Commit Graph

48562 Commits

Author SHA1 Message Date
David Taylor
b81767c1b1
SECURITY: Limit URL length for theme remote (#20787) 2023-03-23 12:01:04 +00:00
Joffrey JAFFEUX
165a3217c8
Revert "FIX: delay custom section reorder (#20781)" (#20786)
This reverts commit 4fe79ccc79.
2023-03-23 11:27:12 +01:00
Joffrey JAFFEUX
67913e59e0
FIX: relies only on message bus to set tracking state (#20785)
This manual set was happening only after the request so was not much faster than just waiting on message bus update. It's not by itself changing any behavior or fixing any bug but it makes reasoning about the whole state easier as it happens in only one central place.
2023-03-23 11:11:13 +01:00
Alan Guo Xiang Tan
2d46824a87
DEV: Switch to data attributes to represent sidebar section name (#20771)
Data attributes are less restrictive than the class attribute.
2023-03-23 13:09:45 +08:00
Sam
d87e78616d
FEATURE: allow site owners to disable impersonation (#20783)
Site owners can now disable impersonation using the global setting
`allow_impersonation` (Eg: DISCOURSE_ALLOW_IMPERSONATION: false)

see:

https://meta.discourse.org/t/thoughts-about-impersonate-user/258795
2023-03-23 15:16:05 +11:00
Krzysztof Kotlarek
4fe79ccc79
FIX: delay custom section reorder (#20781)
Reorder should start after 300ms.
In addition, pointer events should be blocked to not open link after reorder is finished.
2023-03-23 15:05:36 +11:00
Martin Brennan
5d4c5d959a
FIX: Make sure "last visit" is not shown after marking all messages read (#20782)
Followup to a0381157e9, we just
need to make sure we set currentUserMembership.last_read_message_id
to the last_read_message_id from the updated memberships after marking
all channels read, otherwise we do not scroll to the bottom and still
show the "last visit" separators in channels that have been
marked read.
2023-03-23 13:18:55 +10:00
Jarek Radosz
627f69738f
DEV: Capture output in hashtags spec (#20773) 2023-03-23 11:47:14 +10:00
Alan Guo Xiang Tan
4cb79ce8be
UX: Styling adjustments for filters page (#20768)
Change styling of filter input & remove button.

This follows the same pattern of design we use for search. In the search dropdown we do not have a button to search. We rely on pressing enter. I've also provided an example of Github's PR filter UI at the bottom of this comment.

We also do not have buttons like this on any other topic-list header. On tag and category dropdowns, we also rely on pressing enter to filter the topic list by chosen categories & tags.

Co-authored-by: Jordan Vidrine <jordan@jordanvidrine.com>
2023-03-23 06:28:47 +08:00
Régis Hanol
41ed4cac91
FIX: missing translation for 'reset_bounce_score' staff action log (#20780) 2023-03-22 23:18:46 +01:00
Bianca Nenciu
fb3c610f09
PERF: Optimize topic query for many categories (#20743)
Sites with many categories and many of them in muted by default (see
`default_categories_muted`) reported bad performance when requesting
the homepage as an anonymous user. This was the case because of the
long query that iterated over topics and categories trying to remove
those from the muted categories.
2023-03-22 23:31:33 +02:00
Mark VanLandingham
32aa821f12
DEV: Add preload API to CategoryList (#20778) 2023-03-22 15:12:08 -05:00
Bianca Nenciu
f12e77d500
FIX: Do not allow anonymous users to be anonymized (#20776) 2023-03-22 20:51:42 +02:00
David Taylor
7070f81596
DEV: Allow DROP NOT NULL in pre-deploy migrations (#20775)
Our SafeMigrate system is designed to prevent tables/columns being dropped in pre-deploy migrations. Its regex-based detection was triggering incorrectly on `ALTER COLUMN DROP NOT NULL`.
2023-03-22 14:43:32 +00:00
David Taylor
a0140f6f75
DEV: Introduce regex_timeout_seconds global setting (#20774)
This is introduced as `nil` by default. We intend to set a sensible default once we have performed some real-world testing.
2023-03-22 12:01:35 +00:00
Discourse Translator Bot
6406d8e4cb
Update translations (#20760) 2023-03-22 12:13:36 +01:00
dependabot[bot]
16b0db77b5
Build(deps): Bump webpack in /app/assets/javascripts (#20695)
Bumps [webpack](https://github.com/webpack/webpack) from 5.76.1 to 5.76.2.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](https://github.com/webpack/webpack/compare/v5.76.1...v5.76.2)

---
updated-dependencies:
- dependency-name: webpack
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-22 11:59:35 +01:00
dependabot[bot]
8aead86957
Build(deps): Bump sass-embedded from 1.59.2 to 1.59.3 (#20694)
Bumps [sass-embedded](https://github.com/ntkme/sass-embedded-host-ruby) from 1.59.2 to 1.59.3.
- [Release notes](https://github.com/ntkme/sass-embedded-host-ruby/releases)
- [Commits](https://github.com/ntkme/sass-embedded-host-ruby/compare/v1.59.2...v1.59.3)

---
updated-dependencies:
- dependency-name: sass-embedded
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-22 11:58:30 +01:00
Martin Brennan
a0381157e9
FEATURE: Mark all chat channels read with a shortcut (#20629)
This commit adds a keyboard shortcut (Shift+ESC) for chat which marks all
of the chat channels that the user is currently a following member of as read,
updating their `last_read_message_id`. This is done via a new service.

It also includes some refactors and controller changes:

* The old mark message read route from `ChatController` is now supplanted
  by the `Chat::Api::ReadsController#update` route.
* The new controller can handle either marking a single or all messages read,
  and uses the correct service based on the route and params.
* The `UpdateUserLastRead` service is now used (it wasn't before), and has been slightly
  updated to just use the guardian user ID.
2023-03-22 13:24:07 +10:00
Martin Brennan
786f7503b4
DEV: Skip channel-wide mention chat specs (#20770)
These were added in 7dd317b875
but are now consistently failing with described_class.chat_summary(user, {})
returning nil. Skipping for now because they are holding up other
things.

To reproduce failure run:

RSPEC_SEED=46586 bundle exec rake plugin:spec
2023-03-22 12:44:01 +10:00
Krzysztof Kotlarek
3eaf48aa37
FIX: disable reorder links on touch screens (#20769)
This feature causes troubles on touch screens like phones and tablets. Right now, we would like to limit it to mouse and touchpads.

/t/94351
2023-03-22 13:34:19 +11:00
Alan Guo Xiang Tan
b06e31f8e7
DEV: Remove experimental support for query string on /filter route (#20632) 2023-03-22 10:04:57 +08:00
Martin Brennan
520d4f504b
FEATURE: Auto-remove users without permission from channel (#20344)
There are many situations that may cause users to lose permission to
send messages in a chat channel. Until now we have relied on security
checks in `Chat::ChatChannelFetcher` to remove channels which the
user may have a `UserChatChannelMembership` record for but which
they do not have access to.

This commit takes a more proactive approach. Now any of these following
`DiscourseEvent` triggers may cause `UserChatChannelMembership`
records to be deleted:

* `category_updated` - Permissions of the category changed
   (i.e. CategoryGroup records changed)
* `user_removed_from_group` - Means the user may not be able to access the
   channel based on `GroupUser` or also `chat_allowed_groups`
* `site_setting_changed` - The `chat_allowed_groups` was updated, some
   users may no longer be in groups that can access chat.
* `group_destroyed` - Means the user may not be able to access the
   channel based on `GroupUser` or also `chat_allowed_groups`

All of these are handled in a distinct service run in a background
job. Users removed are logged via `StaffActionLog` and then we
publish messages on a per-channel basis to users who had their
memberships deleted.

When the user has a channel they are kicked from open, we show
a dialog saying "You no longer have access to this channel".

When they click OK we redirect them either:

* To their first other public channel, if they have any followed
* The chat browse page if they don't

This is to save on tons of requests from kicked out users getting messages
from other channels.

When the user does not have the kicked channel open, we can just
silently yoink it out of their sidebar and turn off subscriptions.
2023-03-22 10:19:59 +10:00
Joffrey JAFFEUX
b5c4e1b813
FIX: do not refresh metadata of not followed channel (#20766) 2023-03-21 20:13:44 +01:00
Kris
d4c6511d31
UX: improve directory user fields on small screens (#20765) 2023-03-21 14:09:02 -04:00
Kris
1ed70d17ed
UX: allow profile menu tabs to scroll if needed (#20619) 2023-03-21 13:49:19 -04:00
Daniel Waterworth
7b01576c8d
DEV: Remove emoji cache dead code (#20764)
The cache is already not shared between app servers that have different
app_versions, so this check was redundant.
2023-03-21 12:33:12 -05:00
Daniel Waterworth
a0a6f6d71b
FIX: Fix the emoji toned regexes (#20763) 2023-03-21 11:48:55 -05:00
Andrei Prigorshnev
0562f952ed
DEV: no need to pass down skip_notifications for expanding mentions (#20683)
This refactoring simplifies ChatNotifier a bit. I wanted to drop 
that argument for expand_direct_mentions too, but that needs 
a bit deeper refactoring, so it's better to do it separately.

Co-authored-by: Joffrey JAFFEUX <j.jaffeux@gmail.com>
2023-03-21 19:44:24 +04:00
dependabot[bot]
0231e2332d
Build(deps-dev): Bump syntax_tree from 6.0.2 to 6.1.1 (#20762) 2023-03-21 16:40:56 +01:00
dependabot[bot]
a613bed47d
Build(deps): Bump stackprof from 0.2.23 to 0.2.24 (#20752)
Bumps [stackprof](https://github.com/tmm1/stackprof) from 0.2.23 to 0.2.24.
- [Release notes](https://github.com/tmm1/stackprof/releases)
- [Changelog](https://github.com/tmm1/stackprof/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tmm1/stackprof/compare/v0.2.23...v0.2.24)

---
updated-dependencies:
- dependency-name: stackprof
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-21 16:08:19 +01:00
Kris
147941a5d7
UX: update chat icon to d-chat (#20744) 2023-03-21 10:40:42 -04:00
Kris
5d03ddfbc8
UX: clarify descriptions for watched words, style (#20678) 2023-03-21 10:40:26 -04:00
Régis Hanol
37609897e8
FEATURE: log manual bounce reset (#20758)
DEV: rename the route "/admin/users/:id/reset_bounce_score" to use dashes instead of underscores
2023-03-21 15:26:26 +01:00
Joffrey JAFFEUX
7ccc7b75b2
FIX: ensures user with multiple tabs see own reactions (#20759)
Prior to this fix, we wouldn't display reactions done on different tabs. So, if user A was reacting on tab 1, tab 2 wouldn't display this reaction.

Since few weeks ago we now have the guarantee to have uniq reactions on a message which should prevent any duplicate.

This commit also removes various skipped tests related to reactions and makes `sign_in` explicit at the beginning of each test.

<!-- NOTE: All pull requests should have tests (rspec in Ruby, qunit in JavaScript). If your code does not include test coverage, please include an explanation of why it was omitted. -->
2023-03-21 15:25:35 +01:00
Joffrey JAFFEUX
92797109ba
DEV: uses container resize event instead of mutation (#20757)
This commit takes advantage of the `ResizeObserver` to know when dates should be re-computed, it works like this:

```
scrollable-div
--  child-enclosing-div with resize observer
---- message 1
---- message 2
---- message x
```

It also switches to bottom/height for date separators sizing, instead of bottom/top, it prevents a bug where setting the top of the first item (at the top) would cause scrollbar to move to top.

<!-- NOTE: All pull requests should have tests (rspec in Ruby, qunit in JavaScript). If your code does not include test coverage, please include an explanation of why it was omitted. -->
2023-03-21 11:30:32 +01:00
Martin Brennan
0a06974a8a
DEV: Rough chat message loading and posting in thread (#20579)
This commit does a couple of things:

* Adds the ability to load messages in the chat thread panel when it is open. This just loads the most recent N messages, same as a channel, and does nothing more, no scrolling or anything like that.
* Displays the messages in an extremely simple unordered list with no additional features.
* Allows posting new messages to the thread, and echoes them into the main channel, but does not respond to any sort of MessageBus events.

I've moved messages/clearMessages/addMessages/findMessage code out of the `ChatChannel` model
and into a new `ChatMessagesManager` class, which is instantiated in both the `ChatChannel` model
and the `ChatThread` model. This allows both to manage messages in the same way via the
`TrackedArray` pattern.

This is all hidden behind experimental flags, there is no way to make this not completely broken
in a single commit. Much more work and refactoring needs to be done first.

Co-authored-by: Joffrey JAFFEUX <j.jaffeux@gmail.com>
2023-03-21 15:29:10 +10:00
Krzysztof Kotlarek
1859025228
FIX: my links in sidebar section (#20754)
Links like `/my/preferences` were invalid in custom section. The reason is that `/my` links are just redirects from backend, and they are not recognized as valid Ember paths.

https://github.com/discourse/discourse/blob/main/config/routes.rb#L433

Therefore, regex match allowlist was added - similar to backend check:

https://github.com/discourse/discourse/blob/main/app/controllers/users_controller.rb#L471

/safe-mode is same case
2023-03-21 15:58:42 +11:00
Penar Musaraj
ae939f4111
UX: Fix menu panel padding on non-safe-area contexts (#20746)
Followup to 32ad46c. Only picks the `safe-area-inset-bottom` if it is
greater than the default padding value for the element.
2023-03-20 21:46:13 -04:00
Krzysztof Kotlarek
db74e9484b
FEATURE: ability to reorder links in custom sidebar sections (#20626)
Drag and drop to reorder custom sidebar sections
2023-03-21 12:23:28 +11:00
Joffrey JAFFEUX
53cadac4b8
UX: disables composer auto focus on drawer (#20751)
This behavior was interfering with topics shortcuts.
2023-03-20 22:24:12 +01:00
David Taylor
d5c7b9f8df
FIX: Badge granting recursion error (#20750)
Moving the `grantBadge` action out of the actions hash caused it to clash with a method of the same name from the GrantBadgeController mixin. This commit renames the action.
2023-03-20 21:07:21 +00:00
Joffrey JAFFEUX
c37dd63ac3
DEV: fixes linting (#20748)
Followup to 54eaae4326
2023-03-20 20:59:27 +00:00
Dominik Schlipper
54eaae4326
FIX: replace unitless 0 in CSS calc() with '0px' (#20689)
Using the unitless number 0 in CSS calc() functions is recognized as invalid (tested in Chrome 110 & Firefox 111).
In this code, this would disable the style definition for the 'height' property when one of the custom properties is undefined and the fallback '0' is used.
For more insight on this topic. see https://stackoverflow.com/questions/55406001/why-doesnt-css-calc-work-when-using-0-inside-the-equation
2023-03-20 16:06:49 -04:00
Blake Erickson
62e7c72126
DEV: Generate video thumbnails from the File object instead of the DOM (#20696)
In order to avoid built in browser CORS issues and sites that are using
CDNs this change allows us to generate thumbnail images from videos
directly from the File uploaded instead of reading the already uploaded
file via the `video` tag.

Follow-up to: f144c64e13
2023-03-20 13:40:14 -06:00
Penar Musaraj
5b0d300b8a
DEV: Set containing block for Popper dropdowns (#20745)
Popper dropdowns used `position: fixed` or `position: absolute`. But in
tables, we want the content to use auto overflow horizontally, and that
causes the dropdowns to be hidden vertically in some scenarios.

Setting a containing block on the parent container fixes both placement
and overflow issues.
2023-03-20 15:26:20 -04:00
Isaac Janzen
ca4b73d20c
FIX: Support tag query param on /tag/{name} routes (#20742) 2023-03-20 13:51:39 -05:00
Penar Musaraj
f0569db49d
UX: Some very minor WCAG scheme fixes (#20726) 2023-03-20 13:23:10 -04:00
Daniel Waterworth
da0d20d4a9
DEV: Refactor svg sprite parsing (#20727)
There was a lot of duplication in the svg parsing and coercion code. This reduces that duplication and causes svg sprite parsing to happen earlier so that more computation is cached.
2023-03-20 11:41:23 -05:00
Bianca Nenciu
fa96569ef2
FIX: Do not show user tips over composer (#20708) 2023-03-20 18:17:04 +02:00