discourse/lib
Roman Rizzi 5e4c0e2caa
FEATURE: Treat site settings as plain text and add a new HTML type. (#12618)
To add an extra layer of security, we sanitize settings before shipping them to the client. We don't sanitize those that have the "html" type.

The CookedPostProcessor already uses Loofah for sanitization, so I chose to also use it for this. I added it to our gemfile since we installed it as a transitive dependency.
2021-04-07 12:51:19 -03:00
..
auth DEV: Deprecate message parameter in auth provider plugin API (#12523) 2021-03-25 13:23:48 +00:00
autospec DEV: Allow autospec to run full test suite in parallel (#11976) 2021-02-04 14:44:40 +00:00
backup_restore FIX: Remap old S3 endpoints during backup restore (#12276) 2021-03-03 21:10:09 +01:00
common_passwords DEV: s/\$redis/Discourse\.redis (#8431) 2019-12-03 10:05:53 +01:00
compression FIX: Decompressing lots of small files triggered error 2020-01-09 15:11:31 +01:00
content_security_policy FEATURE: Implement nonces for Google Tag Manager integration (#12531) 2021-03-26 11:19:31 -04:00
demon DEV: IMAP debugging improvements (#11784) 2021-01-21 11:37:47 +10:00
email FIX: Improvements to email styles (#12451) 2021-03-22 14:09:38 +02:00
emoji FIX: issues with frowning/grinning (#11235) 2020-11-25 09:09:35 +01:00
file_store PERF: Improve cook_url performance for topic thumbnails (#11609) 2020-12-30 18:13:13 +00:00
freedom_patches DEV: Remove String#match? and Regexp.match? polyfills (#12454) 2021-03-19 19:55:44 +00:00
generators REFACTOR: Move javascript tests inside discourse app 2020-10-02 11:29:36 -04:00
guardian FEATURE: allow category group moderators to pin/unpin topics (#12325) 2021-03-09 16:05:11 -05:00
highlight_js
i18n DEV: Add plugins client/server translation yml file priority structure (#11194) 2020-11-11 09:44:01 -06:00
imap DEV: IMAP debugging improvements (#11784) 2021-01-21 11:37:47 +10:00
import DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
import_export FEATURE: Include category position when exporting categories (#9658) 2020-05-07 12:17:15 +10:00
javascripts A11Y: makes user notifications list more accessible (#11992) 2021-02-08 08:45:14 +01:00
middleware FIX: Redirect to provided origin after auth (#12558) 2021-03-31 10:23:12 +01:00
migration FIX: Allow post migrations using #change to carry out unsafe migration 2020-05-15 14:23:27 +08:00
onebox Drop flash video onebox (#12261) 2021-03-02 17:11:14 +00:00
plugin DEV: Replace Rails ends_with? with Ruby end_with? (#12507) 2021-03-24 19:51:21 +02:00
pretty_text FIX: Missing files from previous commit 2020-09-15 10:59:41 -04:00
rate_limiter DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reviewable DEV: APIs for plugin to add custom reviewable confirm modal (#12246) 2021-03-02 10:28:27 -06:00
scheduler
search FIX: Limit PG headline based search blurb generation to 200 characters. 2020-08-12 15:34:27 +08:00
seed_data DEV: skip_jobs when seeding topics (#11289) 2020-11-19 17:31:21 +01:00
sidekiq DEV: s/\$redis/Discourse\.redis (#8431) 2019-12-03 10:05:53 +01:00
site_settings FEATURE: Treat site settings as plain text and add a new HTML type. (#12618) 2021-04-07 12:51:19 -03:00
stylesheet FIX: Regression in colors used by non-default theme (#12492) 2021-03-23 12:46:25 -04:00
svg_sprite DEV: Added support for custom site setting 'emoji_list' (#12414) 2021-04-07 15:32:05 +02:00
tasks Revert "FEATURE: Introduce theme/component QUnit tests (#12517)" (#12632) 2021-04-07 17:45:49 +03:00
theme_store DEV: Refactor theme SCSS compilation (#11919) 2021-02-02 13:09:41 -05:00
turbo_tests DEV: Add seed explicitly in turbo_rspec so that runs can be reproduced 2020-08-07 16:51:53 +01:00
validators FIX: post merging was failing silently (#12566) 2021-04-01 06:46:18 +05:30
webauthn SECURITY: 2FA with U2F / TOTP 2020-01-15 11:27:12 +01:00
wizard FEATURE: Various improvements to invite system (#12023) 2021-03-03 11:45:29 +02:00
admin_confirmation.rb DEV: Upgrade Redis to 4.2.1. 2020-06-15 10:05:22 +08:00
admin_constraint.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
admin_user_index_query.rb DEV: Standardize table sorting verbiage (#9757) 2020-05-14 20:10:59 -06:00
age_words.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
archetype.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
auth.rb DEV: remove instagram login site settings and auth classes. (#11073) 2020-10-30 09:09:56 +05:30
backup_restore.rb FIX: Killing a Unicorn worker shouldn't kill a running backup or restore process 2020-10-13 19:48:53 +02:00
badge_posts_view_manager.rb DEV: stop freezing frozen strings 2020-04-30 16:48:53 +10:00
badge_queries.rb FEATURE: multiple use invite links (#9813) 2020-06-09 20:49:32 +05:30
base62.rb DEV: stop freezing frozen strings 2020-04-30 16:48:53 +10:00
bookmark_manager.rb FEATURE: Bookmark pinning (#12431) 2021-03-22 09:50:22 +10:00
bookmark_query.rb FEATURE: Bookmark pinning (#12431) 2021-03-22 09:50:22 +10:00
bookmark_reminder_notification_handler.rb FIX: dont error when bookmark topic is nil (#10555) 2020-08-31 09:15:36 +10:00
browser_detection.rb FIX: Detect DiscourseHub user agent. 2019-08-09 11:58:15 +03:00
cache.rb FIX: ensures defined expired_in is passed from write to write_entry (#11622) 2021-01-04 10:34:44 +01:00
canonical_url.rb FEATURE: default canonical URL (#9738) 2020-05-12 09:13:20 +10:00
category_badge.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
comment_migration.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
composer_messages_finder.rb FEATURE: Rename 'Discourse SSO' to DiscourseConnect (#11978) 2021-02-08 10:04:33 +00:00
configurable_urls.rb Replace base_uri with base_path (#10879) 2020-10-09 12:51:24 +01:00
content_buffer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
content_security_policy.rb FIX: Allow CSP to work correctly for non-default hostnames/schemes (#9180) 2020-03-19 19:54:42 +00:00
cooked_post_processor.rb SECURITY: Prefer Loofah for processing cooked HTML 2021-02-24 17:17:49 +02:00
crawler_detection.rb FEATURE: Implement browser update in crawler view (#12448) 2021-03-22 19:41:42 +02:00
csrf_token_verifier.rb DEV: Provide method for auth plugins to generate a CSRF token 2019-08-13 01:13:08 +01:00
current_user.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
custom_renderer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
custom_setting_providers.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
db_helper.rb DEV: Skip readonly tables when remapping content (#10461) 2020-08-18 08:53:12 +01:00
directory_helper.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
discourse_cookie_store.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
discourse_diff.rb FEATURE: Nokogumbo (#9577) 2020-05-05 13:46:57 +10:00
discourse_event.rb DEV: Ensure DiscourseEvent handlers cleaned up during specs (#11205) 2020-11-11 19:46:13 +00:00
discourse_hub.rb DEV: s/\$redis/Discourse\.redis (#8431) 2019-12-03 10:05:53 +01:00
discourse_ip_info.rb FIX: MaxMind DB file not downloading correctly 2020-01-05 22:08:13 +11:00
discourse_js_processor.rb DEV: We hadn't enabled object-rest-spread in all contexts (#12452) 2021-03-19 13:57:04 -04:00
discourse_logstash_logger.rb FIX: Use 'hostname' when Discourse.os_hostname is not available 2020-02-18 13:37:39 +02:00
discourse_plugin_registry.rb DEV: APIs for plugin to add custom reviewable confirm modal (#12246) 2021-03-02 10:28:27 -06:00
discourse_redis.rb DEV: Use rails_failover gem for ActiveRecord and Redis failover handling 2020-06-15 15:47:07 +08:00
discourse_tagging.rb FEATURE: Add new :topic_tags_changed DiscourseEvent (#12530) 2021-03-26 13:53:47 +10:00
discourse_updates.rb DEV: use Redis data for version check in DiscourseUpdates (#12293) 2021-03-08 09:05:08 -05:00
discourse.rb DEV: apply allow origin response header for CDN requests. (#11893) 2021-01-29 07:44:49 +05:30
disk_space.rb FIX: correct upload statistics report for external storage 2020-02-20 15:15:53 +11:00
distributed_cache.rb
distributed_memoizer.rb DEV: Replace Time.new with Time.now (#9142) 2020-03-09 17:37:49 +01:00
distributed_mutex.rb FIX: Off-by-one error setting the distributed mutex key to expire 2020-02-03 14:54:50 +00:00
edit_rate_limiter.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
email_backup_token.rb DEV: s/\$redis/Discourse\.redis (#8431) 2019-12-03 10:05:53 +01:00
email_cook.rb PERF: Avoid lookbehinds when replacing links in imported emails (#11931) 2021-02-02 17:34:00 +01:00
email_updater.rb FEATURE: add maximum limit for secondary emails (#12599) 2021-04-05 20:31:42 +05:30
email.rb FEATURE: Obfuscate emails on invite show page (#12433) 2021-03-18 19:09:23 +02:00
encodings.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
enum_site_setting.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
enum.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
excerpt_parser.rb FIX: always truncate uncomplete emojis in excerpts (#11678) 2021-01-11 13:43:11 +11:00
feed_element_installer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
feed_item_accessor.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
file_helper.rb PERF: optimize homepage and topic performance (#11607) 2020-12-30 13:08:02 +00:00
filter_best_posts.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
final_destination.rb FEATURE: Oneboxer cache response body (#12562) 2021-03-31 13:19:34 -04:00
flag_query.rb FIX: use allowlist and blocklist terminology (#10209) 2020-07-27 10:23:54 +10:00
flag_settings.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
gaps.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
global_path.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
guardian.rb FIX: Simplify send PM to email settings (#12583) 2021-04-06 15:39:27 +03:00
has_errors.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
hijack.rb DEV: Add more debugging context to onebox generation 2020-10-22 12:50:22 +08:00
homepage_constraint.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
html_prettify.rb DEV: stop freezing frozen strings 2020-04-30 16:48:53 +10:00
html_to_markdown.rb FEATURE: support mark tag (#12088) 2021-02-15 21:47:30 +05:30
http_language_parser.rb FIX: Include resolved locale in anonymous cache key (#10289) 2020-07-22 18:00:07 +01:00
image_sizer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
import_export.rb FEATURE: Rake task to export groups (#9450) 2020-04-17 14:59:54 -07:00
inline_oneboxer.rb FEATURE: check blocked_onebox_domains setting for inline oneboxes (#11944) 2021-02-03 21:45:22 +05:30
introduction_updater.rb FIX: replace default welcome topic post with new value from wizard 2020-04-01 15:42:45 -04:00
ip_addr.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
js_locale_helper.rb FEATURE: Add English (UK) as locale (#11768) 2021-01-20 21:32:22 +01:00
json_error.rb FIX: Fix build. 2019-05-22 17:39:44 +03:00
letter_avatar.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
markdown_linker.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
mem_info.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
message_bus_diags.rb PERF: avoid shelling to get hostname aggressively 2020-02-18 15:13:19 +11:00
method_profiler.rb DEV: Add output_sql_to_stderr! to MethodProfiler (#12445) 2021-03-19 17:48:30 +10:00
mini_sql_multisite_connection.rb DEV: upgrade mini_sql (#12465) 2021-03-24 08:48:04 +11:00
mobile_detection.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
new_post_manager.rb FIX: Reintroduce auto_silence_first_post_regex (#12223) 2021-02-26 15:07:04 +02:00
new_post_result.rb Support for custom messages and redirects when creating posts (#8434) 2019-11-29 09:30:54 -05:00
notification_levels.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
oneboxer.rb FEATURE: Oneboxer cache response body (#12562) 2021-03-31 13:19:34 -04:00
onpdiff.rb FIX: Show a correct diff when editing consecutive paragraphs (#8177) 2019-10-11 03:50:37 -04:00
pbkdf2.rb DEV: Switch our fast_xor gem for xorcist (#10565) 2020-08-31 13:20:44 -06:00
permalink_constraint.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
pinned_check.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
plain_text_to_markdown.rb DEV: stop freezing frozen strings 2020-04-30 16:48:53 +10:00
plugin_gem.rb FEATURE: allow specifying platform name for platform specific gems (#10559) 2020-08-31 12:36:04 +10:00
plugin_initialization_guard.rb DEV: Print backtrace of error when plugin fails to initialize. 2020-06-09 10:25:43 +08:00
post_action_creator.rb FEATURE: New DiscourseEvent trigger for likes (#12374) 2021-03-11 21:07:29 -03:00
post_action_destroyer.rb FIX: Unlike own posts on ownership transfer (#10446) 2020-08-19 09:21:02 -06:00
post_action_result.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
post_creator.rb FEATURE: Allow durations < 1 hour and < 1 day for topic timers where duration is specified (auto delete replies, close based on last post) (#11961) 2021-02-05 10:12:56 +10:00
post_destroyer.rb FIX: delete orphan post revisions (#12502) 2021-03-25 12:34:53 +11:00
post_jobs_enqueuer.rb DEV: TopicTrackingState calls should happen in the background (#11682) 2021-01-11 15:58:27 -05:00
post_locker.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
post_merger.rb FIX: post merging was failing silently (#12566) 2021-04-01 06:46:18 +05:30
post_revisor.rb FIX: Add topic_diff to PostRevisor (#12518) 2021-03-25 10:24:50 +10:00
pretty_text.rb FIX: Escape Font Awesome icons (#12421) 2021-03-17 16:11:40 +03:00
promotion.rb FIX: TL2 promotion message and advance training (#10679) 2020-09-22 10:17:52 +10:00
quote_comparer.rb FEATURE: Nokogumbo (#9577) 2020-05-05 13:46:57 +10:00
rake_helpers.rb Try fix upload_spec flakys and remove logging from tasks/uploads_spec 2020-02-18 15:08:58 +10:00
rate_limiter.rb FIX: Add Retry-Header to rate limited responses (#11736) 2021-01-19 11:35:46 +02:00
read_only_header.rb DEV: rename ReadOnly module to ReadOnlyHeader 2019-05-06 16:07:49 +02:00
retrieve_title.rb FIX: Inline Onebox should use encoding from Content-Type header when present (#11625) 2021-01-04 22:32:08 +03:00
route_format.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
route_matcher.rb REFACTOR: Introduce RouteMatcher class 2020-10-19 10:40:55 +01:00
rtl.rb Check site default locale if Rtl class is initialized without a user (#8417) 2019-11-26 15:01:37 -05:00
s3_helper.rb FIX: AWS S3 errors don't necessarily include a message 2020-08-12 17:00:09 -04:00
s3_inventory.rb FIX: increase inventory lag for s3 to 2 days (#11606) 2020-12-30 16:05:42 +11:00
score_calculator.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
screening_model.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
search.rb FEATURE: Change very high/low search priority to rank at absolute ends. 2021-03-09 09:20:37 +08:00
secure_session.rb DEV: s/\$redis/Discourse\.redis (#8431) 2019-12-03 10:05:53 +01:00
shrink_uploaded_image.rb FIX: Handle the case where upload goes missing during downsizing 2020-07-06 18:51:38 +02:00
single_sign_on_provider.rb FEATURE: Rename 'Discourse SSO' to DiscourseConnect (#11978) 2021-02-08 10:04:33 +00:00
single_sign_on.rb FEATURE: Allow using invites when DiscourseConnect SSO is enabled (#12419) 2021-03-19 10:20:10 +10:00
site_icon_manager.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
site_setting_extension.rb FEATURE: Treat site settings as plain text and add a new HTML type. (#12618) 2021-04-07 12:51:19 -03:00
slug.rb FIX: Make category slugs lowercase (#11277) 2021-01-12 17:28:33 +02:00
socket_server.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
spam_handler.rb FIX: use allowlist and blocklist terminology (#10209) 2020-07-27 10:23:54 +10:00
sql_builder.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
staff_constraint.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
staff_message_format.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
suggested_topics_builder.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
system_message.rb DEV: Add option to send system message to groups (#12256) 2021-03-02 18:51:50 +01:00
temporary_db.rb FIX: rake db:validate_indexes was broken (#12463) 2021-03-24 08:53:01 +11:00
text_cleaner.rb FEATURE: English locale with international date formats 2019-05-20 13:47:20 +02:00
text_sentinel.rb FEATURE: Improve errors when title is invalid (#11149) 2020-11-11 15:11:36 +02:00
theme_javascript_compiler.rb Revert "FEATURE: Introduce theme/component QUnit tests (#12517)" (#12632) 2021-04-07 17:45:49 +03:00
theme_modifier_helper.rb DEV: Allow plugins to add theme modifiers via db migrations (#9192) 2020-03-12 16:35:28 +00:00
theme_settings_manager.rb DEV: support json_schema in theme settings (#12294) 2021-03-10 20:15:04 -05:00
theme_settings_parser.rb DEV: support json_schema in theme settings (#12294) 2021-03-10 20:15:04 -05:00
theme_translation_manager.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
theme_translation_parser.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
timeline_lookup.rb FIX: ensures timeline_lookup includes last tuple (#11829) 2021-01-25 11:30:59 +01:00
topic_creator.rb FIX: Improve error messages if user cannot send PM emails (#12547) 2021-03-30 12:18:57 +03:00
topic_list_responder.rb DEV: Refactor draft attributes for CategoryList and TopicList. 2020-07-24 10:11:30 +08:00
topic_publisher.rb FIX: Use destroy_all instead of delete_all for shared drafts 2020-03-05 11:13:43 -08:00
topic_query_params.rb FIX: Build correct topic list filter (#11473) 2020-12-11 14:20:48 +02:00
topic_query_sql.rb
topic_query.rb FEATURE: New way to dismiss new topics (#11927) 2021-02-04 11:27:34 +11:00
topic_retriever.rb FEATURE: Fallback to system users when creating new TopicEmbed (#12386) 2021-03-15 11:58:53 -03:00
topic_subtype.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_upload_security_manager.rb DEV: Add security_last_changed_at and security_last_changed_reason to uploads (#11860) 2021-01-29 09:03:44 +10:00
topic_view.rb FIX: Embedded comments should only return regular posts (#11773) 2021-01-21 12:47:03 -05:00
topics_bulk_action.rb FEATURE: Create revision when bulk moving topics (#10802) 2020-11-12 13:57:12 +01:00
trust_level.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
turbo_tests.rb FIX: Made turbo_rspec display errors in shared groups correctly 2019-08-29 12:41:14 +01:00
twitter_api.rb DEV: Update rubocop-discourse from 2.3.2 to 2.4.0 (#11079) 2020-10-30 15:04:29 +01:00
unicorn_logstash_patch.rb DEV: Fix lint. 2020-07-21 15:55:03 +08:00
unread.rb DEV: Apply Rubocop redundant return style 2019-11-14 15:10:51 -05:00
upload_creator.rb FIX: do not convert format for site setting uploads (#12410) 2021-03-16 20:14:41 +05:30
upload_fixer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
upload_markdown.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
upload_recovery.rb DEV: Recover missing files of existing uploads (#10757) 2020-10-01 14:54:45 +02:00
upload_security.rb FIX: Do not mark group_flair images as secure on upload (#12081) 2021-02-16 12:34:03 +10:00
url_helper.rb PERF: Improve cook_url performance for topic thumbnails (#11609) 2020-12-30 18:13:13 +00:00
user_lookup.rb FEATURE: Allow setting avatar flair for automatic groups (#12586) 2021-04-06 11:13:06 -04:00
user_name_suggester.rb FIX: allow for final sigma in suggested usernames (#11540) 2020-12-23 08:51:36 +11:00
version.rb Version bump to v2.7.0.beta5 (#12287) 2021-03-10 13:45:19 -05:00
webauthn.rb DEV: stop freezing frozen strings 2020-04-30 16:48:53 +10:00
wizard.rb DEV: Allow plugins to add wizard steps after specific steps (#9315) 2020-04-01 08:36:50 -05:00
zeitwerk_config.rb FIX: deprecation warning - initialization autoloaded the constant (#12400) 2021-03-16 09:47:57 +11:00