Merge branch 'master' of github.com:discourse/discourse

This commit is contained in:
Robin Ward 2013-02-06 20:59:07 -05:00
commit 7d7d8c7d4f
16 changed files with 127 additions and 13 deletions

View File

@ -14,6 +14,6 @@
* Nick Sahler - UI Implementation, supplemental
* Don Petersen - Ruby developmer, installation scripts
* Don Petersen - Ruby developer, installation scripts
*For a more detailed list of the many individuals that contributed to the design and development of Discourse outside of GitHub, please refer to the official Discourse website.*

View File

@ -15,7 +15,17 @@ Whenever you need ...
If you're interested in helping us develop Discourse, please start with our **[Discourse Developer Install Guide](https://github.com/discourse/discourse/blob/master/DEVELOPMENT.md)**, which includes instructions to get up and running in a development environment.
We also have a **[Discourse "Quick-and-Dirty" Install Guide](https://github.com/discourse/discourse/blob/master/INSTALL.md)**.
### The quick and easy setup
```
git clone git@github.com:discourse/discourse.git
cd discourse
rake db:create
rake db:migrate
rake db:seed_fu
redis-cli flushall
thin start
```
## Vision

View File

@ -190,9 +190,9 @@ window.Discourse.User.reopenClass
error: (xhr) -> promise.reject(xhr)
promise
createAccount: (name, email, password, username) ->
createAccount: (name, email, password, username, passwordConfirm, challenge) ->
$.ajax
url: '/users'
dataType: 'json'
data: {name: name, email: email, password: password, username: username}
data: {name: name, email: email, password: password, username: username, password_confirmation: passwordConfirm, challenge: challenge}
type: 'POST'

View File

@ -49,6 +49,14 @@
</tr>
{{/if}}
<tr class="password-confirmation">
<td><label for='new-account-password-confirmation'>Password Again</label></td>
<td>
{{view Ember.TextField valueBinding="view.accountPasswordConfirm" type="password" id="new-account-password-confirmation"}}
{{view Ember.TextField valueBinding="view.accountChallenge" id="new-account-challenge"}}
</td>
</tr>
</table>
</form>
</div>

View File

@ -3,6 +3,8 @@ window.Discourse.CreateAccountView = window.Discourse.ModalBodyView.extend Disco
title: Em.String.i18n('create_account.title')
uniqueUsernameValidation: null
complete: false
accountPasswordConfirm: 0
accountChallenge: 0
submitDisabled: (->
@ -22,6 +24,8 @@ window.Discourse.CreateAccountView = window.Discourse.ModalBodyView.extend Disco
# If blank, fail without a reason
return Discourse.InputValidation.create(failed: true) if @blank('accountName')
@fetchConfirmationValue() if @get('accountPasswordConfirm') == 0
# If too short
return Discourse.InputValidation.create(failed: true, reason: Em.String.i18n('user.name.too_short')) if @get('accountName').length < 3
@ -120,13 +124,22 @@ window.Discourse.CreateAccountView = window.Discourse.ModalBodyView.extend Disco
).property('accountPassword')
fetchConfirmationValue: ->
$.ajax
url: '/users/hp.json',
success: (json) =>
@set('accountPasswordConfirm', json.value)
@set('accountChallenge', json.challenge.split("").reverse().join(""))
createAccount: ->
name = @get('accountName')
email = @get('accountEmail')
password = @get('accountPassword')
username = @get('accountUsername')
passwordConfirm = @get('accountPasswordConfirm')
challenge = @get('accountChallenge')
Discourse.User.createAccount(name, email, password, username).then (result) =>
Discourse.User.createAccount(name, email, password, username, passwordConfirm, challenge).then (result) =>
if result.success
@flash(result.message)

View File

@ -152,6 +152,9 @@
margin-bottom: 20px;
}
}
.password-confirmation {
display: none;
}
}
#move-selected {

View File

@ -123,6 +123,12 @@ class UsersController < ApplicationController
end
def create
if params[:password_confirmation] != honeypot_value or params[:challenge] != challenge_value.try(:reverse)
# Don't give any indication that we caught you in the honeypot
return render(:json => {success: true, active: false, message: I18n.t("login.activate_email", email: params[:email]) })
end
user = User.new
user.name = params[:name]
user.email = params[:email]
@ -183,6 +189,10 @@ class UsersController < ApplicationController
render json: {errors: [I18n.t("mothership.access_token_problem")]}
end
def get_honeypot_value
render json: {value: honeypot_value, challenge: challenge_value}
end
# all avatars are funneled through here
def avatar
@ -320,6 +330,14 @@ class UsersController < ApplicationController
private
def honeypot_value
Digest::SHA1::hexdigest("#{Discourse.current_hostname}:#{Discourse::Application.config.secret_token}")[0,15]
end
def challenge_value
'3019774c067cc2b'
end
def fetch_user_from_params
username_lower = params[:username].downcase
username_lower.gsub!(/\.json$/, '')

View File

@ -2,6 +2,8 @@ require_dependency 'rate_limiter'
require_dependency 'system_message'
class PostAction < ActiveRecord::Base
class AlreadyFlagged < StandardError; end
include RateLimiter::OnCreateRecord
attr_accessible :deleted_at, :post_action_type_id, :post_id, :user_id, :post, :user, :post_action_type, :message
@ -115,6 +117,15 @@ class PostAction < ActiveRecord::Base
end
end
before_create do
if is_flag?
if PostAction.where('user_id = ? and post_id = ? and post_action_type_id in (?) and deleted_at is null',
self.user_id, self.post_id, PostActionType.FlagTypes).exists?
raise AlreadyFlagged
end
end
end
after_save do
# Update denormalized counts

View File

@ -1,4 +1,5 @@
class PostActionType < ActiveRecord::Base
attr_accessible :id, :is_flag, :name_key, :icon
def self.ordered

View File

@ -93,10 +93,6 @@ module Discourse
# So open id logs somewhere sane
config.after_initialize do
OpenID::Util.logger = Rails.logger
# latest possible so earliest in the stack
# require 'rack/message_bus'
# config.middleware.insert(0, Rack::MessageBus)
end
end
end

View File

@ -80,6 +80,7 @@ Discourse::Application.routes.draw do
put 'users/password-reset/:token' => 'users#password_reset'
get 'users/activate-account/:token' => 'users#activate_account'
get 'users/authorize-email/:token' => 'users#authorize_email'
get 'users/hp' => 'users#get_honeypot_value'
get 'user_preferences' => 'users#user_preferences_redirect'
get 'users/:username/private-messages' => 'user_actions#private_messages', :format => false, :constraints => {:username => USERNAME_ROUTE_FORMAT}

View File

@ -27,6 +27,13 @@ PostActionType.seed do |s|
s.position = 4
end
PostActionType.seed do |s|
s.id = PostActionType.Types[:vote]
s.name_key = 'vote'
s.is_flag = false
s.position = 5
end
PostActionType.seed do |s|
s.id = PostActionType.Types[:spam]
s.name_key = 'spam'

View File

@ -1,6 +1,6 @@
class AddMetaDataToForumThreads < ActiveRecord::Migration
def change
execute "CREATE EXTENSION hstore"
execute "CREATE EXTENSION IF NOT EXISTS hstore"
add_column :forum_threads, :meta_data, :hstore
end
end

View File

@ -31,8 +31,8 @@ module SiteSettingExtension
end
# just like a setting, except that it is available in javascript via DiscourseSession
def client_setting(name, defualt = nil, type = nil)
setting(name,defualt,type)
def client_setting(name, default = nil, type = nil)
setting(name,default,type)
@@client_settings ||= []
@@client_settings << name
end

View File

@ -2,6 +2,11 @@ require 'spec_helper'
describe UsersController do
before do
UsersController.any_instance.stubs(:honeypot_value).returns(nil)
UsersController.any_instance.stubs(:challenge_value).returns(nil)
end
describe '.show' do
let!(:user) { log_in }
@ -339,7 +344,41 @@ describe UsersController do
User.where(username: @user.username).first.active.should be_false
end
end
shared_examples_for 'honeypot fails' do
it 'should not create a new user' do
expect {
xhr :post, :create, create_params
}.to_not change { User.count }
end
it 'should not send an email' do
User.any_instance.expects(:enqueue_welcome_message).never
xhr :post, :create, create_params
end
it 'should say it was successful' do
xhr :post, :create, create_params
json = JSON::parse(response.body)
json["success"].should be_true
end
end
context 'when honeypot value is wrong' do
before do
UsersController.any_instance.stubs(:honeypot_value).returns('abc')
end
let(:create_params) { {:name => @user.name, :username => @user.username, :password => "strongpassword", :email => @user.email, :password_confirmation => 'wrong'} }
it_should_behave_like 'honeypot fails'
end
context 'when challenge answer is wrong' do
before do
UsersController.any_instance.stubs(:challenge_value).returns('abc')
end
let(:create_params) { {:name => @user.name, :username => @user.username, :password => "strongpassword", :email => @user.email, :challenge => 'abc'} }
it_should_behave_like 'honeypot fails'
end
end
context '.username' do

View File

@ -111,6 +111,13 @@ describe PostAction do
describe 'flagging' do
it 'does not allow you to flag stuff with 2 reasons' do
post = Fabricate(:post)
u1 = Fabricate(:evil_trout)
PostAction.act(u1, post, PostActionType.Types[:spam])
lambda { PostAction.act(u1, post, PostActionType.Types[:off_topic]) }.should raise_error(PostAction::AlreadyFlagged)
end
it 'should update counts when you clear flags' do
post = Fabricate(:post)
u1 = Fabricate(:evil_trout)