Commit Graph

24742 Commits

Author SHA1 Message Date
Alan Guo Xiang Tan
c6ef6632c6 SECURITY: User's read state for topic is leaked to unauthorized clients.
A user's read state for a topic such as the last read post number and the notification level is exposed.
2021-08-12 12:44:39 +08:00
jbrw
d11b6751bb
SECURITY: Destroy EmailToken when EmailChangeRequest is destroyed (#13950) 2021-08-06 19:27:09 -04:00
Bianca Nenciu
4c748f7f54 SECURITY: Sanitize d-popover attributes (#13958) 2021-08-05 16:40:48 +03:00
Robin Ward
db826335e9
DEV: Add support for class properties in babel (#13189)
This allows us to start using JS classes instead of Ember's classes.
2021-06-09 13:53:43 -04:00
Régis Hanol
98f92d2e23 SECURITY: XSS in bookmarks list (#13311)
We should use `fancy_title` instead of `title` when displaying a topic title to ensure only the allowed html is not escaped.
2021-06-07 16:59:12 +02:00
Sam
5db39cce93
UX: unconditionally focus modals (#13179)
Previously auto focus would only work on modals that include buttons or
inputs.

To avoid a situation where information modals such as keyboard shortcuts
do not get focus, simply focus on the close button as a fallback.
2021-06-04 10:35:12 -04:00
Robin Ward
45dca791b0
UX: Add auto focus to hamburger and user menu dropdowns (#13165) 2021-06-04 10:35:04 -04:00
Sam
22e9acc797
UX: Improve navigation on topic lists for screen readers (#13153)
Previously we had no role set for various topic links, nor did we have any
headers.

This teaches screen readers that topic links in topic lists are to be treated
as H2. We opted for this less radical change cause a change of the element
type would probably result in many broken themes.

Confirmed on NVDA you can very quickly breeze through topic lists now. Minor
edge case is pinned topics which can be a bit annoying due to multiple links.
2021-06-04 10:34:40 -04:00
Sam
d444a8a400
UX: provide a region for various topic actions (#13152)
This makes it much easier to reply to topics / bookmark topics and so on

Previously topic buttons had no region
2021-06-04 10:34:31 -04:00
Robin Ward
16e1ea938c
FIX: Better focus support for modals (#13147) 2021-06-04 10:34:20 -04:00
Sam
873eb405cd
UX: add ARIA region role to posts (#13130)
NVDA does not detect HTML5 articles as regions. This explicitly sets a
region with an aria-label denoting post numbers making it much easier to
know where you are in a topic.

Note role: article which is more semantically correct is not respected by
NVDA d/D shortcut, hence the much more generic "region" role.
2021-06-04 10:34:13 -04:00
Kris
8e0a669aa5
A11Y: Fix post control and user-menu focus styles (#13118) 2021-06-04 10:34:05 -04:00
Kris
bb59e4ca61
UX: Fix theme upload width, remove class clash, prettier (#13071)
* UX: fix width & theme upload modal class clash

* remove unneeded class

* unprettier hbs

* add back unicode emoji

* add newline
2021-06-04 10:33:49 -04:00
Penar Musaraj
7d06980cc5
SECURITY: Do not allow unauthorized access to category edit UI (#13252) 2021-06-03 14:35:27 -04:00
Penar Musaraj
5f5301d478
FIX: Close hyperlink modal on ESC key (#13166) 2021-06-03 14:35:00 -04:00
Joffrey JAFFEUX
c78f32a9a1
FIX: removes legacy Ember.keys usage causing a crash (#13085)
The crash:

```
Uncaught TypeError: Ember.keys is not a function
```

Repro:

- visit home page
- click new topic
- navigate to your messages by clicking your avatar (top right), then enveloppe icon, and finally the bottom chevron
- click New Message
- click cancel in the composer, it should crash
2021-05-18 12:23:41 +02:00
Bianca Nenciu
c1dfd76658
FIX: Make replace watched words work with wildcard (#13084)
Watched words are always regular expressions, despite watched_words_
_regular_expressions being enabled or not. Internally, wildcard
characters are replaced with a regular expression that matches any non
whitespace character.
2021-05-18 12:09:47 +03:00
Robin Ward
a21700a444
FIX: Previewing themes didn't work in Ember CLI (#13078)
This is two fixes:

1. Ember CLI's proxy did not support 3xx redirects so a redirect was
   failing.

2. We were not passing query parameters to the `bootstrap.json` endpoint
   to correctly handle previewing themes (and other occasional options.)
2021-05-17 14:51:36 -04:00
Roman Rizzi
8801a27cc6
FIX: Automatically load more reviewable items. (#13069)
If you finished reviewing the initially loaded items, and there're more in the queue, load them.

Also, when fast-tracking the pending items updates, use the reviewable_count returned by the perform result. Calling "result.reviewable_count" returns undefines.
2021-05-14 15:06:34 -03:00
Robin Ward
32d6d8308c
FIX: Allow file-change events soon after reloading (#13065)
This patch remembers the last id for the `file-change` event and uses it
to initialize the client side watcher. This should help fix the issue
where styles are not reloaded client side if the browser refreshed.
2021-05-14 12:36:53 -04:00
Bianca Nenciu
c0679022e7
FIX: Skip upload if HTML cannot be parsed (#12971) 2021-05-14 16:52:40 +03:00
Bianca Nenciu
3a1b05f219
FIX: Make autotag watched words case insensitive (#13043)
* FIX: Hide tag watched words if tagging is disabled

These 'autotag' words were shown even if tagging was disabled.

* FIX: Make autotag watched words case insensitive

This commit also fixes the bug when no tag was applied if no other tag
was already present.
2021-05-14 16:52:10 +03:00
Dan Ungureanu
d903d4dc5a
DEV: Periodically delete old email change requests (#13054)
Email change requests are never deleted no matter if they completed
successfully or not. The abandoned requests have the disadvantage of
showing up as unconfirmed emails in user's preferences page.
2021-05-14 10:34:56 +03:00
Martin Brennan
38742bc208
FIX: Wrong scope used for notification levels user serializer (#13039)
This is a recent regression introduced by https://github.com/discourse/discourse/pull/12937 which makes it so that when looking at a user profile that is not your own, specifically the category and tag notification settings, you would see your own settings instead of the target user. This is only a problem for admins because regular users cannot see these details for other users.

The issue was that we were using `scope` in the serializer, which refers to the current user, rather than using a scope for the target user via `Guardian.new(user)`.

However, on further inspection the `notification_levels_for` method for `TagUser` and `CategoryUser` did not actually need to be accepting an instance of Guardian, all that it was using it for was to check guardian.anonymous? which is just a fancy way of saying user.blank?. Changed this method to just accept a user instead and send the user in from the serializer.
2021-05-14 09:45:14 +10:00
Dan Ungureanu
034a0493e3
FIX: Delete unconfirmed emails first if available (#13046)
Users can end up with the same email both as secondary and unconfirmed.
When they tried to delete the unconfirmed ones, the secondary one was
deleted.
2021-05-13 16:14:00 +10:00
Martin Brennan
3d2cace94f
DEV: Add service to validate email settings (#13021)
We have a few places in the code where we need to validate various email related settings, and will have another soon with the improved group email settings UI. This PR introduces a class which can validate POP3, IMAP, and SMTP credentials and also provide a friendly error message for issues if they must be presented to an end user.

This PR does not change any existing code to use the new service. I have added a TODO to change POP3 validation and the email test rake task to use the new validator post-release.
2021-05-13 15:11:23 +10:00
Jarek Radosz
582ec198d8
DEV: Update ember-cli across all in-repo addons (#13048)
…to match the version used in the app.
2021-05-12 21:49:55 +02:00
Robin Ward
3d7abad949
FIX: We should include resumable.js in the admin bundle (#13049)
Normally we'd use `ember-auto-import` for this, but it's not run on
our admin tree due to the quirky way we load it conditionally.
Instead we'll append it at the bottom like our Rails app does.
2021-05-12 13:44:24 -04:00
Jarek Radosz
f08f6118f2
FIX: Make truth-helpers work in Ember CLI (#13044)
The addon wasn't included at all 😃
2021-05-12 17:52:36 +02:00
Jarek Radosz
b24270845f
DEV: Update chart.js from 2.9.3 to 2.9.4 (#13026)
Release notes: https://github.com/chartjs/Chart.js/releases/tag/v2.9.4
2021-05-12 17:28:16 +02:00
zacholas
e8d0c122e3
added a plugin outlet for above the discovery list controls (#13042) 2021-05-12 11:21:32 -04:00
Penar Musaraj
b0d66b4b2f
FIX: Support pausing inline animated images (#13033) 2021-05-12 09:49:04 -04:00
Penar Musaraj
f9bb6399e0
DEV: Remove SCSS color vars fallbacks (#13035)
They are no longer needed.
2021-05-12 08:56:15 -04:00
Dan Ungureanu
60be1556fc
FIX: Various invite system fixes (#13003)
* FIX: Ensure the same email cannot be invited twice

When creating a new invite with a duplicated email, the old invite will
be updated and returned. When updating an invite with a duplicated email
address, an error will be returned.

* FIX: not Ember helper does not exist

* FIX: Sync can_invite_to_forum? and can_invite_to?

The two methods should perform the same basic set of checks, such as
check must_approve_users site setting.

Ideally, one of the methods would call the other one or be merged and
that will happen in the future.

* FIX: Show invite to group if user is group owner
2021-05-12 13:06:39 +03:00
Rafael dos Santos Silva
63ca9e0650
DEV: Add cleanup methods for composer extension hooks that tests can use (#13034) 2021-05-11 17:29:24 -03:00
Rafael dos Santos Silva
2f60309b13
FEATURE: New API hook to allow for client side upload transforms (#12990) 2021-05-11 12:20:28 -03:00
Penar Musaraj
033a1fb2af
DEV: Minor changes to /theme-qunit landing page (#13032) 2021-05-11 10:45:07 -04:00
Osama Sayegh
cf6b823a2d
DEV: Load plugins in theme tests (#13028)
Some themes/components depend on plugins, and it would be impossible to write tests for those themes without installing/loading the plugins they depend on.
2021-05-11 17:38:50 +03:00
Penar Musaraj
e8f6e00dc9
DEV: Show warning in admin UI for core SCSS color vars (#12984)
Co-authored-by: Jarek Radosz <jradosz@gmail.com>
2021-05-11 09:01:06 -04:00
Andrei Prigorshnev
0a4cb65020
DEV: Fix some deprecation warnings in tests
- Import `exists()` instead of using the global function (#13010)
2021-05-11 14:04:33 +04:00
Osama Sayegh
9ec5f39764
DEV: Clear NavItem.customNavItemHrefs between tests (#13025)
Identical callbacks can pile up during tests and cause all sort of weird problems that are difficult to debug. This commit clears registered callbacks after each test.
2021-05-11 12:54:37 +03:00
Jarek Radosz
a7a2887df0
DEV: Remove unnecessary yarn.lock files (#13001)
All in-repo ember addons share the same yarn.lock in the yarn workspace: `/app/assets/javascripts/yarn.lock`
2021-05-11 11:15:07 +02:00
Joffrey JAFFEUX
81bf581aa9
DEV: rescues site setting missing exception (#13022)
This will allow to correctly catch it client side and display a correct error.
2021-05-11 10:36:57 +02:00
Blake Erickson
37812b8e35
Revert "DEV: Drop old IE11 intersection-observer references" (#13017)
This reverts commit 7360a0f70f.

iOS still wants this sometimes. Probably best to revert for now and we can
always remove this again later.

See: https://meta.discourse.org/t/189799/11?u=blake
2021-05-10 17:47:09 -06:00
Blake Erickson
ee880c4c89
DEV: Extract out compound conditional (#13008) 2021-05-10 11:11:51 -06:00
Roman Rizzi
d4b5a81b05
FIX: Recalculate scores only when approving or transitioning to pending. (#13009)
Recalculating a ReviewableFlaggedPost's score after rejecting or ignoring it sets the score as 0, which means that we can't find them after reviewing. They don't surpass the minimum priority threshold and are hidden.

Additionally, we only want to use agreed flags when calculating the different priority thresholds.
2021-05-10 14:09:04 -03:00
Jeff Wong
d61573fb1b
FIX: ember-cli proxy subfolder fix (#12996)
* FIX: ember-cli proxy subfolder fix

* REFACTOR: put rootURL setup in environment, update baseURL logic for subfolder

Correctly have ember understand and parse relative_url_root and use it in
the dev server
2021-05-10 10:02:33 -07:00
Penar Musaraj
81616fbdc4
DEV: Fix flaky d-editor test (#13005) 2021-05-10 13:00:18 -04:00
Hariraj Venkatesan
c473cde997
FIX: check trust level of user creating invite for group (#12993) 2021-05-10 12:47:32 -04:00
Martin Brennan
c187ede3c6
FIX: Catch UndefinedConversionError for inbound emails (#13000)
Some emails coming in via the mail receiver can still end up
with bad encoding when trying to enqueue the job. This catches
the last encoding issue and forces iso-8559-1 and encodes to
UTF-8 to circumvent the issue.
2021-05-10 14:26:23 +10:00