000 as the owner. We run all our tests as `root`, so this mismatch causes git to raise the permissions error. We can't switch to run the entire workflow as the `discourse (uid=1000)` user because our discourse_test image is not configured to allow `discourse` access to postgres/redis directories. For now, this commit updates the working directory's owner to match the user running the workflow.
2023-01-31 09:06:56 +00:00
David Taylor
a3b01eaa62
FIX: Ensure anon-cached values are never returned for API requests (stable) (#20022)
Under some situations, we would inadvertently return a public (unauthenticated) result to an authenticated API request. This commit adds the `Api-Key` header to our anonymous cache bypass logic.
2023-01-30 14:42:51 +00:00
Bianca Nenciu
4571b10ee5
Version bump to v3.0.1 (#20010) 2023-01-25 13:55:40 -05:00
Bianca Nenciu
1a5a6f66cb
SECURITY: Prevent XSS in local oneboxes (#20009)
Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com>
2023-01-25 19:17:22 +02:00
Bianca Nenciu
15a2af1c21
SECURITY: Update to exclude tag topic filter (#20007)
Ignores tags specified in exclude_tag topics param that a user does not
have access to.

Co-authored-by: Blake Erickson <o.blakeerickson@gmail.com>
2023-01-25 18:56:28 +02:00
Bianca Nenciu
ecb9aa5dba
SECURITY: only show restricted tag lists to authorized users (#20005)
Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
2023-01-25 18:56:00 +02:00
Bianca Nenciu
3c6d938077
SECURITY: Prevent ReDoS in user agent parsing (#20003)
Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
2023-01-25 18:55:36 +02:00
Bianca Nenciu
ec4c302708
SECURITY: Prevent ReDOS by making the SSH url regex unambiguous (#20001)
Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>
2023-01-25 18:55:10 +02:00
Bianca Nenciu
5849c81f1d Revert "FIX: TL4 user can see deleted topics (#19946)"
This reverts commit d725c41d18 which is
a 3.1 feature.
2023-01-25 15:39:38 +02:00
Bianca Nenciu
87b95356f7 SECURITY: Remove bypass for base_url
The check used to be necessary because we validated the referrer too and
this bypass was a workaround a bug that is present in some browsers that
do not send the correct referrer.
2023-01-25 13:53:22 +02:00
Ted Johansson
3e0cc4a5d9 SECURITY: Limit the character count of group membership requests
When creating a group membership request, there is no character
limit on the 'reason' field. This can be potentially be used by
an attacker to create enormous amount of data in the database.
2023-01-25 13:53:07 +02:00
Loïc Guitaut
3dcd0bc544 SECURITY: Limit the length of drafts 2023-01-25 13:52:58 +02:00
Joffrey JAFFEUX
a02af9e6db SECURITY: Limit chat drafts length and preloaded count
Only allow maximum of `50_000` characters for chat drafts. A hidden `max_chat_draft_length` setting can control this limit. A migration is also provided to delete any abusive draft in the database.

The number of drafts loaded on current user has also been limited and ordered by most recent update.

Note that spec files moved are not directly related to the fix.
2023-01-25 13:52:49 +02:00
Aleksey Bogdanov
971f97d03a FIX: text selection breaks opening of links in new tabs (#19867)
When a user checks "Open all external links in a new tab" preference
he expects not to be overruled by unrelated text selections.
Yet if text is selected during a link click the link is followed on
the same tab. This change corrects that.
2023-01-25 13:48:49 +02:00
Martin Brennan
cb6572e940 FIX: Do not add empty use/svg tags in ExcerptParser (#19969)
There was an issue where if hashtag-cooked HTML was sent
to the ExcerptParser without the keep_svg option, we would
end up with empty </use> and </svg> tags on the parts of the
excerpt where the hashtag was, in this case when a post
push notification was sent.

Fixed this, and also added a way to only display a plaintext
version of the hashtag for cases like this via PrettyText#excerpt.
2023-01-25 13:48:49 +02:00
Vinoth Kannan
01b903dc83 FIX: skip email if blank while syncing SSO attributes. (#19939)
Also, return email blank error in `EmailValidator`  when the email is blank.
2023-01-25 13:48:49 +02:00
Krzysztof Kotlarek
1ef2031fae FIX: TL4 user is not redirected to latest when delete topic (#19967)
Continue of https://github.com/discourse/discourse/pull/19766

When TL4 is allowed to delete topic, they should not be redirected to / after that action.
2023-01-25 13:48:49 +02:00
Martin Brennan
dc55e9cdf9 FIX: Do not count deleted post for upload ref security (#19949)
When checking whether an existing upload should be secure
based on upload references, do not count deleted posts, since
there is still a reference attached to them. This can lead to
issues where e.g. an upload is used for a post then later on
a custom emoji.
2023-01-25 13:48:49 +02:00
Joffrey JAFFEUX
7df88e338a FIX: adds negative skidding to popper offset (#19958)
Learn more about skidding here: https://popper.js.org/docs/v2/modifiers/offset/#skidding-1

This change has two goals:
- Fixes an issue when the user had zoomed the viewport and the popper would position on the opposite side
- Makes msg actions arguably more pleasant to the eye by preventing it to be right aligned with the message container
2023-01-25 13:48:49 +02:00
Kris
c13877e71b FIX: data-popper-reference-hidden too broad (#19937) 2023-01-25 13:48:49 +02:00
Jordan Vidrine
5361fa3421 FIX: Fix margin on mini-tag-chooser (#19953) 2023-01-25 13:48:49 +02:00
Joffrey JAFFEUX
482739c171 FIX: prevents msg-actions to show hover text (#19952)
This case was possible in restrained space when the top of the message was not visible in the viewport.
2023-01-25 13:48:49 +02:00
Joffrey JAFFEUX
a0f61f4a25 FIX: generates automatic slug for trashed channels (#19908)
Prior to this fix trashed channels would still prevent a channel with the same slug to be created. This commit generates a new slug on trash and frees the slug for future usage.

The format used for the slug is: `YYYYMMDD-HHMM-OLD_SLUG-deleted` truncated to the max length of a channel name.
2023-01-25 13:48:49 +02:00