discourse/spec/components/cooked_post_processor_spec.rb

# frozen_string_literal: true

require "rails_helper"
require "cooked_post_processor"
require "file_store/s3_store"

def s3_setup
  Rails.configuration.action_controller.stubs(:asset_host).returns("https://local.cdn.com")

  SiteSetting.s3_upload_bucket = "some-bucket-on-s3"
  SiteSetting.s3_access_key_id = "s3-access-key-id"
  SiteSetting.s3_secret_access_key = "s3-secret-access-key"
  SiteSetting.s3_cdn_url = "https://s3.cdn.com"
  SiteSetting.enable_s3_uploads = true
  SiteSetting.authorized_extensions = "png|jpg|gif|mov|ogg|"
end

describe CookedPostProcessor do
  fab!(:upload) { Fabricate(:upload) }
  let(:upload_path) { Discourse.store.upload_path }

  context "#post_process" do
    fab!(:post) do
      Fabricate(:post, raw: <<~RAW)
      <img src="#{upload.url}">
      RAW
    end

    let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
    let(:post_process) { sequence("post_process") }

    it "post process in sequence" do
      cpp.expects(:post_process_oneboxes).in_sequence(post_process)
      cpp.expects(:post_process_images).in_sequence(post_process)
      cpp.expects(:optimize_urls).in_sequence(post_process)
      cpp.expects(:pull_hotlinked_images).in_sequence(post_process)
      cpp.post_process

      expect(PostUpload.exists?(post: post, upload: upload)).to eq(true)
    end

    describe 'when post contains oneboxes and inline oneboxes' do
      let(:url_hostname) { 'meta.discourse.org' }

      let(:url) do
        "https://#{url_hostname}/t/mini-inline-onebox-support-rfc/66400"
      end

      let(:not_oneboxed_url) do
        "https://#{url_hostname}/t/random-url"
      end

      let(:title) { 'some title' }

      let(:post) do
        Fabricate(:post, raw: <<~RAW)
        #{url}
        This is a #{url} with path

        #{not_oneboxed_url}

        This is a https://#{url_hostname}/t/another-random-url test
        This is a #{url} with path

        #{url}
        RAW
      end

      before do
        SiteSetting.enable_inline_onebox_on_all_domains = true

        %i{head get}.each do |method|
          stub_request(method, url).to_return(
            status: 200,
            body: <<~RAW
            <html>
              <head>
                <title>#{title}</title>
                <meta property='og:title' content="#{title}">
                <meta property='og:description' content="some description">
              </head>
            </html>
            RAW
          )
        end
      end

      after do
        InlineOneboxer.invalidate(url)
        Oneboxer.invalidate(url)
      end

      it 'should respect SiteSetting.max_oneboxes_per_post' do
        SiteSetting.max_oneboxes_per_post = 2
        SiteSetting.add_rel_nofollow_to_user_content = false

        cpp.post_process

        expect(cpp.html).to have_tag('a',
          with: { href: url, class: "inline-onebox" },
          text: title,
          count: 2
        )

        expect(cpp.html).to have_tag('aside.onebox a', text: title, count: 2)

        expect(cpp.html).to have_tag('aside.onebox a',
          text: url_hostname,
          count: 2
        )

        expect(cpp.html).to have_tag('a',
          without: { class: "inline-onebox-loading" },
          text: not_oneboxed_url,
          count: 1
        )

        expect(cpp.html).to have_tag('a',
          without: {
            class: 'onebox'
          },
          text: not_oneboxed_url,
          count: 1
        )
      end
    end

    describe 'when post contains inline oneboxes' do
      before do
        SiteSetting.enable_inline_onebox_on_all_domains = true
      end

      describe 'internal links' do
        fab!(:topic) { Fabricate(:topic) }
        fab!(:post) { Fabricate(:post, raw: "Hello #{topic.url}") }
        let(:url) { topic.url }

        it "includes the topic title" do
          cpp.post_process

          expect(cpp.html).to have_tag('a',
            with: { href: UrlHelper.cook_url(url) },
            without: { class: "inline-onebox-loading" },
            text: topic.title,
            count: 1
          )

          topic.update!(title: "Updated to something else")
          cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
          cpp.post_process

          expect(cpp.html).to have_tag('a',
            with: { href: UrlHelper.cook_url(url) },
            without: { class: "inline-onebox-loading" },
            text: topic.title,
            count: 1
          )
        end
      end

      describe 'external links' do
        let(:url_with_path) do
          'https://meta.discourse.org/t/mini-inline-onebox-support-rfc/66400'
        end

        let(:url_with_query_param) do
          'https://meta.discourse.org?a'
        end

        let(:url_no_path) do
          'https://meta.discourse.org/'
        end

        let(:urls) do
          [
            url_with_path,
            url_with_query_param,
            url_no_path
          ]
        end

        let(:title) { '<b>some title</b>' }
        let(:escaped_title) { CGI.escapeHTML(title) }

        let(:post) do
          Fabricate(:post, raw: <<~RAW)
          This is a #{url_with_path} topic
          This should not be inline #{url_no_path} oneboxed

          - #{url_with_path}


             - #{url_with_query_param}
          RAW
        end

        let(:staff_post) do
          Fabricate(:post, user: Fabricate(:admin), raw: <<~RAW)
          This is a #{url_with_path} topic
          RAW
        end

        before do
          urls.each do |url|
            stub_request(:get, url).to_return(
              status: 200,
              body: "<html><head><title>#{escaped_title}</title></head></html>"
            )
          end
        end

        after do
          urls.each { |url| InlineOneboxer.invalidate(url) }
        end

        it 'should convert the right links to inline oneboxes' do
          cpp.post_process
          html = cpp.html

          expect(html).to_not have_tag('a',
            with: { href: url_no_path },
            without: { class: "inline-onebox-loading" },
            text: title
          )

          expect(html).to have_tag('a',
            with: { href: url_with_path },
            without: { class: "inline-onebox-loading" },
            text: title,
            count: 2
          )

          expect(html).to have_tag('a',
            with: { href: url_with_query_param },
            without: { class: "inline-onebox-loading" },
            text: title,
            count: 1
          )

          expect(html).to have_tag("a[rel='noopener nofollow ugc']")
        end

        it 'removes nofollow if user is staff/tl3' do
          cpp = CookedPostProcessor.new(staff_post, invalidate_oneboxes: true)
          cpp.post_process
          expect(cpp.html).to_not have_tag("a[rel='noopener nofollow ugc']")
        end
      end
    end

    context "processing images" do
      before do
        SiteSetting.responsive_post_image_sizes = ""
      end

      context "responsive images" do
        before { SiteSetting.responsive_post_image_sizes = "1|1.5|3" }

        it "includes responsive images on demand" do
          upload.update!(width: 2000, height: 1500, filesize: 10000)
          post = Fabricate(:post, raw: "hello <img src='#{upload.url}'>")

          # fake some optimized images
          OptimizedImage.create!(
            url: "/#{upload_path}/666x500.jpg",
            width: 666,
            height: 500,
            upload_id: upload.id,
            sha1: SecureRandom.hex,
            extension: '.jpg',
            filesize: 500,
            version: OptimizedImage::VERSION
          )

          # fake 3x optimized image, we lose 2 pixels here over original due to rounding on downsize
          OptimizedImage.create!(
            url: "/#{upload_path}/1998x1500.jpg",
            width: 1998,
            height: 1500,
            upload_id: upload.id,
            sha1: SecureRandom.hex,
            extension: '.jpg',
            filesize: 800
          )

          # Fake a loading image
          _optimized_image = OptimizedImage.create!(
            url: "/#{upload_path}/10x10.png",
            width: CookedPostProcessor::LOADING_SIZE,
            height: CookedPostProcessor::LOADING_SIZE,
            upload_id: upload.id,
            sha1: SecureRandom.hex,
            extension: '.png',
            filesize: 123
          )

          cpp = CookedPostProcessor.new(post)

          cpp.add_to_size_cache(upload.url, 2000, 1500)
          cpp.post_process

          html = cpp.html

          expect(html).to include(%Q|data-small-upload="//test.localhost/#{upload_path}/10x10.png"|)
          # 1.5x is skipped cause we have a missing thumb
          expect(html).to include("srcset=\"//test.localhost/#{upload_path}/666x500.jpg, //test.localhost/#{upload_path}/1998x1500.jpg 3x\"")
          expect(html).to include("src=\"//test.localhost/#{upload_path}/666x500.jpg\"")

          # works with CDN
          set_cdn_url("http://cdn.localhost")

          cpp = CookedPostProcessor.new(post)
          cpp.add_to_size_cache(upload.url, 2000, 1500)
          cpp.post_process

          html = cpp.html

          expect(html).to include(%Q|data-small-upload="//cdn.localhost/#{upload_path}/10x10.png"|)
          expect(html).to include("srcset=\"//cdn.localhost/#{upload_path}/666x500.jpg, //cdn.localhost/#{upload_path}/1998x1500.jpg 3x\"")
          expect(html).to include("src=\"//cdn.localhost/#{upload_path}/666x500.jpg\"")
        end

        it "doesn't include response images for cropped images" do
          upload.update!(width: 200, height: 4000, filesize: 12345)
          post = Fabricate(:post, raw: "hello <img src='#{upload.url}'>")

          # fake some optimized images
          OptimizedImage.create!(
            url: 'http://a.b.c/200x500.jpg',
            width: 200,
            height: 500,
            upload_id: upload.id,
            sha1: SecureRandom.hex,
            extension: '.jpg',
            filesize: 500
          )

          cpp = CookedPostProcessor.new(post)
          cpp.add_to_size_cache(upload.url, 200, 4000)
          cpp.post_process

          expect(cpp.html).to_not include('srcset="')
        end
      end

      shared_examples "leave dimensions alone" do
        it "doesn't use them" do
          expect(cpp.html).to match(/src="http:\/\/foo.bar\/image.png" width="" height=""/)
          expect(cpp.html).to match(/src="http:\/\/domain.com\/picture.jpg" width="50" height="42"/)
          expect(cpp).to be_dirty
        end
      end

      context "with image_sizes" do
        fab!(:post) { Fabricate(:post_with_image_urls) }
        let(:cpp) { CookedPostProcessor.new(post, image_sizes: image_sizes) }

        before do
          cpp.post_process
        end

        context "valid" do
          let(:image_sizes) { { "http://foo.bar/image.png" => { "width" => 111, "height" => 222 } } }

          it "uses them" do
            expect(cpp.html).to match(/src="http:\/\/foo.bar\/image.png" width="111" height="222"/)
            expect(cpp.html).to match(/src="http:\/\/domain.com\/picture.jpg" width="50" height="42"/)
            expect(cpp).to be_dirty
          end
        end

        context "invalid width" do
          let(:image_sizes) { { "http://foo.bar/image.png" => { "width" => 0, "height" => 222 } } }
          include_examples "leave dimensions alone"
        end

        context "invalid height" do
          let(:image_sizes) { { "http://foo.bar/image.png" => { "width" => 111, "height" => 0 } } }
          include_examples "leave dimensions alone"
        end

        context "invalid width & height" do
          let(:image_sizes) { { "http://foo.bar/image.png" => { "width" => 0, "height" => 0 } } }
          include_examples "leave dimensions alone"
        end

      end

      context "with unsized images" do
        fab!(:upload) { Fabricate(:image_upload, width: 123, height: 456) }

        fab!(:post) do
          Fabricate(:post, raw: <<~HTML)
          <img src="#{upload.url}">
          HTML
        end

        let(:cpp) { CookedPostProcessor.new(post) }

        it "adds the width and height to images that don't have them" do
          cpp.post_process
          expect(cpp.html).to match(/width="123" height="456"/)
          expect(cpp).to be_dirty
        end

      end

      context "with large images" do
        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }

        fab!(:post) do
          Fabricate(:post, raw: <<~HTML)
          <img src="#{upload.url}">
          HTML
        end

        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }

        before do
          SiteSetting.max_image_height = 2000
          SiteSetting.create_thumbnails = true
        end

        it "generates overlay information" do
          cpp.post_process

          expect(cpp.html).to match_html <<~HTML.rstrip
            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="logo.png"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">logo.png</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
          HTML

          expect(cpp).to be_dirty
        end

        describe 'when image is inside onebox' do
          let(:url) { 'https://image.com/my-avatar' }
          let(:post) { Fabricate(:post, raw: url) }

          before do
            Oneboxer.stubs(:onebox).with(url, anything).returns("<img class='onebox' src='/#{upload_path}/original/1X/1234567890123456.jpg' />")
          end

          it 'should not add lightbox' do
            FastImage.expects(:size).returns([1750, 2000])

            cpp.post_process

            expect(cpp.html).to match_html <<~HTML.rstrip
              <p><img class="onebox" src="//test.localhost/#{upload_path}/original/1X/1234567890123456.jpg" width="690" height="788"></p>
            HTML
          end
        end

        describe 'when image is an svg' do
          fab!(:post) do
            Fabricate(:post, raw: "<img src=\"/#{Discourse.store.upload_path}/original/1X/1234567890123456.svg\">")
          end

          it 'should not add lightbox' do
            FastImage.expects(:size).returns([1750, 2000])

            cpp.post_process

            expect(cpp.html).to match_html <<~HTML.rstrip
              <p><img src="//test.localhost/#{upload_path}/original/1X/1234567890123456.svg" width="690" height="788"></p>
            HTML
          end

          describe 'when image src is an URL' do
            let(:post) do
              Fabricate(:post, raw: "<img src=\"http://test.discourse/#{upload_path}/original/1X/1234567890123456.svg?somepamas\">")
            end

            it 'should not add lightbox' do
              FastImage.expects(:size).returns([1750, 2000])

              SiteSetting.crawl_images = true
              cpp.post_process

              expect(cpp.html).to match_html("<p><img src=\"http://test.discourse/#{upload_path}/original/1X/1234567890123456.svg?somepamas\" width=\"690\"\ height=\"788\"></p>")
            end
          end
        end

        context "s3_uploads" do
          let(:upload) { Fabricate(:secure_upload_s3) }
          before do
            s3_setup
            stored_path = Discourse.store.get_path_for_upload(upload)
            upload.update_column(:url, "#{SiteSetting.Upload.absolute_base_url}/#{stored_path}")

            stub_request(:head, "https://#{SiteSetting.s3_upload_bucket}.s3.amazonaws.com/")
            stub_request(
              :put,
              "https://#{SiteSetting.s3_upload_bucket}.s3.amazonaws.com/optimized/1X/#{upload.sha1}_2_#{optimized_size}.#{upload.extension}"
            )
            stub_request(:get, /#{SiteSetting.s3_upload_bucket}\.s3\.amazonaws\.com/)

            SiteSetting.login_required = true
            SiteSetting.secure_media = true
          end

          let(:optimized_size) { "600x500" }

          let(:post) do
            Fabricate(:post, raw: "![large.png|#{optimized_size}](#{upload.short_url})")
          end

          let(:cooked_html) do
            <<~HTML
            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost/secure-media-uploads/original/1X/#{upload.sha1}.png" data-download-href="//test.localhost/uploads/short-url/#{upload.base62_sha1}.unknown?dl=1" title="large.png"><img src="" alt="large.png" data-base62-sha1="#{upload.base62_sha1}" width="600" height="500"><div class="meta">
            <svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">large.png</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg>
            </div></a></div></p>
            HTML
          end

          context "when the upload is attached to the correct post" do
            before do
              FastImage.expects(:size).returns([1750, 2000])
              OptimizedImage.expects(:resize).returns(true)
              Discourse.store.class.any_instance.expects(:has_been_uploaded?).at_least_once.returns(true)
              upload.update(secure: true, access_control_post: post)
            end

            # TODO fix this spec, it is sometimes getting CDN links when it runs concurrently
            xit "handles secure images with the correct lightbox link href" do
              cpp.post_process

              expect(cpp.html).to match_html cooked_html
            end
          end

          context "when the upload is attached to a different post" do
            before do
              FastImage.size(upload.url)
              upload.update(secure: true, access_control_post: Fabricate(:post))
            end

            it "does not create thumbnails or optimize images" do
              CookedPostProcessor.any_instance.expects(:optimize_image!).never
              Upload.any_instance.expects(:create_thumbnail!).never
              cpp.post_process

              expect(cpp.html).not_to match_html cooked_html
            end
          end
        end
      end

      context "with tall images" do
        fab!(:upload) { Fabricate(:image_upload, width: 860, height: 2000) }

        fab!(:post) do
          Fabricate(:post, raw: <<~HTML)
          <img src="#{upload.url}">
          HTML
        end

        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }

        before do
          SiteSetting.create_thumbnails = true
        end

        it "crops the image" do
          cpp.post_process

          expect(cpp.html).to match(/width="690" height="500">/)
          expect(cpp).to be_dirty
        end

      end

      context "with iPhone X screenshots" do
        fab!(:upload) { Fabricate(:image_upload, width: 1125, height: 2436) }

        fab!(:post) do
          Fabricate(:post, raw: <<~HTML)
          <img src="#{upload.url}">
          HTML
        end

        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }

        before do
          SiteSetting.create_thumbnails = true
        end

        it "crops the image" do
          cpp.post_process

          expect(cpp.html).to match_html <<~HTML.rstrip
            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="logo.png"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_230x500.png" width="230" height="500"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">logo.png</span><span class="informations">1125×2436 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
          HTML

          expect(cpp).to be_dirty
        end

      end

      context "with large images when using subfolders" do
        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }

        fab!(:post) do
          Fabricate(:post, raw: <<~HTML)
          <img src="/subfolder#{upload.url}">
          HTML
        end

        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }

        before do
          set_subfolder "/subfolder"
          stub_request(:get, "http://#{Discourse.current_hostname}/subfolder#{upload.url}").to_return(status: 200, body: File.new(Discourse.store.path_for(upload)))

          SiteSetting.max_image_height = 2000
          SiteSetting.create_thumbnails = true
        end

        it "generates overlay information" do
          cpp.post_process

          expect(cpp.html). to match_html <<~HTML.rstrip
            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost/subfolder#{upload.url}" data-download-href="//test.localhost/subfolder/#{upload_path}/#{upload.sha1}" title="logo.png"><img src="//test.localhost/subfolder/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">logo.png</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
          HTML

          expect(cpp).to be_dirty
        end

        it "should escape the filename" do
          upload.update!(original_filename: "><img src=x onerror=alert('haha')>.png")
          cpp.post_process

          expect(cpp.html).to match_html <<~HTML.rstrip
            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost/subfolder#{upload.url}" data-download-href="//test.localhost/subfolder/#{upload_path}/#{upload.sha1}" title="&amp;gt;&amp;lt;img src=x onerror=alert(&amp;#39;haha&amp;#39;)&amp;gt;.png"><img src="//test.localhost/subfolder/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">&amp;gt;&amp;lt;img src=x onerror=alert(&amp;#39;haha&amp;#39;)&amp;gt;.png</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
          HTML
        end

      end

      context "with title and alt" do
        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }

        fab!(:post) do
          Fabricate(:post, raw: <<~HTML)
          <img src="#{upload.url}" title="WAT" alt="RED">
          HTML
        end

        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }

        before do
          SiteSetting.max_image_height = 2000
          SiteSetting.create_thumbnails = true
        end

        it "generates overlay information using image title and ignores alt" do
          cpp.post_process

          expect(cpp.html).to match_html <<~HTML.rstrip
            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="WAT"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" title="WAT" alt="RED" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">WAT</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
          HTML

          expect(cpp).to be_dirty
        end

      end

      context "with title only" do
        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }

        fab!(:post) do
          Fabricate(:post, raw: <<~HTML)
          <img src="#{upload.url}" title="WAT">
          HTML
        end

        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }

        before do
          SiteSetting.max_image_height = 2000
          SiteSetting.create_thumbnails = true
        end

        it "generates overlay information using image title" do
          cpp.post_process

          expect(cpp.html).to match_html <<~HTML.rstrip
            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="WAT"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" title="WAT" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">WAT</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
          HTML

          expect(cpp).to be_dirty
        end

      end

      context "with alt only" do
        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }

        fab!(:post) do
          Fabricate(:post, raw: <<~HTML)
          <img src="#{upload.url}" alt="RED">
          HTML
        end

        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }

        before do
          SiteSetting.max_image_height = 2000
          SiteSetting.create_thumbnails = true
        end

        it "generates overlay information using image alt" do
          cpp.post_process

          expect(cpp.html).to match_html <<~HTML.rstrip
            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="RED"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" alt="RED" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">RED</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
          HTML

          expect(cpp).to be_dirty
        end

      end

      context "topic image" do
        fab!(:post) { Fabricate(:post_with_uploaded_image) }
        let(:cpp) { CookedPostProcessor.new(post) }

        it "adds a topic image if there's one in the first post" do
          FastImage.stubs(:size)
          expect(post.topic.image_upload_id).to eq(nil)

          cpp.post_process
          post.topic.reload
          expect(post.topic.image_upload_id).to be_present
        end

        it "removes image if post is edited and no longer has an image" do
          FastImage.stubs(:size)

          cpp.post_process
          post.topic.reload
          expect(post.topic.image_upload_id).to be_present
          expect(post.image_upload_id).to be_present

          post.update!(raw: "This post no longer has an image.")
          CookedPostProcessor.new(post).post_process
          post.topic.reload
          expect(post.topic.image_upload_id).not_to be_present
          expect(post.image_upload_id).not_to be_present
        end

        it "won't remove the original image if another post doesn't have an image" do
          FastImage.stubs(:size)
          topic = post.topic

          cpp.post_process
          topic.reload
          expect(topic.image_upload_id).to be_present
          expect(post.image_upload_id).to be_present

          post = Fabricate(:post, topic: topic, raw: "this post doesn't have an image")
          CookedPostProcessor.new(post).post_process
          topic.reload

          expect(post.topic.image_upload_id).to be_present
          expect(post.image_upload_id).to be_blank
        end

        it "generates thumbnails correctly" do
          FastImage.expects(:size).returns([1750, 2000])

          topic = post.topic
          cpp.post_process
          topic.reload
          expect(topic.image_upload_id).to be_present
          expect(post.image_upload_id).to be_present

          post = Fabricate(:post, topic: topic, raw: "this post doesn't have an image")
          CookedPostProcessor.new(post).post_process
          topic.reload

          expect(post.topic.image_upload_id).to be_present
          expect(post.image_upload_id).to be_blank
        end
      end

      context "post image" do
        let(:reply) { Fabricate(:post_with_uploaded_image, post_number: 2) }
        let(:cpp) { CookedPostProcessor.new(reply) }

        it "adds a post image if there's one in the post" do
          FastImage.stubs(:size)
          expect(reply.image_upload_id).to eq(nil)
          cpp.post_process
          reply.reload
          expect(reply.image_upload_id).to be_present
        end
      end
    end
  end

  context "#extract_images" do

    let(:post) { build(:post_with_plenty_of_images) }
    let(:cpp) { CookedPostProcessor.new(post) }

    it "does not extract emojis or images inside oneboxes or quotes" do
      expect(cpp.extract_images.length).to eq(0)
    end

  end

  context "#get_size_from_attributes" do

    let(:post) { build(:post) }
    let(:cpp) { CookedPostProcessor.new(post) }

    it "returns the size when width and height are specified" do
      img = { 'src' => 'http://foo.bar/image3.png', 'width' => 50, 'height' => 70 }
      expect(cpp.get_size_from_attributes(img)).to eq([50, 70])
    end

    it "returns the size when width and height are floats" do
      img = { 'src' => 'http://foo.bar/image3.png', 'width' => 50.2, 'height' => 70.1 }
      expect(cpp.get_size_from_attributes(img)).to eq([50, 70])
    end

    it "resizes when only width is specified" do
      img = { 'src' => 'http://foo.bar/image3.png', 'width' => 100 }
      SiteSetting.crawl_images = true
      FastImage.expects(:size).returns([200, 400])
      expect(cpp.get_size_from_attributes(img)).to eq([100, 200])
    end

    it "resizes when only height is specified" do
      img = { 'src' => 'http://foo.bar/image3.png', 'height' => 100 }
      SiteSetting.crawl_images = true
      FastImage.expects(:size).returns([100, 300])
      expect(cpp.get_size_from_attributes(img)).to eq([33, 100])
    end

    it "doesn't raise an error with a weird url" do
      img = { 'src' => nil, 'height' => 100 }
      SiteSetting.crawl_images = true
      expect(cpp.get_size_from_attributes(img)).to be_nil
    end

  end

  context "#get_size_from_image_sizes" do

    let(:post) { build(:post) }
    let(:cpp) { CookedPostProcessor.new(post) }

    it "returns the size" do
      image_sizes = { "http://my.discourse.org/image.png" => { "width" => 111, "height" => 222 } }
      expect(cpp.get_size_from_image_sizes("/image.png", image_sizes)).to eq([111, 222])
    end

  end

  context "#get_size" do

    let(:post) { build(:post) }
    let(:cpp) { CookedPostProcessor.new(post) }

    it "ensures urls are absolute" do
      cpp.expects(:is_valid_image_url?).with("http://test.localhost/relative/url/image.png")
      cpp.get_size("/relative/url/image.png")
    end

    it "ensures urls have a default scheme" do
      cpp.expects(:is_valid_image_url?).with("http://schemaless.url/image.jpg")
      cpp.get_size("//schemaless.url/image.jpg")
    end

    it "caches the results" do
      SiteSetting.crawl_images = true
      FastImage.expects(:size).returns([200, 400])
      cpp.get_size("http://foo.bar/image3.png")
      expect(cpp.get_size("http://foo.bar/image3.png")).to eq([200, 400])
    end

    context "when crawl_images is disabled" do

      before do
        SiteSetting.crawl_images = false
      end

      it "doesn't call FastImage" do
        FastImage.expects(:size).never
        expect(cpp.get_size("http://foo.bar/image1.png")).to eq(nil)
      end

      it "is always allowed to crawl our own images" do
        store = stub
        Discourse.expects(:store).returns(store).at_least_once
        store.expects(:has_been_uploaded?).returns(true)
        FastImage.expects(:size).returns([100, 200])
        expect(cpp.get_size("http://foo.bar/image2.png")).to eq([100, 200])
      end

      it "returns nil if FastImage can't get the original size" do
        Discourse.store.class.any_instance.expects(:has_been_uploaded?).returns(true)
        FastImage.expects(:size).returns(nil)
        expect(cpp.get_size("http://foo.bar/image3.png")).to eq(nil)
      end

    end

  end

  context "#is_valid_image_url?" do

    let(:post) { build(:post) }
    let(:cpp) { CookedPostProcessor.new(post) }

    it "validates HTTP(s) urls" do
      expect(cpp.is_valid_image_url?("http://domain.com")).to eq(true)
      expect(cpp.is_valid_image_url?("https://domain.com")).to eq(true)
    end

    it "doesn't validate other urls" do
      expect(cpp.is_valid_image_url?("ftp://domain.com")).to eq(false)
      expect(cpp.is_valid_image_url?("ftps://domain.com")).to eq(false)
      expect(cpp.is_valid_image_url?("/tmp/image.png")).to eq(false)
      expect(cpp.is_valid_image_url?("//domain.com")).to eq(false)
    end

    it "doesn't throw an exception with a bad URI" do
      expect(cpp.is_valid_image_url?("http://do<main.com")).to eq(nil)
    end

  end

  context "#get_filename" do

    let(:post) { build(:post) }
    let(:cpp) { CookedPostProcessor.new(post) }

    it "returns the filename of the src when there is no upload" do
      expect(cpp.get_filename(nil, "http://domain.com/image.png")).to eq("image.png")
    end

    it "returns the original filename of the upload when there is an upload" do
      upload = build(:upload, original_filename: "upload.jpg")
      expect(cpp.get_filename(upload, "http://domain.com/image.png")).to eq("upload.jpg")
    end

    it "returns a generic name for pasted images" do
      upload = build(:upload, original_filename: "blob.png")
      expect(cpp.get_filename(upload, "http://domain.com/image.png")).to eq(I18n.t('upload.pasted_image_filename'))
    end

  end

  context "#convert_to_link" do
    fab!(:thumbnail) { Fabricate(:optimized_image, upload: upload, width: 512, height: 384) }

    before do
      CookedPostProcessor.any_instance.stubs(:get_size).with(upload.url).returns([1024, 768])
    end

    it "adds lightbox and optimizes images" do
      post = Fabricate(:post, raw: "![image|1024x768, 50%](#{upload.short_url})")

      cpp = CookedPostProcessor.new(post, disable_loading_image: true)
      cpp.post_process

      doc = Nokogiri::HTML5::fragment(cpp.html)
      expect(doc.css('.lightbox-wrapper').size).to eq(1)
      expect(doc.css('img').first['srcset']).to_not eq(nil)
    end

    it "optimizes images in quotes" do
      post = Fabricate(:post, raw: <<~MD)
        [quote]
        ![image|1024x768, 50%](#{upload.short_url})
        [/quote]
      MD

      cpp = CookedPostProcessor.new(post, disable_loading_image: true)
      cpp.post_process

      doc = Nokogiri::HTML5::fragment(cpp.html)
      expect(doc.css('.lightbox-wrapper').size).to eq(0)
      expect(doc.css('img').first['srcset']).to_not eq(nil)
    end

    it "optimizes images in Onebox" do
      Oneboxer.expects(:onebox)
        .with("https://discourse.org", anything)
        .returns("<aside class='onebox'><img src='#{upload.url}' width='512' height='384'></aside>")

      post = Fabricate(:post, raw: "https://discourse.org")

      cpp = CookedPostProcessor.new(post, disable_loading_image: true)
      cpp.post_process

      doc = Nokogiri::HTML5::fragment(cpp.html)
      expect(doc.css('.lightbox-wrapper').size).to eq(0)
      expect(doc.css('img').first['srcset']).to_not eq(nil)
    end
  end

  context "#post_process_oneboxes" do
    let(:post) { build(:post_with_youtube, id: 123) }
    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }

    before do
      Oneboxer
        .expects(:onebox)
        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
        .returns("<div>GANGNAM STYLE</div>")

      cpp.post_process_oneboxes
    end

    it "inserts the onebox without wrapping p" do
      expect(cpp).to be_dirty
      expect(cpp.html).to match_html "<div>GANGNAM STYLE</div>"
    end

    describe "replacing downloaded onebox image" do
      let(:url) { 'https://image.com/my-avatar' }
      let(:image_url) { 'https://image.com/avatar.png' }

      it "successfully replaces the image" do
        Oneboxer.stubs(:onebox).with(url, anything).returns("<img class='onebox' src='#{image_url}' />")

        post = Fabricate(:post, raw: url)
        upload.update!(url: "https://test.s3.amazonaws.com/something.png")

        post.custom_fields[Post::DOWNLOADED_IMAGES] = { "//image.com/avatar.png": upload.id }
        post.save_custom_fields

        cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
        cpp.post_process_oneboxes

        expect(cpp.doc.to_s).to eq("<p><img class=\"onebox\" src=\"#{upload.url}\" width=\"\" height=\"\"></p>")

        upload.destroy!
        cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
        cpp.post_process_oneboxes

        expect(cpp.doc.to_s).to eq("<p><img class=\"onebox\" src=\"#{image_url}\" width=\"\" height=\"\"></p>")
        Oneboxer.unstub(:onebox)
      end

      context "when the post is with_secure_media and the upload is secure and secure media is enabled" do
        before do
          upload.update(secure: true)
          SiteSetting.login_required = true
          s3_setup
          SiteSetting.secure_media = true
          stub_request(:head, "https://#{SiteSetting.s3_upload_bucket}.s3.amazonaws.com/")
        end

        it "does not use the direct URL, uses the cooked URL instead (because of the private ACL preventing w/h fetch)" do
          Oneboxer.stubs(:onebox).with(url, anything).returns("<img class='onebox' src='#{image_url}' />")

          post = Fabricate(:post, raw: url)
          upload.update!(url: "https://test.s3.amazonaws.com/something.png")

          post.custom_fields[Post::DOWNLOADED_IMAGES] = { "//image.com/avatar.png": upload.id }
          post.save_custom_fields

          cooked_url = "https://localhost/secure-media-uploads/test.png"
          UrlHelper.expects(:cook_url).with(upload.url, secure: true).returns(cooked_url)

          cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
          cpp.post_process_oneboxes

          expect(cpp.doc.to_s).to eq("<p><img class=\"onebox\" src=\"#{cooked_url}\" width=\"\" height=\"\"></p>")
        end
      end
    end

    it "replaces large image placeholder" do
      url = 'https://image.com/my-avatar'
      image_url = 'https://image.com/avatar.png'

      Oneboxer.stubs(:onebox).with(url, anything).returns("<img class='onebox' src='#{image_url}' />")

      post = Fabricate(:post, raw: url)

      post.custom_fields[Post::LARGE_IMAGES] = ["//image.com/avatar.png"]
      post.save_custom_fields

      cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
      cpp.post_process

      expect(cpp.doc.to_s).to match(/<div class="large-image-placeholder">/)
    end
  end

  context "#post_process_oneboxes removes nofollow if add_rel_nofollow_to_user_content is disabled" do
    let(:post) { build(:post_with_youtube, id: 123) }
    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }

    before do
      SiteSetting.add_rel_nofollow_to_user_content = false
      Oneboxer.expects(:onebox)
        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
        .returns('<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="noopener nofollow ugc">GANGNAM STYLE</a></aside>')
      cpp.post_process_oneboxes
    end

    it "removes nofollow noopener from links" do
      expect(cpp).to be_dirty
      expect(cpp.html).to match_html '<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="noopener">GANGNAM STYLE</a></aside>'
    end
  end

  context "#post_process_oneboxes removes nofollow if user is tl3" do
    let(:post) { build(:post_with_youtube, id: 123) }
    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }

    before do
      post.user.trust_level = TrustLevel[3]
      post.user.save!
      SiteSetting.add_rel_nofollow_to_user_content = true
      SiteSetting.tl3_links_no_follow = false
      Oneboxer.expects(:onebox)
        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
        .returns('<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="noopener nofollow ugc">GANGNAM STYLE</a></aside>')
      cpp.post_process_oneboxes
    end

    it "removes nofollow ugc from links" do
      expect(cpp).to be_dirty
      expect(cpp.html).to match_html '<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="noopener">GANGNAM STYLE</a></aside>'
    end
  end

  context "#post_process_oneboxes with oneboxed image" do
    let(:post) { build(:post_with_youtube, id: 123) }
    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }

    it "applies aspect ratio to container" do
      Oneboxer.expects(:onebox)
        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
        .returns("<aside class='onebox'><div class='scale-images'><img src='/img.jpg' width='400' height='500'/></div></div>")

      cpp.post_process_oneboxes

      expect(cpp.html).to match_html('<aside class="onebox"><div class="aspect-image-full-size" style="--aspect-ratio:400/500;"><img src="/img.jpg"></div></aside>')
    end

    it "applies aspect ratio when wrapped in link" do
      Oneboxer.expects(:onebox)
        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
        .returns("<aside class='onebox'><div class='scale-images'><a href='https://example.com'><img src='/img.jpg' width='400' height='500'/></a></div></div>")

      cpp.post_process_oneboxes

      expect(cpp.html).to match_html('<aside class="onebox"><div class="aspect-image-full-size" style="--aspect-ratio:400/500;"><a href="https://example.com"><img src="/img.jpg"></a></div></aside>')
    end
  end

  context "#post_process_oneboxes with square image" do

    it "generates a onebox-avatar class" do
      SiteSetting.crawl_images = true

      url = 'https://square-image.com/onebox'

      body = <<~HTML
      <html>
      <head>
      <meta property='og:title' content="Page awesome">
      <meta property='og:image' content="https://image.com/avatar.png">
      <meta property='og:description' content="Page awesome desc">
      </head>
      </html>
      HTML

      stub_request(:head, url)
      stub_request(:get , url).to_return(body: body)
      FinalDestination.stubs(:lookup_ip).returns('1.2.3.4')

      # not an ideal stub but shipping the whole image to fast image can add
      # a lot of cost to this test
      FastImage.stubs(:size).returns([200, 200])

      post = Fabricate.build(:post, raw: url)
      cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)

      cpp.post_process_oneboxes

      expect(cpp.doc.to_s).not_to include('aspect-image')
      expect(cpp.doc.to_s).to include('onebox-avatar')
    end

  end

  context "#optimize_urls" do

    let(:post) { build(:post_with_uploads_and_links) }
    let(:cpp) { CookedPostProcessor.new(post) }

    it "uses schemaless url for uploads" do
      cpp.optimize_urls
      expect(cpp.html).to match_html <<~HTML.rstrip
        <p><a href="//test.localhost/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
        <img src="//test.localhost/#{upload_path}/original/1X/1234567890123456.jpg"><br>
        <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
        <img src="http://foo.bar/image.png"><br>
        <a class="attachment" href="//test.localhost/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
        <img src="//test.localhost/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
      HTML
    end

    context "when CDN is enabled" do

      it "uses schemaless CDN url for http uploads" do
        Rails.configuration.action_controller.stubs(:asset_host).returns("http://my.cdn.com")
        cpp.optimize_urls
        expect(cpp.html).to match_html <<~HTML.rstrip
          <p><a href="//my.cdn.com/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
          <img src="//my.cdn.com/#{upload_path}/original/1X/1234567890123456.jpg"><br>
          <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
          <img src="http://foo.bar/image.png"><br>
          <a class="attachment" href="//my.cdn.com/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
          <img src="//my.cdn.com/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
        HTML
      end

      it "doesn't use schemaless CDN url for https uploads" do
        Rails.configuration.action_controller.stubs(:asset_host).returns("https://my.cdn.com")
        cpp.optimize_urls
        expect(cpp.html).to match_html <<~HTML.rstrip
          <p><a href="https://my.cdn.com/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
          <img src="https://my.cdn.com/#{upload_path}/original/1X/1234567890123456.jpg"><br>
          <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
          <img src="http://foo.bar/image.png"><br>
          <a class="attachment" href="https://my.cdn.com/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
          <img src="https://my.cdn.com/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
        HTML
      end

      it "doesn't use CDN when login is required" do
        SiteSetting.login_required = true
        Rails.configuration.action_controller.stubs(:asset_host).returns("http://my.cdn.com")
        cpp.optimize_urls
        expect(cpp.html).to match_html <<~HTML.rstrip
          <p><a href="//my.cdn.com/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
          <img src="//my.cdn.com/#{upload_path}/original/1X/1234567890123456.jpg"><br>
          <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
          <img src="http://foo.bar/image.png"><br>
          <a class="attachment" href="//test.localhost/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
          <img src="//my.cdn.com/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
        HTML
      end

      it "doesn't use CDN when preventing anons from downloading files" do
        SiteSetting.prevent_anons_from_downloading_files = true
        Rails.configuration.action_controller.stubs(:asset_host).returns("http://my.cdn.com")
        cpp.optimize_urls
        expect(cpp.html).to match_html <<~HTML.rstrip
          <p><a href="//my.cdn.com/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
          <img src="//my.cdn.com/#{upload_path}/original/1X/1234567890123456.jpg"><br>
          <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
          <img src="http://foo.bar/image.png"><br>
          <a class="attachment" href="//test.localhost/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
          <img src="//my.cdn.com/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
        HTML
      end

      context "s3_uploads" do
        before do
          s3_setup

          uploaded_file = file_from_fixtures("smallest.png")
          upload_sha1 = Digest::SHA1.hexdigest(File.read(uploaded_file))

          upload.update!(
            original_filename: "smallest.png",
            width: 10,
            height: 20,
            sha1: upload_sha1,
            extension: "png",
          )
        end

        it "uses the right CDN when uploads are on S3" do
          stored_path = Discourse.store.get_path_for_upload(upload)
          upload.update_column(:url, "#{SiteSetting.Upload.absolute_base_url}/#{stored_path}")

          the_post = Fabricate(:post, raw: %Q{This post has a local emoji :+1: and an external upload\n\n![smallest.png|10x20](#{upload.short_url})})

          cpp = CookedPostProcessor.new(the_post)
          cpp.optimize_urls

          expect(cpp.html).to match_html <<~HTML.rstrip
            <p>This post has a local emoji <img src="https://local.cdn.com/images/emoji/twitter/+1.png?v=#{Emoji::EMOJI_VERSION}" title=":+1:" class="emoji" alt=":+1:"> and an external upload</p>
            <p><img src="https://s3.cdn.com/#{stored_path}" alt="smallest.png" data-base62-sha1="#{upload.base62_sha1}" width="10" height="20"></p>
          HTML
        end

        it "doesn't use CDN for secure media" do
          SiteSetting.secure_media = true

          stored_path = Discourse.store.get_path_for_upload(upload)
          upload.update_column(:url, "#{SiteSetting.Upload.absolute_base_url}/#{stored_path}")
          upload.update_column(:secure, true)

          the_post = Fabricate(:post, raw: %Q{This post has a local emoji :+1: and an external upload\n\n![smallest.png|10x20](#{upload.short_url})})

          cpp = CookedPostProcessor.new(the_post)
          cpp.optimize_urls

          expect(cpp.html).to match_html <<~HTML.rstrip
            <p>This post has a local emoji <img src="https://local.cdn.com/images/emoji/twitter/+1.png?v=#{Emoji::EMOJI_VERSION}" title=":+1:" class="emoji" alt=":+1:"> and an external upload</p>
            <p><img src="/secure-media-uploads/#{stored_path}" alt="smallest.png" data-base62-sha1="#{upload.base62_sha1}" width="10" height="20"></p>
          HTML
        end

        context "media uploads" do
          fab!(:image_upload) { Fabricate(:upload) }
          fab!(:audio_upload) { Fabricate(:upload, extension: "ogg") }
          fab!(:video_upload) { Fabricate(:upload, extension: "mov") }

          before do
            video_upload.update!(url: "#{SiteSetting.s3_cdn_url}/#{Discourse.store.get_path_for_upload(video_upload)}")
            stub_request(:head, video_upload.url)
          end

          it "ignores prevent_anons_from_downloading_files and oneboxes video uploads" do
            SiteSetting.prevent_anons_from_downloading_files = true

            the_post = Fabricate(:post, raw: "This post has an S3 video onebox:\n#{video_upload.url}")

            cpp = CookedPostProcessor.new(the_post.reload)
            cpp.post_process_oneboxes

            cpp = CookedPostProcessor.new(the_post.reload)
            cpp.post_process_oneboxes

            expect(cpp.html).to match_html <<~HTML
              <p>This post has an S3 video onebox:<br>
                        </p><div class="onebox video-onebox">
                          <video width="100%" height="100%" controls="">
                            <source src="#{video_upload.url}">
                            <a href="#{video_upload.url}" rel="nofollow ugc noopener">#{video_upload.url}</a>
                          </video>
                        </div>
            HTML
          end

          it "oneboxes video using secure url when secure_media is enabled" do
            SiteSetting.login_required = true
            SiteSetting.secure_media = true
            video_upload.update_column(:secure, true)

            the_post = Fabricate(:post, raw: "This post has an S3 video onebox:\n#{video_upload.url}")

            cpp = CookedPostProcessor.new(the_post)
            cpp.post_process_oneboxes

            secure_url = video_upload.url.sub(SiteSetting.s3_cdn_url, "#{Discourse.base_url}/secure-media-uploads")

            expect(cpp.html).to match_html <<~HTML.rstrip
              <p>This post has an S3 video onebox:<br>
              <div class="onebox video-onebox">
                <video width="100%" height="100%" controls="">
                  <source src="#{secure_url}">
                  <a href="#{secure_url}">#{secure_url}</a>
                </video>
              </div>
              </p>
            HTML
          end

          it "oneboxes only audio/video and not images when secure_media is enabled" do
            SiteSetting.login_required = true
            SiteSetting.secure_media = true

            video_upload.update_column(:secure, true)

            audio_upload.update!(
              url: "#{SiteSetting.s3_cdn_url}/#{Discourse.store.get_path_for_upload(audio_upload)}",
              secure: true
            )

            image_upload.update!(
              url: "#{SiteSetting.s3_cdn_url}/#{Discourse.store.get_path_for_upload(image_upload)}",
              secure: true
            )

            stub_request(:head, audio_upload.url)
            stub_request(:get, image_upload.url)

            raw = <<~RAW.rstrip
              This post has a video upload.
              #{video_upload.url}

              This post has an audio upload.
              #{audio_upload.url}

              And an image upload.
              ![logo.png](upload://#{image_upload.base62_sha1}.#{image_upload.extension})
            RAW

            the_post = Fabricate(:post, raw: raw)

            cpp = CookedPostProcessor.new(the_post)
            cpp.post_process_oneboxes

            secure_video_url = video_upload.url.sub(SiteSetting.s3_cdn_url, "#{Discourse.base_url}/secure-media-uploads")
            secure_audio_url = audio_upload.url.sub(SiteSetting.s3_cdn_url, "#{Discourse.base_url}/secure-media-uploads")

            expect(cpp.html).to match_html <<~HTML.rstrip
              <p>This post has a video upload.<br>
              <div class="onebox video-onebox">
                <video width="100%" height="100%" controls="">
                  <source src="#{secure_video_url}">
                  <a href="#{secure_video_url}">#{secure_video_url}</a>
                </video>
              </div>
              </p>
              <p>This post has an audio upload.<br>
              <audio controls=""><source src="#{secure_audio_url}"><a href="#{secure_audio_url}">#{secure_audio_url}</a></audio></p>
              <p>And an image upload.<br>
              <img src="#{image_upload.url}" alt="#{image_upload.original_filename}" data-base62-sha1="#{image_upload.base62_sha1}"></p>

            HTML
          end

        end
      end
    end

  end

  context "#remove_user_ids" do
    let(:topic) { Fabricate(:topic) }

    let(:post) do
      Fabricate(:post, raw: <<~RAW)
        link to a topic: #{topic.url}?u=foo

        a tricky link to a topic: #{topic.url}?bob=bob;u=sam&jane=jane

        link to an external topic: https://google.com/?u=bar

        a malformed url: https://www.example.com/#123#4
      RAW
    end

    let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }

    it "does remove user ids" do
      cpp.remove_user_ids

      expect(cpp.html).to have_tag('a', with: { href: topic.url })
      expect(cpp.html).to have_tag('a', with: { href: "#{topic.url}?bob=bob&jane=jane" })
      expect(cpp.html).to have_tag('a', with: { href: "https://google.com/?u=bar" })
      expect(cpp.html).to have_tag('a', with: { href: "https://www.example.com/#123#4" })
    end
  end

  context "#pull_hotlinked_images" do

    let(:post) { build(:post, created_at: 20.days.ago) }
    let(:cpp) { CookedPostProcessor.new(post) }

    before { cpp.stubs(:available_disk_space).returns(90) }

    it "runs even when download_remote_images_to_local is disabled" do
      # We want to run it to pull hotlinked optimized images
      SiteSetting.download_remote_images_to_local = false
      expect { cpp.pull_hotlinked_images }.
        to change { Jobs::PullHotlinkedImages.jobs.count }.by 1
    end

    context "when download_remote_images_to_local? is enabled" do
      before do
        SiteSetting.download_remote_images_to_local = true
      end

      it "disables download_remote_images if there is not enough disk space" do
        cpp.expects(:available_disk_space).returns(5)
        cpp.pull_hotlinked_images
        expect(SiteSetting.download_remote_images_to_local).to eq(false)
      end

      it "does not run when requested to skip" do
        CookedPostProcessor.new(post, skip_pull_hotlinked_images: true).pull_hotlinked_images
        expect(Jobs::PullHotlinkedImages.jobs.size).to eq(0)
      end

      context "and there is enough disk space" do
        before { cpp.expects(:disable_if_low_on_disk_space).at_least_once }

        context "and the post has been updated by an actual user" do

          before { post.id = 42 }

          it "ensures only one job is scheduled right after the editing_grace_period" do
            freeze_time

            Jobs.expects(:cancel_scheduled_job).with(:pull_hotlinked_images, post_id: post.id).once

            delay = SiteSetting.editing_grace_period + 1

            expect_enqueued_with(job: :pull_hotlinked_images, args: { post_id: post.id }, at: Time.zone.now + delay.seconds) do
              cpp.pull_hotlinked_images
            end
          end

        end

      end

    end

  end

  context "#disable_if_low_on_disk_space" do

    let(:post) { build(:post, created_at: 20.days.ago) }
    let(:cpp) { CookedPostProcessor.new(post) }

    before do
      SiteSetting.download_remote_images_to_local = true
      SiteSetting.download_remote_images_threshold = 20
      cpp.stubs(:available_disk_space).returns(50)
    end

    it "does nothing when there's enough disk space" do
      SiteSetting.expects(:download_remote_images_to_local=).never
      cpp.disable_if_low_on_disk_space
    end

    context "when there's not enough disk space" do

      before { SiteSetting.download_remote_images_threshold = 75 }

      it "disables download_remote_images_threshold and send a notification to the admin" do
        StaffActionLogger.any_instance.expects(:log_site_setting_change).once
        SystemMessage.expects(:create_from_system_user).with(Discourse.site_contact_user, :download_remote_images_disabled).once
        cpp.disable_if_low_on_disk_space

        expect(SiteSetting.download_remote_images_to_local).to eq(false)
      end

      it "doesn't disable download_remote_images_to_local if site uses S3" do
        SiteSetting.s3_access_key_id = "s3-access-key-id"
        SiteSetting.s3_secret_access_key = "s3-secret-access-key"
        SiteSetting.enable_s3_uploads = true
        cpp.disable_if_low_on_disk_space

        expect(SiteSetting.download_remote_images_to_local).to eq(true)
      end

    end

  end

  context "#is_a_hyperlink?" do

    let(:post) { build(:post) }
    let(:cpp) { CookedPostProcessor.new(post) }
    let(:doc) { Nokogiri::HTML5::fragment('<body><div><a><img id="linked_image"></a><p><img id="standard_image"></p></div></body>') }

    it "is true when the image is inside a link" do
      img = doc.css("img#linked_image").first
      expect(cpp.is_a_hyperlink?(img)).to eq(true)
    end

    it "is false when the image is not inside a link" do
      img = doc.css("img#standard_image").first
      expect(cpp.is_a_hyperlink?(img)).to eq(false)
    end

  end

  context "grant badges" do
    let(:cpp) { CookedPostProcessor.new(post) }

    context "emoji inside a quote" do
      let(:post) { Fabricate(:post, raw: "time to eat some sweet \n[quote]\n:candy:\n[/quote]\n mmmm") }

      it "doesn't award a badge when the emoji is in a quote" do
        cpp.grant_badges
        expect(post.user.user_badges.where(badge_id: Badge::FirstEmoji).exists?).to eq(false)
      end
    end

    context "emoji in the text" do
      let(:post) { Fabricate(:post, raw: "time to eat some sweet :candy: mmmm") }

      it "awards a badge for using an emoji" do
        cpp.grant_badges
        expect(post.user.user_badges.where(badge_id: Badge::FirstEmoji).exists?).to eq(true)
      end
    end

    context "onebox" do
      before do
        Oneboxer.stubs(:onebox).with(anything, anything).returns(nil)
        Oneboxer.stubs(:onebox).with('https://discourse.org', anything).returns("<aside class=\"onebox allowlistedgeneric\">the rest of the onebox</aside>")
      end

      it "awards the badge for using an onebox" do
        post = Fabricate(:post, raw: "onebox me:\n\nhttps://discourse.org\n")
        cpp = CookedPostProcessor.new(post)
        cpp.post_process_oneboxes
        cpp.grant_badges
        expect(post.user.user_badges.where(badge_id: Badge::FirstOnebox).exists?).to eq(true)
      end

      it "does not award the badge when link is not oneboxed" do
        post = Fabricate(:post, raw: "onebox me:\n\nhttp://example.com\n")
        cpp = CookedPostProcessor.new(post)
        cpp.post_process_oneboxes
        cpp.grant_badges
        expect(post.user.user_badges.where(badge_id: Badge::FirstOnebox).exists?).to eq(false)
      end

      it "does not award the badge when the badge is disabled" do
        Badge.where(id: Badge::FirstOnebox).update_all(enabled: false)
        post = Fabricate(:post, raw: "onebox me:\n\nhttps://discourse.org\n")
        cpp = CookedPostProcessor.new(post)
        cpp.post_process_oneboxes
        cpp.grant_badges
        expect(post.user.user_badges.where(badge_id: Badge::FirstOnebox).exists?).to eq(false)
      end
    end

    context "reply_by_email" do
      let(:post) { Fabricate(:post, raw: "This is a **reply** via email ;)", via_email: true, post_number: 2) }

      it "awards a badge for replying via email" do
        cpp.grant_badges
        expect(post.user.user_badges.where(badge_id: Badge::FirstReplyByEmail).exists?).to eq(true)
      end
    end

  end

  context "quote processing" do
    let(:cpp) { CookedPostProcessor.new(cp) }
    let(:pp) { Fabricate(:post, raw: "This post is ripe for quoting!") }

    context "with an unmodified quote" do
      let(:cp) do
        Fabricate(
          :post,
          raw: "[quote=\"#{pp.user.username}, post: #{pp.post_number}, topic:#{pp.topic_id}]\nripe for quoting\n[/quote]\ntest"
        )
      end

      it "should not be marked as modified" do
        cpp.post_process_quotes
        expect(cpp.doc.css('aside.quote.quote-modified')).to be_blank
      end
    end

    context "with a modified quote" do
      let(:cp) do
        Fabricate(
          :post,
          raw: "[quote=\"#{pp.user.username}, post: #{pp.post_number}, topic:#{pp.topic_id}]\nmodified\n[/quote]\ntest"
        )
      end

      it "should be marked as modified" do
        cpp.post_process_quotes
        expect(cpp.doc.css('aside.quote.quote-modified')).to be_present
      end
    end

  end

  context "full quote on direct reply" do
    fab!(:topic) { Fabricate(:topic) }
    let!(:post) { Fabricate(:post, topic: topic, raw: 'this is the "first" post') }

    let(:raw) do
      <<~RAW.strip
      [quote="#{post.user.username}, post:#{post.post_number}, topic:#{topic.id}"]

      this is the “first” post

      [/quote]

      and this is the third reply
      RAW
    end

    let(:raw2) do
      <<~RAW.strip
      and this is the third reply

      [quote="#{post.user.username}, post:#{post.post_number}, topic:#{topic.id}"]
      this is the ”first” post
      [/quote]
      RAW
    end

    let(:raw3) do
      <<~RAW.strip
      [quote="#{post.user.username}, post:#{post.post_number}, topic:#{topic.id}"]

      this is the “first” post

      [/quote]

      [quote="#{post.user.username}, post:#{post.post_number}, topic:#{topic.id}"]

      this is the “first” post

      [/quote]

      and this is the third reply
      RAW
    end

    before do
      SiteSetting.remove_full_quote = true
    end

    it 'works' do
      hidden = Fabricate(:post, topic: topic, hidden: true, raw: "this is the second post after")
      small_action = Fabricate(:post, topic: topic, post_type: Post.types[:small_action])
      reply = Fabricate(:post, topic: topic, raw: raw)

      freeze_time do
        topic.bumped_at = 1.day.ago
        CookedPostProcessor.new(reply).remove_full_quote_on_direct_reply

        expect(topic.ordered_posts.pluck(:id))
          .to eq([post.id, hidden.id, small_action.id, reply.id])

        expect(topic.bumped_at).to eq_time(1.day.ago)
        expect(reply.raw).to eq("and this is the third reply")
        expect(reply.revisions.count).to eq(1)
        expect(reply.revisions.first.modifications["raw"]).to eq([raw, reply.raw])
        expect(reply.revisions.first.modifications["edit_reason"][1]).to eq(I18n.t(:removed_direct_reply_full_quotes))
      end
    end

    it 'does nothing if there are multiple quotes' do
      reply = Fabricate(:post, topic: topic, raw: raw3)
      CookedPostProcessor.new(reply).remove_full_quote_on_direct_reply
      expect(topic.ordered_posts.pluck(:id)).to eq([post.id, reply.id])
      expect(reply.raw).to eq(raw3)
    end

    it 'does not delete quote if not first paragraph' do
      reply = Fabricate(:post, topic: topic, raw: raw2)
      CookedPostProcessor.new(reply).remove_full_quote_on_direct_reply
      expect(topic.ordered_posts.pluck(:id)).to eq([post.id, reply.id])
      expect(reply.raw).to eq(raw2)
    end

    it "does nothing when 'remove_full_quote' is disabled" do
      SiteSetting.remove_full_quote = false

      reply = Fabricate(:post, topic: topic, raw: raw)

      CookedPostProcessor.new(reply).remove_full_quote_on_direct_reply
      expect(reply.raw).to eq(raw)
    end

    it "does not generate a blank HTML document" do
      post = Fabricate(:post, topic: topic, raw: "<sunday><monday>")
      cp = CookedPostProcessor.new(post)
      cp.post_process
      expect(cp.html).to eq("<p></p>")
    end

    it "works only on new posts" do
      Fabricate(:post, topic: topic, hidden: true, raw: "this is the second post after")
      Fabricate(:post, topic: topic, post_type: Post.types[:small_action])
      reply = PostCreator.create!(topic.user, topic_id: topic.id, raw: raw)

      CookedPostProcessor.new(reply).post_process
      expect(reply.raw).to eq(raw)

      PostRevisor.new(reply).revise!(Discourse.system_user, raw: raw, edit_reason: "put back full quote")
      CookedPostProcessor.new(reply).post_process(new_post: true)
      expect(reply.raw).to eq("and this is the third reply")
    end

    it "works with nested quotes" do
      reply1 = Fabricate(:post, topic: topic, raw: raw)
      reply2 = Fabricate(:post, topic: topic, raw: <<~RAW.strip)
        [quote="#{reply1.user.username}, post:#{reply1.post_number}, topic:#{topic.id}"]
        #{raw}
        [/quote]

        quoting a post with a quote
      RAW

      CookedPostProcessor.new(reply2).remove_full_quote_on_direct_reply
      expect(reply2.raw).to eq('quoting a post with a quote')
    end
  end

end
-												DEV: use #frozen_string_literal: true on all spec

This change both speeds up specs (less strings to allocate) and helps catch
cases where methods in Discourse are mutating inputs.

Overall we will be migrating everything to use #frozen_string_literal: true
it will take a while, but this is the first and safest move in this direction

											
										
										
											2019-04-29 20:27:42 -04:00
+								# frozen_string_literal: true
-												Prepare for separation of RSpec helper files

Since rspec-rails 3, the default installation creates two helper files:
* `spec_helper.rb`
* `rails_helper.rb`

`spec_helper.rb` is intended as a way of running specs that do not
require Rails, whereas `rails_helper.rb` loads Rails (as Discourse's
current `spec_helper.rb` does).

For more information:

https://www.relishapp.com/rspec/rspec-rails/docs/upgrade#default-helper-files

In this commit, I've simply replaced all instances of `spec_helper` with
`rails_helper`, and renamed the original `spec_helper.rb`.

This brings the Discourse project closer to the standard usage of RSpec
in a Rails app.

At present, every spec relies on loading Rails, but there are likely
many that don't need to. In a future pull request, I hope to introduce a
separate, minimal `spec_helper.rb` which can be used in tests which
don't rely on Rails.

											
										
										
											2015-10-11 05:41:23 -04:00
+								require "rails_helper"
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								require "cooked_post_processor"
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
+								require "file_store/s3_store"
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												FIX: Secure Upload URLs in lightbox (#8451)

This fixes the following issues:

* The link element on the lightbox which pops open the lightbox was linking to the S3 URL with a private ACL instead of the secure media URL for the image
* Change to use `@post.with_secure_media?` in `CookedPostProcessor` for URL cooking, as in some cases, like when a post is edited and an upload is added, `upload.secure?` can be false which resulted in `srcset` URLs not being cooked correctly to secure media upload urls.

											
										
										
											2019-12-04 18:13:09 -05:00
+								def s3_setup
 								  Rails.configuration.action_controller.stubs(:asset_host).returns("https://local.cdn.com")
 								  SiteSetting.s3_upload_bucket = "some-bucket-on-s3"
 								  SiteSetting.s3_access_key_id = "s3-access-key-id"
 								  SiteSetting.s3_secret_access_key = "s3-secret-access-key"
 								  SiteSetting.s3_cdn_url = "https://s3.cdn.com"
 								  SiteSetting.enable_s3_uploads = true
 								  SiteSetting.authorized_extensions = "png|jpg|gif|mov|ogg|"
 								end
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
+								describe CookedPostProcessor do
-												DEV: Reduce object fabrication in `CookedPostProcessor` spec.

											
										
										
											2019-05-29 20:49:37 -04:00
+								  fab!(:upload) { Fabricate(:upload) }
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								  let(:upload_path) { Discourse.store.upload_path }
-												FIX: Link post to uploads in `PostCreator`.

* This ensures that uploads are linked to their post on creation
  instead of a background job which may be delayed if Sidekiq
  is facing difficulties.

											
										
										
											2018-09-05 21:58:01 -04:00
-												DEV: Reduce object fabrication in `CookedPostProcessor` spec.

											
										
										
											2019-05-29 20:49:37 -04:00
+								  context "#post_process" do
-												DEV: Prefabrication (test optimization) (#7414)

* Introduced fab!, a helper that creates database state for a group

It's almost identical to let_it_be, except:

 1. It creates a new object for each test by default,
 2. You can disable it using PREFABRICATION=0


											
										
										
											2019-05-06 23:12:20 -04:00
+								    fab!(:post) do
-												FIX: Link post to uploads in `PostCreator`.

* This ensures that uploads are linked to their post on creation
  instead of a background job which may be delayed if Sidekiq
  is facing difficulties.

											
										
										
											2018-09-05 21:58:01 -04:00
+								      Fabricate(:post, raw: <<~RAW)
 								      <img src="#{upload.url}">
 								      RAW
 								    end
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												FEATURE: Show a blurry preview when lazy loading images

This generates a 10x10 PNG thumbnail for each lightboxed image.
If Image Lazy Loading is enabled (IntersectionObserver API) then
we'll load the low res version when offscreen. As the image scrolls
in we'll swap it for the high res version.

We use a WeakMap to track the old image attributes. It's much less
memory than storing them as `data-*` attributes and swapping them
back and forth all the time.

											
										
										
											2018-12-14 17:44:38 -05:00
+								    let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								    let(:post_process) { sequence("post_process") }
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												update back-end specs

											
										
										
											2013-07-10 16:59:07 -04:00
+								    it "post process in sequence" do
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								      cpp.expects(:post_process_oneboxes).in_sequence(post_process)
-												FIX: properly handle too large & broken images in posts

											
										
										
											2017-11-16 09:45:07 -05:00
+								      cpp.expects(:post_process_images).in_sequence(post_process)
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								      cpp.expects(:optimize_urls).in_sequence(post_process)
 								      cpp.expects(:pull_hotlinked_images).in_sequence(post_process)
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								      cpp.post_process
-												FIX: Link post to uploads in `PostCreator`.

* This ensures that uploads are linked to their post on creation
  instead of a background job which may be delayed if Sidekiq
  is facing difficulties.

											
										
										
											2018-09-05 21:58:01 -04:00
 								      expect(PostUpload.exists?(post: post, upload: upload)).to eq(true)
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
+								    end
-												FEATURE: Reimplement `SiteSetting.max_oneboxes_per_post`. (#6668)

Previously, the site setting was only effective on the client side of
things. Once the site setting was been reached, all oneboxes are not
rendered. This commit changes it such that the site setting is respected
both on the client and server side. The first N oneboxes are rendered and
once the limit has been reached, subsequent oneboxes will not be
rendered.
											
										
										
											2018-11-27 03:00:31 -05:00
+								    describe 'when post contains oneboxes and inline oneboxes' do
 								      let(:url_hostname) { 'meta.discourse.org' }
 								      let(:url) do
 								        "https://#{url_hostname}/t/mini-inline-onebox-support-rfc/66400"
 								      end
-												UX: Strip class when link is not oneboxed due to site setting limits.

											
										
										
											2018-11-29 01:33:01 -05:00
+								      let(:not_oneboxed_url) do
 								        "https://#{url_hostname}/t/random-url"
 								      end
-												FEATURE: Reimplement `SiteSetting.max_oneboxes_per_post`. (#6668)

Previously, the site setting was only effective on the client side of
things. Once the site setting was been reached, all oneboxes are not
rendered. This commit changes it such that the site setting is respected
both on the client and server side. The first N oneboxes are rendered and
once the limit has been reached, subsequent oneboxes will not be
rendered.
											
										
										
											2018-11-27 03:00:31 -05:00
+								      let(:title) { 'some title' }
 								      let(:post) do
 								        Fabricate(:post, raw: <<~RAW)
 								        #{url}
 								        This is a #{url} with path
-												UX: Strip class when link is not oneboxed due to site setting limits.

											
										
										
											2018-11-29 01:33:01 -05:00
+								        #{not_oneboxed_url}
-												FEATURE: Reimplement `SiteSetting.max_oneboxes_per_post`. (#6668)

Previously, the site setting was only effective on the client side of
things. Once the site setting was been reached, all oneboxes are not
rendered. This commit changes it such that the site setting is respected
both on the client and server side. The first N oneboxes are rendered and
once the limit has been reached, subsequent oneboxes will not be
rendered.
											
										
										
											2018-11-27 03:00:31 -05:00
 								        This is a https://#{url_hostname}/t/another-random-url test
 								        This is a #{url} with path
 								        #{url}
 								        RAW
 								      end
 								      before do
 								        SiteSetting.enable_inline_onebox_on_all_domains = true
 								        %i{head get}.each do |method|
 								          stub_request(method, url).to_return(
 								            status: 200,
 								            body: <<~RAW
 								            <html>
 								              <head>
 								                <title>#{title}</title>
 								                <meta property='og:title' content="#{title}">
 								                <meta property='og:description' content="some description">
 								              </head>
 								            </html>
 								            RAW
 								          )
 								        end
 								      end
 								      after do
-												FIX: properly invalidate inline oneboxes when rebaking

When rebaking a post we were invalidating _regular_ oneboxes but not inline oneboxes.

DEV: also renamed 'InlineOneboxer.purge' to 'InlineOneboxer.invalidate' to keep
the API consistent with 'Oneboxer.invalidate'

											
										
										
											2020-06-24 05:54:54 -04:00
+								        InlineOneboxer.invalidate(url)
-												FEATURE: Reimplement `SiteSetting.max_oneboxes_per_post`. (#6668)

Previously, the site setting was only effective on the client side of
things. Once the site setting was been reached, all oneboxes are not
rendered. This commit changes it such that the site setting is respected
both on the client and server side. The first N oneboxes are rendered and
once the limit has been reached, subsequent oneboxes will not be
rendered.
											
										
										
											2018-11-27 03:00:31 -05:00
+								        Oneboxer.invalidate(url)
 								      end
 								      it 'should respect SiteSetting.max_oneboxes_per_post' do
 								        SiteSetting.max_oneboxes_per_post = 2
 								        SiteSetting.add_rel_nofollow_to_user_content = false
 								        cpp.post_process
 								        expect(cpp.html).to have_tag('a',
-												DEV: Remove INLINE_ONEBOX_* constants

There were two constants here, `INLINE_ONEBOX_LOADING_CSS_CLASS` and
`INLINE_ONEBOX_CSS_CLASS` that were both longer than the strings they
were DRYing up: `inline-onebox-loading` and `inline-onebox`

I normally appreciate constants, but in this case it meant that we had
a lot of JS imports resulting in many more lines of code (and CPU cycles
spent figuring them out.)

It also meant we had an `.erb` file and had to invoke Ruby to create the
JS file, which meant the app was harder to port to Ember CLI.

I removed the constants. It's less DRY but faster and simpler, and
arguably the loss of DRYness is not significant as you can still search
for the `inline-onebox-loading` and `inline-onebox` strings easily if
you are refactoring.

											
										
										
											2020-05-07 16:08:48 -04:00
+								          with: { href: url, class: "inline-onebox" },
-												FEATURE: Reimplement `SiteSetting.max_oneboxes_per_post`. (#6668)

Previously, the site setting was only effective on the client side of
things. Once the site setting was been reached, all oneboxes are not
rendered. This commit changes it such that the site setting is respected
both on the client and server side. The first N oneboxes are rendered and
once the limit has been reached, subsequent oneboxes will not be
rendered.
											
										
										
											2018-11-27 03:00:31 -05:00
+								          text: title,
 								          count: 2
 								        )
 								        expect(cpp.html).to have_tag('aside.onebox a', text: title, count: 2)
 								        expect(cpp.html).to have_tag('aside.onebox a',
 								          text: url_hostname,
 								          count: 2
 								        )
 								        expect(cpp.html).to have_tag('a',
-												DEV: Remove INLINE_ONEBOX_* constants

There were two constants here, `INLINE_ONEBOX_LOADING_CSS_CLASS` and
`INLINE_ONEBOX_CSS_CLASS` that were both longer than the strings they
were DRYing up: `inline-onebox-loading` and `inline-onebox`

I normally appreciate constants, but in this case it meant that we had
a lot of JS imports resulting in many more lines of code (and CPU cycles
spent figuring them out.)

It also meant we had an `.erb` file and had to invoke Ruby to create the
JS file, which meant the app was harder to port to Ember CLI.

I removed the constants. It's less DRY but faster and simpler, and
arguably the loss of DRYness is not significant as you can still search
for the `inline-onebox-loading` and `inline-onebox` strings easily if
you are refactoring.

											
										
										
											2020-05-07 16:08:48 -04:00
+								          without: { class: "inline-onebox-loading" },
-												UX: Strip class when link is not oneboxed due to site setting limits.

											
										
										
											2018-11-29 01:33:01 -05:00
+								          text: not_oneboxed_url,
-												FEATURE: Reimplement `SiteSetting.max_oneboxes_per_post`. (#6668)

Previously, the site setting was only effective on the client side of
things. Once the site setting was been reached, all oneboxes are not
rendered. This commit changes it such that the site setting is respected
both on the client and server side. The first N oneboxes are rendered and
once the limit has been reached, subsequent oneboxes will not be
rendered.
											
										
										
											2018-11-27 03:00:31 -05:00
+								          count: 1
 								        )
-												UX: Strip class when link is not oneboxed due to site setting limits.

											
										
										
											2018-11-29 01:33:01 -05:00
+								        expect(cpp.html).to have_tag('a',
 								          without: {
 								            class: 'onebox'
 								          },
 								          text: not_oneboxed_url,
 								          count: 1
 								        )
-												FEATURE: Reimplement `SiteSetting.max_oneboxes_per_post`. (#6668)

Previously, the site setting was only effective on the client side of
things. Once the site setting was been reached, all oneboxes are not
rendered. This commit changes it such that the site setting is respected
both on the client and server side. The first N oneboxes are rendered and
once the limit has been reached, subsequent oneboxes will not be
rendered.
											
										
										
											2018-11-27 03:00:31 -05:00
+								      end
 								    end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								    describe 'when post contains inline oneboxes' do
 								      before do
 								        SiteSetting.enable_inline_onebox_on_all_domains = true
 								      end
 								      describe 'internal links' do
-												DEV: Prefabrication (test optimization) (#7414)

* Introduced fab!, a helper that creates database state for a group

It's almost identical to let_it_be, except:

 1. It creates a new object for each test by default,
 2. You can disable it using PREFABRICATION=0


											
										
										
											2019-05-06 23:12:20 -04:00
+								        fab!(:topic) { Fabricate(:topic) }
 								        fab!(:post) { Fabricate(:post, raw: "Hello #{topic.url}") }
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								        let(:url) { topic.url }
 								        it "includes the topic title" do
 								          cpp.post_process
 								          expect(cpp.html).to have_tag('a',
-												DEV: Remove INLINE_ONEBOX_* constants

There were two constants here, `INLINE_ONEBOX_LOADING_CSS_CLASS` and
`INLINE_ONEBOX_CSS_CLASS` that were both longer than the strings they
were DRYing up: `inline-onebox-loading` and `inline-onebox`

I normally appreciate constants, but in this case it meant that we had
a lot of JS imports resulting in many more lines of code (and CPU cycles
spent figuring them out.)

It also meant we had an `.erb` file and had to invoke Ruby to create the
JS file, which meant the app was harder to port to Ember CLI.

I removed the constants. It's less DRY but faster and simpler, and
arguably the loss of DRYness is not significant as you can still search
for the `inline-onebox-loading` and `inline-onebox` strings easily if
you are refactoring.

											
										
										
											2020-05-07 16:08:48 -04:00
+								            with: { href: UrlHelper.cook_url(url) },
 								            without: { class: "inline-onebox-loading" },
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								            text: topic.title,
 								            count: 1
 								          )
 								          topic.update!(title: "Updated to something else")
 								          cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
 								          cpp.post_process
 								          expect(cpp.html).to have_tag('a',
-												DEV: Remove INLINE_ONEBOX_* constants

There were two constants here, `INLINE_ONEBOX_LOADING_CSS_CLASS` and
`INLINE_ONEBOX_CSS_CLASS` that were both longer than the strings they
were DRYing up: `inline-onebox-loading` and `inline-onebox`

I normally appreciate constants, but in this case it meant that we had
a lot of JS imports resulting in many more lines of code (and CPU cycles
spent figuring them out.)

It also meant we had an `.erb` file and had to invoke Ruby to create the
JS file, which meant the app was harder to port to Ember CLI.

I removed the constants. It's less DRY but faster and simpler, and
arguably the loss of DRYness is not significant as you can still search
for the `inline-onebox-loading` and `inline-onebox` strings easily if
you are refactoring.

											
										
										
											2020-05-07 16:08:48 -04:00
+								            with: { href: UrlHelper.cook_url(url) },
 								            without: { class: "inline-onebox-loading" },
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								            text: topic.title,
 								            count: 1
 								          )
 								        end
 								      end
 								      describe 'external links' do
 								        let(:url_with_path) do
 								          'https://meta.discourse.org/t/mini-inline-onebox-support-rfc/66400'
 								        end
 								        let(:url_with_query_param) do
 								          'https://meta.discourse.org?a'
 								        end
 								        let(:url_no_path) do
 								          'https://meta.discourse.org/'
 								        end
 								        let(:urls) do
 								          [
 								            url_with_path,
 								            url_with_query_param,
 								            url_no_path
 								          ]
 								        end
-												SECURITY: escape title HTML for inline onebox

											
										
										
											2019-01-09 20:02:05 -05:00
+								        let(:title) { '<b>some title</b>' }
 								        let(:escaped_title) { CGI.escapeHTML(title) }
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
 								        let(:post) do
 								          Fabricate(:post, raw: <<~RAW)
 								          This is a #{url_with_path} topic
 								          This should not be inline #{url_no_path} oneboxed
 								          - #{url_with_path}
 								             - #{url_with_query_param}
 								          RAW
 								        end
-												FIX: respect `tl3 links no follow` setting (#8232)


											
										
										
											2019-10-22 13:11:04 -04:00
+								        let(:staff_post) do
 								          Fabricate(:post, user: Fabricate(:admin), raw: <<~RAW)
 								          This is a #{url_with_path} topic
 								          RAW
 								        end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								        before do
 								          urls.each do |url|
 								            stub_request(:get, url).to_return(
 								              status: 200,
-												SECURITY: escape title HTML for inline onebox

											
										
										
											2019-01-09 20:02:05 -05:00
+								              body: "<html><head><title>#{escaped_title}</title></head></html>"
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								            )
 								          end
 								        end
 								        after do
-												FIX: properly invalidate inline oneboxes when rebaking

When rebaking a post we were invalidating _regular_ oneboxes but not inline oneboxes.

DEV: also renamed 'InlineOneboxer.purge' to 'InlineOneboxer.invalidate' to keep
the API consistent with 'Oneboxer.invalidate'

											
										
										
											2020-06-24 05:54:54 -04:00
+								          urls.each { |url| InlineOneboxer.invalidate(url) }
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								        end
 								        it 'should convert the right links to inline oneboxes' do
 								          cpp.post_process
 								          html = cpp.html
 								          expect(html).to_not have_tag('a',
-												DEV: Remove INLINE_ONEBOX_* constants

There were two constants here, `INLINE_ONEBOX_LOADING_CSS_CLASS` and
`INLINE_ONEBOX_CSS_CLASS` that were both longer than the strings they
were DRYing up: `inline-onebox-loading` and `inline-onebox`

I normally appreciate constants, but in this case it meant that we had
a lot of JS imports resulting in many more lines of code (and CPU cycles
spent figuring them out.)

It also meant we had an `.erb` file and had to invoke Ruby to create the
JS file, which meant the app was harder to port to Ember CLI.

I removed the constants. It's less DRY but faster and simpler, and
arguably the loss of DRYness is not significant as you can still search
for the `inline-onebox-loading` and `inline-onebox` strings easily if
you are refactoring.

											
										
										
											2020-05-07 16:08:48 -04:00
+								            with: { href: url_no_path },
 								            without: { class: "inline-onebox-loading" },
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								            text: title
 								          )
 								          expect(html).to have_tag('a',
-												DEV: Remove INLINE_ONEBOX_* constants

There were two constants here, `INLINE_ONEBOX_LOADING_CSS_CLASS` and
`INLINE_ONEBOX_CSS_CLASS` that were both longer than the strings they
were DRYing up: `inline-onebox-loading` and `inline-onebox`

I normally appreciate constants, but in this case it meant that we had
a lot of JS imports resulting in many more lines of code (and CPU cycles
spent figuring them out.)

It also meant we had an `.erb` file and had to invoke Ruby to create the
JS file, which meant the app was harder to port to Ember CLI.

I removed the constants. It's less DRY but faster and simpler, and
arguably the loss of DRYness is not significant as you can still search
for the `inline-onebox-loading` and `inline-onebox` strings easily if
you are refactoring.

											
										
										
											2020-05-07 16:08:48 -04:00
+								            with: { href: url_with_path },
 								            without: { class: "inline-onebox-loading" },
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								            text: title,
 								            count: 2
 								          )
 								          expect(html).to have_tag('a',
-												DEV: Remove INLINE_ONEBOX_* constants

There were two constants here, `INLINE_ONEBOX_LOADING_CSS_CLASS` and
`INLINE_ONEBOX_CSS_CLASS` that were both longer than the strings they
were DRYing up: `inline-onebox-loading` and `inline-onebox`

I normally appreciate constants, but in this case it meant that we had
a lot of JS imports resulting in many more lines of code (and CPU cycles
spent figuring them out.)

It also meant we had an `.erb` file and had to invoke Ruby to create the
JS file, which meant the app was harder to port to Ember CLI.

I removed the constants. It's less DRY but faster and simpler, and
arguably the loss of DRYness is not significant as you can still search
for the `inline-onebox-loading` and `inline-onebox` strings easily if
you are refactoring.

											
										
										
											2020-05-07 16:08:48 -04:00
+								            with: { href: url_with_query_param },
 								            without: { class: "inline-onebox-loading" },
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								            text: title,
 								            count: 1
 								          )
-												FIX: respect `tl3 links no follow` setting (#8232)


											
										
										
											2019-10-22 13:11:04 -04:00
-												FIX: Make sure rel attributes are correctly set. (#10645)

We must guarantee that "rel=noopener" was set if "target=_blank" is present, which is not always the case for trusted users. Also, if the link contains the "nofollow" attribute, it has to have the "ugc" attribute as well.
											
										
										
											2020-09-10 11:59:51 -04:00
+								          expect(html).to have_tag("a[rel='noopener nofollow ugc']")
-												FIX: respect `tl3 links no follow` setting (#8232)


											
										
										
											2019-10-22 13:11:04 -04:00
+								        end
 								        it 'removes nofollow if user is staff/tl3' do
 								          cpp = CookedPostProcessor.new(staff_post, invalidate_oneboxes: true)
 								          cpp.post_process
-												FIX: Make sure rel attributes are correctly set. (#10645)

We must guarantee that "rel=noopener" was set if "target=_blank" is present, which is not always the case for trusted users. Also, if the link contains the "nofollow" attribute, it has to have the "ugc" attribute as well.
											
										
										
											2020-09-10 11:59:51 -04:00
+								          expect(cpp.html).to_not have_tag("a[rel='noopener nofollow ugc']")
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								        end
 								      end
 								    end
-												FEATURE: Show a blurry preview when lazy loading images

This generates a 10x10 PNG thumbnail for each lightboxed image.
If Image Lazy Loading is enabled (IntersectionObserver API) then
we'll load the low res version when offscreen. As the image scrolls
in we'll swap it for the high res version.

We use a WeakMap to track the old image attributes. It's much less
memory than storing them as `data-*` attributes and swapping them
back and forth all the time.

											
										
										
											2018-12-14 17:44:38 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								    context "processing images" do
 								      before do
 								        SiteSetting.responsive_post_image_sizes = ""
 								      end
 								      context "responsive images" do
 								        before { SiteSetting.responsive_post_image_sizes = "1|1.5|3" }
 								        it "includes responsive images on demand" do
-												DEV: Reduce object fabrication in `CookedPostProcessor` spec.

											
										
										
											2019-05-29 20:49:37 -04:00
+								          upload.update!(width: 2000, height: 1500, filesize: 10000)
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          post = Fabricate(:post, raw: "hello <img src='#{upload.url}'>")
 								          # fake some optimized images
 								          OptimizedImage.create!(
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								            url: "/#{upload_path}/666x500.jpg",
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								            width: 666,
 								            height: 500,
 								            upload_id: upload.id,
 								            sha1: SecureRandom.hex,
 								            extension: '.jpg',
 								            filesize: 500,
 								            version: OptimizedImage::VERSION
 								          )
-												FEATURE: add support for responsive images in posts

When creating lightboxes we will attempt to create 1.5x and 2x thumbnails
for retina screens, this can be controlled with a new hidden site setting
called responsice_post_image_sizes, if you wish to create 3x images run

SiteSetting.responsive_post_image_sizes = "1|1.5|2|3"


The default should be good for most of the setups as it balances filesize
with quality. 3x thumbs can get big.

											
										
										
											2018-10-02 23:44:53 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          # fake 3x optimized image, we lose 2 pixels here over original due to rounding on downsize
 								          OptimizedImage.create!(
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								            url: "/#{upload_path}/1998x1500.jpg",
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								            width: 1998,
 								            height: 1500,
 								            upload_id: upload.id,
 								            sha1: SecureRandom.hex,
 								            extension: '.jpg',
 								            filesize: 800
 								          )
-												FEATURE: add support for responsive images in posts

When creating lightboxes we will attempt to create 1.5x and 2x thumbnails
for retina screens, this can be controlled with a new hidden site setting
called responsice_post_image_sizes, if you wish to create 3x images run

SiteSetting.responsive_post_image_sizes = "1|1.5|2|3"


The default should be good for most of the setups as it balances filesize
with quality. 3x thumbs can get big.

											
										
										
											2018-10-02 23:44:53 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          # Fake a loading image
-												DEV: correct fragile test

This test would fail sometimes if for some reason topic id 1 was in the db

No reason to pretend here, this only makes for a fragile test suite.

											
										
										
											2019-11-01 00:40:00 -04:00
+								          _optimized_image = OptimizedImage.create!(
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								            url: "/#{upload_path}/10x10.png",
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								            width: CookedPostProcessor::LOADING_SIZE,
 								            height: CookedPostProcessor::LOADING_SIZE,
 								            upload_id: upload.id,
 								            sha1: SecureRandom.hex,
 								            extension: '.png',
 								            filesize: 123
 								          )
-												DEV: Improve tests to assert that the right HTML is generated.

											
										
										
											2018-12-19 18:13:36 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          cpp = CookedPostProcessor.new(post)
-												FIX: Use CDN for optimized loading images. (#7006)

We missed a few spots in the cooked post processor where images where not loaded using CDN, causing
uneeded load and requests against the server 
											
										
										
											2019-02-19 21:55:08 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          cpp.add_to_size_cache(upload.url, 2000, 1500)
 								          cpp.post_process
-												FIX: Use CDN for optimized loading images. (#7006)

We missed a few spots in the cooked post processor where images where not loaded using CDN, causing
uneeded load and requests against the server 
											
										
										
											2019-02-19 21:55:08 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          html = cpp.html
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          expect(html).to include(%Q|data-small-upload="//test.localhost/#{upload_path}/10x10.png"|)
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          # 1.5x is skipped cause we have a missing thumb
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          expect(html).to include("srcset=\"//test.localhost/#{upload_path}/666x500.jpg, //test.localhost/#{upload_path}/1998x1500.jpg 3x\"")
 								          expect(html).to include("src=\"//test.localhost/#{upload_path}/666x500.jpg\"")
-												FIX: Use CDN for optimized loading images. (#7006)

We missed a few spots in the cooked post processor where images where not loaded using CDN, causing
uneeded load and requests against the server 
											
										
										
											2019-02-19 21:55:08 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          # works with CDN
 								          set_cdn_url("http://cdn.localhost")
-												FIX: don't use srcset on cropped thumbnails

											
										
										
											2018-10-25 10:08:10 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          cpp = CookedPostProcessor.new(post)
 								          cpp.add_to_size_cache(upload.url, 2000, 1500)
 								          cpp.post_process
-												FIX: don't use srcset on cropped thumbnails

											
										
										
											2018-10-25 10:08:10 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          html = cpp.html
-												FEATURE: add support for responsive images in posts

When creating lightboxes we will attempt to create 1.5x and 2x thumbnails
for retina screens, this can be controlled with a new hidden site setting
called responsice_post_image_sizes, if you wish to create 3x images run

SiteSetting.responsive_post_image_sizes = "1|1.5|2|3"


The default should be good for most of the setups as it balances filesize
with quality. 3x thumbs can get big.

											
										
										
											2018-10-02 23:44:53 -04:00
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          expect(html).to include(%Q|data-small-upload="//cdn.localhost/#{upload_path}/10x10.png"|)
 								          expect(html).to include("srcset=\"//cdn.localhost/#{upload_path}/666x500.jpg, //cdn.localhost/#{upload_path}/1998x1500.jpg 3x\"")
 								          expect(html).to include("src=\"//cdn.localhost/#{upload_path}/666x500.jpg\"")
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        end
-												FEATURE: add support for responsive images in posts

When creating lightboxes we will attempt to create 1.5x and 2x thumbnails
for retina screens, this can be controlled with a new hidden site setting
called responsice_post_image_sizes, if you wish to create 3x images run

SiteSetting.responsive_post_image_sizes = "1|1.5|2|3"


The default should be good for most of the setups as it balances filesize
with quality. 3x thumbs can get big.

											
										
										
											2018-10-02 23:44:53 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        it "doesn't include response images for cropped images" do
-												DEV: Reduce object fabrication in `CookedPostProcessor` spec.

											
										
										
											2019-05-29 20:49:37 -04:00
+								          upload.update!(width: 200, height: 4000, filesize: 12345)
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          post = Fabricate(:post, raw: "hello <img src='#{upload.url}'>")
 								          # fake some optimized images
 								          OptimizedImage.create!(
 								            url: 'http://a.b.c/200x500.jpg',
 								            width: 200,
 								            height: 500,
 								            upload_id: upload.id,
 								            sha1: SecureRandom.hex,
 								            extension: '.jpg',
 								            filesize: 500
 								          )
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          cpp = CookedPostProcessor.new(post)
 								          cpp.add_to_size_cache(upload.url, 200, 4000)
 								          cpp.post_process
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          expect(cpp.html).to_not include('srcset="')
 								        end
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
+								      end
-												FIX stretched thumbnails

											
										
										
											2013-11-25 12:36:13 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      shared_examples "leave dimensions alone" do
 								        it "doesn't use them" do
 								          expect(cpp.html).to match(/src="http:\/\/foo.bar\/image.png" width="" height=""/)
-												FIX: picture would be hidden when [details] block was closed in the composer

											
										
										
											2015-03-16 13:57:15 -04:00
+								          expect(cpp.html).to match(/src="http:\/\/domain.com\/picture.jpg" width="50" height="42"/)
 								          expect(cpp).to be_dirty
 								        end
 								      end
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      context "with image_sizes" do
 								        fab!(:post) { Fabricate(:post_with_image_urls) }
 								        let(:cpp) { CookedPostProcessor.new(post, image_sizes: image_sizes) }
-												FIX: picture would be hidden when [details] block was closed in the composer

											
										
										
											2015-03-16 13:57:15 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        before do
 								          cpp.post_process
 								        end
-												FIX: picture would be hidden when [details] block was closed in the composer

											
										
										
											2015-03-16 13:57:15 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        context "valid" do
 								          let(:image_sizes) { { "http://foo.bar/image.png" => { "width" => 111, "height" => 222 } } }
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          it "uses them" do
 								            expect(cpp.html).to match(/src="http:\/\/foo.bar\/image.png" width="111" height="222"/)
 								            expect(cpp.html).to match(/src="http:\/\/domain.com\/picture.jpg" width="50" height="42"/)
 								            expect(cpp).to be_dirty
 								          end
 								        end
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        context "invalid width" do
 								          let(:image_sizes) { { "http://foo.bar/image.png" => { "width" => 0, "height" => 222 } } }
 								          include_examples "leave dimensions alone"
 								        end
 								        context "invalid height" do
 								          let(:image_sizes) { { "http://foo.bar/image.png" => { "width" => 111, "height" => 0 } } }
 								          include_examples "leave dimensions alone"
 								        end
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        context "invalid width & height" do
 								          let(:image_sizes) { { "http://foo.bar/image.png" => { "width" => 0, "height" => 0 } } }
 								          include_examples "leave dimensions alone"
 								        end
-												keep uploads reverse index up to date

											
										
										
											2013-06-17 16:46:48 -04:00
 								      end
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      context "with unsized images" do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								        fab!(:upload) { Fabricate(:image_upload, width: 123, height: 456) }
 								        fab!(:post) do
 								          Fabricate(:post, raw: <<~HTML)
 								          <img src="#{upload.url}">
 								          HTML
 								        end
-												keep uploads reverse index up to date

											
										
										
											2013-06-17 16:46:48 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        let(:cpp) { CookedPostProcessor.new(post) }
-												Move a bunch of callbacks into PostCreator

											
										
										
											2013-03-18 13:55:34 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        it "adds the width and height to images that don't have them" do
 								          cpp.post_process
 								          expect(cpp.html).to match(/width="123" height="456"/)
 								          expect(cpp).to be_dirty
 								        end
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												UX: Don't add light box for SVG images.

											
										
										
											2018-06-18 05:10:23 -04:00
+								      end
-												BUGFIX: broken spec

											
										
										
											2014-05-26 07:17:20 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      context "with large images" do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        fab!(:post) do
 								          Fabricate(:post, raw: <<~HTML)
 								          <img src="#{upload.url}">
 								          HTML
 								        end
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
-												FIX: Do not add lightbox to onebox images (#6479)


											
										
										
											2018-10-10 17:57:21 -04:00
 								        before do
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          SiteSetting.max_image_height = 2000
 								          SiteSetting.create_thumbnails = true
-												FIX: Do not add lightbox to onebox images (#6479)


											
										
										
											2018-10-10 17:57:21 -04:00
+								        end
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        it "generates overlay information" do
 								          cpp.post_process
-												FIX: Do not add lightbox to onebox images (#6479)


											
										
										
											2018-10-10 17:57:21 -04:00
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								          expect(cpp.html).to match_html <<~HTML.rstrip
 								            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="logo.png"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">logo.png</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
+								          HTML
-												FIX: Do not add lightbox to onebox images (#6479)


											
										
										
											2018-10-10 17:57:21 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          expect(cpp).to be_dirty
-												UX: Don't add light box for SVG images.

											
										
										
											2018-06-18 05:10:23 -04:00
+								        end
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        describe 'when image is inside onebox' do
 								          let(:url) { 'https://image.com/my-avatar' }
 								          let(:post) { Fabricate(:post, raw: url) }
-												UX: Don't add light box for SVG images.

											
										
										
											2018-06-18 05:10:23 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          before do
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								            Oneboxer.stubs(:onebox).with(url, anything).returns("<img class='onebox' src='/#{upload_path}/original/1X/1234567890123456.jpg' />")
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          end
 								          it 'should not add lightbox' do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								            FastImage.expects(:size).returns([1750, 2000])
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								            cpp.post_process
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								            expect(cpp.html).to match_html <<~HTML.rstrip
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								              <p><img class="onebox" src="//test.localhost/#{upload_path}/original/1X/1234567890123456.jpg" width="690" height="788"></p>
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								            HTML
 								          end
-												UX: Don't add light box for SVG images.

											
										
										
											2018-06-18 05:10:23 -04:00
+								        end
-												FIX: URL with params for svg images should not be light boxed.

											
										
										
											2018-06-19 22:47:14 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        describe 'when image is an svg' do
 								          fab!(:post) do
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								            Fabricate(:post, raw: "<img src=\"/#{Discourse.store.upload_path}/original/1X/1234567890123456.svg\">")
-												FIX: URL with params for svg images should not be light boxed.

											
										
										
											2018-06-19 22:47:14 -04:00
+								          end
 								          it 'should not add lightbox' do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								            FastImage.expects(:size).returns([1750, 2000])
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								            cpp.post_process
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								            expect(cpp.html).to match_html <<~HTML.rstrip
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								              <p><img src="//test.localhost/#{upload_path}/original/1X/1234567890123456.svg" width="690" height="788"></p>
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								            HTML
 								          end
 								          describe 'when image src is an URL' do
 								            let(:post) do
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								              Fabricate(:post, raw: "<img src=\"http://test.discourse/#{upload_path}/original/1X/1234567890123456.svg?somepamas\">")
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								            end
 								            it 'should not add lightbox' do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								              FastImage.expects(:size).returns([1750, 2000])
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								              SiteSetting.crawl_images = true
 								              cpp.post_process
-												FIX: URL with params for svg images should not be light boxed.

											
										
										
											2018-06-19 22:47:14 -04:00
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								              expect(cpp.html).to match_html("<p><img src=\"http://test.discourse/#{upload_path}/original/1X/1234567890123456.svg?somepamas\" width=\"690\"\ height=\"788\"></p>")
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								            end
-												FIX: URL with params for svg images should not be light boxed.

											
										
										
											2018-06-19 22:47:14 -04:00
+								          end
 								        end
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
-												FIX: Secure Upload URLs in lightbox (#8451)

This fixes the following issues:

* The link element on the lightbox which pops open the lightbox was linking to the S3 URL with a private ACL instead of the secure media URL for the image
* Change to use `@post.with_secure_media?` in `CookedPostProcessor` for URL cooking, as in some cases, like when a post is edited and an upload is added, `upload.secure?` can be false which resulted in `srcset` URLs not being cooked correctly to secure media upload urls.

											
										
										
											2019-12-04 18:13:09 -05:00
+								        context "s3_uploads" do
-												FIX: Mitigate issue where legacy pre-secure hotlinked media would not be redownloaded (#8802)

Basically, say you had already downloaded a certain image from a certain URL
using pull_hotlinked_images and the onebox. The upload would be stored
by its sha as an upload record. Whenever you linked to the same URL again
in a post (e.g. in our case an og:image on review.discourse) we would
would reuse the original upload record because of the sha1.

However when you turned on secure media this could cause problems as
the first post that uses that upload after secure media is enabled
will set the access control post for the upload to the new post.
Then if the post is deleted every single onebox/link to that same image
URL will fail forever with 403 as the secure-media-uploads URL fails
if the access control post has been deleted.

To fix this when cooking posts and pulling hotlinked images, we only
allow using an original upload by URL if its access control post
matches the current post, and if the original_sha1 is filled in,
meaning it was uploaded AFTER secure media was enabled. otherwise
we just redownload the media again to be safe, as the URL will always
be new then.
											
										
										
											2020-01-28 19:11:38 -05:00
+								          let(:upload) { Fabricate(:secure_upload_s3) }
-												FIX: Secure Upload URLs in lightbox (#8451)

This fixes the following issues:

* The link element on the lightbox which pops open the lightbox was linking to the S3 URL with a private ACL instead of the secure media URL for the image
* Change to use `@post.with_secure_media?` in `CookedPostProcessor` for URL cooking, as in some cases, like when a post is edited and an upload is added, `upload.secure?` can be false which resulted in `srcset` URLs not being cooked correctly to secure media upload urls.

											
										
										
											2019-12-04 18:13:09 -05:00
+								          before do
 								            s3_setup
 								            stored_path = Discourse.store.get_path_for_upload(upload)
 								            upload.update_column(:url, "#{SiteSetting.Upload.absolute_base_url}/#{stored_path}")
-												FIX: Update S3 stubs for more aws-sdk API changes (#8534)


											
										
										
											2019-12-11 14:26:52 -05:00
+								            stub_request(:head, "https://#{SiteSetting.s3_upload_bucket}.s3.amazonaws.com/")
-												DEV: Bump aws-sdk-sns from 1.13.0 to 1.21.0 (#8490)

Bumps [aws-sdk-sns](https://github.com/aws/aws-sdk-ruby) from 1.13.0 to 1.21.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-sns/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/compare/1.13.0...1.21.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
											
										
										
											2019-12-11 09:13:17 -05:00
+								            stub_request(
 								              :put,
-												FIX: Update S3 stubs for more aws-sdk API changes (#8534)


											
										
										
											2019-12-11 14:26:52 -05:00
+								              "https://#{SiteSetting.s3_upload_bucket}.s3.amazonaws.com/optimized/1X/#{upload.sha1}_2_#{optimized_size}.#{upload.extension}"
-												DEV: Bump aws-sdk-sns from 1.13.0 to 1.21.0 (#8490)

Bumps [aws-sdk-sns](https://github.com/aws/aws-sdk-ruby) from 1.13.0 to 1.21.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-sns/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/compare/1.13.0...1.21.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
											
										
										
											2019-12-11 09:13:17 -05:00
+								            )
-												FIX: Update S3 stubs for more aws-sdk API changes (#8534)


											
										
										
											2019-12-11 14:26:52 -05:00
+								            stub_request(:get, /#{SiteSetting.s3_upload_bucket}\.s3\.amazonaws\.com/)
-												FIX: Secure Upload URLs in lightbox (#8451)

This fixes the following issues:

* The link element on the lightbox which pops open the lightbox was linking to the S3 URL with a private ACL instead of the secure media URL for the image
* Change to use `@post.with_secure_media?` in `CookedPostProcessor` for URL cooking, as in some cases, like when a post is edited and an upload is added, `upload.secure?` can be false which resulted in `srcset` URLs not being cooked correctly to secure media upload urls.

											
										
										
											2019-12-04 18:13:09 -05:00
 								            SiteSetting.login_required = true
 								            SiteSetting.secure_media = true
 								          end
-												DEV: Bump aws-sdk-sns from 1.13.0 to 1.21.0 (#8490)

Bumps [aws-sdk-sns](https://github.com/aws/aws-sdk-ruby) from 1.13.0 to 1.21.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-sns/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/compare/1.13.0...1.21.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
											
										
										
											2019-12-11 09:13:17 -05:00
+								          let(:optimized_size) { "600x500" }
-												FIX: Secure Upload URLs in lightbox (#8451)

This fixes the following issues:

* The link element on the lightbox which pops open the lightbox was linking to the S3 URL with a private ACL instead of the secure media URL for the image
* Change to use `@post.with_secure_media?` in `CookedPostProcessor` for URL cooking, as in some cases, like when a post is edited and an upload is added, `upload.secure?` can be false which resulted in `srcset` URLs not being cooked correctly to secure media upload urls.

											
										
										
											2019-12-04 18:13:09 -05:00
+								          let(:post) do
-												DEV: Bump aws-sdk-sns from 1.13.0 to 1.21.0 (#8490)

Bumps [aws-sdk-sns](https://github.com/aws/aws-sdk-ruby) from 1.13.0 to 1.21.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-sns/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/compare/1.13.0...1.21.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
											
										
										
											2019-12-11 09:13:17 -05:00
+								            Fabricate(:post, raw: "![large.png|#{optimized_size}](#{upload.short_url})")
-												FIX: Secure Upload URLs in lightbox (#8451)

This fixes the following issues:

* The link element on the lightbox which pops open the lightbox was linking to the S3 URL with a private ACL instead of the secure media URL for the image
* Change to use `@post.with_secure_media?` in `CookedPostProcessor` for URL cooking, as in some cases, like when a post is edited and an upload is added, `upload.secure?` can be false which resulted in `srcset` URLs not being cooked correctly to secure media upload urls.

											
										
										
											2019-12-04 18:13:09 -05:00
+								          end
-												FIX: Mitigate issue where legacy pre-secure hotlinked media would not be redownloaded (#8802)

Basically, say you had already downloaded a certain image from a certain URL
using pull_hotlinked_images and the onebox. The upload would be stored
by its sha as an upload record. Whenever you linked to the same URL again
in a post (e.g. in our case an og:image on review.discourse) we would
would reuse the original upload record because of the sha1.

However when you turned on secure media this could cause problems as
the first post that uses that upload after secure media is enabled
will set the access control post for the upload to the new post.
Then if the post is deleted every single onebox/link to that same image
URL will fail forever with 403 as the secure-media-uploads URL fails
if the access control post has been deleted.

To fix this when cooking posts and pulling hotlinked images, we only
allow using an original upload by URL if its access control post
matches the current post, and if the original_sha1 is filled in,
meaning it was uploaded AFTER secure media was enabled. otherwise
we just redownload the media again to be safe, as the URL will always
be new then.
											
										
										
											2020-01-28 19:11:38 -05:00
+								          let(:cooked_html) do
 								            <<~HTML
-												FIX: Secure Upload URLs in lightbox (#8451)

This fixes the following issues:

* The link element on the lightbox which pops open the lightbox was linking to the S3 URL with a private ACL instead of the secure media URL for the image
* Change to use `@post.with_secure_media?` in `CookedPostProcessor` for URL cooking, as in some cases, like when a post is edited and an upload is added, `upload.secure?` can be false which resulted in `srcset` URLs not being cooked correctly to secure media upload urls.

											
										
										
											2019-12-04 18:13:09 -05:00
+								            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost/secure-media-uploads/original/1X/#{upload.sha1}.png" data-download-href="//test.localhost/uploads/short-url/#{upload.base62_sha1}.unknown?dl=1" title="large.png"><img src="" alt="large.png" data-base62-sha1="#{upload.base62_sha1}" width="600" height="500"><div class="meta">
 								            <svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">large.png</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg>
 								            </div></a></div></p>
 								            HTML
 								          end
-												FIX: Mitigate issue where legacy pre-secure hotlinked media would not be redownloaded (#8802)

Basically, say you had already downloaded a certain image from a certain URL
using pull_hotlinked_images and the onebox. The upload would be stored
by its sha as an upload record. Whenever you linked to the same URL again
in a post (e.g. in our case an og:image on review.discourse) we would
would reuse the original upload record because of the sha1.

However when you turned on secure media this could cause problems as
the first post that uses that upload after secure media is enabled
will set the access control post for the upload to the new post.
Then if the post is deleted every single onebox/link to that same image
URL will fail forever with 403 as the secure-media-uploads URL fails
if the access control post has been deleted.

To fix this when cooking posts and pulling hotlinked images, we only
allow using an original upload by URL if its access control post
matches the current post, and if the original_sha1 is filled in,
meaning it was uploaded AFTER secure media was enabled. otherwise
we just redownload the media again to be safe, as the URL will always
be new then.
											
										
										
											2020-01-28 19:11:38 -05:00
 								          context "when the upload is attached to the correct post" do
 								            before do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								              FastImage.expects(:size).returns([1750, 2000])
-												FIX: Mitigate issue where legacy pre-secure hotlinked media would not be redownloaded (#8802)

Basically, say you had already downloaded a certain image from a certain URL
using pull_hotlinked_images and the onebox. The upload would be stored
by its sha as an upload record. Whenever you linked to the same URL again
in a post (e.g. in our case an og:image on review.discourse) we would
would reuse the original upload record because of the sha1.

However when you turned on secure media this could cause problems as
the first post that uses that upload after secure media is enabled
will set the access control post for the upload to the new post.
Then if the post is deleted every single onebox/link to that same image
URL will fail forever with 403 as the secure-media-uploads URL fails
if the access control post has been deleted.

To fix this when cooking posts and pulling hotlinked images, we only
allow using an original upload by URL if its access control post
matches the current post, and if the original_sha1 is filled in,
meaning it was uploaded AFTER secure media was enabled. otherwise
we just redownload the media again to be safe, as the URL will always
be new then.
											
										
										
											2020-01-28 19:11:38 -05:00
+								              OptimizedImage.expects(:resize).returns(true)
 								              Discourse.store.class.any_instance.expects(:has_been_uploaded?).at_least_once.returns(true)
 								              upload.update(secure: true, access_control_post: post)
 								            end
-												DEV: Skip erratic spec for now

Spec fails intermittently due to CDN state.

											
										
										
											2020-04-24 23:20:04 -04:00
+								            # TODO fix this spec, it is sometimes getting CDN links when it runs concurrently
 								            xit "handles secure images with the correct lightbox link href" do
-												FIX: Mitigate issue where legacy pre-secure hotlinked media would not be redownloaded (#8802)

Basically, say you had already downloaded a certain image from a certain URL
using pull_hotlinked_images and the onebox. The upload would be stored
by its sha as an upload record. Whenever you linked to the same URL again
in a post (e.g. in our case an og:image on review.discourse) we would
would reuse the original upload record because of the sha1.

However when you turned on secure media this could cause problems as
the first post that uses that upload after secure media is enabled
will set the access control post for the upload to the new post.
Then if the post is deleted every single onebox/link to that same image
URL will fail forever with 403 as the secure-media-uploads URL fails
if the access control post has been deleted.

To fix this when cooking posts and pulling hotlinked images, we only
allow using an original upload by URL if its access control post
matches the current post, and if the original_sha1 is filled in,
meaning it was uploaded AFTER secure media was enabled. otherwise
we just redownload the media again to be safe, as the URL will always
be new then.
											
										
										
											2020-01-28 19:11:38 -05:00
+								              cpp.post_process
 								              expect(cpp.html).to match_html cooked_html
 								            end
 								          end
 								          context "when the upload is attached to a different post" do
 								            before do
 								              FastImage.size(upload.url)
 								              upload.update(secure: true, access_control_post: Fabricate(:post))
 								            end
 								            it "does not create thumbnails or optimize images" do
 								              CookedPostProcessor.any_instance.expects(:optimize_image!).never
 								              Upload.any_instance.expects(:create_thumbnail!).never
 								              cpp.post_process
 								              expect(cpp.html).not_to match_html cooked_html
 								            end
 								          end
-												FIX: Secure Upload URLs in lightbox (#8451)

This fixes the following issues:

* The link element on the lightbox which pops open the lightbox was linking to the S3 URL with a private ACL instead of the secure media URL for the image
* Change to use `@post.with_secure_media?` in `CookedPostProcessor` for URL cooking, as in some cases, like when a post is edited and an upload is added, `upload.secure?` can be false which resulted in `srcset` URLs not being cooked correctly to secure media upload urls.

											
										
										
											2019-12-04 18:13:09 -05:00
+								        end
-												UX: Don't add light box for SVG images.

											
										
										
											2018-06-18 05:10:23 -04:00
+								      end
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      context "with tall images" do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								        fab!(:upload) { Fabricate(:image_upload, width: 860, height: 2000) }
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        fab!(:post) do
 								          Fabricate(:post, raw: <<~HTML)
 								          <img src="#{upload.url}">
 								          HTML
 								        end
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        before do
 								          SiteSetting.create_thumbnails = true
 								        end
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        it "crops the image" do
 								          cpp.post_process
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          expect(cpp.html).to match(/width="690" height="500">/)
 								          expect(cpp).to be_dirty
 								        end
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
 								      end
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      context "with iPhone X screenshots" do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								        fab!(:upload) { Fabricate(:image_upload, width: 1125, height: 2436) }
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        fab!(:post) do
 								          Fabricate(:post, raw: <<~HTML)
 								          <img src="#{upload.url}">
 								          HTML
 								        end
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        before do
 								          SiteSetting.create_thumbnails = true
 								        end
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        it "crops the image" do
 								          cpp.post_process
-												FIX: don't crop iPhone X screenshots

											
										
										
											2017-11-14 14:37:27 -05:00
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								          expect(cpp.html).to match_html <<~HTML.rstrip
 								            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="logo.png"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_230x500.png" width="230" height="500"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">logo.png</span><span class="informations">1125×2436 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          HTML
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          expect(cpp).to be_dirty
 								        end
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
+								      end
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      context "with large images when using subfolders" do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        fab!(:post) do
 								          Fabricate(:post, raw: <<~HTML)
 								          <img src="/subfolder#{upload.url}">
 								          HTML
 								        end
-												Adds large image upload on subfolder install spec
											
										
										
											2016-03-09 22:48:50 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
-												Adds large image upload on subfolder install spec
											
										
										
											2016-03-09 22:48:50 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        before do
-												DEV: improve usability of subfolder specs

Previously people were not consistent about mocking which left internals in
a fragile state when running subfolder specs.

This introduces a simple helper `set_subfolder` which you can use to set
the subfolder for the spec. It takes care of proper configuration of subfolder
and teardown.

```
# usage
set_subfolder "/my_amazing_subfolder"
```

You should no longer stub base_uri or global_settings

											
										
										
											2019-11-15 00:48:24 -05:00
+								          set_subfolder "/subfolder"
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								          stub_request(:get, "http://#{Discourse.current_hostname}/subfolder#{upload.url}").to_return(status: 200, body: File.new(Discourse.store.path_for(upload)))
-												DEV: improve usability of subfolder specs

Previously people were not consistent about mocking which left internals in
a fragile state when running subfolder specs.

This introduces a simple helper `set_subfolder` which you can use to set
the subfolder for the spec. It takes care of proper configuration of subfolder
and teardown.

```
# usage
set_subfolder "/my_amazing_subfolder"
```

You should no longer stub base_uri or global_settings

											
										
										
											2019-11-15 00:48:24 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          SiteSetting.max_image_height = 2000
 								          SiteSetting.create_thumbnails = true
 								        end
-												Adds large image upload on subfolder install spec
											
										
										
											2016-03-09 22:48:50 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        it "generates overlay information" do
 								          cpp.post_process
-												Adds large image upload on subfolder install spec
											
										
										
											2016-03-09 22:48:50 -05:00
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								          expect(cpp.html). to match_html <<~HTML.rstrip
 								            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost/subfolder#{upload.url}" data-download-href="//test.localhost/subfolder/#{upload_path}/#{upload.sha1}" title="logo.png"><img src="//test.localhost/subfolder/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">logo.png</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          HTML
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          expect(cpp).to be_dirty
 								        end
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        it "should escape the filename" do
 								          upload.update!(original_filename: "><img src=x onerror=alert('haha')>.png")
 								          cpp.post_process
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								          expect(cpp.html).to match_html <<~HTML.rstrip
 								            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost/subfolder#{upload.url}" data-download-href="//test.localhost/subfolder/#{upload_path}/#{upload.sha1}" title="&amp;gt;&amp;lt;img src=x onerror=alert(&amp;#39;haha&amp;#39;)&amp;gt;.png"><img src="//test.localhost/subfolder/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">&amp;gt;&amp;lt;img src=x onerror=alert(&amp;#39;haha&amp;#39;)&amp;gt;.png</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          HTML
 								        end
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												SECURITY: Escape HTML in filename.

											
										
										
											2016-08-10 23:27:12 -04:00
+								      end
-												FEATURE: fallback to image alt before filename if there's no title in lightboxes (#8286)

* use image alt as a fallback when there's no title

* update spec

we used to check that the overlay information is added when the image has a titie. This adds 2 more scenarios. One where an image has both a title and an alt, in which case the title should be used and alt ignored.

The other is when there's only an alt, it should then be used to generate the overlay

											
										
										
											2019-11-03 18:15:14 -05:00
+								      context "with title and alt" do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }
-												FEATURE: fallback to image alt before filename if there's no title in lightboxes (#8286)

* use image alt as a fallback when there's no title

* update spec

we used to check that the overlay information is added when the image has a titie. This adds 2 more scenarios. One where an image has both a title and an alt, in which case the title should be used and alt ignored.

The other is when there's only an alt, it should then be used to generate the overlay

											
										
										
											2019-11-03 18:15:14 -05:00
+								        fab!(:post) do
 								          Fabricate(:post, raw: <<~HTML)
 								          <img src="#{upload.url}" title="WAT" alt="RED">
 								          HTML
 								        end
 								        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
 								        before do
 								          SiteSetting.max_image_height = 2000
 								          SiteSetting.create_thumbnails = true
 								        end
 								        it "generates overlay information using image title and ignores alt" do
 								          cpp.post_process
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								          expect(cpp.html).to match_html <<~HTML.rstrip
 								            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="WAT"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" title="WAT" alt="RED" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">WAT</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
-												FEATURE: fallback to image alt before filename if there's no title in lightboxes (#8286)

* use image alt as a fallback when there's no title

* update spec

we used to check that the overlay information is added when the image has a titie. This adds 2 more scenarios. One where an image has both a title and an alt, in which case the title should be used and alt ignored.

The other is when there's only an alt, it should then be used to generate the overlay

											
										
										
											2019-11-03 18:15:14 -05:00
+								          HTML
 								          expect(cpp).to be_dirty
 								        end
 								      end
 								      context "with title only" do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        fab!(:post) do
 								          Fabricate(:post, raw: <<~HTML)
 								          <img src="#{upload.url}" title="WAT">
 								          HTML
 								        end
-												FEATURE: use img's title attribute in overlay information when provided

											
										
										
											2014-11-03 16:03:06 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
-												FEATURE: use img's title attribute in overlay information when provided

											
										
										
											2014-11-03 16:03:06 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        before do
 								          SiteSetting.max_image_height = 2000
 								          SiteSetting.create_thumbnails = true
 								        end
-												FIX: images aren't lightboxed anymore (partially reverts 646c6eb7cd781b47663d104de4f37cdd99b465bf)

											
										
										
											2017-10-18 17:54:36 -04:00
-												FEATURE: fallback to image alt before filename if there's no title in lightboxes (#8286)

* use image alt as a fallback when there's no title

* update spec

we used to check that the overlay information is added when the image has a titie. This adds 2 more scenarios. One where an image has both a title and an alt, in which case the title should be used and alt ignored.

The other is when there's only an alt, it should then be used to generate the overlay

											
										
										
											2019-11-03 18:15:14 -05:00
+								        it "generates overlay information using image title" do
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          cpp.post_process
-												FEATURE: use img's title attribute in overlay information when provided

											
										
										
											2014-11-03 16:03:06 -05:00
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								          expect(cpp.html).to match_html <<~HTML.rstrip
 								            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="WAT"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" title="WAT" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">WAT</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
-												FEATURE: fallback to image alt before filename if there's no title in lightboxes (#8286)

* use image alt as a fallback when there's no title

* update spec

we used to check that the overlay information is added when the image has a titie. This adds 2 more scenarios. One where an image has both a title and an alt, in which case the title should be used and alt ignored.

The other is when there's only an alt, it should then be used to generate the overlay

											
										
										
											2019-11-03 18:15:14 -05:00
+								          HTML
 								          expect(cpp).to be_dirty
 								        end
 								      end
 								      context "with alt only" do
-												FIX: Perform crop using user-specified image sizes (#9224)

* FIX: Perform crop using user-specified image sizes

It used to resize the images to max width and height first and then
perform the crop operation. This is wrong because it ignored the user
specified image sizes from the Markdown.

* DEV: Use real images in test
											
										
										
											2020-03-26 10:40:00 -04:00
+								        fab!(:upload) { Fabricate(:image_upload, width: 1750, height: 2000) }
-												FEATURE: fallback to image alt before filename if there's no title in lightboxes (#8286)

* use image alt as a fallback when there's no title

* update spec

we used to check that the overlay information is added when the image has a titie. This adds 2 more scenarios. One where an image has both a title and an alt, in which case the title should be used and alt ignored.

The other is when there's only an alt, it should then be used to generate the overlay

											
										
										
											2019-11-03 18:15:14 -05:00
+								        fab!(:post) do
 								          Fabricate(:post, raw: <<~HTML)
 								          <img src="#{upload.url}" alt="RED">
 								          HTML
 								        end
 								        let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
 								        before do
 								          SiteSetting.max_image_height = 2000
 								          SiteSetting.create_thumbnails = true
 								        end
 								        it "generates overlay information using image alt" do
 								          cpp.post_process
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								          expect(cpp.html).to match_html <<~HTML.rstrip
 								            <p><div class="lightbox-wrapper"><a class="lightbox" href="//test.localhost#{upload.url}" data-download-href="//test.localhost/#{upload_path}/#{upload.sha1}" title="RED"><img src="//test.localhost/#{upload_path}/optimized/1X/#{upload.sha1}_#{OptimizedImage::VERSION}_690x788.png" alt="RED" width="690" height="788"><div class="meta"><svg class="fa d-icon d-icon-far-image svg-icon" aria-hidden="true"><use xlink:href="#far-image"></use></svg><span class="filename">RED</span><span class="informations">1750×2000 1.21 KB</span><svg class="fa d-icon d-icon-discourse-expand svg-icon" aria-hidden="true"><use xlink:href="#discourse-expand"></use></svg></div></a></div></p>
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          HTML
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          expect(cpp).to be_dirty
 								        end
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												FEATURE: use img's title attribute in overlay information when provided

											
										
										
											2014-11-03 16:03:06 -05:00
+								      end
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      context "topic image" do
-												FEATURE: Include optimized thumbnails for topics (#9215)

This introduces new APIs for obtaining optimized thumbnails for topics. There are a few building blocks required for this:

- Introduces new `image_upload_id` columns on the `posts` and `topics` table. This replaces the old `image_url` column, which means that thumbnails are now restricted to uploads. Hotlinked thumbnails are no longer possible. In normal use (with pull_hotlinked_images enabled), this has no noticeable impact

- A migration attempts to match existing urls to upload records. If a match cannot be found then the posts will be queued for rebake

- Optimized thumbnails are generated during post_process_cooked. If thumbnails are missing when serializing a topic list, then a sidekiq job is queued

- Topic lists and topics now include a `thumbnails` key, which includes all the available images:
   ```
   "thumbnails": [
   {
     "max_width": null,
     "max_height": null,
     "url": "//example.com/original-image.png",
     "width": 1380,
     "height": 1840
   },
   {
     "max_width": 1024,
     "max_height": 1024,
     "url": "//example.com/optimized-image.png",
     "width": 768,
     "height": 1024
   }
   ]
  ```

- Themes can request additional thumbnail sizes by using a modifier in their `about.json` file:
   ```
    "modifiers": {
      "topic_thumbnail_sizes": [
        [200, 200],
        [800, 800]
      ],
      ...
  ```
  Remember that these are generated asynchronously, so your theme should include logic to fallback to other available thumbnails if your requested size has not yet been generated

- Two new raw plugin outlets are introduced, to improve the customisability of the topic list. `topic-list-before-columns` and `topic-list-before-link`
											
										
										
											2020-05-05 04:07:50 -04:00
+								        fab!(:post) { Fabricate(:post_with_uploaded_image) }
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        let(:cpp) { CookedPostProcessor.new(post) }
 								        it "adds a topic image if there's one in the first post" do
 								          FastImage.stubs(:size)
-												FEATURE: Include optimized thumbnails for topics (#9215)

This introduces new APIs for obtaining optimized thumbnails for topics. There are a few building blocks required for this:

- Introduces new `image_upload_id` columns on the `posts` and `topics` table. This replaces the old `image_url` column, which means that thumbnails are now restricted to uploads. Hotlinked thumbnails are no longer possible. In normal use (with pull_hotlinked_images enabled), this has no noticeable impact

- A migration attempts to match existing urls to upload records. If a match cannot be found then the posts will be queued for rebake

- Optimized thumbnails are generated during post_process_cooked. If thumbnails are missing when serializing a topic list, then a sidekiq job is queued

- Topic lists and topics now include a `thumbnails` key, which includes all the available images:
   ```
   "thumbnails": [
   {
     "max_width": null,
     "max_height": null,
     "url": "//example.com/original-image.png",
     "width": 1380,
     "height": 1840
   },
   {
     "max_width": 1024,
     "max_height": 1024,
     "url": "//example.com/optimized-image.png",
     "width": 768,
     "height": 1024
   }
   ]
  ```

- Themes can request additional thumbnail sizes by using a modifier in their `about.json` file:
   ```
    "modifiers": {
      "topic_thumbnail_sizes": [
        [200, 200],
        [800, 800]
      ],
      ...
  ```
  Remember that these are generated asynchronously, so your theme should include logic to fallback to other available thumbnails if your requested size has not yet been generated

- Two new raw plugin outlets are introduced, to improve the customisability of the topic list. `topic-list-before-columns` and `topic-list-before-link`
											
										
										
											2020-05-05 04:07:50 -04:00
+								          expect(post.topic.image_upload_id).to eq(nil)
-												FEATURE: use img's title attribute in overlay information when provided

											
										
										
											2014-11-03 16:03:06 -05:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          cpp.post_process
 								          post.topic.reload
-												FEATURE: Include optimized thumbnails for topics (#9215)

This introduces new APIs for obtaining optimized thumbnails for topics. There are a few building blocks required for this:

- Introduces new `image_upload_id` columns on the `posts` and `topics` table. This replaces the old `image_url` column, which means that thumbnails are now restricted to uploads. Hotlinked thumbnails are no longer possible. In normal use (with pull_hotlinked_images enabled), this has no noticeable impact

- A migration attempts to match existing urls to upload records. If a match cannot be found then the posts will be queued for rebake

- Optimized thumbnails are generated during post_process_cooked. If thumbnails are missing when serializing a topic list, then a sidekiq job is queued

- Topic lists and topics now include a `thumbnails` key, which includes all the available images:
   ```
   "thumbnails": [
   {
     "max_width": null,
     "max_height": null,
     "url": "//example.com/original-image.png",
     "width": 1380,
     "height": 1840
   },
   {
     "max_width": 1024,
     "max_height": 1024,
     "url": "//example.com/optimized-image.png",
     "width": 768,
     "height": 1024
   }
   ]
  ```

- Themes can request additional thumbnail sizes by using a modifier in their `about.json` file:
   ```
    "modifiers": {
      "topic_thumbnail_sizes": [
        [200, 200],
        [800, 800]
      ],
      ...
  ```
  Remember that these are generated asynchronously, so your theme should include logic to fallback to other available thumbnails if your requested size has not yet been generated

- Two new raw plugin outlets are introduced, to improve the customisability of the topic list. `topic-list-before-columns` and `topic-list-before-link`
											
										
										
											2020-05-05 04:07:50 -04:00
+								          expect(post.topic.image_upload_id).to be_present
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        end
-												FIX: Remove post/topic image_url on post edits

- resets image_url when image is removed from first post on edit
- excludes onebox icons from being featured as topic/post images

											
										
										
											2020-02-06 11:19:40 -05:00
 								        it "removes image if post is edited and no longer has an image" do
 								          FastImage.stubs(:size)
 								          cpp.post_process
 								          post.topic.reload
-												FEATURE: Include optimized thumbnails for topics (#9215)

This introduces new APIs for obtaining optimized thumbnails for topics. There are a few building blocks required for this:

- Introduces new `image_upload_id` columns on the `posts` and `topics` table. This replaces the old `image_url` column, which means that thumbnails are now restricted to uploads. Hotlinked thumbnails are no longer possible. In normal use (with pull_hotlinked_images enabled), this has no noticeable impact

- A migration attempts to match existing urls to upload records. If a match cannot be found then the posts will be queued for rebake

- Optimized thumbnails are generated during post_process_cooked. If thumbnails are missing when serializing a topic list, then a sidekiq job is queued

- Topic lists and topics now include a `thumbnails` key, which includes all the available images:
   ```
   "thumbnails": [
   {
     "max_width": null,
     "max_height": null,
     "url": "//example.com/original-image.png",
     "width": 1380,
     "height": 1840
   },
   {
     "max_width": 1024,
     "max_height": 1024,
     "url": "//example.com/optimized-image.png",
     "width": 768,
     "height": 1024
   }
   ]
  ```

- Themes can request additional thumbnail sizes by using a modifier in their `about.json` file:
   ```
    "modifiers": {
      "topic_thumbnail_sizes": [
        [200, 200],
        [800, 800]
      ],
      ...
  ```
  Remember that these are generated asynchronously, so your theme should include logic to fallback to other available thumbnails if your requested size has not yet been generated

- Two new raw plugin outlets are introduced, to improve the customisability of the topic list. `topic-list-before-columns` and `topic-list-before-link`
											
										
										
											2020-05-05 04:07:50 -04:00
+								          expect(post.topic.image_upload_id).to be_present
 								          expect(post.image_upload_id).to be_present
-												FIX: Remove post/topic image_url on post edits

- resets image_url when image is removed from first post on edit
- excludes onebox icons from being featured as topic/post images

											
										
										
											2020-02-06 11:19:40 -05:00
 								          post.update!(raw: "This post no longer has an image.")
 								          CookedPostProcessor.new(post).post_process
 								          post.topic.reload
-												FEATURE: Include optimized thumbnails for topics (#9215)

This introduces new APIs for obtaining optimized thumbnails for topics. There are a few building blocks required for this:

- Introduces new `image_upload_id` columns on the `posts` and `topics` table. This replaces the old `image_url` column, which means that thumbnails are now restricted to uploads. Hotlinked thumbnails are no longer possible. In normal use (with pull_hotlinked_images enabled), this has no noticeable impact

- A migration attempts to match existing urls to upload records. If a match cannot be found then the posts will be queued for rebake

- Optimized thumbnails are generated during post_process_cooked. If thumbnails are missing when serializing a topic list, then a sidekiq job is queued

- Topic lists and topics now include a `thumbnails` key, which includes all the available images:
   ```
   "thumbnails": [
   {
     "max_width": null,
     "max_height": null,
     "url": "//example.com/original-image.png",
     "width": 1380,
     "height": 1840
   },
   {
     "max_width": 1024,
     "max_height": 1024,
     "url": "//example.com/optimized-image.png",
     "width": 768,
     "height": 1024
   }
   ]
  ```

- Themes can request additional thumbnail sizes by using a modifier in their `about.json` file:
   ```
    "modifiers": {
      "topic_thumbnail_sizes": [
        [200, 200],
        [800, 800]
      ],
      ...
  ```
  Remember that these are generated asynchronously, so your theme should include logic to fallback to other available thumbnails if your requested size has not yet been generated

- Two new raw plugin outlets are introduced, to improve the customisability of the topic list. `topic-list-before-columns` and `topic-list-before-link`
											
										
										
											2020-05-05 04:07:50 -04:00
+								          expect(post.topic.image_upload_id).not_to be_present
 								          expect(post.image_upload_id).not_to be_present
-												FIX: Remove post/topic image_url on post edits

- resets image_url when image is removed from first post on edit
- excludes onebox icons from being featured as topic/post images

											
										
										
											2020-02-06 11:19:40 -05:00
+								        end
-												FIX: Don't remove the topic image if posts don't have them

											
										
										
											2020-02-13 14:00:30 -05:00
 								        it "won't remove the original image if another post doesn't have an image" do
 								          FastImage.stubs(:size)
 								          topic = post.topic
 								          cpp.post_process
 								          topic.reload
-												FEATURE: Include optimized thumbnails for topics (#9215)

This introduces new APIs for obtaining optimized thumbnails for topics. There are a few building blocks required for this:

- Introduces new `image_upload_id` columns on the `posts` and `topics` table. This replaces the old `image_url` column, which means that thumbnails are now restricted to uploads. Hotlinked thumbnails are no longer possible. In normal use (with pull_hotlinked_images enabled), this has no noticeable impact

- A migration attempts to match existing urls to upload records. If a match cannot be found then the posts will be queued for rebake

- Optimized thumbnails are generated during post_process_cooked. If thumbnails are missing when serializing a topic list, then a sidekiq job is queued

- Topic lists and topics now include a `thumbnails` key, which includes all the available images:
   ```
   "thumbnails": [
   {
     "max_width": null,
     "max_height": null,
     "url": "//example.com/original-image.png",
     "width": 1380,
     "height": 1840
   },
   {
     "max_width": 1024,
     "max_height": 1024,
     "url": "//example.com/optimized-image.png",
     "width": 768,
     "height": 1024
   }
   ]
  ```

- Themes can request additional thumbnail sizes by using a modifier in their `about.json` file:
   ```
    "modifiers": {
      "topic_thumbnail_sizes": [
        [200, 200],
        [800, 800]
      ],
      ...
  ```
  Remember that these are generated asynchronously, so your theme should include logic to fallback to other available thumbnails if your requested size has not yet been generated

- Two new raw plugin outlets are introduced, to improve the customisability of the topic list. `topic-list-before-columns` and `topic-list-before-link`
											
										
										
											2020-05-05 04:07:50 -04:00
+								          expect(topic.image_upload_id).to be_present
 								          expect(post.image_upload_id).to be_present
-												FIX: Don't remove the topic image if posts don't have them

											
										
										
											2020-02-13 14:00:30 -05:00
 								          post = Fabricate(:post, topic: topic, raw: "this post doesn't have an image")
 								          CookedPostProcessor.new(post).post_process
 								          topic.reload
-												FEATURE: Include optimized thumbnails for topics (#9215)

This introduces new APIs for obtaining optimized thumbnails for topics. There are a few building blocks required for this:

- Introduces new `image_upload_id` columns on the `posts` and `topics` table. This replaces the old `image_url` column, which means that thumbnails are now restricted to uploads. Hotlinked thumbnails are no longer possible. In normal use (with pull_hotlinked_images enabled), this has no noticeable impact

- A migration attempts to match existing urls to upload records. If a match cannot be found then the posts will be queued for rebake

- Optimized thumbnails are generated during post_process_cooked. If thumbnails are missing when serializing a topic list, then a sidekiq job is queued

- Topic lists and topics now include a `thumbnails` key, which includes all the available images:
   ```
   "thumbnails": [
   {
     "max_width": null,
     "max_height": null,
     "url": "//example.com/original-image.png",
     "width": 1380,
     "height": 1840
   },
   {
     "max_width": 1024,
     "max_height": 1024,
     "url": "//example.com/optimized-image.png",
     "width": 768,
     "height": 1024
   }
   ]
  ```

- Themes can request additional thumbnail sizes by using a modifier in their `about.json` file:
   ```
    "modifiers": {
      "topic_thumbnail_sizes": [
        [200, 200],
        [800, 800]
      ],
      ...
  ```
  Remember that these are generated asynchronously, so your theme should include logic to fallback to other available thumbnails if your requested size has not yet been generated

- Two new raw plugin outlets are introduced, to improve the customisability of the topic list. `topic-list-before-columns` and `topic-list-before-link`
											
										
										
											2020-05-05 04:07:50 -04:00
+								          expect(post.topic.image_upload_id).to be_present
 								          expect(post.image_upload_id).to be_blank
 								        end
 								        it "generates thumbnails correctly" do
 								          FastImage.expects(:size).returns([1750, 2000])
 								          topic = post.topic
 								          cpp.post_process
 								          topic.reload
 								          expect(topic.image_upload_id).to be_present
 								          expect(post.image_upload_id).to be_present
 								          post = Fabricate(:post, topic: topic, raw: "this post doesn't have an image")
 								          CookedPostProcessor.new(post).post_process
 								          topic.reload
 								          expect(post.topic.image_upload_id).to be_present
 								          expect(post.image_upload_id).to be_blank
-												FIX: Don't remove the topic image if posts don't have them

											
										
										
											2020-02-13 14:00:30 -05:00
+								        end
-												Don't append the base url to absolute image urls without protocol.

											
										
										
											2013-05-30 11:17:07 -04:00
+								      end
-												FEATURE: include post image in OpenGraph image tag

											
										
										
											2016-10-31 05:41:33 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      context "post image" do
 								        let(:reply) { Fabricate(:post_with_uploaded_image, post_number: 2) }
 								        let(:cpp) { CookedPostProcessor.new(reply) }
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        it "adds a post image if there's one in the post" do
 								          FastImage.stubs(:size)
-												FEATURE: Include optimized thumbnails for topics (#9215)

This introduces new APIs for obtaining optimized thumbnails for topics. There are a few building blocks required for this:

- Introduces new `image_upload_id` columns on the `posts` and `topics` table. This replaces the old `image_url` column, which means that thumbnails are now restricted to uploads. Hotlinked thumbnails are no longer possible. In normal use (with pull_hotlinked_images enabled), this has no noticeable impact

- A migration attempts to match existing urls to upload records. If a match cannot be found then the posts will be queued for rebake

- Optimized thumbnails are generated during post_process_cooked. If thumbnails are missing when serializing a topic list, then a sidekiq job is queued

- Topic lists and topics now include a `thumbnails` key, which includes all the available images:
   ```
   "thumbnails": [
   {
     "max_width": null,
     "max_height": null,
     "url": "//example.com/original-image.png",
     "width": 1380,
     "height": 1840
   },
   {
     "max_width": 1024,
     "max_height": 1024,
     "url": "//example.com/optimized-image.png",
     "width": 768,
     "height": 1024
   }
   ]
  ```

- Themes can request additional thumbnail sizes by using a modifier in their `about.json` file:
   ```
    "modifiers": {
      "topic_thumbnail_sizes": [
        [200, 200],
        [800, 800]
      ],
      ...
  ```
  Remember that these are generated asynchronously, so your theme should include logic to fallback to other available thumbnails if your requested size has not yet been generated

- Two new raw plugin outlets are introduced, to improve the customisability of the topic list. `topic-list-before-columns` and `topic-list-before-link`
											
										
										
											2020-05-05 04:07:50 -04:00
+								          expect(reply.image_upload_id).to eq(nil)
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								          cpp.post_process
 								          reply.reload
-												FEATURE: Include optimized thumbnails for topics (#9215)

This introduces new APIs for obtaining optimized thumbnails for topics. There are a few building blocks required for this:

- Introduces new `image_upload_id` columns on the `posts` and `topics` table. This replaces the old `image_url` column, which means that thumbnails are now restricted to uploads. Hotlinked thumbnails are no longer possible. In normal use (with pull_hotlinked_images enabled), this has no noticeable impact

- A migration attempts to match existing urls to upload records. If a match cannot be found then the posts will be queued for rebake

- Optimized thumbnails are generated during post_process_cooked. If thumbnails are missing when serializing a topic list, then a sidekiq job is queued

- Topic lists and topics now include a `thumbnails` key, which includes all the available images:
   ```
   "thumbnails": [
   {
     "max_width": null,
     "max_height": null,
     "url": "//example.com/original-image.png",
     "width": 1380,
     "height": 1840
   },
   {
     "max_width": 1024,
     "max_height": 1024,
     "url": "//example.com/optimized-image.png",
     "width": 768,
     "height": 1024
   }
   ]
  ```

- Themes can request additional thumbnail sizes by using a modifier in their `about.json` file:
   ```
    "modifiers": {
      "topic_thumbnail_sizes": [
        [200, 200],
        [800, 800]
      ],
      ...
  ```
  Remember that these are generated asynchronously, so your theme should include logic to fallback to other available thumbnails if your requested size has not yet been generated

- Two new raw plugin outlets are introduced, to improve the customisability of the topic list. `topic-list-before-columns` and `topic-list-before-link`
											
										
										
											2020-05-05 04:07:50 -04:00
+								          expect(reply.image_upload_id).to be_present
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								        end
-												FEATURE: include post image in OpenGraph image tag

											
										
										
											2016-10-31 05:41:33 -04:00
+								      end
-												Don't append the base url to absolute image urls without protocol.

											
										
										
											2013-05-30 11:17:07 -04:00
+								    end
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								  end
-												do not lightbox oneboxed images

											
										
										
											2013-06-23 20:10:21 -04:00
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#extract_images" do
-												do not lightbox oneboxed images

											
										
										
											2013-06-23 20:10:21 -04:00
-												FIX: don't use emojis as topic image

											
										
										
											2015-08-05 06:57:31 -04:00
+								    let(:post) { build(:post_with_plenty_of_images) }
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    let(:cpp) { CookedPostProcessor.new(post) }
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
-												FIX: don't use emojis as topic image

											
										
										
											2015-08-05 06:57:31 -04:00
+								    it "does not extract emojis or images inside oneboxes or quotes" do
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.extract_images.length).to eq(0)
-												do not lightbox oneboxed images

											
										
										
											2013-06-23 20:10:21 -04:00
+								    end
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								  end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#get_size_from_attributes" do
-												FIX: rescale image during cooked_post_processor when only img height or width is specified

											
										
										
											2015-08-29 17:56:25 -04:00
 								    let(:post) { build(:post) }
 								    let(:cpp) { CookedPostProcessor.new(post) }
 								    it "returns the size when width and height are specified" do
 								      img = { 'src' => 'http://foo.bar/image3.png', 'width' => 50, 'height' => 70 }
 								      expect(cpp.get_size_from_attributes(img)).to eq([50, 70])
 								    end
 								    it "returns the size when width and height are floats" do
 								      img = { 'src' => 'http://foo.bar/image3.png', 'width' => 50.2, 'height' => 70.1 }
 								      expect(cpp.get_size_from_attributes(img)).to eq([50, 70])
 								    end
 								    it "resizes when only width is specified" do
 								      img = { 'src' => 'http://foo.bar/image3.png', 'width' => 100 }
-												Nuke all `SiteSetting.stubs` from our codebase.

											
										
										
											2017-07-07 02:09:14 -04:00
+								      SiteSetting.crawl_images = true
-												FIX: rescale image during cooked_post_processor when only img height or width is specified

											
										
										
											2015-08-29 17:56:25 -04:00
+								      FastImage.expects(:size).returns([200, 400])
 								      expect(cpp.get_size_from_attributes(img)).to eq([100, 200])
 								    end
 								    it "resizes when only height is specified" do
 								      img = { 'src' => 'http://foo.bar/image3.png', 'height' => 100 }
-												Nuke all `SiteSetting.stubs` from our codebase.

											
										
										
											2017-07-07 02:09:14 -04:00
+								      SiteSetting.crawl_images = true
-												FIX: rescale image during cooked_post_processor when only img height or width is specified

											
										
										
											2015-08-29 17:56:25 -04:00
+								      FastImage.expects(:size).returns([100, 300])
 								      expect(cpp.get_size_from_attributes(img)).to eq([33, 100])
 								    end
-												FIX: Don't raise an error when the img attribute cannot be found

											
										
										
											2017-05-08 15:35:31 -04:00
+								    it "doesn't raise an error with a weird url" do
 								      img = { 'src' => nil, 'height' => 100 }
-												Nuke all `SiteSetting.stubs` from our codebase.

											
										
										
											2017-07-07 02:09:14 -04:00
+								      SiteSetting.crawl_images = true
-												FIX: Don't raise an error when the img attribute cannot be found

											
										
										
											2017-05-08 15:35:31 -04:00
+								      expect(cpp.get_size_from_attributes(img)).to be_nil
 								    end
-												FIX: rescale image during cooked_post_processor when only img height or width is specified

											
										
										
											2015-08-29 17:56:25 -04:00
+								  end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#get_size_from_image_sizes" do
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
 								    let(:post) { build(:post) }
 								    let(:cpp) { CookedPostProcessor.new(post) }
 								    it "returns the size" do
 								      image_sizes = { "http://my.discourse.org/image.png" => { "width" => 111, "height" => 222 } }
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.get_size_from_image_sizes("/image.png", image_sizes)).to eq([111, 222])
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								    end
-												soften the lightbox overlay

											
										
										
											2013-06-25 20:44:20 -04:00
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								  end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#get_size" do
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
 								    let(:post) { build(:post) }
 								    let(:cpp) { CookedPostProcessor.new(post) }
 								    it "ensures urls are absolute" do
 								      cpp.expects(:is_valid_image_url?).with("http://test.localhost/relative/url/image.png")
 								      cpp.get_size("/relative/url/image.png")
 								    end
 								    it "ensures urls have a default scheme" do
 								      cpp.expects(:is_valid_image_url?).with("http://schemaless.url/image.jpg")
 								      cpp.get_size("//schemaless.url/image.jpg")
 								    end
 								    it "caches the results" do
-												Nuke all `SiteSetting.stubs` from our codebase.

											
										
										
											2017-07-07 02:09:14 -04:00
+								      SiteSetting.crawl_images = true
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								      FastImage.expects(:size).returns([200, 400])
 								      cpp.get_size("http://foo.bar/image3.png")
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.get_size("http://foo.bar/image3.png")).to eq([200, 400])
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    end
 								    context "when crawl_images is disabled" do
-												Nuke all `SiteSetting.stubs` from our codebase.

											
										
										
											2017-07-07 02:09:14 -04:00
+								      before do
 								        SiteSetting.crawl_images = false
 								      end
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
 								      it "doesn't call FastImage" do
 								        FastImage.expects(:size).never
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								        expect(cpp.get_size("http://foo.bar/image1.png")).to eq(nil)
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								      end
 								      it "is always allowed to crawl our own images" do
 								        store = stub
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								        Discourse.expects(:store).returns(store).at_least_once
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								        store.expects(:has_been_uploaded?).returns(true)
 								        FastImage.expects(:size).returns([100, 200])
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								        expect(cpp.get_size("http://foo.bar/image2.png")).to eq([100, 200])
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								      end
-												FIX: `FastImage#size` returns `nil` if it can't fetch the image size.

											
										
										
											2016-03-07 22:29:18 -05:00
+								      it "returns nil if FastImage can't get the original size" do
 								        Discourse.store.class.any_instance.expects(:has_been_uploaded?).returns(true)
 								        FastImage.expects(:size).returns(nil)
 								        expect(cpp.get_size("http://foo.bar/image3.png")).to eq(nil)
 								      end
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								    end
-												soften the lightbox overlay

											
										
										
											2013-06-25 20:44:20 -04:00
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								  end
-												soften the lightbox overlay

											
										
										
											2013-06-25 20:44:20 -04:00
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#is_valid_image_url?" do
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
 								    let(:post) { build(:post) }
 								    let(:cpp) { CookedPostProcessor.new(post) }
 								    it "validates HTTP(s) urls" do
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.is_valid_image_url?("http://domain.com")).to eq(true)
 								      expect(cpp.is_valid_image_url?("https://domain.com")).to eq(true)
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    end
 								    it "doesn't validate other urls" do
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.is_valid_image_url?("ftp://domain.com")).to eq(false)
 								      expect(cpp.is_valid_image_url?("ftps://domain.com")).to eq(false)
 								      expect(cpp.is_valid_image_url?("/tmp/image.png")).to eq(false)
 								      expect(cpp.is_valid_image_url?("//domain.com")).to eq(false)
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    end
 								    it "doesn't throw an exception with a bad URI" do
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.is_valid_image_url?("http://do<main.com")).to eq(nil)
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    end
 								  end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#get_filename" do
-												soften the lightbox overlay

											
										
										
											2013-06-25 20:44:20 -04:00
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								    let(:post) { build(:post) }
 								    let(:cpp) { CookedPostProcessor.new(post) }
 								    it "returns the filename of the src when there is no upload" do
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.get_filename(nil, "http://domain.com/image.png")).to eq("image.png")
-												soften the lightbox overlay

											
										
										
											2013-06-25 20:44:20 -04:00
+								    end
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								    it "returns the original filename of the upload when there is an upload" do
 								      upload = build(:upload, original_filename: "upload.jpg")
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.get_filename(upload, "http://domain.com/image.png")).to eq("upload.jpg")
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								    end
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								    it "returns a generic name for pasted images" do
 								      upload = build(:upload, original_filename: "blob.png")
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.get_filename(upload, "http://domain.com/image.png")).to eq(I18n.t('upload.pasted_image_filename'))
-												basic lightbox support

											
										
										
											2013-02-19 01:57:14 -05:00
+								    end
-												remove trailing whitespaces :heart:

											
										
										
											2013-02-25 11:42:20 -05:00
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								  end
-												FIX: Optimize quoted images (#8427)

Only images that were part of a lightbox used to be optimized. This
patch ensures that quoted images are also optimized.
											
										
										
											2019-11-29 08:18:42 -05:00
+								  context "#convert_to_link" do
 								    fab!(:thumbnail) { Fabricate(:optimized_image, upload: upload, width: 512, height: 384) }
 								    before do
 								      CookedPostProcessor.any_instance.stubs(:get_size).with(upload.url).returns([1024, 768])
 								    end
 								    it "adds lightbox and optimizes images" do
 								      post = Fabricate(:post, raw: "![image|1024x768, 50%](#{upload.short_url})")
 								      cpp = CookedPostProcessor.new(post, disable_loading_image: true)
 								      cpp.post_process
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								      doc = Nokogiri::HTML5::fragment(cpp.html)
-												FIX: Optimize quoted images (#8427)

Only images that were part of a lightbox used to be optimized. This
patch ensures that quoted images are also optimized.
											
										
										
											2019-11-29 08:18:42 -05:00
+								      expect(doc.css('.lightbox-wrapper').size).to eq(1)
 								      expect(doc.css('img').first['srcset']).to_not eq(nil)
 								    end
 								    it "optimizes images in quotes" do
 								      post = Fabricate(:post, raw: <<~MD)
 								        [quote]
 								        ![image|1024x768, 50%](#{upload.short_url})
 								        [/quote]
 								      MD
 								      cpp = CookedPostProcessor.new(post, disable_loading_image: true)
 								      cpp.post_process
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								      doc = Nokogiri::HTML5::fragment(cpp.html)
-												FIX: Optimize images in Onebox (#8471)

This commit ensures that images in Onebox are being optimized, but not
converted to lightbox too.
											
										
										
											2019-12-09 08:39:25 -05:00
+								      expect(doc.css('.lightbox-wrapper').size).to eq(0)
 								      expect(doc.css('img').first['srcset']).to_not eq(nil)
 								    end
 								    it "optimizes images in Onebox" do
 								      Oneboxer.expects(:onebox)
 								        .with("https://discourse.org", anything)
 								        .returns("<aside class='onebox'><img src='#{upload.url}' width='512' height='384'></aside>")
 								      post = Fabricate(:post, raw: "https://discourse.org")
 								      cpp = CookedPostProcessor.new(post, disable_loading_image: true)
 								      cpp.post_process
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								      doc = Nokogiri::HTML5::fragment(cpp.html)
-												FIX: Optimize quoted images (#8427)

Only images that were part of a lightbox used to be optimized. This
patch ensures that quoted images are also optimized.
											
										
										
											2019-11-29 08:18:42 -05:00
+								      expect(doc.css('.lightbox-wrapper').size).to eq(0)
 								      expect(doc.css('img').first['srcset']).to_not eq(nil)
 								    end
 								  end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#post_process_oneboxes" do
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    let(:post) { build(:post_with_youtube, id: 123) }
 								    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }
-												removed auto_link_images_wider_than setting

											
										
										
											2013-07-06 13:10:53 -04:00
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    before do
-												FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
											
										
										
											2020-01-22 18:31:46 -05:00
+								      Oneboxer
 								        .expects(:onebox)
-												SECURITY: correct local onebox category checks

Also removes ugly "source_topic_id" from cooked posts

Patch was authored by @zogstrip

Signed-off-by: Sam <sam.saffron@gmail.com>

											
										
										
											2018-02-13 18:39:44 -05:00
+								        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								        .returns("<div>GANGNAM STYLE</div>")
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								      cpp.post_process_oneboxes
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
+								    end
-												SECURITY: correct local onebox category checks

Also removes ugly "source_topic_id" from cooked posts

Patch was authored by @zogstrip

Signed-off-by: Sam <sam.saffron@gmail.com>

											
										
										
											2018-02-13 18:39:44 -05:00
-												UX: generic onebox treats all square images as avatars and renders them smaller

											
										
										
											2017-11-12 19:19:06 -05:00
+								    it "inserts the onebox without wrapping p" do
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp).to be_dirty
-												UX: generic onebox treats all square images as avatars and renders them smaller

											
										
										
											2017-11-12 19:19:06 -05:00
+								      expect(cpp.html).to match_html "<div>GANGNAM STYLE</div>"
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    end
-												FIX: Onebox images are not downloaded locally without css class

											
										
										
											2018-07-31 17:21:02 -04:00
-												FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
											
										
										
											2020-01-22 18:31:46 -05:00
+								    describe "replacing downloaded onebox image" do
 								      let(:url) { 'https://image.com/my-avatar' }
 								      let(:image_url) { 'https://image.com/avatar.png' }
-												FIX: Onebox images are not downloaded locally without css class

											
										
										
											2018-07-31 17:21:02 -04:00
-												FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
											
										
										
											2020-01-22 18:31:46 -05:00
+								      it "successfully replaces the image" do
 								        Oneboxer.stubs(:onebox).with(url, anything).returns("<img class='onebox' src='#{image_url}' />")
-												FIX: Onebox images are not downloaded locally without css class

											
										
										
											2018-07-31 17:21:02 -04:00
-												FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
											
										
										
											2020-01-22 18:31:46 -05:00
+								        post = Fabricate(:post, raw: url)
 								        upload.update!(url: "https://test.s3.amazonaws.com/something.png")
-												FIX: Onebox images are not downloaded locally without css class

											
										
										
											2018-07-31 17:21:02 -04:00
-												FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
											
										
										
											2020-01-22 18:31:46 -05:00
+								        post.custom_fields[Post::DOWNLOADED_IMAGES] = { "//image.com/avatar.png": upload.id }
 								        post.save_custom_fields
-												FIX: Onebox images are not downloaded locally without css class

											
										
										
											2018-07-31 17:21:02 -04:00
-												FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
											
										
										
											2020-01-22 18:31:46 -05:00
+								        cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
 								        cpp.post_process_oneboxes
-												FIX: Onebox images are not downloaded locally without css class

											
										
										
											2018-07-31 17:21:02 -04:00
-												FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
											
										
										
											2020-01-22 18:31:46 -05:00
+								        expect(cpp.doc.to_s).to eq("<p><img class=\"onebox\" src=\"#{upload.url}\" width=\"\" height=\"\"></p>")
-												FIX: Use find_by_id method to prevent record not found exception

											
										
										
											2018-12-14 16:49:45 -05:00
-												FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
											
										
										
											2020-01-22 18:31:46 -05:00
+								        upload.destroy!
 								        cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
 								        cpp.post_process_oneboxes
 								        expect(cpp.doc.to_s).to eq("<p><img class=\"onebox\" src=\"#{image_url}\" width=\"\" height=\"\"></p>")
 								        Oneboxer.unstub(:onebox)
 								      end
-												FIX: Use find_by_id method to prevent record not found exception

											
										
										
											2018-12-14 16:49:45 -05:00
-												FIX: Use presigned URL to avoid 403 when pulling hotlinked images for secure media (#8764)

When we were pulling hotlinked images for oneboxes in the CookedPostProcessor, we were using the direct S3 URL, which returned a 403 error and thus did not set widths and heights of the images. We now cook the URL first based on whether the upload is secure before handing off to FastImage.
											
										
										
											2020-01-22 18:31:46 -05:00
+								      context "when the post is with_secure_media and the upload is secure and secure media is enabled" do
 								        before do
 								          upload.update(secure: true)
 								          SiteSetting.login_required = true
 								          s3_setup
 								          SiteSetting.secure_media = true
 								          stub_request(:head, "https://#{SiteSetting.s3_upload_bucket}.s3.amazonaws.com/")
 								        end
 								        it "does not use the direct URL, uses the cooked URL instead (because of the private ACL preventing w/h fetch)" do
 								          Oneboxer.stubs(:onebox).with(url, anything).returns("<img class='onebox' src='#{image_url}' />")
 								          post = Fabricate(:post, raw: url)
 								          upload.update!(url: "https://test.s3.amazonaws.com/something.png")
 								          post.custom_fields[Post::DOWNLOADED_IMAGES] = { "//image.com/avatar.png": upload.id }
 								          post.save_custom_fields
 								          cooked_url = "https://localhost/secure-media-uploads/test.png"
 								          UrlHelper.expects(:cook_url).with(upload.url, secure: true).returns(cooked_url)
 								          cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
 								          cpp.post_process_oneboxes
 								          expect(cpp.doc.to_s).to eq("<p><img class=\"onebox\" src=\"#{cooked_url}\" width=\"\" height=\"\"></p>")
 								        end
 								      end
-												FIX: Onebox images are not downloaded locally without css class

											
										
										
											2018-07-31 17:21:02 -04:00
+								    end
-												FIX: Display large/broken image placeholders for image oneboxes

											
										
										
											2018-10-07 08:10:15 -04:00
 								    it "replaces large image placeholder" do
 								      url = 'https://image.com/my-avatar'
 								      image_url = 'https://image.com/avatar.png'
 								      Oneboxer.stubs(:onebox).with(url, anything).returns("<img class='onebox' src='#{image_url}' />")
 								      post = Fabricate(:post, raw: url)
-												REFACTOR: Refactor pull_hotlinked_images job

This commit should cause no functional change
- Split into functions to avoid deep nesting
- Register custom field type, and remove manual json parse/serialize
- Recover from deleted upload records

Also adds a test to ensure pull_hotlinked_images redownloads secure images only once
											
										
										
											2020-08-05 07:14:59 -04:00
+								      post.custom_fields[Post::LARGE_IMAGES] = ["//image.com/avatar.png"]
-												FIX: Display large/broken image placeholders for image oneboxes

											
										
										
											2018-10-07 08:10:15 -04:00
+								      post.save_custom_fields
 								      cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
-												DEV: Make `CookedPostProcessor#post_process_images` method private.

											
										
										
											2019-05-26 23:28:37 -04:00
+								      cpp.post_process
-												FIX: Display large/broken image placeholders for image oneboxes

											
										
										
											2018-10-07 08:10:15 -04:00
 								      expect(cpp.doc.to_s).to match(/<div class="large-image-placeholder">/)
 								    end
-												UX: generic onebox treats all square images as avatars and renders them smaller

											
										
										
											2017-11-12 19:19:06 -05:00
+								  end
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#post_process_oneboxes removes nofollow if add_rel_nofollow_to_user_content is disabled" do
-												FIX: respect nofollow settings for onebox links

											
										
										
											2018-03-26 06:24:39 -04:00
+								    let(:post) { build(:post_with_youtube, id: 123) }
 								    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }
 								    before do
 								      SiteSetting.add_rel_nofollow_to_user_content = false
 								      Oneboxer.expects(:onebox)
 								        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
-												FIX: Make sure rel attributes are correctly set. (#10645)

We must guarantee that "rel=noopener" was set if "target=_blank" is present, which is not always the case for trusted users. Also, if the link contains the "nofollow" attribute, it has to have the "ugc" attribute as well.
											
										
										
											2020-09-10 11:59:51 -04:00
+								        .returns('<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="noopener nofollow ugc">GANGNAM STYLE</a></aside>')
-												FIX: respect nofollow settings for onebox links

											
										
										
											2018-03-26 06:24:39 -04:00
+								      cpp.post_process_oneboxes
 								    end
 								    it "removes nofollow noopener from links" do
 								      expect(cpp).to be_dirty
-												FIX: Don't strip `noopener` from oneboxes

											
										
										
											2020-07-13 16:54:15 -04:00
+								      expect(cpp.html).to match_html '<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="noopener">GANGNAM STYLE</a></aside>'
-												FIX: respect nofollow settings for onebox links

											
										
										
											2018-03-26 06:24:39 -04:00
+								    end
 								  end
-												FIX: respect `tl3 links no follow` setting (#8232)


											
										
										
											2019-10-22 13:11:04 -04:00
+								  context "#post_process_oneboxes removes nofollow if user is tl3" do
 								    let(:post) { build(:post_with_youtube, id: 123) }
 								    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }
 								    before do
 								      post.user.trust_level = TrustLevel[3]
 								      post.user.save!
 								      SiteSetting.add_rel_nofollow_to_user_content = true
 								      SiteSetting.tl3_links_no_follow = false
 								      Oneboxer.expects(:onebox)
 								        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
-												FIX: Make sure rel attributes are correctly set. (#10645)

We must guarantee that "rel=noopener" was set if "target=_blank" is present, which is not always the case for trusted users. Also, if the link contains the "nofollow" attribute, it has to have the "ugc" attribute as well.
											
										
										
											2020-09-10 11:59:51 -04:00
+								        .returns('<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="noopener nofollow ugc">GANGNAM STYLE</a></aside>')
-												FIX: respect `tl3 links no follow` setting (#8232)


											
										
										
											2019-10-22 13:11:04 -04:00
+								      cpp.post_process_oneboxes
 								    end
-												FIX: Don't strip `noopener` from oneboxes

											
										
										
											2020-07-13 16:54:15 -04:00
+								    it "removes nofollow ugc from links" do
-												FIX: respect `tl3 links no follow` setting (#8232)


											
										
										
											2019-10-22 13:11:04 -04:00
+								      expect(cpp).to be_dirty
-												FIX: Don't strip `noopener` from oneboxes

											
										
										
											2020-07-13 16:54:15 -04:00
+								      expect(cpp.html).to match_html '<aside class="onebox"><a href="https://www.youtube.com/watch?v=9bZkp7q19f0" rel="noopener">GANGNAM STYLE</a></aside>'
-												FIX: respect `tl3 links no follow` setting (#8232)


											
										
										
											2019-10-22 13:11:04 -04:00
+								    end
 								  end
-												FIX: Process image onebox correctly when image is wrapped in a link

The instagram onebox sometimes surrounds the image with an `<a>` tag, which was breaking the aspect ratio logic, and therefore causing posts to change height on load.

											
										
										
											2019-05-10 05:02:15 -04:00
+								  context "#post_process_oneboxes with oneboxed image" do
 								    let(:post) { build(:post_with_youtube, id: 123) }
 								    let(:cpp) { CookedPostProcessor.new(post, invalidate_oneboxes: true) }
 								    it "applies aspect ratio to container" do
 								      Oneboxer.expects(:onebox)
 								        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
 								        .returns("<aside class='onebox'><div class='scale-images'><img src='/img.jpg' width='400' height='500'/></div></div>")
 								      cpp.post_process_oneboxes
 								      expect(cpp.html).to match_html('<aside class="onebox"><div class="aspect-image-full-size" style="--aspect-ratio:400/500;"><img src="/img.jpg"></div></aside>')
 								    end
 								    it "applies aspect ratio when wrapped in link" do
 								      Oneboxer.expects(:onebox)
 								        .with("http://www.youtube.com/watch?v=9bZkp7q19f0", invalidate_oneboxes: true, user_id: nil, category_id: post.topic.category_id)
 								        .returns("<aside class='onebox'><div class='scale-images'><a href='https://example.com'><img src='/img.jpg' width='400' height='500'/></a></div></div>")
 								      cpp.post_process_oneboxes
 								      expect(cpp.html).to match_html('<aside class="onebox"><div class="aspect-image-full-size" style="--aspect-ratio:400/500;"><a href="https://example.com"><img src="/img.jpg"></a></div></aside>')
 								    end
 								  end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#post_process_oneboxes with square image" do
-												UX: generic onebox treats all square images as avatars and renders them smaller

											
										
										
											2017-11-12 19:19:06 -05:00
 								    it "generates a onebox-avatar class" do
 								      SiteSetting.crawl_images = true
 								      url = 'https://square-image.com/onebox'
 								      body = <<~HTML
 								      <html>
 								      <head>
 								      <meta property='og:title' content="Page awesome">
 								      <meta property='og:image' content="https://image.com/avatar.png">
 								      <meta property='og:description' content="Page awesome desc">
 								      </head>
 								      </html>
 								      HTML
-												FIX: don't double request when downloading a file

											
										
										
											2018-02-24 06:35:57 -05:00
+								      stub_request(:head, url)
 								      stub_request(:get , url).to_return(body: body)
-												UX: generic onebox treats all square images as avatars and renders them smaller

											
										
										
											2017-11-12 19:19:06 -05:00
+								      FinalDestination.stubs(:lookup_ip).returns('1.2.3.4')
 								      # not an ideal stub but shipping the whole image to fast image can add
 								      # a lot of cost to this test
 								      FastImage.stubs(:size).returns([200, 200])
 								      post = Fabricate.build(:post, raw: url)
 								      cpp = CookedPostProcessor.new(post, invalidate_oneboxes: true)
 								      cpp.post_process_oneboxes
 								      expect(cpp.doc.to_s).not_to include('aspect-image')
 								      expect(cpp.doc.to_s).to include('onebox-avatar')
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    end
-												removed auto_link_images_wider_than setting

											
										
										
											2013-07-06 13:10:53 -04:00
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								  end
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#optimize_urls" do
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    let(:post) { build(:post_with_uploads_and_links) }
 								    let(:cpp) { CookedPostProcessor.new(post) }
 								    it "uses schemaless url for uploads" do
 								      cpp.optimize_urls
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								      expect(cpp.html).to match_html <<~HTML.rstrip
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								        <p><a href="//test.localhost/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
 								        <img src="//test.localhost/#{upload_path}/original/1X/1234567890123456.jpg"><br>
-												FIX: Make sure rel attributes are correctly set. (#10645)

We must guarantee that "rel=noopener" was set if "target=_blank" is present, which is not always the case for trusted users. Also, if the link contains the "nofollow" attribute, it has to have the "ugc" attribute as well.
											
										
										
											2020-09-10 11:59:51 -04:00
+								        <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
-												FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled

											
										
										
											2017-02-07 12:06:44 -05:00
+								        <img src="http://foo.bar/image.png"><br>
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								        <a class="attachment" href="//test.localhost/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
-												FEATURE: line with only 1 to 3  emojis will now display as large emojis


											
										
										
											2020-01-16 03:54:26 -05:00
+								        <img src="//test.localhost/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
-												FIX: store the topic links using the cooked upload url

											
										
										
											2018-08-14 06:23:32 -04:00
+								      HTML
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								    end
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								    context "when CDN is enabled" do
-												FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled

											
										
										
											2017-02-07 12:06:44 -05:00
+								      it "uses schemaless CDN url for http uploads" do
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								        Rails.configuration.action_controller.stubs(:asset_host).returns("http://my.cdn.com")
 								        cpp.optimize_urls
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								        expect(cpp.html).to match_html <<~HTML.rstrip
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          <p><a href="//my.cdn.com/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
 								          <img src="//my.cdn.com/#{upload_path}/original/1X/1234567890123456.jpg"><br>
-												FIX: Make sure rel attributes are correctly set. (#10645)

We must guarantee that "rel=noopener" was set if "target=_blank" is present, which is not always the case for trusted users. Also, if the link contains the "nofollow" attribute, it has to have the "ugc" attribute as well.
											
										
										
											2020-09-10 11:59:51 -04:00
+								          <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
-												FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled

											
										
										
											2017-02-07 12:06:44 -05:00
+								          <img src="http://foo.bar/image.png"><br>
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          <a class="attachment" href="//my.cdn.com/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
-												FEATURE: line with only 1 to 3  emojis will now display as large emojis


											
										
										
											2020-01-16 03:54:26 -05:00
+								          <img src="//my.cdn.com/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
-												FIX: store the topic links using the cooked upload url

											
										
										
											2018-08-14 06:23:32 -04:00
+								        HTML
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								      end
-												FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled

											
										
										
											2017-02-07 12:06:44 -05:00
+								      it "doesn't use schemaless CDN url for https uploads" do
-												FIX: properly support HTTPS CDN on HTTP site

Previously we changed all CDN links to schemaless.

This is desirable for non HTTPS sites, to ease migration to HTTPS.
It is not desirable for secure sites.

Once site is secure or CDN is secure a rebake should be required
to move it back to non-secure.

											
										
										
											2015-07-24 00:08:32 -04:00
+								        Rails.configuration.action_controller.stubs(:asset_host).returns("https://my.cdn.com")
 								        cpp.optimize_urls
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								        expect(cpp.html).to match_html <<~HTML.rstrip
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          <p><a href="https://my.cdn.com/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
 								          <img src="https://my.cdn.com/#{upload_path}/original/1X/1234567890123456.jpg"><br>
-												FIX: Make sure rel attributes are correctly set. (#10645)

We must guarantee that "rel=noopener" was set if "target=_blank" is present, which is not always the case for trusted users. Also, if the link contains the "nofollow" attribute, it has to have the "ugc" attribute as well.
											
										
										
											2020-09-10 11:59:51 -04:00
+								          <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
-												FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled

											
										
										
											2017-02-07 12:06:44 -05:00
+								          <img src="http://foo.bar/image.png"><br>
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          <a class="attachment" href="https://my.cdn.com/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
-												FEATURE: line with only 1 to 3  emojis will now display as large emojis


											
										
										
											2020-01-16 03:54:26 -05:00
+								          <img src="https://my.cdn.com/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
-												FIX: store the topic links using the cooked upload url

											
										
										
											2018-08-14 06:23:32 -04:00
+								        HTML
-												FIX: don't use the CDN for attachments when login is required

											
										
										
											2016-01-06 15:54:01 -05:00
+								      end
-												FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled

											
										
										
											2017-02-07 12:06:44 -05:00
+								      it "doesn't use CDN when login is required" do
-												FIX: don't use the CDN for attachments when login is required

											
										
										
											2016-01-06 15:54:01 -05:00
+								        SiteSetting.login_required = true
 								        Rails.configuration.action_controller.stubs(:asset_host).returns("http://my.cdn.com")
 								        cpp.optimize_urls
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								        expect(cpp.html).to match_html <<~HTML.rstrip
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          <p><a href="//my.cdn.com/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
 								          <img src="//my.cdn.com/#{upload_path}/original/1X/1234567890123456.jpg"><br>
-												FIX: Make sure rel attributes are correctly set. (#10645)

We must guarantee that "rel=noopener" was set if "target=_blank" is present, which is not always the case for trusted users. Also, if the link contains the "nofollow" attribute, it has to have the "ugc" attribute as well.
											
										
										
											2020-09-10 11:59:51 -04:00
+								          <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
-												FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled

											
										
										
											2017-02-07 12:06:44 -05:00
+								          <img src="http://foo.bar/image.png"><br>
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          <a class="attachment" href="//test.localhost/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
-												FEATURE: line with only 1 to 3  emojis will now display as large emojis


											
										
										
											2020-01-16 03:54:26 -05:00
+								          <img src="//my.cdn.com/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
-												FIX: store the topic links using the cooked upload url

											
										
										
											2018-08-14 06:23:32 -04:00
+								        HTML
-												FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled

											
										
										
											2017-02-07 12:06:44 -05:00
+								      end
 								      it "doesn't use CDN when preventing anons from downloading files" do
 								        SiteSetting.prevent_anons_from_downloading_files = true
 								        Rails.configuration.action_controller.stubs(:asset_host).returns("http://my.cdn.com")
 								        cpp.optimize_urls
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								        expect(cpp.html).to match_html <<~HTML.rstrip
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          <p><a href="//my.cdn.com/#{upload_path}/original/2X/2345678901234567.jpg">Link</a><br>
 								          <img src="//my.cdn.com/#{upload_path}/original/1X/1234567890123456.jpg"><br>
-												FIX: Make sure rel attributes are correctly set. (#10645)

We must guarantee that "rel=noopener" was set if "target=_blank" is present, which is not always the case for trusted users. Also, if the link contains the "nofollow" attribute, it has to have the "ugc" attribute as well.
											
										
										
											2020-09-10 11:59:51 -04:00
+								          <a href="http://www.google.com" rel="noopener nofollow ugc">Google</a><br>
-												FIX: don't put attachments on the CDN when 'prevent anons from downloading files' is enabled

											
										
										
											2017-02-07 12:06:44 -05:00
+								          <img src="http://foo.bar/image.png"><br>
-												FIX: parallel spec system needs a dedicated upload folder for each worker. (#8547)


											
										
										
											2019-12-18 00:51:57 -05:00
+								          <a class="attachment" href="//test.localhost/#{upload_path}/original/1X/af2c2618032c679333bebf745e75f9088748d737.txt">text.txt</a> (20 Bytes)<br>
-												FEATURE: line with only 1 to 3  emojis will now display as large emojis


											
										
										
											2020-01-16 03:54:26 -05:00
+								          <img src="//my.cdn.com/images/emoji/twitter/smile.png?v=#{Emoji::EMOJI_VERSION}" title=":smile:" class="emoji only-emoji" alt=":smile:"></p>
-												FIX: store the topic links using the cooked upload url

											
										
										
											2018-08-14 06:23:32 -04:00
+								        HTML
-												FIX: properly support HTTPS CDN on HTTP site

Previously we changed all CDN links to schemaless.

This is desirable for non HTTPS sites, to ease migration to HTTPS.
It is not desirable for secure sites.

Once site is secure or CDN is secure a rebake should be required
to move it back to non-secure.

											
										
										
											2015-07-24 00:08:32 -04:00
+								      end
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								      context "s3_uploads" do
 								        before do
-												FIX: Secure Upload URLs in lightbox (#8451)

This fixes the following issues:

* The link element on the lightbox which pops open the lightbox was linking to the S3 URL with a private ACL instead of the secure media URL for the image
* Change to use `@post.with_secure_media?` in `CookedPostProcessor` for URL cooking, as in some cases, like when a post is edited and an upload is added, `upload.secure?` can be false which resulted in `srcset` URLs not being cooked correctly to secure media upload urls.

											
										
										
											2019-12-04 18:13:09 -05:00
+								          s3_setup
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								          uploaded_file = file_from_fixtures("smallest.png")
 								          upload_sha1 = Digest::SHA1.hexdigest(File.read(uploaded_file))
 								          upload.update!(
 								            original_filename: "smallest.png",
 								            width: 10,
 								            height: 20,
 								            sha1: upload_sha1,
 								            extension: "png",
 								          )
 								        end
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								        it "uses the right CDN when uploads are on S3" do
 								          stored_path = Discourse.store.get_path_for_upload(upload)
 								          upload.update_column(:url, "#{SiteSetting.Upload.absolute_base_url}/#{stored_path}")
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								          the_post = Fabricate(:post, raw: %Q{This post has a local emoji :+1: and an external upload\n\n![smallest.png|10x20](#{upload.short_url})})
-												DEV: Reduce object fabrication in `CookedPostProcessor` spec.

											
										
										
											2019-05-29 20:49:37 -04:00
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								          cpp = CookedPostProcessor.new(the_post)
 								          cpp.optimize_urls
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								          expect(cpp.html).to match_html <<~HTML.rstrip
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								            <p>This post has a local emoji <img src="https://local.cdn.com/images/emoji/twitter/+1.png?v=#{Emoji::EMOJI_VERSION}" title=":+1:" class="emoji" alt=":+1:"> and an external upload</p>
 								            <p><img src="https://s3.cdn.com/#{stored_path}" alt="smallest.png" data-base62-sha1="#{upload.base62_sha1}" width="10" height="20"></p>
 								          HTML
 								        end
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								        it "doesn't use CDN for secure media" do
 								          SiteSetting.secure_media = true
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								          stored_path = Discourse.store.get_path_for_upload(upload)
 								          upload.update_column(:url, "#{SiteSetting.Upload.absolute_base_url}/#{stored_path}")
 								          upload.update_column(:secure, true)
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								          the_post = Fabricate(:post, raw: %Q{This post has a local emoji :+1: and an external upload\n\n![smallest.png|10x20](#{upload.short_url})})
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								          cpp = CookedPostProcessor.new(the_post)
 								          cpp.optimize_urls
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								          expect(cpp.html).to match_html <<~HTML.rstrip
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								            <p>This post has a local emoji <img src="https://local.cdn.com/images/emoji/twitter/+1.png?v=#{Emoji::EMOJI_VERSION}" title=":+1:" class="emoji" alt=":+1:"> and an external upload</p>
 								            <p><img src="/secure-media-uploads/#{stored_path}" alt="smallest.png" data-base62-sha1="#{upload.base62_sha1}" width="10" height="20"></p>
 								          HTML
 								        end
 								        context "media uploads" do
 								          fab!(:image_upload) { Fabricate(:upload) }
 								          fab!(:audio_upload) { Fabricate(:upload, extension: "ogg") }
 								          fab!(:video_upload) { Fabricate(:upload, extension: "mov") }
 								          before do
 								            video_upload.update!(url: "#{SiteSetting.s3_cdn_url}/#{Discourse.store.get_path_for_upload(video_upload)}")
 								            stub_request(:head, video_upload.url)
 								          end
 								          it "ignores prevent_anons_from_downloading_files and oneboxes video uploads" do
 								            SiteSetting.prevent_anons_from_downloading_files = true
 								            the_post = Fabricate(:post, raw: "This post has an S3 video onebox:\n#{video_upload.url}")
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								            cpp = CookedPostProcessor.new(the_post.reload)
 								            cpp.post_process_oneboxes
 								            cpp = CookedPostProcessor.new(the_post.reload)
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								            cpp.post_process_oneboxes
 								            expect(cpp.html).to match_html <<~HTML
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								              <p>This post has an S3 video onebox:<br>
 								                        </p><div class="onebox video-onebox">
 								                          <video width="100%" height="100%" controls="">
 								                            <source src="#{video_upload.url}">
 								                            <a href="#{video_upload.url}" rel="nofollow ugc noopener">#{video_upload.url}</a>
 								                          </video>
 								                        </div>
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								            HTML
 								          end
 								          it "oneboxes video using secure url when secure_media is enabled" do
 								            SiteSetting.login_required = true
 								            SiteSetting.secure_media = true
 								            video_upload.update_column(:secure, true)
-												FIX: ensure local images use local CDN when uploads are stored on S3

When the S3 store was enabled, we were only applying the S3 CDN.
So all images stored locally, like the emojis, were never put on the local CDN.

Fixed a bunch of CookedPostProcessor test by adding a call to 'optimize_urls'
in order to get final URLs.

I also removed the unnecessary PrettyText.add_s3_cdn method since this is already
handled in the CookedPostProcessor.

											
										
										
											2019-02-20 13:24:38 -05:00
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								            the_post = Fabricate(:post, raw: "This post has an S3 video onebox:\n#{video_upload.url}")
 								            cpp = CookedPostProcessor.new(the_post)
 								            cpp.post_process_oneboxes
 								            secure_url = video_upload.url.sub(SiteSetting.s3_cdn_url, "#{Discourse.base_url}/secure-media-uploads")
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								            expect(cpp.html).to match_html <<~HTML.rstrip
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								              <p>This post has an S3 video onebox:<br>
 								              <div class="onebox video-onebox">
 								                <video width="100%" height="100%" controls="">
 								                  <source src="#{secure_url}">
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								                  <a href="#{secure_url}">#{secure_url}</a>
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								                </video>
 								              </div>
 								              </p>
 								            HTML
 								          end
 								          it "oneboxes only audio/video and not images when secure_media is enabled" do
 								            SiteSetting.login_required = true
 								            SiteSetting.secure_media = true
 								            video_upload.update_column(:secure, true)
 								            audio_upload.update!(
 								              url: "#{SiteSetting.s3_cdn_url}/#{Discourse.store.get_path_for_upload(audio_upload)}",
 								              secure: true
 								            )
 								            image_upload.update!(
 								              url: "#{SiteSetting.s3_cdn_url}/#{Discourse.store.get_path_for_upload(image_upload)}",
 								              secure: true
 								            )
 								            stub_request(:head, audio_upload.url)
 								            stub_request(:get, image_upload.url)
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								            raw = <<~RAW.rstrip
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								              This post has a video upload.
 								              #{video_upload.url}
 								              This post has an audio upload.
 								              #{audio_upload.url}
 								              And an image upload.
 								              ![logo.png](upload://#{image_upload.base62_sha1}.#{image_upload.extension})
 								            RAW
 								            the_post = Fabricate(:post, raw: raw)
 								            cpp = CookedPostProcessor.new(the_post)
 								            cpp.post_process_oneboxes
 								            secure_video_url = video_upload.url.sub(SiteSetting.s3_cdn_url, "#{Discourse.base_url}/secure-media-uploads")
 								            secure_audio_url = audio_upload.url.sub(SiteSetting.s3_cdn_url, "#{Discourse.base_url}/secure-media-uploads")
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								            expect(cpp.html).to match_html <<~HTML.rstrip
 								              <p>This post has a video upload.<br>
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								              <div class="onebox video-onebox">
 								                <video width="100%" height="100%" controls="">
 								                  <source src="#{secure_video_url}">
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								                  <a href="#{secure_video_url}">#{secure_video_url}</a>
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								                </video>
 								              </div>
 								              </p>
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								              <p>This post has an audio upload.<br>
 								              <audio controls=""><source src="#{secure_audio_url}"><a href="#{secure_audio_url}">#{secure_audio_url}</a></audio></p>
-												FEATURE: Add support for secure media (#7888)

This PR introduces a new secure media setting. When enabled, it prevent unathorized access to media uploads (files of type image, video and audio). When the `login_required` setting is enabled, then all media uploads will be protected from unauthorized (anonymous) access. When `login_required`is disabled, only media in private messages will be protected from unauthorized access. 

A few notes: 

- the `prevent_anons_from_downloading_files` setting no longer applies to audio and video uploads
- the `secure_media` setting can only be enabled if S3 uploads are already enabled and configured
- upload records have a new column, `secure`, which is a boolean `true/false` of the upload's secure status
- when creating a public post with an upload that has already been uploaded and is marked as secure, the post creator will raise an error
- when enabling or disabling the setting on a site with existing uploads, the rake task `uploads:ensure_correct_acl` should be used to update all uploads' secure status and their ACL on S3

											
										
										
											2019-11-17 20:25:42 -05:00
+								              <p>And an image upload.<br>
 								              <img src="#{image_upload.url}" alt="#{image_upload.original_filename}" data-base62-sha1="#{image_upload.base62_sha1}"></p>
 								            HTML
 								          end
 								        end
 								      end
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
+								    end
-												removed auto_link_images_wider_than setting

											
										
										
											2013-07-06 13:10:53 -04:00
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
+								  end
-												FEATURE: Remove user IDs from internal URLs. (#7406)


											
										
										
											2019-04-22 22:45:41 -04:00
+								  context "#remove_user_ids" do
 								    let(:topic) { Fabricate(:topic) }
 								    let(:post) do
 								      Fabricate(:post, raw: <<~RAW)
 								        link to a topic: #{topic.url}?u=foo
 								        a tricky link to a topic: #{topic.url}?bob=bob;u=sam&jane=jane
 								        link to an external topic: https://google.com/?u=bar
-												FIX: rescue InvalidURIError when removing user ids from links

											
										
										
											2019-04-25 03:06:31 -04:00
 								        a malformed url: https://www.example.com/#123#4
-												FEATURE: Remove user IDs from internal URLs. (#7406)


											
										
										
											2019-04-22 22:45:41 -04:00
+								      RAW
 								    end
 								    let(:cpp) { CookedPostProcessor.new(post, disable_loading_image: true) }
 								    it "does remove user ids" do
 								      cpp.remove_user_ids
 								      expect(cpp.html).to have_tag('a', with: { href: topic.url })
 								      expect(cpp.html).to have_tag('a', with: { href: "#{topic.url}?bob=bob&jane=jane" })
 								      expect(cpp.html).to have_tag('a', with: { href: "https://google.com/?u=bar" })
-												FIX: rescue InvalidURIError when removing user ids from links

											
										
										
											2019-04-25 03:06:31 -04:00
+								      expect(cpp.html).to have_tag('a', with: { href: "https://www.example.com/#123#4" })
-												FEATURE: Remove user IDs from internal URLs. (#7406)


											
										
										
											2019-04-22 22:45:41 -04:00
+								    end
 								  end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#pull_hotlinked_images" do
-												FIX: lightbox wasn't working when using s3 upload

											
										
										
											2013-06-22 07:38:42 -04:00
-												FEATURE: new site setting download_remote_images_max_days_old

											
										
										
											2016-07-06 09:51:48 -04:00
+								    let(:post) { build(:post, created_at: 20.days.ago) }
-												refactor CookedPostProcessor & specs

											
										
										
											2013-07-07 19:39:08 -04:00
+								    let(:cpp) { CookedPostProcessor.new(post) }
-												add disk space usage failsafe

											
										
										
											2013-11-15 10:46:41 -05:00
+								    before { cpp.stubs(:available_disk_space).returns(90) }
-												FIX: Always schedule pull_hotlinked_images in cooked_post_processor

The job is now used to pull optimized images, and images from other sites on the same CDN. This needs to run even if download_remote_images is false

											
										
										
											2019-06-07 08:08:23 -04:00
+								    it "runs even when download_remote_images_to_local is disabled" do
 								      # We want to run it to pull hotlinked optimized images
-												Nuke all `SiteSetting.stubs` from our codebase.

											
										
										
											2017-07-07 02:09:14 -04:00
+								      SiteSetting.download_remote_images_to_local = false
-												FIX: Always schedule pull_hotlinked_images in cooked_post_processor

The job is now used to pull optimized images, and images from other sites on the same CDN. This needs to run even if download_remote_images is false

											
										
										
											2019-06-07 08:08:23 -04:00
+								      expect { cpp.pull_hotlinked_images }.
 								        to change { Jobs::PullHotlinkedImages.jobs.count }.by 1
-												cleaned up CookedPostProcessor and improved specs

											
										
										
											2013-06-15 06:29:20 -04:00
+								    end
-												add download_remote_images_to_local site setting

											
										
										
											2013-11-15 09:22:18 -05:00
+								    context "when download_remote_images_to_local? is enabled" do
-												Nuke all `SiteSetting.stubs` from our codebase.

											
										
										
											2017-07-07 02:09:14 -04:00
+								      before do
 								        SiteSetting.download_remote_images_to_local = true
 								      end
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
-												FIX: Avoid infinite loop if disk space is low

We now continue to enqueue the pull_hotlinked_images job for optimized images, even if disk space is low

											
										
										
											2019-06-07 09:09:02 -04:00
+								      it "disables download_remote_images if there is not enough disk space" do
 								        cpp.expects(:available_disk_space).returns(5)
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								        cpp.pull_hotlinked_images
-												FIX: Avoid infinite loop if disk space is low

We now continue to enqueue the pull_hotlinked_images job for optimized images, even if disk space is low

											
										
										
											2019-06-07 09:09:02 -04:00
+								        expect(SiteSetting.download_remote_images_to_local).to eq(false)
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
+								      end
-												FIX: Pull hotlinked images even when edited by system users (#9890)

Previously the pull hotlinked images job was skipped after system edits. This ensured that we never had an infinite loop of system-edit/pull-hotlinked/system-edit/pull-hotlinked etc.

A side effect was that edits made by system for any other reason (e.g. API, removing full quotes) would prevent pulling hotlinked images. This commit removes the system edit check, and replaces it with another method to avoid an infinite job scheduling loop.
											
										
										
											2020-05-29 08:07:47 -04:00
+								      it "does not run when requested to skip" do
 								        CookedPostProcessor.new(post, skip_pull_hotlinked_images: true).pull_hotlinked_images
 								        expect(Jobs::PullHotlinkedImages.jobs.size).to eq(0)
 								      end
-												add disk space usage failsafe

											
										
										
											2013-11-15 10:46:41 -05:00
-												FIX: Pull hotlinked images even when edited by system users (#9890)

Previously the pull hotlinked images job was skipped after system edits. This ensured that we never had an infinite loop of system-edit/pull-hotlinked/system-edit/pull-hotlinked etc.

A side effect was that edits made by system for any other reason (e.g. API, removing full quotes) would prevent pulling hotlinked images. This commit removes the system edit check, and replaces it with another method to avoid an infinite job scheduling loop.
											
										
										
											2020-05-29 08:07:47 -04:00
+								      context "and there is enough disk space" do
-												Update rubocop to 2.3.1.

											
										
										
											2020-07-24 05:16:52 -04:00
+								        before { cpp.expects(:disable_if_low_on_disk_space).at_least_once }
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
-												FEATURE: warn the admin whenever we disable the download_remote_images_to_local site setting

											
										
										
											2014-04-23 06:43:10 -04:00
+								        context "and the post has been updated by an actual user" do
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
-												FEATURE: warn the admin whenever we disable the download_remote_images_to_local site setting

											
										
										
											2014-04-23 06:43:10 -04:00
+								          before { post.id = 42 }
-												Rename `ninja_edit_window` to `editing_grace_period` :'(

											
										
										
											2015-11-24 14:28:42 -05:00
+								          it "ensures only one job is scheduled right after the editing_grace_period" do
-												Update rubocop to 2.3.1.

											
										
										
											2020-07-24 05:16:52 -04:00
+								            freeze_time
-												FEATURE: warn the admin whenever we disable the download_remote_images_to_local site setting

											
										
										
											2014-04-23 06:43:10 -04:00
+								            Jobs.expects(:cancel_scheduled_job).with(:pull_hotlinked_images, post_id: post.id).once
-												Rename `ninja_edit_window` to `editing_grace_period` :'(

											
										
										
											2015-11-24 14:28:42 -05:00
+								            delay = SiteSetting.editing_grace_period + 1
-												FEATURE: warn the admin whenever we disable the download_remote_images_to_local site setting

											
										
										
											2014-04-23 06:43:10 -04:00
-												Update rubocop to 2.3.1.

											
										
										
											2020-07-24 05:16:52 -04:00
+								            expect_enqueued_with(job: :pull_hotlinked_images, args: { post_id: post.id }, at: Time.zone.now + delay.seconds) do
 								              cpp.pull_hotlinked_images
 								            end
-												FEATURE: warn the admin whenever we disable the download_remote_images_to_local site setting

											
										
										
											2014-04-23 06:43:10 -04:00
+								          end
-												pull hotlinked images

											
										
										
											2013-11-05 13:04:47 -05:00
 								        end
 								      end
-												forgot to commit the test

											
										
										
											2013-06-24 16:56:03 -04:00
+								    end
-												cleaned up CookedPostProcessor and improved specs

											
										
										
											2013-06-15 06:29:20 -04:00
+								  end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#disable_if_low_on_disk_space" do
-												add disk space usage failsafe

											
										
										
											2013-11-15 10:46:41 -05:00
-												FEATURE: new site setting download_remote_images_max_days_old

											
										
										
											2016-07-06 09:51:48 -04:00
+								    let(:post) { build(:post, created_at: 20.days.ago) }
-												add disk space usage failsafe

											
										
										
											2013-11-15 10:46:41 -05:00
+								    let(:cpp) { CookedPostProcessor.new(post) }
-												FIX: Avoid infinite loop if disk space is low

We now continue to enqueue the pull_hotlinked_images job for optimized images, even if disk space is low

											
										
										
											2019-06-07 09:09:02 -04:00
+								    before do
 								      SiteSetting.download_remote_images_to_local = true
-												DEV: Fix CookedPostProcessor specs

Broken in #8480

											
										
										
											2019-12-08 21:16:00 -05:00
+								      SiteSetting.download_remote_images_threshold = 20
 								      cpp.stubs(:available_disk_space).returns(50)
-												FIX: Avoid infinite loop if disk space is low

We now continue to enqueue the pull_hotlinked_images job for optimized images, even if disk space is low

											
										
										
											2019-06-07 09:09:02 -04:00
+								    end
-												add disk space usage failsafe

											
										
										
											2013-11-15 10:46:41 -05:00
 								    it "does nothing when there's enough disk space" do
-												FIX: Avoid infinite loop if disk space is low

We now continue to enqueue the pull_hotlinked_images job for optimized images, even if disk space is low

											
										
										
											2019-06-07 09:09:02 -04:00
+								      SiteSetting.expects(:download_remote_images_to_local=).never
-												DEV: Remove the return value of disable_if_low_on_disk_space (#9469)

It was used only in specs.
											
										
										
											2020-04-20 21:48:33 -04:00
+								      cpp.disable_if_low_on_disk_space
-												add disk space usage failsafe

											
										
										
											2013-11-15 10:46:41 -05:00
+								    end
-												FEATURE: warn the admin whenever we disable the download_remote_images_to_local site setting

											
										
										
											2014-04-23 06:43:10 -04:00
+								    context "when there's not enough disk space" do
-												DEV: Fix CookedPostProcessor specs

Broken in #8480

											
										
										
											2019-12-08 21:16:00 -05:00
+								      before { SiteSetting.download_remote_images_threshold = 75 }
-												FEATURE: warn the admin whenever we disable the download_remote_images_to_local site setting

											
										
										
											2014-04-23 06:43:10 -04:00
 								      it "disables download_remote_images_threshold and send a notification to the admin" do
-												FIX: log a staff action + send a private message when disabling the 'download_remote_images_to_local' site setting

											
										
										
											2014-09-23 13:11:14 -04:00
+								        StaffActionLogger.any_instance.expects(:log_site_setting_change).once
 								        SystemMessage.expects(:create_from_system_user).with(Discourse.site_contact_user, :download_remote_images_disabled).once
-												DEV: Remove the return value of disable_if_low_on_disk_space (#9469)

It was used only in specs.
											
										
										
											2020-04-20 21:48:33 -04:00
+								        cpp.disable_if_low_on_disk_space
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								        expect(SiteSetting.download_remote_images_to_local).to eq(false)
-												FEATURE: warn the admin whenever we disable the download_remote_images_to_local site setting

											
										
										
											2014-04-23 06:43:10 -04:00
+								      end
-												FIX: don't disable download_remote_images_to_local if site uses S3 (#7861)


											
										
										
											2019-07-04 23:36:03 -04:00
+								      it "doesn't disable download_remote_images_to_local if site uses S3" do
 								        SiteSetting.s3_access_key_id = "s3-access-key-id"
 								        SiteSetting.s3_secret_access_key = "s3-secret-access-key"
 								        SiteSetting.enable_s3_uploads = true
-												DEV: Remove the return value of disable_if_low_on_disk_space (#9469)

It was used only in specs.
											
										
										
											2020-04-20 21:48:33 -04:00
+								        cpp.disable_if_low_on_disk_space
-												FIX: don't disable download_remote_images_to_local if site uses S3 (#7861)


											
										
										
											2019-07-04 23:36:03 -04:00
+								        expect(SiteSetting.download_remote_images_to_local).to eq(true)
 								      end
-												add disk space usage failsafe

											
										
										
											2013-11-15 10:46:41 -05:00
+								    end
 								  end
-												PERF: Move processing of inline onebox out of V8 context. (#6658)


											
										
										
											2018-11-25 20:21:38 -05:00
+								  context "#is_a_hyperlink?" do
-												FIX markdown hotlinked images were not properly pulled

											
										
										
											2013-11-20 07:10:08 -05:00
 								    let(:post) { build(:post) }
 								    let(:cpp) { CookedPostProcessor.new(post) }
-												FEATURE: Nokogumbo (#9577)

* FEATURE: Nokogumbo

Use Nokogumbo HTML parser.
											
										
										
											2020-05-04 23:46:57 -04:00
+								    let(:doc) { Nokogiri::HTML5::fragment('<body><div><a><img id="linked_image"></a><p><img id="standard_image"></p></div></body>') }
-												FIX markdown hotlinked images were not properly pulled

											
										
										
											2013-11-20 07:10:08 -05:00
 								    it "is true when the image is inside a link" do
 								      img = doc.css("img#linked_image").first
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.is_a_hyperlink?(img)).to eq(true)
-												FIX markdown hotlinked images were not properly pulled

											
										
										
											2013-11-20 07:10:08 -05:00
+								    end
 								    it "is false when the image is not inside a link" do
 								      img = doc.css("img#standard_image").first
-												few components with rspec3 syntax

											
										
										
											2015-01-09 11:34:37 -05:00
+								      expect(cpp.is_a_hyperlink?(img)).to eq(false)
-												FIX markdown hotlinked images were not properly pulled

											
										
										
											2013-11-20 07:10:08 -05:00
+								    end
 								  end
-												Remove `UserFirst` table and grant Emoji badge directly

											
										
										
											2016-04-07 12:27:26 -04:00
+								  context "grant badges" do
-												FIX: FirstReplyByEmail badge wasn't granted

DEPRECATED: PostProcess badge trigger

											
										
										
											2016-08-10 13:24:01 -04:00
+								    let(:cpp) { CookedPostProcessor.new(post) }
-												FEATURE: New "First Onebox" badge

											
										
										
											2016-04-12 14:09:59 -04:00
-												Remove `UserFirst` table and grant Emoji badge directly

											
										
										
											2016-04-07 12:27:26 -04:00
+								    context "emoji inside a quote" do
-												Feature: Change markdown engine to markdown it

This commit removes the old evilstreak markdownjs engine.

- Adds specs to WhiteLister and changes it to stop using globals
    (Fixes large memory leak)
- Fixes edge cases around bbcode handling
- Removes mdtest which is no longer valid (to be replaced with
    CommonMark)
- Updates MiniRacer to correct minor unmanaged memory leak
- Fixes plugin specs

											
										
										
											2017-07-14 08:27:28 -04:00
+								      let(:post) { Fabricate(:post, raw: "time to eat some sweet \n[quote]\n:candy:\n[/quote]\n mmmm") }
-												Remove `UserFirst` table and grant Emoji badge directly

											
										
										
											2016-04-07 12:27:26 -04:00
 								      it "doesn't award a badge when the emoji is in a quote" do
 								        cpp.grant_badges
 								        expect(post.user.user_badges.where(badge_id: Badge::FirstEmoji).exists?).to eq(false)
 								      end
 								    end
 								    context "emoji in the text" do
 								      let(:post) { Fabricate(:post, raw: "time to eat some sweet :candy: mmmm") }
 								      it "awards a badge for using an emoji" do
 								        cpp.grant_badges
 								        expect(post.user.user_badges.where(badge_id: Badge::FirstEmoji).exists?).to eq(true)
 								      end
 								    end
-												FEATURE: New "First Onebox" badge

											
										
										
											2016-04-12 14:09:59 -04:00
 								    context "onebox" do
-												FIX: Award 'First Onebox' badge just for Oneboxed URLs. (#7974)


											
										
										
											2019-08-08 12:45:18 -04:00
+								      before do
 								        Oneboxer.stubs(:onebox).with(anything, anything).returns(nil)
-												FIX: use allowlist and blocklist terminology (#10209)

This is a PR of the renaming whitelist to allowlist and blacklist to the blocklist.
											
										
										
											2020-07-26 20:23:54 -04:00
+								        Oneboxer.stubs(:onebox).with('https://discourse.org', anything).returns("<aside class=\"onebox allowlistedgeneric\">the rest of the onebox</aside>")
-												FIX: Award 'First Onebox' badge just for Oneboxed URLs. (#7974)


											
										
										
											2019-08-08 12:45:18 -04:00
+								      end
-												FEATURE: New "First Onebox" badge

											
										
										
											2016-04-12 14:09:59 -04:00
-												FIX: Award 'First Onebox' badge just for Oneboxed URLs. (#7974)


											
										
										
											2019-08-08 12:45:18 -04:00
+								      it "awards the badge for using an onebox" do
 								        post = Fabricate(:post, raw: "onebox me:\n\nhttps://discourse.org\n")
 								        cpp = CookedPostProcessor.new(post)
-												FEATURE: New "First Onebox" badge

											
										
										
											2016-04-12 14:09:59 -04:00
+								        cpp.post_process_oneboxes
 								        cpp.grant_badges
 								        expect(post.user.user_badges.where(badge_id: Badge::FirstOnebox).exists?).to eq(true)
 								      end
-												FIX: Don't ever grant badges when they're disabled

											
										
										
											2016-08-19 15:16:37 -04:00
-												FIX: Award 'First Onebox' badge just for Oneboxed URLs. (#7974)


											
										
										
											2019-08-08 12:45:18 -04:00
+								      it "does not award the badge when link is not oneboxed" do
 								        post = Fabricate(:post, raw: "onebox me:\n\nhttp://example.com\n")
 								        cpp = CookedPostProcessor.new(post)
 								        cpp.post_process_oneboxes
 								        cpp.grant_badges
 								        expect(post.user.user_badges.where(badge_id: Badge::FirstOnebox).exists?).to eq(false)
 								      end
 								      it "does not award the badge when the badge is disabled" do
-												FIX: Don't ever grant badges when they're disabled

											
										
										
											2016-08-19 15:16:37 -04:00
+								        Badge.where(id: Badge::FirstOnebox).update_all(enabled: false)
-												FIX: Award 'First Onebox' badge just for Oneboxed URLs. (#7974)


											
										
										
											2019-08-08 12:45:18 -04:00
+								        post = Fabricate(:post, raw: "onebox me:\n\nhttps://discourse.org\n")
 								        cpp = CookedPostProcessor.new(post)
-												FIX: Don't ever grant badges when they're disabled

											
										
										
											2016-08-19 15:16:37 -04:00
+								        cpp.post_process_oneboxes
 								        cpp.grant_badges
 								        expect(post.user.user_badges.where(badge_id: Badge::FirstOnebox).exists?).to eq(false)
 								      end
-												FEATURE: New "First Onebox" badge

											
										
										
											2016-04-12 14:09:59 -04:00
+								    end
-												FIX: FirstReplyByEmail badge wasn't granted

DEPRECATED: PostProcess badge trigger

											
										
										
											2016-08-10 13:24:01 -04:00
+								    context "reply_by_email" do
 								      let(:post) { Fabricate(:post, raw: "This is a **reply** via email ;)", via_email: true, post_number: 2) }
 								      it "awards a badge for replying via email" do
 								        cpp.grant_badges
 								        expect(post.user.user_badges.where(badge_id: Badge::FirstReplyByEmail).exists?).to eq(true)
 								      end
 								    end
-												Remove `UserFirst` table and grant Emoji badge directly

											
										
										
											2016-04-07 12:27:26 -04:00
+								  end
-												FEATURE: Add `quote-modified` class if a quote has been modified

											
										
										
											2018-03-13 13:07:51 -04:00
+								  context "quote processing" do
 								    let(:cpp) { CookedPostProcessor.new(cp) }
 								    let(:pp) { Fabricate(:post, raw: "This post is ripe for quoting!") }
 								    context "with an unmodified quote" do
 								      let(:cp) do
 								        Fabricate(
 								          :post,
 								          raw: "[quote=\"#{pp.user.username}, post: #{pp.post_number}, topic:#{pp.topic_id}]\nripe for quoting\n[/quote]\ntest"
 								        )
 								      end
 								      it "should not be marked as modified" do
 								        cpp.post_process_quotes
 								        expect(cpp.doc.css('aside.quote.quote-modified')).to be_blank
 								      end
 								    end
 								    context "with a modified quote" do
 								      let(:cp) do
 								        Fabricate(
 								          :post,
 								          raw: "[quote=\"#{pp.user.username}, post: #{pp.post_number}, topic:#{pp.topic_id}]\nmodified\n[/quote]\ntest"
 								        )
 								      end
 								      it "should be marked as modified" do
 								        cpp.post_process_quotes
 								        expect(cpp.doc.css('aside.quote.quote-modified')).to be_present
 								      end
 								    end
 								  end
-												FIX: handle clicks counters in full quotes

											
										
										
											2019-05-17 08:17:29 -04:00
+								  context "full quote on direct reply" do
-												DEV: Prefabrication (test optimization) (#7414)

* Introduced fab!, a helper that creates database state for a group

It's almost identical to let_it_be, except:

 1. It creates a new object for each test by default,
 2. You can disable it using PREFABRICATION=0


											
										
										
											2019-05-06 23:12:20 -04:00
+								    fab!(:topic) { Fabricate(:topic) }
-												FIX: remove full quote on direct replies when "typographed"

Use the cooked version of the post and the quote to compare their content in
order to take into account the "typographer" option of the markdown pipeline.

											
										
										
											2019-05-15 11:49:29 -04:00
+								    let!(:post) { Fabricate(:post, topic: topic, raw: 'this is the "first" post') }
-												FEATURE: Remove full quote only if first paragraph. (#6793)


											
										
										
											2018-12-18 09:46:20 -05:00
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
+								    let(:raw) do
-												FEATURE: Remove full quotes only from new posts. (#6862)


											
										
										
											2019-01-16 21:24:32 -05:00
+								      <<~RAW.strip
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
+								      [quote="#{post.user.username}, post:#{post.post_number}, topic:#{topic.id}"]
-												FIX: remove full quote on direct replies when "typographed"

Use the cooked version of the post and the quote to compare their content in
order to take into account the "typographer" option of the markdown pipeline.

											
										
										
											2019-05-15 11:49:29 -04:00
 								      this is the “first” post
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
+								      [/quote]
 								      and this is the third reply
 								      RAW
 								    end
-												FEATURE: Remove full quotes of direct replies. (#6729)


											
										
										
											2018-12-07 07:07:11 -05:00
-												FEATURE: Remove full quote only if first paragraph. (#6793)


											
										
										
											2018-12-18 09:46:20 -05:00
+								    let(:raw2) do
-												FEATURE: Remove full quotes only from new posts. (#6862)


											
										
										
											2019-01-16 21:24:32 -05:00
+								      <<~RAW.strip
-												FEATURE: Remove full quote only if first paragraph. (#6793)


											
										
										
											2018-12-18 09:46:20 -05:00
+								      and this is the third reply
 								      [quote="#{post.user.username}, post:#{post.post_number}, topic:#{topic.id}"]
-												FIX: remove full quote on direct replies when "typographed"

Use the cooked version of the post and the quote to compare their content in
order to take into account the "typographer" option of the markdown pipeline.

											
										
										
											2019-05-15 11:49:29 -04:00
+								      this is the ”first” post
-												FEATURE: Remove full quote only if first paragraph. (#6793)


											
										
										
											2018-12-18 09:46:20 -05:00
+								      [/quote]
 								      RAW
 								    end
-												FIX: Remove full nested quotes on direct reply (#8581)

It used to check how many quotes were inside a post, without taking
considering that some quotes can contain other quotes. This commit
selects only top level quotes.

I had to use XPath because I could not find an equivalent CSS
selector.
											
										
										
											2019-12-20 03:24:34 -05:00
+								    let(:raw3) do
 								      <<~RAW.strip
 								      [quote="#{post.user.username}, post:#{post.post_number}, topic:#{topic.id}"]
 								      this is the “first” post
 								      [/quote]
 								      [quote="#{post.user.username}, post:#{post.post_number}, topic:#{topic.id}"]
 								      this is the “first” post
 								      [/quote]
 								      and this is the third reply
 								      RAW
 								    end
-												FEATURE: Remove full quotes only from new posts. (#6862)


											
										
										
											2019-01-16 21:24:32 -05:00
+								    before do
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
+								      SiteSetting.remove_full_quote = true
-												FEATURE: Remove full quotes only from new posts. (#6862)


											
										
										
											2019-01-16 21:24:32 -05:00
+								    end
-												FEATURE: Remove full quotes of direct replies. (#6729)


											
										
										
											2018-12-07 07:07:11 -05:00
-												FEATURE: Remove full quotes only from new posts. (#6862)


											
										
										
											2019-01-16 21:24:32 -05:00
+								    it 'works' do
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
+								      hidden = Fabricate(:post, topic: topic, hidden: true, raw: "this is the second post after")
 								      small_action = Fabricate(:post, topic: topic, post_type: Post.types[:small_action])
-												FEATURE: Remove full quotes of direct replies. (#6729)


											
										
										
											2018-12-07 07:07:11 -05:00
+								      reply = Fabricate(:post, topic: topic, raw: raw)
-												DEV: Improve flaky time-sensitive specs (#9141)


											
										
										
											2020-03-10 17:13:17 -04:00
+								      freeze_time do
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
+								        topic.bumped_at = 1.day.ago
-												FIX: remove full quote on direct replies when "typographed"

Use the cooked version of the post and the quote to compare their content in
order to take into account the "typographer" option of the markdown pipeline.

											
										
										
											2019-05-15 11:49:29 -04:00
+								        CookedPostProcessor.new(reply).remove_full_quote_on_direct_reply
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
-												Fix the build.

											
										
										
											2019-04-08 09:30:04 -04:00
+								        expect(topic.ordered_posts.pluck(:id))
 								          .to eq([post.id, hidden.id, small_action.id, reply.id])
-												DEV: Improve flaky time-sensitive specs (#9141)


											
										
										
											2020-03-10 17:13:17 -04:00
+								        expect(topic.bumped_at).to eq_time(1.day.ago)
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
+								        expect(reply.raw).to eq("and this is the third reply")
 								        expect(reply.revisions.count).to eq(1)
 								        expect(reply.revisions.first.modifications["raw"]).to eq([raw, reply.raw])
 								        expect(reply.revisions.first.modifications["edit_reason"][1]).to eq(I18n.t(:removed_direct_reply_full_quotes))
 								      end
 								    end
-												FIX: Remove full nested quotes on direct reply (#8581)

It used to check how many quotes were inside a post, without taking
considering that some quotes can contain other quotes. This commit
selects only top level quotes.

I had to use XPath because I could not find an equivalent CSS
selector.
											
										
										
											2019-12-20 03:24:34 -05:00
+								    it 'does nothing if there are multiple quotes' do
 								      reply = Fabricate(:post, topic: topic, raw: raw3)
 								      CookedPostProcessor.new(reply).remove_full_quote_on_direct_reply
 								      expect(topic.ordered_posts.pluck(:id)).to eq([post.id, reply.id])
 								      expect(reply.raw).to eq(raw3)
 								    end
-												FEATURE: Remove full quote only if first paragraph. (#6793)


											
										
										
											2018-12-18 09:46:20 -05:00
+								    it 'does not delete quote if not first paragraph' do
 								      reply = Fabricate(:post, topic: topic, raw: raw2)
-												FIX: remove full quote on direct replies when "typographed"

Use the cooked version of the post and the quote to compare their content in
order to take into account the "typographer" option of the markdown pipeline.

											
										
										
											2019-05-15 11:49:29 -04:00
+								      CookedPostProcessor.new(reply).remove_full_quote_on_direct_reply
-												Fix the build.

											
										
										
											2019-04-08 09:30:04 -04:00
+								      expect(topic.ordered_posts.pluck(:id)).to eq([post.id, reply.id])
-												FEATURE: Remove full quote only if first paragraph. (#6793)


											
										
										
											2018-12-18 09:46:20 -05:00
+								      expect(reply.raw).to eq(raw2)
 								    end
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
+								    it "does nothing when 'remove_full_quote' is disabled" do
 								      SiteSetting.remove_full_quote = false
 								      reply = Fabricate(:post, topic: topic, raw: raw)
-												FEATURE: Remove full quotes of direct replies. (#6729)


											
										
										
											2018-12-07 07:07:11 -05:00
-												FIX: remove full quote on direct replies when "typographed"

Use the cooked version of the post and the quote to compare their content in
order to take into account the "typographer" option of the markdown pipeline.

											
										
										
											2019-05-15 11:49:29 -04:00
+								      CookedPostProcessor.new(reply).remove_full_quote_on_direct_reply
-												* FEATURE: Adds site setting to let quotes on direct replies.

* DEV: Added test.
* FIX: Do not bump topic when removing full quotes.

											
										
										
											2018-12-12 09:42:53 -05:00
+								      expect(reply.raw).to eq(raw)
-												FEATURE: Remove full quotes of direct replies. (#6729)


											
										
										
											2018-12-07 07:07:11 -05:00
+								    end
-												FIX: blank cooked markdown could raise an exception in logs

Previously if somehow a user created a blank markdown document using tag
tricks (eg `<p></p><p></p><p></p><p></p><p></p><p></p>`) and so on, we would
completely strip the document down to blank on post process due to onebox
hack.

Needs a followup cause I am still unclear about the reason for empty p stripping
and it can cause some unclear cases when we re-cook posts.

											
										
										
											2020-01-28 19:37:04 -05:00
+								    it "does not generate a blank HTML document" do
 								      post = Fabricate(:post, topic: topic, raw: "<sunday><monday>")
 								      cp = CookedPostProcessor.new(post)
 								      cp.post_process
 								      expect(cp.html).to eq("<p></p>")
 								    end
-												FEATURE: Remove full quotes only from new posts. (#6862)


											
										
										
											2019-01-16 21:24:32 -05:00
+								    it "works only on new posts" do
-												FIX: Slow test (deadlock)

It was getting caught in a `DistributedMutex` deadlock (twice!), which
meant this test was taking 120s to run.

I'm not sure why queue jobs was turned off here, because when I turn it
on the test passes and takes <2s instead.

											
										
										
											2019-02-19 12:29:50 -05:00
+								      Fabricate(:post, topic: topic, hidden: true, raw: "this is the second post after")
 								      Fabricate(:post, topic: topic, post_type: Post.types[:small_action])
-												FEATURE: Remove full quotes only from new posts. (#6862)


											
										
										
											2019-01-16 21:24:32 -05:00
+								      reply = PostCreator.create!(topic.user, topic_id: topic.id, raw: raw)
-												FIX: Slow test (deadlock)

It was getting caught in a `DistributedMutex` deadlock (twice!), which
meant this test was taking 120s to run.

I'm not sure why queue jobs was turned off here, because when I turn it
on the test passes and takes <2s instead.

											
										
										
											2019-02-19 12:29:50 -05:00
-												FEATURE: Remove full quotes only from new posts. (#6862)


											
										
										
											2019-01-16 21:24:32 -05:00
+								      CookedPostProcessor.new(reply).post_process
 								      expect(reply.raw).to eq(raw)
 								      PostRevisor.new(reply).revise!(Discourse.system_user, raw: raw, edit_reason: "put back full quote")
 								      CookedPostProcessor.new(reply).post_process(new_post: true)
 								      expect(reply.raw).to eq("and this is the third reply")
 								    end
-												FIX: Remove full nested quotes on direct reply (#8581)

It used to check how many quotes were inside a post, without taking
considering that some quotes can contain other quotes. This commit
selects only top level quotes.

I had to use XPath because I could not find an equivalent CSS
selector.
											
										
										
											2019-12-20 03:24:34 -05:00
+								    it "works with nested quotes" do
 								      reply1 = Fabricate(:post, topic: topic, raw: raw)
 								      reply2 = Fabricate(:post, topic: topic, raw: <<~RAW.strip)
 								        [quote="#{reply1.user.username}, post:#{reply1.post_number}, topic:#{topic.id}"]
 								        #{raw}
 								        [/quote]
 								        quoting a post with a quote
 								      RAW
 								      CookedPostProcessor.new(reply2).remove_full_quote_on_direct_reply
 								      expect(reply2.raw).to eq('quoting a post with a quote')
 								    end
-												FEATURE: Remove full quotes of direct replies. (#6729)


											
										
										
											2018-12-07 07:07:11 -05:00
+								  end
-												Initial release of Discourse

											
										
										
											2013-02-05 14:16:51 -05:00
+								end