github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-15 23:33:57 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
20,126 Commits 214 Branches 500 Tags 960 MiB
c10dfe0d1b
Commit Graph

3157 Commits

Author SHA1 Message Date
Sam
c10dfe0d1b SECURITY: prevent reuse of password reset 2016-12-19 18:04:55 +11:00
Sam
402f06de27 SECURITY: protect upload params, only allow very strict filenames 2016-12-19 10:18:32 +11:00
Guo Xiang Tan
2bce183581 FIX: User enabled readonly mode was not working. 2016-10-25 11:50:51 +08:00
Guo Xiang Tan
2c86c202e5 FIX: Randomly failing specs try 2. 2016-09-23 15:05:03 +08:00
cpradio
69691fa7a6 FIX: Backup validation wasn't escaping hyphens 
Conflicts:
	spec/controllers/admin/backups_controller_spec.rb
 2016-09-19 08:53:54 +08:00
Guo Xiang Tan
82fe884a7f SECURITY: Add filename validation for backup uploads. 2016-09-16 12:50:59 +08:00
Guo Xiang Tan
adb1e2cbc8 SECURITY: Escape HTML in filename. 2016-08-11 13:48:23 +08:00
Régis Hanol
6d2a687ec7 FIX: wasn't able to update category's settings 2016-08-09 23:57:50 +02:00
Sam
0b5c3f5a03 SECURITY: do cookie auth rate limiting earlier 2016-08-09 10:04:49 +10:00
Neil Lalonde
2499b56594 Merge master 2016-08-05 15:13:33 -04:00
Robin Ward
b17908fab1 SECURITY: XSS issue on Admin users list 2016-08-05 12:48:33 -04:00
Robin Ward
a139e469a7 SECURITY: Avoid mass assignment on user create 2016-08-05 12:43:50 -04:00
Robin Ward
3d62e5dd98 SECURITY: XSS issue on Admin users list 2016-08-05 12:01:16 -04:00
Robin Ward
429f27ec96 SECURITY: Avoid mass assignment on user create 2016-08-05 11:57:13 -04:00
Régis Hanol
d0962d6e5a FIX: serve category images from the CDN 2016-08-05 13:03:49 +02:00
Robin Ward
e5b529f8e1 FIX: Couldn't move posts with deleted replies 2016-08-04 11:56:01 -04:00
Neil Lalonde
f10c4682cd FIX: muted tags showing in latest topic list 2016-08-04 11:54:48 -04:00
Neil Lalonde
5f67cd7b45 FIX: tag input detects when a tag is not allowed and won't offer to create it anyway 2016-08-03 13:18:56 -04:00
Régis Hanol
b08ab829b8 added 'X-Auto-Response-Suppress' email header (props to elijah) 2016-08-03 11:02:07 +02:00
Robin Ward
f4c8070d09 FIX: Couldn't update category notification level 2016-08-02 11:22:02 -04:00
Guo Xiang Tan
bf683178a8 FIX: Remove tag plugin code from tag hashtag check. 2016-08-02 10:59:12 +08:00
Régis Hanol
681f566a66 FIX: staff members should be able to see raw email of deleted posts 2016-08-01 23:55:22 +02:00
Régis Hanol
829143bf88 FIX: 'List-Unsubscribe' header wasn't added to emails sent when mailing_list_mode was enabled 2016-08-01 20:19:00 +02:00
Régis Hanol
c591429868 FIX: don't destroy uploads in queued posts and drafts 2016-08-01 18:35:57 +02:00
Sam
9018de39ed FEATURE: allow shipping bio markdown via SSO 
- Also adds site setting for sso_overrides_bio to disable bio editing by end users
 2016-08-01 15:29:28 +10:00
Neil Lalonde
82e170d6a6 FIX: 404 when filtering by category, no sub-category, and a tag 2016-07-28 16:19:03 -04:00
Robin Ward
5d062206db SECURITY: Make sure uploaded_urls have corresponding upload records 2016-07-28 15:41:03 -04:00
Robin Ward
f416634ea0 SECURITY: Cross-Site Scripting in Category and Group Settings 2016-07-28 15:30:53 -04:00
Robin Ward
80834df757 SECURITY: SQL Injection in Admin List Active Users 2016-07-28 15:29:16 -04:00
Robin Ward
90a3cc7f18 SECURITY: XSS in "Account Suspended" Messages and Badge Descriptions 2016-07-28 15:29:05 -04:00
Robin Ward
2891f230d1 SECURITY: Make sure uploaded_urls have corresponding upload records 2016-07-28 13:54:17 -04:00
Robin Ward
cf5b756b1a SECURITY: Cross-Site Scripting in Category and Group Settings 2016-07-28 11:57:59 -04:00
Robin Ward
dc1a830d3d SECURITY: SQL Injection in Admin List Active Users 2016-07-28 11:42:06 -04:00
Robin Ward
2f8ab8cd30 SECURITY: XSS in "Account Suspended" Messages and Badge Descriptions 2016-07-28 11:38:12 -04:00
Sam
16a383ea1e SECURITY: limit bad cookie auth attempts 
- Also cleans up the _t cookie if it is invalid
 2016-07-28 12:58:49 +10:00
Sam
ab68e0c9db FEATURE: allow "developer" account flagging via developers table 
This mechanism for flagging developer accounts will eventually replace
DISCOURSE_DEVELOPER_EMAILS
 2016-07-28 10:14:06 +10:00
Sam
f319923753 SECURITY: limit route access when using external avatars 2016-07-28 09:04:32 +10:00
Sam
c6dbaca0dc SECURITY: disable user entered badge SQL by default 
- Hidden site settings now must be change via rails console
 2016-07-28 09:03:00 +10:00
Sam
cb3afd11b4 SECURITY: limit route access when using external avatars 2016-07-28 09:00:43 +10:00
Andre Pereira
8cbd585e20 FEATURE: Allow staff users to merge posts. 2016-07-27 12:04:14 +08:00
Robin Ward
2a4006fe0c Add YandexBot to our list of crawlers 2016-07-26 13:21:37 -04:00
Sam
b5fbff947b FIX: don't expire old sessions when logging in 2016-07-26 11:37:41 +10:00
Jeff Atwood
1379bd5053 fix all v=2 spec / test errors for emoji 2016-07-25 15:53:48 -07:00
Sam
12ecf8624a FIX: tokenize words with dots correctly 
hello.world is now tokenized as "hello.world" and "world" that way the word
"world" will find the post with "hello.world"
 2016-07-25 16:26:33 +10:00
Sam
e01802a13b FIX: strip quote from search term when searching within topic 2016-07-25 15:06:25 +10:00
Sam
df535c6346 FEATURE: refresh session cookie at most once an hour 
This feature ensures session cookie lifespan is extended
when user is online.

Also decreases session timeout from 90 to 60 days.
Ensures all users (including logged on ones) get expiring sessions.
 2016-07-25 12:07:31 +10:00
Sam
12dc511fea PERF: make score calculator cheaper when site has long topics 2016-07-22 09:48:44 +10:00
Robin Ward
c279889191 FIX: Watching First Post in groups was working incorrectly 2016-07-21 15:05:10 -04:00
Neil Lalonde
7c092b0fe0 FEATURE: add filter to show topics that have not been tagged 2016-07-20 16:21:51 -04:00
Robin Ward
09be741820 FIX: Don't alert on new posts in a topic unless it's a new record 2016-07-19 15:57:05 -04:00