59090 Commits

Author SHA1 Message Date
Martin Brennan
edd19bd96f
Revert "UX: Hide inner site settings sidebar if admin sidebar enabled (#31047)" (#31268)
This reverts commit 91e9c1c81343990d5ebbb3a3bb7c68ec4445d610.

After feedback, for now we are reverting this change. This is not
permanent, the settings sidebar will be removed again, after we:

* Visually group the settings the same way as the sidebar does
  on All Settings
* Add more settings pages to the main admin sidebar to cover the ~250
  settings not yet represented there
2025-02-11 12:47:36 +10:00
Kris
22f2a554ef
FIX: ensure all children of .with-topic-progress are clickable (#31176) (#31178)
This is a follow-up to 71eb2f6cda9ad8a69ba1ae7d506440c3ff0bc9cb, we have
outlets in this wrapper too — so best to re-enable pointer events on all
immediate children of the disabled wrapper.
2025-02-05 09:06:54 -05:00
Roman Rizzi
4abee26a32
Bump version to v3.4.0 2025-02-04 13:51:15 -03:00
Roman Rizzi
216662eb90
Merge v3.4.0.beta4 into stable 2025-02-04 13:51:15 -03:00
Roman Rizzi
76e7f12a6d
Bump version to v3.4.0.beta4 2025-02-04 13:49:16 -03:00
Roman Rizzi
fa235e49e9
Bump version to v3.3.4 2025-02-04 13:43:01 -03:00
David Taylor
d47964d992
SECURITY: Ensure user-stream topic titles are always escaped correctly
In core, `escapeExpression` was being applied during the model loading phase. However, plugin consumers of the UserStreamItem component were not necessarily doing the same.

This commit moves the emoji-replacement logic (which also safely handles escaping) into the component template, so that it is safe-by-default, regardless of how it's used by plugins.
2025-02-04 13:35:17 -03:00
OsamaSayegh
ca1ff4dfbc
SECURITY: Limit /inline-onebox to 10 URLs at a time 2025-02-04 13:35:13 -03:00
Gary
549cabd140
Don't allow loading tagged PMs in another user's inbox. 2025-02-04 13:35:09 -03:00
David Battersby
fa0748428d
SECURITY: Ability to bypass disabling chat of users 2025-02-04 13:35:06 -03:00
Blake Erickson
2ddb27cf9c
SECURITY: Restrict allowed URL patterns
Restrict allowed URL patterns for oneboxes.
2025-02-04 13:35:02 -03:00
Alan Guo Xiang Tan
5d60557e0f
SECURITY: Preload data only when rendering application layout
This commit drops the `before_action :preload_json` callback in `ApplicationController` as it adds unnecessary complexity to `ApplicationController` as well as other controllers which has to skip this callback. The source of the complexity comes mainly from the following two conditionals in the `preload_json` method:

```
    # We don't preload JSON on xhr or JSON request
    return if request.xhr? || request.format.json?

    # if we are posting in makes no sense to preload
    return if request.method != "GET"
```

Basically, the conditionals solely exists for optimization purposes to ensure that we don't run the preloading code when the request is not a GET request and the response is not expected to be HTML. The key problem here is that the conditionals are trying to expect what the content type of the response will be and this has proven to be hard to get right. Instead, we can simplify this problem by running the preloading code in a more deterministic way which is to preload only when the `application` layout is being rendered and this is main change that this commit introduces.
2025-02-04 13:34:58 -03:00
Blake Erickson
8192aedd69
SECURITY: Sanitize video placeholder urls
Make sure video placeholder urls are valid. An error message is displayed instead of an infinite loading spinner after clicking play.
2025-02-04 13:34:54 -03:00
OsamaSayegh
416ec83ae5
SECURITY: Limit /inline-onebox to 10 URLs at a time 2025-02-04 13:32:53 -03:00
David Taylor
6d0173c9bd
SECURITY: Ensure user-stream topic titles are always escaped correctly
In core, `escapeExpression` was being applied during the model loading phase. However, plugin consumers of the UserStreamItem component were not necessarily doing the same.

This commit moves the emoji-replacement logic (which also safely handles escaping) into the component template, so that it is safe-by-default, regardless of how it's used by plugins.
2025-02-04 13:32:49 -03:00
Gary
d2de58e760
Don't allow loading tagged PMs in another user's inbox. 2025-02-04 13:32:46 -03:00
David Battersby
3d47a1268c
SECURITY: Ability to bypass disabling chat of users 2025-02-04 13:32:42 -03:00
Penar Musaraj
b89cf9b443
SECURITY: Disable access to "activate-account" route for existing users 2025-02-04 13:32:38 -03:00
Blake Erickson
17116c440b
SECURITY: Restrict allowed URL patterns
Restrict allowed URL patterns for oneboxes.
2025-02-04 13:32:34 -03:00
Alan Guo Xiang Tan
17e1bfe069
SECURITY: Preload data only when rendering application layout
This commit drops the `before_action :preload_json` callback in `ApplicationController` as it adds unnecessary complexity to `ApplicationController` as well as other controllers which has to skip this callback. The source of the complexity comes mainly from the following two conditionals in the `preload_json` method:

```
    # We don't preload JSON on xhr or JSON request
    return if request.xhr? || request.format.json?

    # if we are posting in makes no sense to preload
    return if request.method != "GET"
```

Basically, the conditionals solely exists for optimization purposes to ensure that we don't run the preloading code when the request is not a GET request and the response is not expected to be HTML. The key problem here is that the conditionals are trying to expect what the content type of the response will be and this has proven to be hard to get right. Instead, we can simplify this problem by running the preloading code in a more deterministic way which is to preload only when the `application` layout is being rendered and this is main change that this commit introduces.
2025-02-04 13:32:30 -03:00
Blake Erickson
14d1d11536
SECURITY: Sanitize video placeholder urls
Make sure video placeholder urls are valid. An error message is
displayed instead of an infinite loading spinner after clicking play.
2025-02-04 13:32:20 -03:00
Loïc Guitaut
5055a071b8 FIX: Allow to follow non-ASCII canonical links for oneboxes 2025-02-04 15:40:23 +01:00
Discourse Translator Bot
324857c4c4
Update translations (#31163) 2025-02-04 15:18:03 +01:00
Discourse Translator Bot
2c5dbdc23f
Update translations (#31124) 2025-02-04 15:17:59 +01:00
David Taylor
2ceb40ffa4
DEV: Resolve flaky trust_level spec (#31165) 2025-02-04 13:46:31 +00:00
Bianca Nenciu
649505d869
DEV: Add 'include' statements for outlets in nginx config (#30929)
The 'include' statements serve as extension outlets that are populated
by discourse/discourse_docker.
2025-02-04 15:21:33 +02:00
Kelv
65324b6e5d
DEV: enable raise_error in test envs for deprecated icons in svg_sprite.rb (#30980)
This PR raises an error on any deprecated icon names being converted by
svg_sprite.rb, which will result in any deprecated icons being processed
by the ruby lib to fail tests.
2025-02-04 21:21:20 +08:00
Joffrey JAFFEUX
8ad34862e4
DEV: adds includeNone param to form-kit select (#31162)
This option allows to force the presence of none when a value is
selected.
2025-02-04 11:46:24 +01:00
David Battersby
294ed87a6f
UX: restore shared sidebar link for posts and drafts (#31159)
While introducing the new drafts dropdown menu component, we also made
some changes to how the sidebar link works for Drafts. However, after
following user feedback and internal discussions we decided to revert
back to the shared link approach that combines My Posts and My Drafts.
2025-02-04 14:40:18 +04:00
David Taylor
acad83199e
DEV: Make api version optional (#31160)
We'll be making this change more deeply soon. For now, this is the
minimum change required to a this version-free syntax work under
Discourse 3.4.0.
2025-02-04 10:19:04 +00:00
David Taylor
50337a7595
DEV: Pin pnpm to v9 (#31158)
pnpm 10 changed the lockfile syntax slightly, so we need to keep
everyone using v9 until we handle the upgrade.
2025-02-04 09:18:15 +00:00
Joffrey JAFFEUX
1a8b5b9d42
FIX: better standalone checkbox support (#31130)
Before this commit it was complicated to render a `Checkbox` outside of
a `CheckboxGroup` as you would get no title, no description, no optional
hint and not tooltip.

This commits makes all of this possible by adding a special case for
checkboxes, and sharing code for tooltips and optional hint.

This commit also uses this opportunity to refactor part of the code to
use curryComponent and reduce code duplication.
2025-02-04 09:58:00 +01:00
David Battersby
41ce3d868e
UX: improve drafts list (#31122)
Improves the layout for the drafts list page, including the addition of
icons to represent the content type.

Internal ref: /t/129117
2025-02-04 11:42:17 +04:00
Ted Johansson
503f9b6f02
DEV: Use default admin routes for plugins with settings (#30941)
This change adds a sidebar link for each plugin that fulfils the following criteria:

- Does not have an explicit admin route defined in the plugin.
- Has at least one site setting (not including enabled/disabled.)

That sidebar link leads to the automatically generated plugin show settings page.
2025-02-04 14:57:28 +08:00
Jordan Vidrine
9991eacef4
UX: More selectors for transparent buttons (#31155) 2025-02-04 03:04:16 +01:00
Sam
0b35f72e6a
DEV: upgrade mini_racer (#31154)
Previous upgrade had a runaway CPU issue due to
overly aggressive GC running.

MiniRacer was running V8 GC every 2 seconds.

New change fixes the parameter so it only issues a GC
if 2 seconds past since last MiniRacer eval.
2025-02-04 12:33:19 +11:00
Martin Brennan
91e9c1c813
UX: Hide inner site settings sidebar if admin sidebar enabled (#31047)
This experiment hides the list of categories in the inner
sidebar for the main site settings page if the admin sidebar
is enabled. It also defaults the list of settings to "All"
instead of a specific category.

Our theory here is that people who use this page are using
it to find an exact setting, not to go through the categories
one by one. Our admin sidebar also has several groups of important
settings already too, so that can be used for browsing.

Finally, the input on the page focuses when you load it, so
filtering is faster.
2025-02-04 09:24:03 +10:00
Jordan Vidrine
a961f92cc7
DEV: Add removed & back to transparent styling (#31149) 2025-02-03 17:03:45 -06:00
Kris
9d7764bb21
UX: prevent topic map link menu from overflowing when there are many links (#31147)
Before (overflows, can't reach bottom): 

<img
src="https://github.com/user-attachments/assets/fd3cf28a-9735-452e-82ca-8415da9fd66f"
height="500">

After (max-height clipped, can scroll contents): 

<img
src="https://github.com/user-attachments/assets/3b26bf84-a535-4931-9406-6a3354b76534"
height="500">
2025-02-03 18:02:41 -05:00
Régis Hanol
7245292fe1
FIX: chat was enqueueing too many "chat summary" emails (#31133)
due to an issue with LEFT JOIN, we were enqueue a "chat summary" email
for every new messages in a channel, instead of for every new mentions 😬

This bloated the sidekiq queue with a lot of unecessary jobs as seen in

- https://meta.discourse.org/t/-/347197
- https://meta.discourse.org/t/-/346542

Thankfully, it wasn't sending those emails as the query for listing the
unread mentions and dms was correct when generating the chat summary
email.
2025-02-03 23:56:47 +01:00
Jordan Vidrine
585c2b9ed3
UX: Replace href cancel with DButton (#31138) 2025-02-03 16:24:53 -06:00
Jarek Radosz
0ad05e022f
DEV: Fix unwanted stylelint changes, do cleanup (#31140) 2025-02-03 22:05:22 +01:00
Joffrey JAFFEUX
ab4ca0be6e
FIX: quote from thread in drawer mode (#31137)
Due to a recent regression the selection management was failing in
drawer mode for threads. We were not correctly setting the active
thread.

This commit fixes the issue and adds a spec.
2025-02-03 21:20:50 +01:00
Jarek Radosz
4b037a7f90
UX: Remove half-pixel border from loading dots (#31105)
That didn't render well (and was visible in dark themes only)
2025-02-03 20:26:24 +01:00
dependabot[bot]
fe9086fdfa
Build(deps): Bump ember-template-imports from 4.2.0 to 4.3.0 (#31111)
Bumps
[ember-template-imports](https://github.com/ember-template-imports/ember-template-imports)
from 4.2.0 to 4.3.0.
- [Release
notes](https://github.com/ember-template-imports/ember-template-imports/releases)
-
[Changelog](https://github.com/ember-cli/ember-template-imports/blob/master/CHANGELOG.md)
-
[Commits](https://github.com/ember-template-imports/ember-template-imports/commits)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-03 19:56:12 +01:00
David Taylor
c982593088
DEV: Warn admins about topic-list deprecations (#31136) 2025-02-03 18:35:35 +00:00
Kris
71eb2f6cda
UX: unblock clicking through progress bar wrapper (#31135)
Reported here:
https://meta.discourse.org/t/topic-navigation-toggle-prevents-interactions-on-the-page-in-a-certain-area/350073

The purple wrapper shown here prevents elements underneath it from being
clicked/tapped, this can sometimes interfere with post controls


![image](https://github.com/user-attachments/assets/18cec59d-f150-495c-86c9-572b261f95e3)

The fix is to disable pointer events on the wrapping element, so clicks
pass through. Then clicks are re-enabled on the child element.
2025-02-03 13:18:28 -05:00
David Taylor
c731a918e5
DEV: Mark topic-list-columns transformer as mutable (#31127)
`topic-list-columns` expects consumers to mutate the DAG, not return a
new one. This change means that themes/plugins do not need to remember
to `return columns` when using the transformer.

Also removes the exception when someone returns a value to a mutable
valueTransformer. This is essential for backward-compatibility.
2025-02-03 17:57:58 +00:00
David Taylor
a8e10521c3
DEV: Use transformed useMobileLayout value in topic-list/item (#31128) 2025-02-03 17:57:44 +00:00
Kris
7c50543da5
UX: fix topic progress position when composer is open (#31134)
I'm not sure what the original intention was @ZogStriP, but it seems
this causes a lot of overflow...


Before: 

![image](https://github.com/user-attachments/assets/64e12179-d948-4311-9cba-4271ebe8559e)


After: 

![image](https://github.com/user-attachments/assets/416d28b6-f116-42ab-8b8e-cfdeb477637e)
2025-02-03 12:40:18 -05:00