Commit Graph

42646 Commits

Author SHA1 Message Date
Joffrey JAFFEUX
b673fee946
DEV: resets user search cache between tests (#13873)
The current behaviour was producing random tests failures which where consistently reproducible using `seed=32037592518471299633729129648744282271`

The cause of this error, is a previous test not giving any topicId or categoryId resulting in a cache key "undefined-undefined", just like a possibly previous test. Reseting cache between tests, seems the most straightforward and future proof solution
2021-07-28 15:32:49 +02:00
Alan Guo Xiang Tan
2818ebd19f DEV: Avoid duplication of gems in gemfile.
Follow-up to 08c6a7679d
2021-07-28 21:23:15 +08:00
Joffrey JAFFEUX
1b649016d9
DEV: suppress assets logs from qunit tests (#13871)
Partially reverts: 956f849250

Note that this way of running tests will soon be deprecated in favor of `ember test` and this shouldn’t matter anymore.
2021-07-28 14:27:45 +02:00
Andrei Prigorshnev
5a2ad7e386
DEV: remove calls to guardian from GroupActionLogger (#13835)
We shouldn't be checking if a user is allowed to do an action in the logger. We should be checking it just before we perform the action. In fact, guardians in the logger can make things even worse in case of a security bug. Let's say we forgot to check user's permissions before performing some action, but we still have a call to the guardian in the logger. In this case, a user would perform the action anyway, and this action wouldn't even be logged!

I've checked all cases and I confirm that we're safe to delete this calls from the logger.

I've added two calls to guardians in admin/user_controller. We didn't have security bugs there, because regular users can't access admin/... routes at all. But it's good to have calls to guardian in these methods anyway, neighboring methods have them.
2021-07-28 15:04:04 +04:00
Alan Guo Xiang Tan
32951ca2f4 FIX: User can change name when auth_overrides_name is enabled. 2021-07-28 14:40:57 +08:00
awesomerobot
343ea81ac3 UX: Remove theme-specific css, fix space 2021-07-28 09:34:33 +08:00
Martin Brennan
84e77e9078
FIX: Remove additional setting check for uppy-upload (#13867)
Because the enable_s3_uploads setting may be false for
some sites but GlobalSetting.use_s3? is true, we need to
remove this additional check in uppy-upload. The hidden
enable_direct_s3_uploads setting is sufficient.
2021-07-28 11:26:09 +10:00
dependabot[bot]
53b33a3a7c
Build(deps): Bump globalid from 0.4.2 to 0.5.1 (#13866)
Bumps [globalid](https://github.com/rails/globalid) from 0.4.2 to 0.5.1.
- [Release notes](https://github.com/rails/globalid/releases)
- [Commits](https://github.com/rails/globalid/compare/v0.4.2...v0.5.1)

---
updated-dependencies:
- dependency-name: globalid
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-07-28 00:44:06 +02:00
dependabot[bot]
dfb5a244cb
Build(deps): Bump css_parser from 1.9.0 to 1.10.0 (#13865)
Bumps [css_parser](https://github.com/premailer/css_parser) from 1.9.0 to 1.10.0.
- [Release notes](https://github.com/premailer/css_parser/releases)
- [Changelog](https://github.com/premailer/css_parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/premailer/css_parser/compare/v1.9.0...v1.10.0)

---
updated-dependencies:
- dependency-name: css_parser
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-07-28 00:43:23 +02:00
Martin Brennan
b500949ef6
FEATURE: Initial implementation of direct S3 uploads with uppy and stubs (#13787)
This adds a few different things to allow for direct S3 uploads using uppy. **These changes are still not the default.** There are hidden `enable_experimental_image_uploader` and `enable_direct_s3_uploads`  settings that must be turned on for any of this code to be used, and even if they are turned on only the User Card Background for the user profile actually uses uppy-image-uploader.

A new `ExternalUploadStub` model and database table is introduced in this pull request. This is used to keep track of uploads that are uploaded to a temporary location in S3 with the direct to S3 code, and they are eventually deleted a) when the direct upload is completed and b) after a certain time period of not being used. 

### Starting a direct S3 upload

When an S3 direct upload is initiated with uppy, we first request a presigned PUT URL from the new `generate-presigned-put` endpoint in `UploadsController`. This generates an S3 key in the `temp` folder inside the correct bucket path, along with any metadata from the clientside (e.g. the SHA1 checksum described below). This will also create an `ExternalUploadStub` and store the details of the temp object key and the file being uploaded.

Once the clientside has this URL, uppy will upload the file direct to S3 using the presigned URL. Once the upload is complete we go to the next stage.

### Completing a direct S3 upload

Once the upload to S3 is done we call the new `complete-external-upload` route with the unique identifier of the `ExternalUploadStub` created earlier. Only the user who made the stub can complete the external upload. One of two paths is followed via the `ExternalUploadManager`.

1. If the object in S3 is too large (currently 100mb defined by `ExternalUploadManager::DOWNLOAD_LIMIT`) we do not download and generate the SHA1 for that file. Instead we create the `Upload` record via `UploadCreator` and simply copy it to its final destination on S3 then delete the initial temp file. Several modifications to `UploadCreator` have been made to accommodate this.

2. If the object in S3 is small enough, we download it. When the temporary S3 file is downloaded, we compare the SHA1 checksum generated by the browser with the actual SHA1 checksum of the file generated by ruby. The browser SHA1 checksum is stored on the object in S3 with metadata, and is generated via the `UppyChecksum` plugin. Keep in mind that some browsers will not generate this due to compatibility or other issues.

    We then follow the normal `UploadCreator` path with one exception. To cut down on having to re-upload the file again, if there are no changes (such as resizing etc) to the file in `UploadCreator` we follow the same copy + delete temp path that we do for files that are too large.

3. Finally we return the serialized upload record back to the client

There are several errors that could happen that are handled by `UploadsController` as well.

Also in this PR is some refactoring of `displayErrorForUpload` to handle both uppy and jquery file uploader errors.
2021-07-28 08:42:25 +10:00
Gerhard Schlager
4a37612fd5
FIX: Changing the post owner didn't update the reply_to_user_id of replies (#13862) 2021-07-27 20:49:08 +02:00
Andrew Schleifer
461cb96532 use more appropriate labels for chinese UI option 2021-07-27 22:47:59 +08:00
Discourse Translator Bot
e951cb9aef
Update translations (#13860) 2021-07-27 15:24:03 +02:00
Joffrey JAFFEUX
8ded33c411
DEV: prevents badges tests to log 404 (#13859) 2021-07-27 14:46:49 +02:00
Joffrey JAFFEUX
cdeaddbbb6
DEV: referencing global exists is deprecated (#13857) 2021-07-27 14:42:36 +02:00
Joffrey JAFFEUX
32d0467881
DEV: avoids using document.write (#13858)
It doesn’t provide much than just avoiding some logs in tests. I didn't change test_starter as it's going to be removed at some point.
2021-07-27 14:42:21 +02:00
Joffrey JAFFEUX
29e71f8450
DEV: adds grinning_face_with_smiling_eyes.png to google-classic (#13856) 2021-07-27 13:27:13 +02:00
Bianca Nenciu
760c9a5698
FEATURE: Show draft count in user menu and activity (#13812)
This commit adds the number of drafts a user has next to the "Draft"
label in the user preferences menu and activity tab. The count is
updated via MessageBus when a draft is created or destroyed.
2021-07-27 14:05:33 +03:00
Joffrey JAFFEUX
d801e33e0b
DEV: ensures tree is present for traverseCustomWidgets (#13855)
We already had this check sometimes in code, it's just safer to have this responsibility baked in the function.
2021-07-27 11:37:40 +02:00
wbhouston
efe38efb0a
FIX: Don't grant sharing badges to users who don't exist (#13851)
In badge queries for 'First Share' and 'Nice/Good/Great Share' badges,
check that the user exists.

For 'Nice+ Share' badges, also grant badges if the number of shares is
equal to the threshhold count to better match the descriptions.
2021-07-27 16:32:59 +10:00
Alan Guo Xiang Tan
1780961e70 DEV: Fix flaky topics invite spec due to id collision.
The hardcoded group id eventually became a valid group id leading to 2
groups being attached to the invite.
2021-07-27 13:59:07 +08:00
Alan Guo Xiang Tan
02b84dbff2 DEV: Fix flaky instagram onebox spec by not mutating constant. 2021-07-27 13:54:14 +08:00
awesomerobot
c161f5e0b2 fix badge wrapping on user summary 2021-07-27 12:48:16 +08:00
dependabot[bot]
e28fbf73c7 Build(deps): Bump bootsnap from 1.7.5 to 1.7.6
Bumps [bootsnap](https://github.com/Shopify/bootsnap) from 1.7.5 to 1.7.6.
- [Release notes](https://github.com/Shopify/bootsnap/releases)
- [Changelog](https://github.com/Shopify/bootsnap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Shopify/bootsnap/compare/v1.7.5...v1.7.6)

---
updated-dependencies:
- dependency-name: bootsnap
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-07-27 09:10:44 +08:00
jbrw
292412f196
DEV: Add new after-create-topic-button plugin outlet (#13848) 2021-07-26 17:39:59 -04:00
Vinoth Kannan
5a93893b08
FIX: use correct URL in schema markup for post images. (#13847)
Currently, it wrongly adds Discourse base URL in prefix even for CDN URLs.
2021-07-26 21:39:51 +05:30
Martin Brennan
e1d2b67178
DEV: Fix stylesheet manager flaky spec (#13846)
The cache_fullpath for the Stylesheet::Manager was the same for
every test runner in a parallel test environment, so when other
specs or other places e.g. the stylesheets_controller_spec ran
rm -rf Stylesheet::Manager.cache_fullpath this caused errors
for other specs running that went through the
Stylesheet::Manager::Builder#compile path, causing the error

```
Errno::ENOENT:
       No such file or directory @ rb_sysopen
```


Also fixed the stylesheet_controller which was interpolating Rails.root + CACHE_PATH
itself instead of just using Stylesheet::Manager.cache_fullpath
2021-07-26 14:22:54 +10:00
Martin Brennan
3d25572970
DEV: Remove flaky topic_view_serializer spec (#13845)
We tried fixing this one in b579e9a7de
but it continues to cause nothing but problems.
2021-07-26 13:17:53 +10:00
Krzysztof Kotlarek
88aa0136e3
FIX: do not raise exception when svg path is nil (#13844)
Bug was introduced here: f7ab852e12

If path is nil, it should not raise an exception and continue logging the error.
2021-07-26 12:35:27 +10:00
Bianca Nenciu
6db93e86d4
FIX: Show Uncategorized when unsubscribing (#13832)
If user tried to unsubscribe from a post from category Uncategorized,
the category name was not displayed. It said only "Stop watching all
topics in".
2021-07-26 12:19:30 +10:00
Alan Guo Xiang Tan
ffb3e7b356 FIX: Clear Site#categories cache when git sha changes.
Category custom fields are cached so we need to break the cache when a
new plugin is added/removed.
2021-07-26 09:15:07 +08:00
Alan Guo Xiang Tan
0ce9fd12d0 DEV: Remove depreciation warning in user-topics-lists controller.
```
The <(unknown):ember849>#canBulkSelect computed property was just overriden. This removes the computed property and replaces it with a plain value, and has been deprecated.
```

Follow-up to 43058db3ca
2021-07-26 09:14:55 +08:00
Alan Guo Xiang Tan
92d62eb2a4 DEV: Remove unncessary fabrication in tests. 2021-07-26 09:14:23 +08:00
Andrei Prigorshnev
f79eb207a6 FIX: Don't show the Tis Weekend option in date pickers on Sundays 2021-07-26 08:57:29 +08:00
Andrei Prigorshnev
814781780d FIX: Don't show the Later This Week option in date pickers on Sundays 2021-07-26 08:55:18 +08:00
Joffrey JAFFEUX
ed9e63b00e DEV: update doc as current would raise 2021-07-26 08:54:34 +08:00
dependabot[bot]
026a1ee4f7 Build(deps): Bump oj from 3.12.1 to 3.12.2
Bumps [oj](https://github.com/ohler55/oj) from 3.12.1 to 3.12.2.
- [Release notes](https://github.com/ohler55/oj/releases)
- [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/ohler55/oj/compare/v3.12.1...v3.12.2)

---
updated-dependencies:
- dependency-name: oj
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-07-26 08:53:45 +08:00
dependabot[bot]
d50ce35de2
Build(deps): Bump rubocop from 1.18.3 to 1.18.4 (#13843)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.18.3 to 1.18.4.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.18.3...v1.18.4)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-07-26 01:31:13 +02:00
Simon Cossar
bbf47345f8
Add min-width rule to fix header display issues on the Android Gmail app (#13827) 2021-07-23 14:21:03 -07:00
Blake Erickson
6ac3f1f7b5
DEV: Return 400 instead of 500 for invalid top period (#13828)
* DEV: Return 400 instead of 500 for invalid top period

This change will prevent a fatal 500 error when passing in an invalid
period param value to the `/top` route.

* Check if the method exists first

I couldn't get `ListController.respond_to?` to work, but was still able
to check if the method exists with
`ListController.action_methods.include?`. This way we can avoid relying
on the `NoMethodError` exception which may be raised during the course
of executing the method.

* Just check if the period param value is valid

* Use the new TopTopic.validate_period method
2021-07-23 14:58:10 -06:00
Andrei Prigorshnev
bd4b87245e
DEV: add more tests for future-date-input-selector (#13836)
This PR contains only tests. These tests are from my old PR with refactoring of future-date-input-selector. That PR was closed because we had some changes in our planes about our time-pickers and additionally these tests were flaky.

Tests in this PR aren't flaky, since they use fake time moments in the future. Tests just document current behaviour of future-date-input-selector.
2021-07-23 22:44:23 +04:00
Robin Ward
7b45a5ce55 FIX: Better and more secure validation of periods for TopicQuery
Co-authored-by: Martin Brennan <mjrbrennan@gmail.com>
2021-07-23 14:24:44 -04:00
Kris
c7beb0b9a6
UX: prioritize moderator bg color in PMs (#13833) 2021-07-23 13:06:48 -04:00
Kris
7d9d4bcb6d
FIX: Show bulk button on PMs for all users (#13801) 2021-07-23 12:04:18 -04:00
Bianca Nenciu
2c10809244
FIX: Long poll if window becomes active (#13825)
This commit fixes two bugs. The first one is that onPresenceChange was
called with invalid arguments and it did not register a callback. The
second bug is that it triggered the wrong visibilitychange event. The
function it tried to call does not exist in all versions of MessageBus.
It is safer to trigger an event instead because that exists in all
versions.
2021-07-23 15:52:10 +03:00
Alan Guo Xiang Tan
53082e011a DEV: Make rubocop happy. 2021-07-23 16:04:41 +08:00
Alan Guo Xiang Tan
2923abdec7 SECURITY: Don't leak user of previous whisper post when deleting a topic.
A topic's last poster can be incorrectly set to a user of a whisper post
if the whisper post is before the last post and the last post is
deleted.
2021-07-23 15:42:23 +08:00
Alan Guo Xiang Tan
303e9e42b6 SECURITY: Do not reveal post whisperer in personal messages.
Prior to this fix, post whisperer in personal messages are revealed in
the topic's participants list even though non-staff users are unable to
see the whisper.
2021-07-23 15:42:23 +08:00
Mark VanLandingham
9165f0a0f8
DEV: Export pretty text function for plugin use (#13826) 2021-07-22 14:06:46 -05:00
Neil Lalonde
cb858af8c7
Version bump to v2.8.0.beta4 (#13824) 2021-07-22 12:23:50 -04:00