Robin Ward
f5e0cf63f6
SECURITY: The SSO return_path was an open redirect
...
This security fix needs SSO to be configured, and the user has to go
through the entire auth process before being redirected to the wrong host so
it is probably lower priority for most installs.
2015-01-22 12:33:07 -05:00
Régis Hanol
a036ac7bdc
FIX: users can see the raw email source of their own posts
2014-11-12 14:49:42 +01:00
David McClure
efc4109902
update specs to remove deprecation warnings
2014-11-07 06:05:44 -08:00
Régis Hanol
bb2d538194
FEATURE: log impersonations
2014-11-06 10:58:47 +01:00
Robin Ward
068d22e9b3
Add API support for querying admin reports by date range
2014-11-05 13:11:37 -05:00
Robin Ward
c9eb809dad
FIX: The text to users who signed up when approval was required was
...
misleading.
2014-11-04 15:48:03 -05:00
Régis Hanol
b09ad87098
FIX: add 'show emails' button from moderators in user admin section
2014-11-03 12:46:08 +01:00
Robin Ward
316f1bea04
SECURITY: Don't allow redirects with periods in case you don't control
...
other tlds on the same domain.
2014-10-30 11:31:44 -04:00
Régis Hanol
865194f409
FIX: cannot show email for pending/inactive users
2014-10-29 01:07:27 +01:00
Sam
7d6d8bd0a3
FEATURE: admin end point to sync sso /admin/users/sync_sso
...
Must be admin to invoke (api is fine too), uses same sso payload nonce is ignored
2014-10-28 11:25:21 +11:00
Régis Hanol
e7f251c105
LOTS of changes to properly handle post/topic revisions
...
FIX: history revision can now properly be hidden
FIX: PostRevision serializer is now entirely dynamic to properly handle
hidden revisions
FIX: default history modal to "side by side" view on mobile
FIX: properly hiden which revision has been hidden
UX: inline category/user/wiki/post_type changes with the revision
details
FEATURE: new '/posts/:post_id/revisions/latest' endpoint to retrieve
latest revision
UX: do not show the hide/show revision button on mobile (no room for
them)
UX: remove CSS transitions on the buttons in the history modal
FIX: PostRevisor now handles all the changes that might create new
revisions
FIX: PostRevision.ensure_consistency! was wrong due to off by 1
mistake...
refactored topic's callbacks for better readability
extracted 'PostRevisionGuardian'
2014-10-27 22:06:43 +01:00
Robin Ward
71f211f0b3
FEATURE: Allow users to select a badge with an image to appear on their
...
user card
2014-10-20 16:35:38 -04:00
Robin Ward
1cf4a0d604
Rename "User Expansion" to the much clearer "User Card"
2014-10-20 12:11:59 -04:00
Jeff Atwood
92b615b503
reorganize site settings a bit
2014-10-19 23:14:50 -07:00
Arpit Jalan
f8237e2ac0
add spec for raw_email action
2014-10-18 22:36:08 +05:30
Robin Ward
f3a67a48a3
Merge pull request #2874 from cpradio/clear-notifications
...
FEATURE: Mark All as Read button for Notifications page
2014-10-16 15:57:19 -04:00
Robin Ward
4d465362b5
FEATURE: Allow a user to upload an image for their expansion background.
2014-10-16 15:05:36 -04:00
cpradio
8f390c979b
FEATURE: Mark All as Read button for Notifications page
...
Added a Mark All as Read button to the top/bottom of the notifications user page
https://meta.discourse.org/t/possibility-to-selectively-or-completely-mark-notifications-as-read/20227
Remove notifications property (no longer used)
2014-10-13 06:31:27 -04:00
Régis Hanol
5754e8dd0f
FEATURE: auto-close topics based on last post
2014-10-10 18:21:44 +02:00
Régis Hanol
7e8c4b63f4
FIX: only show agreed abd deferred flags on user's profile
2014-10-09 16:10:16 +02:00
Robin Ward
f9a8f6d6ce
FEATURE: Support for a required setting on user fields.
2014-10-08 15:10:19 -04:00
Sam
0e7be81e60
FIX: badge granted titles were not being revoked when badge was revoked
2014-10-08 10:26:18 +11:00
Robin Ward
2fbfc9dffa
FIX: Editing a topic's title should be rate limited too.
2014-10-07 16:46:01 -04:00
Robin Ward
1252e7324f
Added easy impersonate route while in development mode
2014-10-07 12:25:50 -04:00
Arpit Jalan
78fd99fc40
Feature: resend invites
2014-10-07 01:43:17 +05:30
Robin Ward
381814fd5d
Adds support for a description to user fields.
2014-10-02 15:56:52 -04:00
Sam
29bb9eaa89
Merge pull request #2835 from techAPJ/patch-2
...
add user email on account created page
2014-10-02 17:29:26 +10:00
Arpit Jalan
41af2d79b5
add user email on account created page
2014-10-02 12:43:44 +05:30
Régis Hanol
98b6b9821a
FEATURE: log topic/post deletions from staff members
2014-10-01 17:40:13 +02:00
Robin Ward
edb34c178a
FEATURE: Show user fields when the user is signing up
2014-09-30 10:45:18 -04:00
Sam
4bcd4e05b8
correct spec
2014-09-30 13:16:34 +10:00
Régis Hanol
a7a1dcadcc
use the right HTTP verb
2014-09-29 22:41:54 +02:00
Régis Hanol
7e309a21cf
FEATURE: hide emails behind a button for staff members
2014-09-29 22:31:05 +02:00
Robin Ward
0fc0533134
FEATURE: Admin interface for adding custom fields for users
2014-09-25 16:17:51 -04:00
Régis Hanol
de76b512c1
fix most deprecations in the specs (still some left)
2014-09-25 17:44:48 +02:00
Sam
dd5872eecb
remove warnings
2014-09-25 17:46:51 +10:00
Robin Ward
bc53d48bd7
Renaming site contents to site text
2014-09-24 16:08:14 -04:00
Sam
58eabb03e5
FEATURE: api support for arbitrary unlinked assets
...
admins can set retain periods for assets
2014-09-23 16:50:17 +10:00
Sam
d1f6aba71f
fix test
2014-09-23 09:55:30 +10:00
Sam
9428ad779f
FIX: send content length with backups
2014-09-23 09:25:53 +10:00
Sam
8c74255cbb
FIX: 404 if we try to navigate to a non-existant page
2014-09-22 17:08:11 +10:00
Robin Ward
c16b8364ab
FIX: Support ember app routing to topics with only slugs
2014-09-17 11:18:59 -04:00
riking
2c6d03f87f
SECURITY: Limit passwords to 200 characters
...
Prevents layer 8 attack.
2014-09-12 12:07:11 -04:00
Robin Ward
eb512f07a7
FIX: Spec failures for feeds related to enabling categories as default
...
page for anons when latest is deleted.
2014-09-11 15:30:41 -04:00
Régis Hanol
e56fcf0c43
FEATURE: add 'rebake post' in post wrench menu
2014-09-11 16:04:40 +02:00
Sam
aa21969d99
fix incorrect spec
2014-09-11 11:31:31 +10:00
riking
69bc552054
FEATURE: Actually show more notifications
...
The "Show more notifications..." link in the notifications dropdown now
links to /my/notifications, which is a historical view of all
notifications you have recieved.
Notification history is loaded in blocks of 60 at a time.
Admins can see others' notification history. (This was requested for
'debugging purposes', though that's what impersonation is for, IMO.)
2014-09-09 16:29:08 -07:00
Régis Hanol
eb34ecfc0c
FEATURE: new 'prevent anons from download files' site setting
2014-09-09 18:41:13 +02:00
Robin Ward
334e21a03a
Revert "Revert "FEATURE: Can create warnings for users via PM""
...
This reverts commit 1c7559380c
2014-09-08 11:11:56 -04:00
Robin Ward
1c7559380c
Revert "FEATURE: Can create warnings for users via PM"
...
This reverts commit b0bfc1f93f
2014-09-08 10:38:59 -04:00
