Commit Graph

53900 Commits

Author SHA1 Message Date
Blake Erickson
c90488b917
FIX: Add a boarder around the video placeholder play button (#25727)
The video placeholder play button is white, so on a video placeholder
that is also white it is very hard to see where the play button is, so
this change adds a dark grey transparent background to the play button
so that it stands out. This is similar to how we have done the
play/pause button on animated gifs.
2024-03-15 16:01:43 +08:00
Penar Musaraj
457c2bf5bb
FIX: Handle old Firefox versions that do not support isConditionalMediationAvailable (#25549)
Some versions of Firefox will throw a TypeError when calling
PublicKeyCredential.isConditionalMediationAvailable() because the
method does not exist. That would previously lead to a "Sorry, an error
has occurred." modal when trying to login.

This commit fixes the issue by properly checking if the method exists.
Since it only affects older Firefox versions, no tests are added.
2024-03-15 16:01:27 +08:00
Neil Lalonde
798068b2a3
FIX: missing translation of guidelines_topic.body (#25505)
Broken in https://github.com/discourse/discourse/pull/25253
2024-03-15 15:59:17 +08:00
Nat
d41529c811
Bump version to v3.2.1 2024-03-15 15:27:07 +08:00
Penar Musaraj
bcc556b956
SECURITY: Limit invites params length 2024-03-15 14:37:28 +08:00
Alan Guo Xiang Tan
c41755bd69
SECURITY: Add rate limits for uploads 2024-03-15 14:37:23 +08:00
Bianca Nenciu
5a0851d8ac
SECURITY: Generate more category CSS on client
This commit moves the generation of category background CSS from the
server side to the client side. This simplifies the server side code
because it does not need to check which categories are visible to the
current user.
2024-03-15 14:37:19 +08:00
Daniel Waterworth
e9a8c059ec
SECURITY: Prevent large staff actions causing DoS
This commit operates at three levels of abstraction:

 1. We want to prevent user history rows from being unbounded in size.
    This commit adds rails validations to limit the sizes of columns on
    user_histories,

 2. However, we don't want to prevent certain actions from being
    completed if these columns are too long. In those cases, we truncate
    the values that are given and store the truncated versions,

 3. For endpoints that perform staff actions, we can further control
    what is permitted by explicitly validating the params that are given
    before attempting the action,
2024-03-15 14:37:15 +08:00
Daniel Waterworth
1f2ded8e8d
SECURITY: Don't disclose the existence of secret subcategories 2024-03-15 14:37:11 +08:00
Discourse Translator Bot
9f85bf559a
Update translations (#26137) 2024-03-12 15:40:16 +01:00
Jarek Radosz
99fe9ddd40 UX: Fix the video spinner css (#25770)
A followup to 62e36145c5
2024-03-06 14:36:50 -07:00
Jarek Radosz
8f643dc1b8 UX: Tweak play button css (#25754)
* Remove unnecessary properties
* Use rem unit
* Add a drop shadow
* Make the "box shadow" slightly more subtle
* Use --d-border-radius
* Don't scale the "box shadow" on hover
* Scale down the on-hover size
* Make the button slightly larger
* Respect prefers-reduced-motion
* Use white rather than --secondary-or-primary
* Don't animate on-hover on mobile
2024-03-06 14:36:50 -07:00
Blake Erickson
cda09483de FIX: Set the video background to be black (#25744)
If you upload a portrait video or just a video that doesn't fit in the
normal video dimensions we want it to have a black background instead of
trying to render parts of the placeholder image as the video background.

This change removes the placeholder image for the video background when
the play button is clicked and replaces it with an all black background.
2024-03-06 14:36:50 -07:00
Blake Erickson
0003599754 FIX: Add a boarder around the video placeholder play button (#25727)
The video placeholder play button is white, so on a video placeholder
that is also white it is very hard to see where the play button is, so
this change adds a dark grey transparent background to the play button
so that it stands out. This is similar to how we have done the
play/pause button on animated gifs.
2024-03-06 14:36:50 -07:00
Blake Erickson
0821b2b6fe FEATURE: Auto generate and display video preview image (#25633)
This change will allow auto generated video thumbnails to be used
instead of the black video thumbnail that overlays videos.

Follow up to: 2443446e62
2024-03-06 14:36:50 -07:00
Blake Erickson
aac6036868 FIX: Video playback on iOS (#25513) 2024-03-06 14:36:50 -07:00
Discourse Translator Bot
ef94de52d9
Update translations (#26031) 2024-03-05 16:47:51 +01:00
Jeff Wong
895a018e9d
FEATURE: site setting to include post in penalty messages (#26026)
Adds a site setting to include a post's content in penalty message.
When silencing/suspending a user from a post, or a reviewable with
a post, adds an option to include a post's content in the email
message by default.
2024-03-04 18:35:35 -08:00
Discourse Translator Bot
1167b5b9a5
Update translations (#25915) 2024-02-27 20:50:35 +01:00
Jeff Wong
ba8555df86
DEV: resolve on conflict (#25848) 2024-02-26 10:04:13 -08:00
Discourse Translator Bot
e049f82681
Update translations (#25768) 2024-02-22 13:17:06 -05:00
Penar Musaraj
d85414f885
DEV: Add SecureUploadEndpointHelpers for controllers (#25758) (#25769)
This commit moves some code out of UploadController#show_secure
so it can be reused in other controllers if a secure upload
needs to have permission checks run.

Co-authored-by: Martin Brennan <martin@discourse.org>
2024-02-20 10:34:29 -05:00
Jeff Wong
92749b7384
DEV: Add conflict resolution to migration min trust level for here mention to group [stable] (#25668) 2024-02-13 17:19:22 -08:00
Discourse Translator Bot
b750485f62
Update translations (#25660) 2024-02-13 16:11:35 +01:00
Penar Musaraj
45cbfc088e
FIX: Webauthn origin was incorrect for subfolder setups (#25651) (#25654) 2024-02-13 08:37:51 -05:00
Discourse Translator Bot
124aa9ac94
Update translations (#25580) 2024-02-06 22:35:48 +01:00
Jarek Radosz
07fb62331c
FIX: Correctly save group invites (stable) (#25567)
regressed in 19b86e7ea2
2024-02-05 10:27:30 +01:00
Alan Guo Xiang Tan
39dffcb657
FIX: Update themes javascript cache after running themes migrations (#25564)
Why this change?

This is caused by a regression in
59839e428f, where we stopped saving the
`Theme` object because it was unnecessary. However, it resulted in the
`after_save` callback not being called and hence
`Theme#update_javascript_cache!` not being called. As a result, some
sites were reporting that after runing a theme migration, the defaults
for the theme settings were used instead of the settings overrides
stored in the database.

What does this change do?

Add a call to `Theme#update_javascript_cache!` after running theme
migrations.
2024-02-05 14:49:23 +08:00
Jarek Radosz
968b1a57e4
FIX: Site-setting integer input type (#25488)
Regressed in f2e1363f67
2024-01-30 20:38:58 +01:00
Isaac Janzen
f9502188a6
Bump version to v3.2.0 2024-01-30 11:35:45 -07:00
Isaac Janzen
bfb292d931
Merge v3.2.0.beta5 into stable 2024-01-30 11:35:44 -07:00
Isaac Janzen
b2b1e721b5
Bump version to v3.2.0.beta5 2024-01-30 10:37:25 -07:00
David Taylor
88305e3d96
DEV: Remove version-number-based logic (#25482)
The `deprecate_column` helper would change its behavior based on the current `Discourse::VERSION`. This means that 'finalizing' a stable release introduces a previously untested behavior change.

Much better to keep it as a deprecation until manual action is taken to introduce the breaking change.
2024-01-30 17:34:10 +00:00
Isaac Janzen
c7c1cac814
Bump version to v3.1.5 2024-01-30 09:52:13 -07:00
David Taylor
568d704a94
SECURITY: Properly escape user content within <noscript> (stable) 2024-01-30 09:12:29 -07:00
David Taylor
9b50de4569
SECURITY: Properly escape user content within <noscript> 2024-01-30 09:10:09 -07:00
Discourse Translator Bot
177147f0ac
Update translations (#25477) 2024-01-30 17:05:44 +01:00
Discourse Translator Bot
c3b8216869
Update translations (#25476) 2024-01-30 17:05:37 +01:00
Loïc Guitaut
484954ec4c DEV: Add early support for aarch64 dev env
This patch allows running system specs on an aarch64 Linux system
(typically our `discourse_dev` docker image).
As Chrome isn’t available for the aarch64 architecture (yet), we have to
rely on Firefox instead. This has some drawbacks like not being able to
access the browser logs like we do with the Chrome webdriver.
2024-01-30 15:50:44 +01:00
Andrei Prigorshnev
429a7d09e2
FIX: Chat messages exporter (#25461)
We usually don't enforce foreign key relationships on the database level. 
Because of that, occasionally it's possible to see a chat message that 
references to a non-existent chat_channel or user. MessagesExporter 
failed in such case before, this PR fixes that.
2024-01-30 18:37:11 +04:00
Jan Cernik
8654757581
FIX: Hide 'My Threads' if no followed channels have threads (#25470)
Co-authored-by: Joffrey JAFFEUX <j.jaffeux@gmail.com>
2024-01-30 10:53:32 -03:00
Jan Cernik
ab326d10d8
FIX: Make long thread titles readable (#25456)
When reaching the top of a thread, the full thread title will be displayed if it was too long to fit.
It works in mobile, drawer mode, and fullscreen.
---------

Co-authored-by: Joffrey JAFFEUX <j.jaffeux@gmail.com>
2024-01-30 14:18:00 +01:00
David Taylor
283fe48243
DEV: Update confirm-email flows to use central 2fa and ember rendering (#25404)
These routes were previously rendered using Rails, and had a fairly fragile 2fa implementation in vanilla-js. This commit refactors the routes to be handled in the Ember app, removes the custom vanilla-js bundles, and leans on our centralized 2fa implementation. It also introduces a set of system specs for the behavior.
2024-01-30 10:32:42 +00:00
Sam
27301ae5c7
FEATURE: support silent internal links (#25472)
Internal links always notify and add internal connections in topics.

This adds a special feature that lets you append `?silent=true` to a link
to have it excluded from:

1. Notifications - users will not be notified for these links
2. Post links below posts in the UI

This is specifically useful for large reports where adding all these connections
just results in noise.
2024-01-30 17:03:58 +11:00
Martin Brennan
304a7f3e1a
FIX: Do not show quote copy button to anon (#25471)
This was an oversight in 51016e56dd,
anon doesn't have any need to copy quotes, just as they have
no need to open the composer with a quote prefilled.
2024-01-30 13:19:35 +10:00
dependabot[bot]
38eef3306f
Build(deps-dev): Bump crack from 0.4.5 to 0.4.6 (#25467)
Bumps [crack](https://github.com/jnunemaker/crack) from 0.4.5 to 0.4.6.
- [Changelog](https://github.com/jnunemaker/crack/blob/master/History)
- [Commits](https://github.com/jnunemaker/crack/compare/v0.4.5...v0.4.6)

---
updated-dependencies:
- dependency-name: crack
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-29 23:42:59 +01:00
Mark VanLandingham
f6becaa0b6
DEV: Wrap user summary category rows in plugin outlet (#25466) 2024-01-29 15:48:36 -06:00
Penar Musaraj
2558543794
DEV: Add general pretender for passkey challenge (#25432)
* DEV: Add general pretender for passkey challenge

* Limit a test to Chrome because of Firefox ESR flakiness
2024-01-30 08:13:59 +11:00
Kris
d29fefd73a
FIX: missing ampersand in input class selector (#25464) 2024-01-29 14:03:32 -05:00
Mark VanLandingham
2665752732
DEV: PluginOutlet addition in user/notifications-index & summary class names (#25463) 2024-01-29 12:56:42 -06:00