3552 Commits

Author	SHA1	Message	Date
Robin Ward	bf9626d031	FIX: Embedding was broken with non-english URLs and ports	2017-02-27 12:17:52 -05:00
Arpit Jalan	877957ae88	Merge pull request #4715 from techAPJ/login-per-ip ... FEATURE: new site setting for max logins per ip per hour/minute	2017-02-27 18:24:53 +05:30
Arpit Jalan	cba51e1c38	FEATURE: new site setting for max logins per ip per hour/minute	2017-02-27 16:58:03 +05:30
jomaxro	f5673fbd47	Remove references to elder ... The use of the TL4 name Elder was changed in 2014 to Leader. The spec function was changed to `:trust_level_4`, but the it statement was not changed.	2017-02-26 17:40:42 -07:00
Sam Saffron	7e8f0dc967	FIX: attempt to handle ios edge case where token is seen but unsaved ... This relaxes our security in the following way - prev auth token is always accepted as long as rotation date is within our window of SiteSetting.maximum_session_age.hours (previously old token expired within a minute of new one being seen) - new auth token is marked unseen if we are presented with an old token after we already saw new one This attempts to fix an issue where ios webkit is not committing new cookies	2017-02-26 17:09:57 -05:00
Régis Hanol	ecdae9f863	FIX: i18n integrity specs ... FIX: check all .yml files in the project for integrity FIX: ensure localized yamls are compatible with english	2017-02-24 11:35:33 +01:00
Régis Hanol	a2c04be718	FIX: eradicate I18n fallback issues 💣 ... FIX: client's translation overrides were not working when the current locale was missing a key FIX: ExtraLocalesController.show was not properly handling multiple translations FIX: JsLocaleHelper#output_locale was not properly handling multiple translations FIX: ExtraLocalesController.show's spec which was randomly failing FIX: JsLocaleHelper#output_locale was muting cached translations hashes REFACTOR: move 'enableVerboseLocalization' to the 'localization' initializer REFACTOR: remove unused I18n.js methods (getFallbacks, localize, parseDate, toTime, strftime, toCurrency, toPercentage) REFACTOR: remove all I18n.pluralizationRules and instead use MessageFormat's pluralization rules TEST: add tests for localization initializer TEST: add tests for I18n.js	2017-02-24 11:31:21 +01:00
Guo Xiang Tan	1060239e2d	SECURITY: Ensure oAuth authenticated email is the same as created user's email.	2017-02-24 13:13:10 +08:00
Guo Xiang Tan	0847b4258a	Revert "SECURITY: Ensure that user has been authenticated." ... This reverts commit fbe51d68a7. Changing the commit message to correctly reflect what we're actually fixing.	2017-02-24 13:12:29 +08:00
Guo Xiang Tan	fbe51d68a7	SECURITY: Ensure that user has been authenticated.	2017-02-24 10:47:48 +08:00
Sam	f15f61da0a	FEATURE: add immutable caching to rails site of things	2017-02-23 13:05:00 -05:00
Sam	ea1007e954	FEATURE: add support for same site cookies ... Defaults to Lax, can be disabled or set to Strict. Strict will only work if you require login and use SSO. Otherwise when clicking on links to your site you will appear logged out till you refresh the page.	2017-02-23 12:01:28 -05:00
Neil Lalonde	0551b3f5ee	FEATURE: replace emoji with unicode in title and description meta tags	2017-02-22 16:24:13 -05:00
Sam Saffron	b7d2edc7dc	FIX: allow some auth token misses prior to clearing cookie ... It appears that in some cases ios queues up requests up front and "releases" them when tab gets focus, this allows for a certain number of cookie misses for this case. Otherwise you get logged off.	2017-02-22 12:37:11 -05:00
Arpit Jalan	213a496203	FIX: show all staff events related to the target user	2017-02-22 13:31:40 +05:30
Arpit Jalan	b32f33b3f0	FIX: allow staff members to send PMs when enable_private_messages is disabled	2017-02-22 11:32:09 +05:30
Neil Lalonde	c94fdcea38	FIX: admin dashboard posts count should not include system posts and whispers	2017-02-21 14:45:41 -05:00
Arpit Jalan	046cbad10b	FEATURE: add a button on admin user page that links to action log	2017-02-21 21:38:37 +05:30
Régis Hanol	f51e3b2131	FIX: should not be able to rename a system badge	2017-02-20 14:35:05 +01:00
Régis Hanol	cb99f59ec3	reset bounce score when email is successfully changed	2017-02-20 10:37:01 +01:00
Robin Ward	e62c0a42fa	FIX: Support multiple embeddable host records with the same host	2017-02-17 12:41:34 -05:00
Sam	7a85469c4c	SECURITY: inactive/suspended accounts should be banned from api ... Also fixes edge cases around users presenting multiple credentials	2017-02-17 11:03:09 -05:00
Neil Lalonde	c0e1722ca6	fix intermittent spec failure due to Time comparison with TimeWithZone	2017-02-17 10:30:29 -05:00
Neil Lalonde	3fb50d587d	FIX: invited users and new TL1 users will see their first notification highlighted	2017-02-17 10:30:29 -05:00
Jeff Atwood	9b263a0559	increase req min unique pw chars from 5 to 6	2017-02-16 17:06:19 -08:00
Neil Lalonde	4b28bfaa15	Merge pull request #4710 from ento/fix-s3-config-check ... FIX: admin dashboard shouldn't complain when using IAM profile for S3 access	2017-02-15 17:02:07 -05:00
Neil Lalonde	d0fbb27f3e	FEATURE: new invite acceptance page, where username can be chosen and password can be set	2017-02-15 16:51:57 -05:00
Sam	74d4209d24	FEATURE: allow plugins to register custom topic list filters	2017-02-15 15:25:43 -05:00
Sam	9c51e3e8e7	amend preloader api to supply topic list	2017-02-15 12:04:02 -05:00
Sam	2c59ffeb2c	FIX: token rotation not accounting for overlapping tokens correctly ... also... freeze_time has no block form, correct all usages and specs	2017-02-15 10:58:18 -05:00
Marica Odagaki	af9c97ec43	Add failing tests	2017-02-15 00:05:58 -08:00
Marica Odagaki	2c1279b740	Fix typo to be more consistent with other test descriptions	2017-02-15 00:04:10 -08:00
Sam	f2099c3811	adjust API	2017-02-14 16:32:33 -05:00
Sam	89d5e8ab4b	FEATURE: allow plugins to preload data in topic list	2017-02-14 16:29:06 -05:00
Sam	8feb94e13f	FIX: password validator was being too strict	2017-02-14 09:18:04 -05:00
Sam	783bac9ff7	less stubbing for better clarity and robustness	2017-02-13 14:34:15 -05:00
Sam	7652901b75	reduce mocking and stubbing in controller spec	2017-02-13 14:31:15 -05:00
Sam	0ab96a7691	FEATURE: add hidden setting for verbose auth token logging ... This is only needed to debug auth token issues, will result in lots of logging	2017-02-13 14:01:09 -05:00
Robin Ward	e1d358ffbf	FIX: Don't clear the login hint when the system user is saved	2017-02-13 10:54:20 -05:00
Jeff Atwood	3ee7a9266c	Merge pull request #4686 from tgxworld/group_is_visible_if_user_is_group_owner ... FIX: Show groups that user is owner of on groups page.	2017-02-11 22:18:44 -08:00
Neil Lalonde	94e1105af7	fix unique char counting in password validator	2017-02-10 10:38:17 -05:00
Sam Saffron	4332f0dde1	FEATURE: allow user search API to restrict to group	2017-02-09 18:45:39 -05:00
Neil Lalonde	1bcb835446	FEATURE: passwords must have a minimum number of unique characters, configurable with a new setting	2017-02-09 15:00:22 -05:00
Robin Ward	9fe4427071	Clean up get_a_room following review	2017-02-08 12:24:26 -05:00
Neil Lalonde	5a8bbe663a	FEATURE: include most popular tag in page title for webcrawlers of tagged uncategorized topics	2017-02-07 16:55:42 -05:00
Sam Saffron	df8f365d99	FEATURE: improve search so it searches sub categories by default ... If you want an exact category match use `category:=howto` or `#=howto"	2017-02-07 15:53:37 -05:00
Régis Hanol	02bb7beaaf	FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled	2017-02-07 18:06:44 +01:00
Sam	49e7124a5e	clarify override semantics in spec	2017-02-07 10:41:27 -05:00
Sam	f34907b523	Merge pull request #4681 from vietqhoang/feature/add-user-title-to-sso-payload ... FEATURE: Add user title to SSO payload	2017-02-07 10:25:32 -05:00
Sam	ff49f72ad9	FEATURE: per client user tokens ... Revamped system for managing authentication tokens. - Every user has 1 token per client (web browser) - Tokens are rotated every 10 minutes New system migrates the old tokens to "legacy" tokens, so users still remain logged on. Also introduces weekly job to expire old auth tokens.	2017-02-07 09:22:16 -05:00