34242 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
David Taylor	85cdf213e1	FIX: Hide live-loaded posts from ignored users	2019-07-27 14:00:34 +01:00
David Taylor	e9c0fb0621	SECURITY: Sanitize email id for use as mutex key	2019-07-24 13:51:08 +01:00
David Taylor	c4ff66e1a5	DEV: Correct merge conflicts for 9cfe3f99	2019-07-24 13:31:16 +01:00
David Taylor	9cfe3f9948	SECURITY: Add confirmation screen when connecting associated accounts	2019-07-24 13:29:59 +01:00
Gerhard Schlager	90a1aa5536	SECURITY: Validate backup chunk identifier	2019-07-22 08:44:38 +02:00
Neil Lalonde	af192ff9d5	Version bump to v2.3.2	2019-07-15 10:00:45 -04:00
Guo Xiang Tan	3663ef6394	Fix the build. ... Follow up to 4b0cf7f6dd.	2019-07-15 16:42:58 +08:00
Guo Xiang Tan	477bacb3ae	SECURITY: XSS when displaying watched words in admin panel. ... The XSS here is only possible if CSP is disabled. Low impact since CSP is enabled by default in SiteSettings.	2019-07-15 10:58:52 +08:00
Robin Ward	fe8bd92f71	SECURITY: SQL injection with default categories ... This is a low severity security fix because it requires a logged in admin user to update a site setting via the API directly to an invalid value. The fix adds validation for the affected site settings, as well as a secondary fix to prevent injection in the event of bad data somehow already exists.	2019-07-11 13:53:12 -04:00
Robin Ward	2f91f88d06	SECURITY: Upgrade lodash ... There is a security hole in lodash with prototype pollution. It's not clear if Discourse is affected but to be on the safe side we will upgrade right away. Note that the front end Discourse does not appear to use `defaultsDeep` in our custom build and should be protected.	2019-07-11 10:51:44 -04:00
Robin Ward	d1c12539dd	SECURITY: XSS with title selector on preferences page ... Note this is very low severity as the group needs to be created with a default title that contains HTML, and group creation is restricted to staff members right now.	2019-07-09 17:35:26 -04:00
Robin Ward	4fd470e63d	SECURITY: Strip HTML from invite emails ... We also strip new lines from the emails because it ruins the markdown formatting which expects a one line message.	2019-07-05 14:58:46 -04:00
Jeff Wong	a7a7afdb27	FIX: iterate when clearing watched words cache	2019-07-04 08:59:01 -07:00
romanrizzi	2a7d270fd6	Revert "FIX: remove misplaced save button" ... This reverts commit f1381a274b.	2019-07-03 10:58:33 -03:00
romanrizzi	f1381a274b	FIX: remove misplaced save button	2019-07-03 10:47:54 -03:00
romanrizzi	34d548dbd3	FIX: Remove misplaced outlet	2019-07-03 10:47:43 -03:00
Arpit Jalan	867eebb55e	FIX: creating new badge is failing on empty SQL query (#7837)	2019-07-02 15:17:32 +05:30
Gerhard Schlager	b549cab2ad	FIX: Don't send notification email when user isn't allowed to see topic	2019-07-02 09:05:36 +10:00
Gerhard Schlager	5b91182985	DEV: Respond with error 400 to uploads requested via XHR ... follow-up to 13f38055	2019-06-27 11:30:05 +02:00
Sam Saffron	467e03a2ec	DEV: lint file ... We no longer need that isAppleDevice require	2019-06-27 11:29:51 +02:00
Joffrey JAFFEUX	a91881280d	FIX: closes search-menu on escape (#7804)	2019-06-27 09:34:34 +02:00
Joffrey JAFFEUX	690fb5c4fb	FIX: prevents failure when TL was mutated on internal object (#7808)	2019-06-27 09:34:31 +02:00
Gerhard Schlager	9c8aa0a906	SECURITY: XSS in routes ... Co-authored-by: Guo Xiang Tan <tgx_world@hotmail.com> Co-authored-by: David Taylor <david@taylorhq.com>	2019-06-26 16:45:33 +02:00
Bianca Nenciu	3503271959	SECURITY: Escape email text for posts containing [details].	2019-06-26 16:45:25 +02:00
Neil Lalonde	2c26998f86	Version bump to v2.3.1	2019-06-25 12:26:20 -04:00
Neil Lalonde	6411810630	Update translations	2019-06-25 11:50:50 -04:00
Sam Saffron	0fa02274c2	DEV: bump version on mini_scheduler ... This corrects a catastrophic state that can ensue if redis becomes readonly It also adds support for multiple queues and minor cleanup	2019-06-25 11:50:19 -04:00
Penar Musaraj	8b963bce37	FIX: Do not refresh all settings on save for all settings, limit to only a few ... - Followup to 0e303c7f5d - Automatically reloads site settings after saving only for the logo, logo_small and large_icon settings.	2019-06-25 11:49:09 -04:00
Penar Musaraj	e1822034dc	FIX: use correct name for selectable_avatars_enabled site setting	2019-06-25 11:48:56 -04:00
Maja Komel	faf059e018	FIX: remove temporary hack for fixed iOS bug (#7773) ... A bug where input focus is displaced on modals was fixed in iOS 11.3 update. This hack was causing problems on topic page since hiding main-outlet results in lost read position after opening and closing a modal.	2019-06-25 11:48:42 -04:00
Joffrey JAFFEUX	f2d5cde24c	FIX: category-chooser search should be scoped to category (#7794)	2019-06-24 11:31:41 +02:00
Neil Lalonde	0bcb62fc2d	Version bump to v2.3.0	2019-06-17 20:47:22 -04:00
Neil Lalonde	04be572a92	Merge diffs from master	2019-06-17 20:07:19 -04:00
Neil Lalonde	a4308fdd43	Merge master	2019-06-17 20:04:04 -04:00
Jeff Wong	893b50031d	replace subfolder on cdn url conversion between general cdn and s3 (#7764) ... When both a cdn URL and an s3 cdn URL defined, subfolder paths were leaking through to the s3 cdn URL. If we are replacing the cdn url with the s3_cdn url, we also need to make sure that the subpath is removed as well, as it appears in the original cdn url. The test should give a fairly good gist of the situations - in subfolder situations where s3_cdn and a cdn is defined: `asset_path` returns the asset with a subfolder, in the form `{cdn_url}/{subfolder}/{asset_path}` Currently this is being replaced to `{s3_cdn_url}/{subfolder}/{asset_path}` I am proposing we change this to: `{s3_cdn_url}/{asset_path}` as it seems like for s3_cdn urls we should not be carrying around app subfolder pathing anywhere we are looking up s3 paths.	2019-06-17 11:51:17 -07:00
Neil Lalonde	dbc59cfe61	Update translations	2019-06-17 13:25:37 -04:00
David Taylor	40cbcc7720	SECURITY: Add confirmation screen when logging in via email link	2019-06-17 18:20:48 +01:00
David Taylor	e6e47f2fb2	SECURITY: Add confirmation screen when logging in via user-api OTP	2019-06-17 16:18:44 +01:00
David Taylor	52387be4a4	SECURITY: Add confirmation screen when logging in via email link	2019-06-17 16:18:37 +01:00
David Taylor	5f6f707080	Revert "Merge pull request from GHSA-hv9p-jfm4-gpr9" ... This reverts commit b8340c6c8e.	2019-06-17 16:17:10 +01:00
David Taylor	b8340c6c8e	Merge pull request from GHSA-hv9p-jfm4-gpr9 ... * SECURITY: Add confirmation screen when logging in via email link * SECURITY: Add confirmation screen when logging in via user-api OTP * FIX: Correct translation key in session controller specs * FIX: Use .email-login class for page	2019-06-17 15:59:41 +01:00
Robin Ward	89e0d8c521	FIX: There is new behavior on a live site, staff are granted access.	2019-06-17 08:17:39 -04:00
Arpit Jalan	863d8014d0	FIX: respond with 400 error on invalid redirect param	2019-06-17 16:44:30 +05:30
Joffrey JAFFEUX	59e84e8e05	DEV: skip tests instead of commenting them (#7774)	2019-06-17 10:24:20 +02:00
Arpit Jalan	102be5a9e3	DEV: optimize fix for sub-categories not getting pre-filled.	2019-06-17 13:28:08 +05:30
tshenry	c909033f2b	Add plugin outlets to login/create-account modals (#7770)	2019-06-17 16:22:00 +10:00
Sam Saffron	10b94e4530	Attempt to get travis to run tests correctly	2019-06-17 16:14:26 +10:00
Sam Saffron	704c579550	FIX: do not allow unbound membership lookups ... Previously we would allow looking up membership limits in an unbound way via the API, this introduces an upper limit of 1000 per page.	2019-06-17 15:32:06 +10:00
Sam Saffron	fe4f0a4369	FIX: staged users should not be included in TL groups ... staged users should not be included in any automatic groups cause for all purposes they do not exist.	2019-06-17 15:10:47 +10:00
Joffrey JAFFEUX	32cd9ba59b	FIX: ensures local-dates modal is not taking full height on mobile (#7772)	2019-06-16 08:48:07 +02:00