github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-11-24 14:19:49 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
22,596 Commits 190 Branches 500 Tags 938 MiB
ca567caee4
Commit Graph

3708 Commits

Author SHA1 Message Date
Arpit Jalan
b32d3d66e5 FEATURE: log all username and name changes 2017-02-28 00:23:27 +05:30
Robin Ward
0e3def7d2b Revert "SECURITY: Ensure oAuth authenticated email is the same as created user's email." 
This reverts commit 1060239e2d.
 2017-02-27 13:19:26 -05:00
Robin Ward
bf9626d031 FIX: Embedding was broken with non-english URLs and ports 2017-02-27 12:17:52 -05:00
Arpit Jalan
877957ae88 Merge pull request #4715 from techAPJ/login-per-ip 
FEATURE: new site setting for max logins per ip per hour/minute
 2017-02-27 18:24:53 +05:30
Arpit Jalan
cba51e1c38 FEATURE: new site setting for max logins per ip per hour/minute 2017-02-27 16:58:03 +05:30
jomaxro
f5673fbd47 Remove references to elder 
The use of the TL4 name Elder was changed in 2014 to Leader.  The spec function was changed to `:trust_level_4`, but the it statement was not changed.
 2017-02-26 17:40:42 -07:00
Sam Saffron
7e8f0dc967 FIX: attempt to handle ios edge case where token is seen but unsaved 
This relaxes our security in the following way

- prev auth token is always accepted as long as rotation
date is within our window of SiteSetting.maximum_session_age.hours
(previously old token expired within a minute of new one being seen)

- new auth token is marked unseen if we are presented with an old token
after we already saw new one

This attempts to fix an issue where ios webkit is not committing new cookies
 2017-02-26 17:09:57 -05:00
Blake Erickson
0e6cb752da Clean up valid order names 
Add a sortable mappings list to match other endpoints and so that you
don't have to use database column names.

Example: 'created' => 'created_at'

Also cleaned up some of the logic since a lot of it got moved into the
SORTABLE_MAPPING hash.
 2017-02-25 11:51:40 -07:00
Blake Erickson
e9d5c3265c Change param asc to ascending 
For consistency, change param asc to ascending:

https://meta.discourse.org/t/make-admin-users-list-sortable-suggestion/47649/17?u=oblakeerickson
 2017-02-25 09:13:31 -07:00
Blake Erickson
0a41da6bad FEATURE: Add order logic to admin users controller 
Added order and direction parameters for sorting admin user pages. This
commit only includes backend api changes.

https://meta.discourse.org/t/make-admin-users-list-sortable-suggestion/47649

Now you can pass in `order` and `asc` parameters to the
`/admin/users/list/<query>.json` endpoint.

Example:

`/admin/users/list/active.json?&order=post_count` which defaults to desc

and

`/admin/users/list/active.json?order=post_count&asc=true`
 2017-02-24 17:11:17 -07:00
Régis Hanol
ecdae9f863 FIX: i18n integrity specs 
FIX: check all .yml files in the project for integrity
FIX: ensure localized yamls are compatible with english
 2017-02-24 11:35:33 +01:00
Régis Hanol
a2c04be718 FIX: eradicate I18n fallback issues 💣 
FIX: client's translation overrides were not working when the current locale was missing a key
FIX: ExtraLocalesController.show was not properly handling multiple translations
FIX: JsLocaleHelper#output_locale was not properly handling multiple translations

FIX: ExtraLocalesController.show's spec which was randomly failing
FIX: JsLocaleHelper#output_locale was muting cached translations hashes

REFACTOR: move 'enableVerboseLocalization' to the 'localization' initializer
REFACTOR: remove unused I18n.js methods (getFallbacks, localize, parseDate, toTime, strftime, toCurrency, toPercentage)
REFACTOR: remove all I18n.pluralizationRules and instead use MessageFormat's pluralization rules

TEST: add tests for localization initializer
TEST: add tests for I18n.js
 2017-02-24 11:31:21 +01:00
Guo Xiang Tan
1060239e2d SECURITY: Ensure oAuth authenticated email is the same as created user's email. 2017-02-24 13:13:10 +08:00
Guo Xiang Tan
0847b4258a Revert "SECURITY: Ensure that user has been authenticated." 
This reverts commit fbe51d68a7.

Changing the commit message to correctly reflect what we're actually
fixing.
 2017-02-24 13:12:29 +08:00
Guo Xiang Tan
fbe51d68a7 SECURITY: Ensure that user has been authenticated. 2017-02-24 10:47:48 +08:00
Sam
f15f61da0a FEATURE: add immutable caching to rails site of things 2017-02-23 13:05:00 -05:00
Sam
ea1007e954 FEATURE: add support for same site cookies 
Defaults to Lax, can be disabled or set to Strict.

Strict will only work if you require login and use SSO. Otherwise when clicking on links to your site you will appear logged out till you refresh the page.
 2017-02-23 12:01:28 -05:00
Neil Lalonde
0551b3f5ee FEATURE: replace emoji with unicode in title and description meta tags 2017-02-22 16:24:13 -05:00
Sam Saffron
b7d2edc7dc FIX: allow some auth token misses prior to clearing cookie 
It appears that in some cases ios queues up requests up front
and "releases" them when tab gets focus, this allows for a certain
number of cookie misses for this case. Otherwise you get logged off.
 2017-02-22 12:37:11 -05:00
Arpit Jalan
213a496203 FIX: show all staff events related to the target user 2017-02-22 13:31:40 +05:30
Arpit Jalan
b32f33b3f0 FIX: allow staff members to send PMs when enable_private_messages is disabled 2017-02-22 11:32:09 +05:30
Neil Lalonde
c94fdcea38 FIX: admin dashboard posts count should not include system posts and whispers 2017-02-21 14:45:41 -05:00
Arpit Jalan
046cbad10b FEATURE: add a button on admin user page that links to action log 2017-02-21 21:38:37 +05:30
Jakub Macina
4a2f13348a ADD: Append tags bulk action for topics 2017-02-20 18:14:32 +01:00
Régis Hanol
f51e3b2131 FIX: should not be able to rename a system badge 2017-02-20 14:35:05 +01:00
Régis Hanol
cb99f59ec3 reset bounce score when email is successfully changed 2017-02-20 10:37:01 +01:00
Robin Ward
e62c0a42fa FIX: Support multiple embeddable host records with the same host 2017-02-17 12:41:34 -05:00
Sam
7a85469c4c SECURITY: inactive/suspended accounts should be banned from api 
Also fixes edge cases around users presenting multiple credentials
 2017-02-17 11:03:09 -05:00
Neil Lalonde
c0e1722ca6 fix intermittent spec failure due to Time comparison with TimeWithZone 2017-02-17 10:30:29 -05:00
Neil Lalonde
3fb50d587d FIX: invited users and new TL1 users will see their first notification highlighted 2017-02-17 10:30:29 -05:00
Jeff Atwood
9b263a0559 increase req min unique pw chars from 5 to 6 2017-02-16 17:06:19 -08:00
Neil Lalonde
4b28bfaa15 Merge pull request #4710 from ento/fix-s3-config-check 
FIX: admin dashboard shouldn't complain when using IAM profile for S3 access
 2017-02-15 17:02:07 -05:00
Neil Lalonde
d0fbb27f3e FEATURE: new invite acceptance page, where username can be chosen and password can be set 2017-02-15 16:51:57 -05:00
Sam
74d4209d24 FEATURE: allow plugins to register custom topic list filters 2017-02-15 15:25:43 -05:00
Sam
9c51e3e8e7 amend preloader api to supply topic list 2017-02-15 12:04:02 -05:00
Sam
2c59ffeb2c FIX: token rotation not accounting for overlapping tokens correctly 
also... freeze_time has no block form, correct all usages and specs
 2017-02-15 10:58:18 -05:00
Marica Odagaki
af9c97ec43 Add failing tests 2017-02-15 00:05:58 -08:00
Marica Odagaki
2c1279b740 Fix typo to be more consistent with other test descriptions 2017-02-15 00:04:10 -08:00
Sam
f2099c3811 adjust API 2017-02-14 16:32:33 -05:00
Sam
89d5e8ab4b FEATURE: allow plugins to preload data in topic list 2017-02-14 16:29:06 -05:00
Sam
8feb94e13f FIX: password validator was being too strict 2017-02-14 09:18:04 -05:00
Sam
783bac9ff7 less stubbing for better clarity and robustness 2017-02-13 14:34:15 -05:00
Sam
7652901b75 reduce mocking and stubbing in controller spec 2017-02-13 14:31:15 -05:00
Sam
0ab96a7691 FEATURE: add hidden setting for verbose auth token logging 
This is only needed to debug auth token issues, will result in lots
of logging
 2017-02-13 14:01:09 -05:00
Robin Ward
e1d358ffbf FIX: Don't clear the login hint when the system user is saved 2017-02-13 10:54:20 -05:00
Jeff Atwood
3ee7a9266c Merge pull request #4686 from tgxworld/group_is_visible_if_user_is_group_owner 
FIX: Show groups that user is owner of on groups page.
 2017-02-11 22:18:44 -08:00
Neil Lalonde
94e1105af7 fix unique char counting in password validator 2017-02-10 10:38:17 -05:00
Sam Saffron
4332f0dde1 FEATURE: allow user search API to restrict to group 2017-02-09 18:45:39 -05:00
Neil Lalonde
1bcb835446 FEATURE: passwords must have a minimum number of unique characters, configurable with a new setting 2017-02-09 15:00:22 -05:00
Robin Ward
9fe4427071 Clean up get_a_room following review 2017-02-08 12:24:26 -05:00
Neil Lalonde
5a8bbe663a FEATURE: include most popular tag in page title for webcrawlers of tagged uncategorized topics 2017-02-07 16:55:42 -05:00
Sam Saffron
df8f365d99 FEATURE: improve search so it searches sub categories by default 
If you want an exact category match use `category:=howto` or `#=howto"
 2017-02-07 15:53:37 -05:00
Régis Hanol
02bb7beaaf FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled 2017-02-07 18:06:44 +01:00
Sam
49e7124a5e clarify override semantics in spec 2017-02-07 10:41:27 -05:00
Sam
f34907b523 Merge pull request #4681 from vietqhoang/feature/add-user-title-to-sso-payload 
FEATURE: Add user title to SSO payload
 2017-02-07 10:25:32 -05:00
Sam
ff49f72ad9 FEATURE: per client user tokens 
Revamped system for managing authentication tokens.

- Every user has 1 token per client (web browser)
- Tokens are rotated every 10 minutes

New system migrates the old tokens to "legacy" tokens,
so users still remain logged on.

Also introduces weekly job to expire old auth tokens.
 2017-02-07 09:22:16 -05:00
Sam
2dec731da3 SECURITY: correctly validate input when admin searches for screened ips 2017-02-06 16:11:16 -05:00
Régis Hanol
84af84dc52 prevent inactive & staged users from being automatically added to a group 2017-02-06 17:49:27 +01:00
Régis Hanol
ba115480ba FIX: wasn't extracting links to quoted posts 2017-02-06 14:45:04 +01:00
Régis Hanol
27fb9c8804 FIX: bounce webhooks should also use recipient address 2017-02-05 19:06:35 +01:00
Robin Ward
f1e7bca3c9 FEATURE: Warn a user when they're replying to the same user too much 2017-02-03 17:00:54 -05:00
Neil Lalonde
c4e10f2a9d FEATURE: redesign the change password page to use javascript and validations 2017-02-03 16:09:24 -05:00
Robin Ward
b251d11518 FIX: If you make a new banner, clear the old dismissed values 2017-02-03 15:07:38 -05:00
Guo Xiang Tan
61111a3f9b FIX: Show groups that user is owner of on groups page. 2017-02-03 16:51:32 +08:00
Arpit Jalan
6b8691ecea Merge pull request #4685 from techAPJ/approve-users-invite-fix 
FIX: allow existing users to be invited to topic/message when must_approve_users is enabled
 2017-02-03 13:22:18 +05:30
Arpit Jalan
dc2171960b FIX: allow existing users to be invited to topic/message when must_approve_users is enabled 2017-02-03 13:01:23 +05:30
Guo Xiang Tan
c392994793 Fix specs. 2017-02-03 08:38:19 +08:00
Neil Lalonde
b91cb92af0 FIX: reports for time to first reply and topics without replies were counting whispers and moderator actions 2017-02-02 17:27:41 -05:00
Guo Xiang Tan
3c28d94706 FIX: Don't configure Redis connector if Redis slave config is not set. 2017-02-02 13:48:55 +08:00
Régis Hanol
82555ca761 FIX: mail threading wasn't working properly in Mac Mail 2017-02-01 23:02:41 +01:00
Viet Hoang
40164ccd4a Add user title to SSO payload 2017-01-31 16:42:27 -08:00
Arpit Jalan
a525563eea Optimize spec for ProcessPost job 2017-01-31 14:10:56 +05:30
Rimian Perkins
25516874b5 FIX: Escape regexp chars in SiteSetting.censored_words. 2017-01-31 10:14:51 +08:00
Régis Hanol
8fc7420f83 FIX: prevent huge custom emojis in emails 2017-01-30 18:06:48 +01:00
Arpit Jalan
19f7beaa2c FIX: topic links were getting dropped when post is rebaked 2017-01-30 14:55:53 +05:30
Arpit Jalan
28e8d32d53 Suppress console output when running RSpec 2017-01-28 11:04:47 +05:30
Guo Xiang Tan
0e5d490b05 No need for special helper to reset SiteSetting state. 
* SiteSetting in tests uses a local provider that resets it.
 2017-01-28 10:55:49 +08:00
Neil Lalonde
7ead3e1f18 fix failing specs 2017-01-27 16:17:10 -05:00
Arpit Jalan
c36dda70ae spec for posts:remap rake task 2017-01-28 00:13:08 +05:30
Leo McArdle
c76f6856ea FEATURE: reply as new message to the same recipients 2017-01-27 12:24:31 +08:00
Robin Ward
496682c442 Merge pull request #4662 from tgxworld/fix_localized_group_name_change 
Fix localized group name change
 2017-01-26 10:50:00 -05:00
Arpit Jalan
9dd09e453b FEATURE: add explicit confirmation button to accept the invite 2017-01-25 15:50:30 +05:30
Guo Xiang Tan
781d83a46f FIX: Toggling a post's wiki status should not skip revision. 2017-01-25 13:34:55 +08:00
Guo Xiang Tan
ce07da1d8b UX: Only display the words that fails censored words validations. 2017-01-24 13:11:05 +08:00
Régis Hanol
7e52d29a5b Merge pull request #4643 from LeoMcA/fix-pull-img 
FIX: Handle img src starting with "//" in pull_hotlinked_images job
 2017-01-23 17:56:53 +01:00
Guo Xiang Tan
32846aad2a FIX: Toggling post's wiki status should not create a new version. 2017-01-20 15:42:33 +08:00
Jeff Atwood
521ced38c5 fix spec for default email title 2017-01-19 14:01:51 -08:00
Neil Lalonde
6b93b09404 FIX: when blocking a user results in hiding their posts, only hide posts made in the last 24 hours 2017-01-19 15:56:22 -05:00
Régis Hanol
07660ecedb bump onebox 2017-01-19 00:28:37 +01:00
Guo Xiang Tan
706b4f6b9f FEATURE: Remap group mentions when group name has been changed. 2017-01-18 13:39:34 +08:00
Guo Xiang Tan
59dfb51a35 FIX: Don't change automatic group name if localized name has been taken. 2017-01-18 12:20:23 +08:00
Guo Xiang Tan
1e1e40c75f Dump the page's content as well on failure. 2017-01-17 18:40:46 +08:00
Régis Hanol
fbf9172db8 FIX: log backups download/destroy staff action 
FIX: clean up junk left by the specs
RENAME: 'backup_operation' to 'backup_create' to match other backup log types
 2017-01-16 19:53:31 +01:00
Robin Ward
86c52c72f6 FIX: Deleting a user was not deleting their directory items 2017-01-16 11:46:52 -05:00
Leo McArdle
b60e9b7330 FIX: Handle img src starting with "//" in pull_hotlinked_images job 2017-01-16 10:50:07 +00:00
Guo Xiang Tan
63954c1b33 FIX: Same user record being saved twice causing validation to fail. 2017-01-16 16:41:03 +08:00
Guo Xiang Tan
e3b6f9b8ae FIX: Do not update user stats like counts for private messages. 2017-01-16 11:07:53 +08:00
Guo Xiang Tan
ed5fa20b0c Revert "FIX: error during signup saying "Password is the same as your current password" due to automatic group membership granting a trust level" 
This reverts commit 9c40657ba4.

Calling this whenever a user is initialize is hurting us bad
on performance.
 2017-01-16 09:44:10 +08:00
Neil Lalonde
e8307ac24c FIX: mailing list mode digest emails included whispers 2017-01-13 13:46:33 -05:00
Robin Ward
adb73180f7 FEATURE: Let plugins register themes easily 2017-01-13 11:50:52 -05:00
Régis Hanol
499a83270a FIX: don't onebox to IP addresses 2017-01-12 22:35:33 +01:00
Guo Xiang Tan
38496985ef Fix syntax error. 2017-01-12 10:03:37 +08:00
Guo Xiang Tan
23d4435af1 Oops. 2017-01-12 09:56:20 +08:00
Guo Xiang Tan
515f50e42e FEATURE: Log admin action when readonly mode is changed. 2017-01-12 09:41:02 +08:00
Régis Hanol
887e9af84f FEATURE: new 'max_image_megapixels' site setting 2017-01-11 23:37:12 +01:00
Neil Lalonde
b177827841 more specs for staff action logging 2017-01-11 11:41:21 -05:00
Guo Xiang Tan
1758af9a1d FIX: Perform emoji unescape for topic titles in quotes. 2017-01-11 17:23:13 +08:00
Guo Xiang Tan
cdd550e947 Use a different Redis key when PG failover sets site to readonly mode. 2017-01-11 16:38:49 +08:00
Régis Hanol
185dcb2ca1 handle emails with localized headers 😠 2017-01-09 22:59:30 +01:00
Guo Xiang Tan
3d21ccd4a5 FIX: Add validation to disallow censored words in topic title. 2017-01-09 16:55:41 +08:00
Régis Hanol
98c62bccb5 FIX: mark forwarded email as read by the forwarder 
FIX: 'Re:' prefix is mostly used for replies and not forwarded emails
 2017-01-06 15:33:55 +01:00
Guo Xiang Tan
58f3a2e9a9 Fix randomly failing spec. 2017-01-06 15:25:49 +08:00
Guo Xiang Tan
68300f515c FIX: Return 404 if id is not valid. 2017-01-06 10:39:44 +08:00
Guo Xiang Tan
d10fe51b72 Fix broken specs since all urls will be oneboxed. 2017-01-06 10:05:51 +08:00
Guo Xiang Tan
f473a119ff Remove unnecessary stub. 2017-01-06 08:53:30 +08:00
Arpit Jalan
7a1ff59822 FIX: PM email to suspended member was broken 2017-01-05 13:58:14 +05:30
Guo Xiang Tan
a89f60b85b Merge pull request #4631 from tgxworld/prevent_users_from_changing_permissions_of_non_real_users 
FIX: Do not allow admins to meddle with admin and moderation access o…
 2017-01-04 09:10:27 +08:00
Robin Ward
cf7774bdd9 FEATURE: Block muted users from sending you PMs 2017-01-03 14:51:53 -05:00
Guo Xiang Tan
c68bcfeb72 Improve spec. 2017-01-03 15:36:36 +08:00
Guo Xiang Tan
ad4a96d387 FIX: Only send membership request to the last 5 active group owners. 2017-01-03 15:33:57 +08:00
Arpit Jalan
495a511862 simplify quote markup in emails 2017-01-02 21:37:01 +05:30
Guo Xiang Tan
f1beef43a8 Merge pull request #4618 from tgxworld/fix_invalid_emails 
FIX: Don't allow invalid email to be saved.
 2016-12-30 07:11:48 +08:00
Guo Xiang Tan
c7b151683d FIX: Do not allow admins to meddle with admin and moderation access of non real users. 2016-12-29 11:11:33 +08:00
Neil Lalonde
9c40657ba4 FIX: error during signup saying "Password is the same as your current password" due to automatic group membership granting a trust level 2016-12-28 17:36:04 -05:00
Sam
d28d8a1f85 FIX: order by op_likes leads to broken browsing 2016-12-27 19:08:54 +11:00
Arpit Jalan
d72cbcb2a4 FEATURE: new setting to validate user website 2016-12-26 21:29:27 +05:30
Guo Xiang Tan
5aee2673c7 FIX: Push null fields to last when sorting group members. 2016-12-22 14:55:24 +08:00
Guo Xiang Tan
8551d821a0 FEATURE: Add site setting to disable group directory. 2016-12-22 14:14:22 +08:00
Sam
c531f4ded5 remove rails-observers 
Rails yanked out observers many many years ago, instead the functionality
was yanked out to a gem that is very lightly maintained.

For example: if we want to upgrade to rails 5 there is no published gem

Internally the usage of observers had quite a few problem.

The series of refactors renamed a bunch of classes to give us more clarity
and removed some magic.
 2016-12-22 16:46:53 +11:00
Sam
019f1a1d06 UserEmailObserver is now removed 
no big surprises here was pretty straightforward

after_commit semantics sure are weird though
 2016-12-22 16:46:53 +11:00
Sam
2f6a4cc6de remove UserActionObserver, replace with after_save and service 
interestingly there was some left over dead code from when stars
existed in the topic_users table
 2016-12-22 16:46:53 +11:00
Sam
0a78ae739d Remove SearchObserver, aim is to remove all observers 
rails-observers gem is mostly unmaintained and is a pain to carry forward
new implementation contains significantly less magic as a bonus
 2016-12-22 13:13:14 +11:00
Guo Xiang Tan
28befcb5d4 Fix specs. 2016-12-21 21:21:39 +08:00
Guo Xiang Tan
076a08d8e1 FIX: Unactivated users should not be automatically added into groups as well. 2016-12-21 18:15:01 +08:00
Guo Xiang Tan
7228081820 FIX: Automatic group membership should not add staged or unactivated users. 2016-12-21 18:04:26 +08:00
Guo Xiang Tan
13c6191e89 FIX: Don't allow invalid email to be saved. 2016-12-21 17:47:11 +08:00
Guo Xiang Tan
5d7f3223f0 SECURITY: Users can only bookmark posts which they can see. 2016-12-21 12:01:26 +08:00
Neil Lalonde
c75bebdea2 FIX: uncategorized setting to control whether topic featured links are allowed 2016-12-20 15:55:30 -05:00
Guo Xiang Tan
9db5d5b6a7 FIX: Incorrect serializer for groups page. 2016-12-20 15:44:22 +08:00
Guo Xiang Tan
7c7c233c1c FIX: Can't update Groups#allow_membership_requests in admin. 2016-12-20 15:14:35 +08:00
Guo Xiang Tan
502e114c60 FIX: Incorrect count when loading more groups. 2016-12-20 14:39:44 +08:00
Guo Xiang Tan
193f8301a4 FIX: Do not show automatic groups to normal users. 2016-12-20 14:26:49 +08:00
Régis Hanol
52cd9972bb FIX: prevent DDoS with lots of _oneboxable_ links 
FIX: ensure the onebox route is only allowed to logged in users
FIX: only allow 1 outgoing onebox preview per user
FIX: client should only do 1 preview at a time
 2016-12-20 00:31:10 +01:00
Sam
2b808ad9da Merge pull request #4609 from joebuhlig/category-topics-wiki 
FEATURE: Category setting to make all topics wikis
 2016-12-20 09:15:51 +11:00
Neil Lalonde
74956694e5 If summary email finds no topics, show topics more than 1 day old from new users 2016-12-19 14:54:08 -05:00
Neil Lalonde
923cf73c6e Topic Featured Links: move data from custom fields to topics and categories tables. Invert behaviour of topic_featured_link_allowed checkbox. Fix a bug with invalid topic records due to changing that category checkbox. 2016-12-19 14:54:07 -05:00
Arpit Jalan
a2096a01fb add test case for handling uploads without extension 2016-12-20 00:46:47 +05:30
Robin Ward
e03d5e2140 Reapply Ember 2.10 for good this time! 
This reverts commit ddd299f4aa.
 2016-12-19 11:19:10 -05:00
Joe Buhlig
87251fded7 FEATURE: Category setting to make all topics wikis 
FEATURE: Category setting to make all topics wikis
 2016-12-19 06:42:18 -06:00
Guo Xiang Tan
18c8323987 FIX: Incorrect path for redirect. 2016-12-19 18:12:15 +08:00
Sam
e0ff57ca75 SECURITY: prevent reuse of password reset 2016-12-19 18:00:22 +11:00
Sam
eb2db23b40 FEATURE: remove email_token_grace_period_hours 
The site setting email_token_grace_period_hours just causes confusion and
should not be used anyway.

Out of the box, tokens stop working once confirmed, no need to add complexity here
 2016-12-19 17:15:20 +11:00
Sam
0599bd0154 FEATURE: add referrer never tag to password reset page 2016-12-19 11:01:58 +11:00
Sam
15b5fddd49 SECURITY: protect upload params, only allow very strict filenames 2016-12-19 10:16:18 +11:00
Arpit Jalan
ab6843dcde FIX: username route was broken 2016-12-16 23:56:22 +05:30
Guo Xiang Tan
d8541c589a FIX: Incorrect route for updating username. 2016-12-17 00:23:12 +08:00
Robin Ward
ddd299f4aa Revert "Revert "Revert Ember 2.10+ for a short while"" 
This reverts commit 76bbc481cb.
 2016-12-16 10:29:30 -05:00
Robin Ward
76bbc481cb Revert "Revert Ember 2.10+ for a short while" 
This reverts commit 21682fd60b.
 2016-12-16 09:52:29 -05:00
Sam
61eb134181 FEATURE: setting to allow arbitrary redirects from sso origin 
if sso_allows_all_return_paths is set to true you can redirect off-site from sso success
 2016-12-16 13:37:44 +11:00
Sam
6ff309aa80 SECURITY: don't grant same privileges to user_api and api access 
User API is no longer gets bypasses that standard API gets.
Only bypasses are CSRF and XHR requirements.
 2016-12-16 12:05:43 +11:00
Régis Hanol
197517d55e FIX: locally uploaded audio & video files should onebox even when the extension is uppercase 2016-12-15 23:21:44 +01:00
Robin Ward
21682fd60b Revert Ember 2.10+ for a short while 2016-12-15 16:43:38 -05:00
Robin Ward
ba8c6fd840 FIX: PhantomJS was crashing 2016-12-15 12:30:20 -05:00
Sam
98f4a2adcb FIX: on 404 from brotli asset path return a correctly encoded doc 
old implementation would cache the 404 for 1 year with incorrect encoding

hilarity would ensue
 2016-12-15 16:05:20 +11:00
Guo Xiang Tan
13c344245d Merge pull request #4603 from tgxworld/group_index_page 
FEATURE: Add groups page.
 2016-12-14 23:26:05 +08:00
Guo Xiang Tan
20f9aad539 Merge pull request #4599 from tgxworld/remove_rspec_given 
Remove RSpec given.
 2016-12-14 17:42:30 +08:00
Guo Xiang Tan
4b940dc8bd FEATURE: Add groups page. 2016-12-14 17:27:47 +08:00
Guo Xiang Tan
18f400e652 Remove RSpec given. 2016-12-14 10:29:22 +08:00
Neil Lalonde
2d61d7d644 update embed_controller_spec 2016-12-13 16:29:51 -05:00
Guo Xiang Tan
2686ee5ab2 FIX: Admin can't add/remove public group users. 2016-12-13 16:39:44 +08:00
Guo Xiang Tan
43ee9f884e FEATURE: Add Group#full_name. 2016-12-13 16:16:26 +08:00
Guo Xiang Tan
69330f8bc2 Add user_updated event to webhooks. 2016-12-13 11:26:26 +08:00
Guo Xiang Tan
da7009a968 FEATURE: Add request membership button for allowed groups. 2016-12-12 22:48:08 +08:00
Régis Hanol
664feca199 FIX: don't send emails from muted users in mailing list mode 2016-12-12 15:28:26 +01:00
Guo Xiang Tan
9a800107cb FIX: Associate category logo and background to uploads record. 2016-12-12 17:37:28 +08:00
Guo Xiang Tan
05f55dbc10 FEATURE: Group logs. 2016-12-12 17:29:54 +08:00
Guo Xiang Tan
be5b5f6bea FEATURE: Public groups. 2016-12-12 17:00:30 +08:00
Neil Lalonde
24d2973108 enable featured links by default 2016-12-09 16:08:17 -05:00
Neil Lalonde
fb2633366a FIX: featured link topics shouldn't require the same min post length 2016-12-09 15:46:26 -05:00
Neil Lalonde
a4c4f13901 Remove the topic_featured_link_onebox setting. We will always try to onebox a link and add it to the body if topic_featured_link_enabled is enabled. 2016-12-09 13:28:12 -05:00
Sam
846597f563 FIX: staff tags are stripped by non-staff 2016-12-09 17:24:26 +11:00
Guo Xiang Tan
b9b4b0c175 FIX: Members should be ordered by username. 2016-12-08 14:27:38 +08:00
Guo Xiang Tan
a2da2971af FEATURE: Allow columns on group members page to be sortable. 2016-12-08 10:49:12 +08:00
Guo Xiang Tan
545dfa7191 FEATURE: Allow group owners to edit title. 2016-12-07 10:26:28 +08:00
Sam
1135e00c83 FIX: regression unable to dismiss unread 2016-12-06 08:49:40 +11:00
Erick Guan
52763f5115
FEATURE: Allow posting a link with topics 2016-12-05 17:20:54 +01:00
Régis Hanol
06469ef0ce FIX: don't extract links from .elided parts 2016-12-05 15:19:15 +01:00
Guo Xiang Tan
37b256e7f2 Fix specs. 2016-12-05 17:13:58 +08:00
Arpit Jalan
431aa79bb3 Merge pull request #4587 from techAPJ/invite-upload 
FIX: simplify CSV file upload
 2016-12-05 14:30:13 +05:30
Guo Xiang Tan
adb7fcb6b3 FEATURE: Add bio to group page. 2016-12-05 16:58:04 +08:00
Arpit Jalan
ce974da9e5 FIX: simplify CSV file upload 2016-12-05 14:09:08 +05:30
Guo Xiang Tan
31acd311e5 FEATURE: Allow group owners to edit group name and avatar flair. 2016-12-05 14:27:46 +08:00
Guo Xiang Tan
b45fd21ed9 FIX: Clean up specs. 2016-12-05 13:37:33 +08:00
Sam
dc66f6681a add spec for brotli controller, ensure cached correctly 2016-12-05 16:08:36 +11:00
Guo Xiang Tan
22059d4df9 Add Rake task to clean up unused multisite Redis keys. 2016-12-05 11:46:34 +08:00
Sam
39a524aac8 FEATURE: brotli cdn bypass for assets 
Allow CDNS that strip out brotli encoding to use brotli regardless
 2016-12-05 13:57:09 +11:00
Sam
33d0a23d84 Merge branch 'fix_whisper' 2016-12-05 10:01:03 +11:00
Neil Lalonde
dafd1453d6 FIX: topic list filters for bookmarked, posted, and read now work with tag filter 2016-12-02 15:58:14 -05:00
Guo Xiang Tan
3971f96aa6 Merge pull request #4536 from fantasticfears/webhooks-edit 
FIX: missing post and topic edited webhooks
 2016-12-02 10:16:19 +01:00
Guo Xiang Tan
bc0a8142fe PERF: Only show members count on group page. 2016-12-02 16:28:54 +08:00