Commit Graph

8580 Commits

Author SHA1 Message Date
Andrei Prigorshnev c202252190
FEATURE: when suggesting usernames skip input that consist entirely of disallowed characters () 2021-12-21 21:13:05 +04:00
Martin Brennan d330a5447d
DEV: Remove old backup uploader and resumable.js ()
Now that d5e380e5c1 has been
committed there is nothing in the codebase that uses either
resumable.js or the old backup-uploader component.

R.I.P resumable.js
2021-12-21 15:02:10 +10:00
Martin Brennan 2d68e5d942
FEATURE: Scheduled problem checks for admin dashboard ()
This commit introduces scheduled problem checks for the admin dashboard, which are long running or otherwise cumbersome problem checks that will be run every 10 minutes rather than every time the dashboard is loaded. If these scheduled checks add a problem, the problem will remain until it is cleared or until the scheduled job runs again.

An example of a check that should be scheduled is validating credentials against an external provider.

This commit also introduces the concept of a `priority` to the problems generated by `AdminDashboardData` and the scheduled checks. This is `low` by default, and can be set to `high`, but this commit does not change any part of the UI with this information, only adds a CSS class.

I will be making a follow up PR to check group SMTP credentials.
2021-12-20 09:59:11 +10:00
jbrw 6e925fee6f
FIX: Use basic meta description if other description tags are missing ()
When attempting to Onebox a page if there is no `meta property="og:description"` tag but there is a  `meta name="description"` tag, Onebox should try to use that value.
2021-12-17 19:36:54 -05:00
Penar Musaraj cebf55f590
DEV: Remove `jquery-tags-input` dependency () 2021-12-17 14:53:52 -05:00
Penar Musaraj 178acd4d46
DEV: Remove jQuery color dependency () 2021-12-17 14:26:16 -05:00
Penar Musaraj 4ee5d52ac9
DEV: Remove jQuery autoellipsis dependency () 2021-12-17 11:45:12 -05:00
Gerhard Schlager 769388b8ba FIX: Translation overrides from fallback locale didn't work on client
Discourse sent only translation overrides for the current language to the client instead of sending overrides from fallback locales as well. This especially impacted en_GB -> en since most overrides would be done in English instead of English (UK).

This also adds lots of tests for previously untested code.

There's a small caveat: The client currently doesn't handle fallback locales for MessageFormat strings. That is why overrides for those strings always have a higher priority than regular translations. So, as an example, the lookup order for MessageFormat strings in German is:
1. override for de
2. override for en
3. value from de
4. value from en
2021-12-17 14:03:35 +01:00
Gerhard Schlager 4cd5158974 FIX: "Customize Text" showed compiled MessageFormat string for overridden `_MF` translations 2021-12-17 14:03:35 +01:00
Gerhard Schlager e19a7a7c8d FIX: translation precedence was different on client and server
As an example, the lookup order for German was:

1. override for de
2. override for en
3. value from de
4. value from en

After this change the lookup order is the same as on the client:
1. override for de
2. value from de
3. override for en
4. value from en

see /t/16381
2021-12-17 14:03:35 +01:00
Jarek Radosz 2a4df93b8e
FEATURE: Allow to modify topic-backed static pages ()
A plugin API that allows customizing existing topic-backed static pages, like:
faq, tos, privacy (see: StaticController) The block passed to this
method has to return a SiteSetting name that contains a topic id.

```
add_topic_static_page("faq") do |controller|
  current_user&.locale == "pl" ? "polish_faq_topic_id" : "faq_topic_id"
end
```

You can also add new pages in a plugin, but remember to add a route,
for example:

```
get "contact" => "static#show", id: "contact"
```
2021-12-16 04:24:11 +01:00
Natalie Tay 9fd1a00eef
DEV: Remove customer flair from being an official plugin () 2021-12-15 22:30:50 +08:00
David Taylor 0e87f882a7
DEV: Use discourse image for postgres in GitHub Actions ()
The discourse base image already contains a postgres installation, so pulling a separate postgres image is a little wasteful. Using the copy of Postgres in the discourse image saves about 20 seconds on every GitHub actions run.

This commit sets up Postgres with a few performance-improving flags, which we were already using for the `rake docker:test` task (used on our internal CI system).
2021-12-14 17:20:06 +00:00
David Taylor b3e5421b25
DEV: Add discourse-vk-auth to official plugins list () 2021-12-13 22:54:28 +00:00
Jarek Radosz 42015fe8b2
DEV: Drop env-based SiteSetting deprecation errors ()
These were deprecated ~4 years ago. No need to keep the errors anymore.
2021-12-13 17:36:29 +01:00
Jarek Radosz cf84f85f3e
DEV: Use `Discourse.deprecate` instead of `logger.warn` () 2021-12-13 17:36:19 +01:00
David Taylor 1773d9d594
DEV: Add SAML to official plugin list () 2021-12-13 15:50:57 +00:00
David Taylor 6e9bb84d12
FIX: Ensure theme names are escaped in HTML attributes ()
If a theme name contained a double-quote, this problem could lead to invalid/unexpected HTML in the `<head>`

Note that this is not considered a security issue because themes can only be installed/named by administrators, and themes/administrators already have the ability to run arbitrary javascript.
2021-12-13 10:50:09 +00:00
Dax74 f8b3fe65d7
FEATURE: Add Apple plugin to the official list () 2021-12-13 16:29:02 +11:00
Daniel Waterworth 02245ce41f
PERF: Redis snapshotting during tests ()
We can fake redis transactions so that `fab!` works for redis and PG
data, but it's too slow to be used indiscriminately. Instead, you can
opt into it with the `use_redis_snapshotting` helper.

Insofar as snapshotting allows us to `fab!` more things, it provides a
speedup.
2021-12-10 14:25:26 -06:00
David Taylor e42f33b6ba
FIX: Allow OAuth2Authenticator to handle existing associations ()
OAuth2Authenticator is considered deprecated, and isn't used in core. However, some plugins still depend on it, and this was breaking the signup of previously-staged users. There is no easy way to make an end-end test of this in core, but I will be adding an integration test in the SAML plugin.
2021-12-10 19:53:14 +00:00
Blake Erickson b93b6c4299
FIX: Blurry onebox favicon images ()
This is a fix to address blurry onebox favicon images if the site you
are linking to happens to have a favicon.ico file that contains multiple
images.

This fix detects of we are trying to create an upload for a favicon.ico
file. We then convert it to a png and not a jpeg like we were doing. We
want a png because it will preserve transparency, otherwise if we
convert it to a jpeg we lose that and it looks bad on dark themed sites.

This fix also addresses the fact that .ico files can include multiple
images. The blurry images we were producing was caused by the
ImageMagick `-flatten` option when the .ico file had multiple images
which then squishes them all together. So for .ico files we are no
longer flattening them and instead we are grabbing the last image in the
.ico bundle and converting that single image to a png.
2021-12-10 12:25:50 -07:00
Roman Rizzi b7b61d4b56
FEATURE: A notification consolidation plan for keeping the latest one. ()
We previously used ConsolidateNotifications with a threshold of 1 to re-use an existing notification and bump it to the top instead of creating a new one. It produces some jumpiness in the user notification list, and it relies on updating the `created_at` attribute, which is a bit hacky.

As a better alternative, we're introducing a new plan that deletes all the previous versions of the notification, then creates a new one.
2021-12-10 10:32:15 -03:00
Daniel Waterworth ec36cddd2f
FIX: Defer topic/post created events until emails have been added () 2021-12-09 14:45:07 -06:00
Angus McLeod df3886d6e5
FEATURE: Experimental support for group membership via google auth ()
This commit introduces a new site setting "google_oauth2_hd_groups". If enabled, group information will be fetched from Google during authentication, and stored in the Discourse database. These 'associated groups' can be connected to a Discourse group via the "Membership" tab of the group preferences UI. 

The majority of the implementation is generic, so we will be able to add support to more authentication methods in the near future.

https://meta.discourse.org/t/managing-group-membership-via-authentication/175950
2021-12-09 12:30:27 +00:00
David Taylor f799b8bfb1
FIX: Ensure MessageIdService can handle hostname changes and multisite () 2021-12-08 11:17:20 +00:00
Martin Brennan f26b8b448d
FIX: References header leading to broken email threading ()
Since 3b13f1146b the email threading
in mail clients has been broken, because the random suffix meant
that the References header would always be different for non-group
SMTP email notifications sent out.

This commit fixes the issue by always using the "canonical" topic
reference ID inside the References header in the format:

topic/TOPIC_ID@HOST

Which was the old format. We also add the References header to
notifications sent for the first post arriving, so the threading
works for subsequent emails. The Message-ID header is still random
as per the previous change.
2021-12-08 08:14:48 +10:00
Daniel Waterworth 6cae6aadf4
FIX: Make thumbnail tests start with a clean slate ()
* FIX: Make thumbnail tests start with a clean slate

Unfortunately, this exposes the fact that they don't actually work.
Marking as pending for now.
2021-12-07 13:07:45 -06:00
Loïc Guitaut d0888c190e FIX: Display pending posts in a moderated category
Currently we display pending posts in topics (both for author and staff
members) but the feature is only enabled when there’s an enabled global site
setting related to moderation.

This patch allows to have the same behavior for a site where there’s
nothing enabled globally but where a moderated category exists. So when
browsing a topic of a moderated category, the presence of pending posts
will be checked whereas nothing will happen in a normal category.
2021-12-07 10:14:45 +01:00
Andrei Prigorshnev f3508065a3
FIX: auth incorrectly handles duplicate usernames () 2021-12-06 20:49:04 +04:00
Daniel Waterworth 3ebce550fe
DEV: Make add_api_parameter_route parameter deprecations errors ()
Since we said we would remove support in 2.7, this is overdue.
2021-12-06 09:10:14 -06:00
Andrei Prigorshnev 10cc082560
FIX: when using external auth disallowed characters weren't removed from username () 2021-12-06 15:06:35 +04:00
Martin Brennan 3b13f1146b
FIX: Add random suffix to outbound Message-ID for email ()
Currently the Message-IDs we send out for outbound email
are not unique; for a post they look like:

topic/TOPIC_ID/POST_ID@HOST

And for a topic they look like:

topic/TOPIC_ID@HOST

This commit changes the outbound Message-IDs to also have
a random suffix before the host, so the new format is
like this:

topic/TOPIC_ID/POST_ID.RANDOM_SUFFIX@HOST

Or:

topic/TOPIC_ID.RANDOM_SUFFIX@HOST

This should help with email deliverability. This change
is backwards-compatible, the old Message-ID format will
still be recognized in the mail receiver flow, so people
will still be able to reply using Message-IDs, In-Reply-To,
and References headers that have already been sent.

This commit also refactors Message-ID related logic
to a central location, and adds judicious amounts of
tests and documentation.
2021-12-06 10:34:39 +10:00
David Taylor 93860fd29b
DEV: Update discourse-plugin-linkedin-auth to discourse-linkedin-auth () 2021-12-03 17:42:14 +00:00
David Taylor 75dbc488d9
DEV: Update official plugin list ()
- Remove Discord plugin (it has now been merged into core)
- Rename discourse-plugin-office365-auth to discourse-microsoft-auth
2021-12-03 12:05:05 +00:00
Daniel Waterworth bd10f113e9
DEV: Raise errors for (black|white)list accesses ()
These have been deprecated for a while
2021-12-02 12:16:55 -06:00
Daniel Waterworth 2f04a9b9fb
DEV: Remove site_setting_saved event ()
We said we would drop it from 2.4, so this is long overdue

Co-authored-by: Jarek Radosz <jradosz@gmail.com>
2021-12-02 09:33:03 -06:00
Andrei Prigorshnev 1c0022c195
FIX: extract and fix overriding of usernames by external auth () 2021-12-02 17:42:23 +04:00
Jarek Radosz df6e8b924e
DEV: Make legacy ember tests less likely to fail ()
…on launch
2021-12-01 19:30:33 +01:00
Osama Sayegh 20f736aa11
FIX: Skip themes that have blank URL in the `themes:update` rake task ()
Themes that are imported via a ZIP file do have a `remote_theme` record in the database but the record has a blank value for the `remote_url` field which means attempting to do an update git via will result in an error.
2021-12-01 19:57:36 +03:00
Neil Lalonde c4d3b6556d
Version bump to v2.8.0.beta9 () 2021-12-01 11:40:49 -05:00
David Taylor 1fa7a87f86
SECURITY: Remove ember-cli specific response from application routes ()
Under some conditions, these varied responses could lead to cache poisoning, hence the 'security' label.

Previously the Rails application would serve JSON data in place of HTML whenever Ember CLI requested an `application.html.erb`-rendered page. This commit removes that logic, and instead parses the HTML out of the standard response. This means that Rails doesn't need to customize its response for Ember CLI.
2021-12-01 16:10:40 +00:00
Krzysztof Kotlarek 9cabd3721b
FEATURE: ability to add description to tags ()
Ability to add description to tags, which will be displayed on hover.
2021-12-01 09:18:56 +11:00
Roman Rizzi 1fc06520bd
REFACTOR: Improve support for consolidating notifications. ()
* REFACTOR: Improve support for consolidating notifications.

Before this commit, we didn't have a single way of consolidating notifications. For notifications like group summaries, we manually removed old ones before creating a new one. On the other hand, we used an after_create callback for likes and group membership requests, which caused unnecessary work, as we need to delete the record we created to replace it with a consolidated one.

We now have all the consolidation rules centralized in a single place: the consolidation planner class. Other parts of the app looking to create a consolidable notification can do so by calling Notification#consolidate_or_save!, instead of the default Notification#create! method.

Finally, we added two more rules: one for re-using existing group summaries and another for deleting duplicated dashboard problems PMs notifications when the user is tracking the moderator's inbox. Setting the threshold to one forces the planner to apply this rule every time.

I plan to add plugin support for adding custom rules in another PR to keep this one relatively small.

* DEV: Introduces a plugin API for consolidating notifications.

This commit removes the `Notification#filter_by_consolidation_data` scope since plugins could have to define their criteria. The Plan class now receives two blocks, one to query for an already consolidated notification, which we'll try to update, and another to query for existing ones to consolidate.

It also receives a consolidation window, which accepts an ActiveSupport::Duration object, and filter notifications created since that value.
2021-11-30 13:36:14 -03:00
Osama Sayegh 7bd3986b21
FEATURE: Replace `Crawl-delay` directive with proper rate limiting ()
We have a couple of site setting, `slow_down_crawler_user_agents` and `slow_down_crawler_rate`, that are meant to allow site owners to signal to specific crawlers that they're crawling the site too aggressively and that they should slow down.

When a crawler is added to the `slow_down_crawler_user_agents` setting, Discourse currently adds a `Crawl-delay` directive for that crawler in `/robots.txt`. Unfortunately, many crawlers don't support the `Crawl-delay` directive in `/robots.txt` which leaves the site owners no options if a crawler is crawling the site too aggressively.

This PR replaces the `Crawl-delay` directive with proper rate limiting for crawlers added to the `slow_down_crawler_user_agents` list. On every request made by a non-logged in user, Discourse will check the User Agent string and if it contains one of the values of the `slow_down_crawler_user_agents` list, Discourse will only allow 1 request every N seconds for that User Agent (N is the value of the `slow_down_crawler_rate` setting) and the rest of requests made within the same interval will get a 429 response. 

The `slow_down_crawler_user_agents` setting becomes quite dangerous with this PR since it could rate limit lots if not all of anonymous traffic if the setting is not used appropriately. So to protect against this scenario, we've added a couple of new validations to the setting when it's changed:

1) each value added to setting must 3 characters or longer
2) each value cannot be a substring of tokens found in popular browser User Agent. The current list of prohibited values is: apple, windows, linux, ubuntu, gecko, firefox, chrome, safari, applewebkit, webkit, mozilla, macintosh, khtml, intel, osx, os x, iphone, ipad and mac.
2021-11-30 12:55:25 +03:00
Jarek Radosz c9e0ad5ec4
DEV: Remove build:stamp task and related code ()
I don't think we use `build:stamp` task anymore, nor we rely on config/version.rb
2021-11-29 19:09:05 +01:00
Loïc Guitaut a5fbb90df4 FEATURE: Display pending posts on user’s page
Currently when a user creates posts that are moderated (for whatever
reason), a popup is displayed saying the post needs approval and the
total number of the user’s pending posts. But then this piece of
information is kind of lost and there is nowhere for the user to know
what are their pending posts or how many there are.

This patch solves this issue by adding a new “Pending” section to the
user’s activity page when there are some pending posts to display. When
there are none, then the “Pending” section isn’t displayed at all.
2021-11-29 10:26:33 +01:00
Penar Musaraj d99deaf1ab
FEATURE: show recent searches in quick search panel () 2021-11-25 15:44:15 -05:00
Rafael dos Santos Silva 5647819de4
FEATURE: Send a 'noindex' header in non-canonical responses ()
* FEATURE: Optionally send a 'noindex' header in non-canonical responses

This will be used in a SEO experiment.

Co-authored-by: David Taylor <david@taylorhq.com>
2021-11-25 16:58:39 -03:00
Dan Ungureanu b1844c45c3
DEV: Stop if theme:update fails for default site ()
The error handling of the theme:update Rake task has been improved. If
an error occurs while updating the default site, then the exception will
be propagated and the process will exit with non-zero status.

This is a follow-up to commit 3f97f884fe.
2021-11-25 16:28:28 +02:00
David Taylor 03998e0a29
FIX: Use CDN URL for internal onebox avatars ()
This commit will also trigger a background rebake for all existing posts with internal oneboxes
2021-11-25 12:07:34 +00:00
Dan Ungureanu fa8cd629f1
DEV: Hash tokens stored from email_tokens ()
This commit adds token_hash and scopes columns to email_tokens table.
token_hash is a replacement for the token column to avoid storing email
tokens in plaintext as it can pose a security risk. The new scope column
ensures that email tokens cannot be used to perform a different action
than the one intended.

To sum up, this commit:

* Adds token_hash and scope to email_tokens

* Reuses code that schedules critical_user_email

* Refactors EmailToken.confirm and EmailToken.atomic_confirm methods

* Periodically cleans old, unconfirmed or expired email tokens
2021-11-25 09:34:39 +02:00
Natalie Tay 4c46c7e334
DEV: Remove xlink hrefs () 2021-11-25 15:22:43 +11:00
Dan Ungureanu 3f97f884fe
DEV: Fail stop if theme update fails ()
This applies only when a single site exists. If a theme update fails
when there are multiple sites, then it will continue updating the
remaining themes.
2021-11-24 19:12:49 +02:00
janzenisaac 8c7cc426b7
FEATURE: Notify responders of post removal ()
- Notify users whose posts were cascade deleted due to a flagged post
2021-11-24 09:28:20 -06:00
Alan Guo Xiang Tan a6aff40e4b
DEV: Allow default scope to be configurable per topic. ()
Not exposing this as a plugin API yet as we're testing it out with a
plugin.
2021-11-24 16:40:58 +08:00
Martin Brennan 44be79f095
FIX: Strip Auto-Submitted email header from group SMTP emails ()
Remove Auto-Submitted header for group private message emails, it does
not make sense there and may hurt deliverability.

From https://www.iana.org/assignments/auto-submitted-keywords/auto-submitted-keywords.xhtml:

> Indicates that a message was generated by an automatic process, and is not a direct response to another message.
2021-11-24 10:54:01 +10:00
Jarek Radosz d40e56272f
DEV: Remove unnecessary requires ()
`auth/*` one was causing warnings (the file was loaded twice)

and `sha1` isn't used anymore here
2021-11-23 23:42:24 +01:00
Jarek Radosz 1c0dcbfd47
DEV: Remove `build_test_topic` task ()
I don't think anyone is using it anymore
2021-11-23 23:41:49 +01:00
Bianca Nenciu 73760c77d9
FEATURE: Mention @here to notify users in topic ()
Use @here to mention all users that were allowed to topic directly or
through group, who liked topics or read the topic. Only first 10 users
will be notified.
2021-11-23 22:25:54 +02:00
Dan Ungureanu fa2fd7fff8
FIX: Do not fail-stop if theme update fails () 2021-11-23 13:55:09 +02:00
Dan Ungureanu ff7acc9828
FIX: Git should not prompt for credentials ()
When cloning a public remote repository (no key), git should not prompt
for credentials.
2021-11-23 13:54:51 +02:00
Dan Ungureanu 948a1523ea
FIX: Keep existent tags when editing tag topics ()
Allow current user to keep existent tags when adding or removing a tag.
For example, a user could not remove a tag from a topic if the topic
had another tag that was restricted to a different category.
2021-11-23 13:00:45 +02:00
Mark VanLandingham 4da23e811b
DEV: Create CookedProcessMixin to process generic cooked () 2021-11-22 13:32:12 -06:00
Dan Ungureanu d420a7b2c8
DEV: Reuse code for TrustLevelAndStaffSetting ()
The code that checked this permission was duplicated everytime a new
settings of this type was added. This commit changes the behavior of
some functionality because some feature checks were bypassed for staff
members.
2021-11-22 20:18:53 +02:00
Blake Erickson da9cd4f692
DEV: Swap out optipng with oxipng ()
* DEV: Swap out optipng with oxipng

The oxipng binary has been added to our base docker image here:

244c9cb110

oxipng is a rust replacement for optipng that provides increased
performance and multi-threading. Checkout
https://github.com/shssoichiro/oxipng for more info.

* add instructions for installing oxipng
2021-11-22 10:16:35 -07:00
Jarek Radosz 648332bc9f
DEV: Don't clear cache/trigger events if site setting hasn't changed () 2021-11-22 16:43:12 +01:00
Jarek Radosz d91d67a442
FEATURE: Allow theme settings to request refresh ()
Similar to site settings, adds support for `refresh` option to theme settings.

```yaml
super_feature_enabled:
  type: bool
  default: false
  refresh: true
```
2021-11-22 13:16:56 +01:00
Dan Ungureanu f43c433d50
FIX: Allow invites if must_approve_users is true ()
This was implemented in 36e0e6a, but then regressed when the guardian
for invites was refactored in 76a7b75.
2021-11-22 14:04:35 +02:00
Martin Brennan fa6b87a1bf
SECURITY: Strip unrendered unicode bidirectional chars in code blocks ()
When rendering the markdown code blocks we replace the
offending characters in the output string with spans highlighting a textual
representation of the character, along with a title attribute with
information about why the character was highlighted.

The list of characters stripped by this fix, which are the bidirectional
characters considered relevant, are:

U+202A
U+202B
U+202C
U+202D
U+202E
U+2066
U+2067
U+2068
U+2069
2021-11-22 10:43:03 +10:00
Penar Musaraj 20f5474be9
FEATURE: Log only topic/post search queries in search log () 2021-11-18 09:21:12 +08:00
Martin Brennan b96c10a903
DEV: Extract shared external upload routes into controller helper ()
This commit refactors the direct external upload routes (get presigned
put, complete external, create/abort/complete multipart) into a
helper which is then included in both BackupController and the
UploadController. This is done so UploadController doesn't need
strange backup logic added to it, and so each controller implementing
this helper can do their own validation/error handling nicely.

This is a follow up to e4350bb966
2021-11-18 09:17:23 +10:00
Osama Sayegh b86127ad12
FEATURE: Apply rate limits per user instead of IP for trusted users ()
Currently, Discourse rate limits all incoming requests by the IP address they
originate from regardless of the user making the request. This can be
frustrating if there are multiple users using Discourse simultaneously while
sharing the same IP address (e.g. employees in an office).

This commit implements a new feature to make Discourse apply rate limits by
user id rather than IP address for users at or higher than the configured trust
level (1 is the default).

For example, let's say a Discourse instance is configured to allow 200 requests
per minute per IP address, and we have 10 users at trust level 4 using
Discourse simultaneously from the same IP address. Before this feature, the 10
users could only make a total of 200 requests per minute before they got rate
limited. But with the new feature, each user is allowed to make 200 requests
per minute because the rate limits are applied on user id rather than the IP
address.

The minimum trust level for applying user-id-based rate limits can be
configured by the `skip_per_ip_rate_limit_trust_level` global setting. The
default is 1, but it can be changed by either adding the
`DISCOURSE_SKIP_PER_IP_RATE_LIMIT_TRUST_LEVEL` environment variable with the
desired value to your `app.yml`, or changing the setting's value in the
`discourse.conf` file.

Requests made with API keys are still rate limited by IP address and the
relevant global settings that control API keys rate limits.

Before this commit, Discourse's auth cookie (`_t`) was simply a 32 characters
string that Discourse used to lookup the current user from the database and the
cookie contained no additional information about the user. However, we had to
change the cookie content in this commit so we could identify the user from the
cookie without making a database query before the rate limits logic and avoid
introducing a bottleneck on busy sites.

Besides the 32 characters auth token, the cookie now includes the user id,
trust level and the cookie's generation date, and we encrypt/sign the cookie to
prevent tampering.

Internal ticket number: t54739.
2021-11-17 23:27:30 +03:00
Jarek Radosz 05423e9dfd
DEV: `I18n` global is no longer supported ()
Don't allow it when linting.
2021-11-17 20:52:22 +01:00
Vinoth Kannan a3a4f16e88
UX: add more search aliases for emojis. () 2021-11-17 11:54:43 +01:00
Osama Sayegh 8f5412cccf
DEV: Skip logging in test environment ()
It adds unnecessary noise when running the test suite.
2021-11-16 18:01:48 +03:00
Vinoth Kannan c47a526371
FIX: exclude topics from muted tag in category featured list. ()
Topics from muted tags were visible in the categories page's featured topics section since we didn't filter it before.
2021-11-16 12:10:50 +05:30
Neil Lalonde cbfe48b990
Version bump to v2.8.0.beta8 () 2021-11-15 11:13:34 -05:00
Jarek Radosz 4ad77f3382
DEV: Remove `.es6` extensions from core ()
Still supported in plugins though.
2021-11-13 12:51:53 +01:00
Rafael dos Santos Silva 6645243a26
SECURITY: Disallow caching of MIME/Content-Type errors ()
This will sign intermediary proxies and/or misconfigured CDNs to not
cache those error responses.
2021-11-12 15:52:25 -03:00
Daniel Waterworth e7c0bbb9c0
DEV: Let's always give a drop_from param to deprecate ()
So that we know when deprecations can be removed in the future.
2021-11-12 08:52:59 -06:00
Daniel Waterworth 388f45c570
DEV: Remove deprecated methods () 2021-11-11 12:21:25 -06:00
Osama Sayegh 69ec6899f9
Revert "DEV: increase lock timeout for multisite migration ()" ()
* Revert "DEV: increase lock timeout for multisite migration ()"

This partially reverts commit 337ef60303.

We need to revert the mutex around `db:status:json` because the mutex is not available unless the rails environment is loaded which the `db:status:json` doesn't load before the mutex. We can't load the environment before entering the mutex because the mutex is meant to prevent other instances of the task from loading a rails environment while the database is migrating.

Co-authored-by: David Taylor <david@taylorhq.com>

Co-authored-by: David Taylor <david@taylorhq.com>
2021-11-11 16:16:53 +03:00
Martin Brennan e4350bb966
FEATURE: Direct S3 multipart uploads for backups ()
This PR introduces a new `enable_experimental_backup_uploads` site setting (default false and hidden), which when enabled alongside `enable_direct_s3_uploads` will allow for direct S3 multipart uploads of backup .tar.gz files.

To make multipart external uploads work with both the S3BackupStore and the S3Store, I've had to move several methods out of S3Store and into S3Helper, including:

* presigned_url
* create_multipart
* abort_multipart
* complete_multipart
* presign_multipart_part
* list_multipart_parts

Then, S3Store and S3BackupStore either delegate directly to S3Helper or have their own special methods to call S3Helper for these methods. FileStore.temporary_upload_path has also removed its dependence on upload_path, and can now be used interchangeably between the stores. A similar change was made in the frontend as well, moving the multipart related JS code out of ComposerUppyUpload and into a mixin of its own, so it can also be used by UppyUploadMixin.

Some changes to ExternalUploadManager had to be made here as well. The backup direct uploads do not need an Upload record made for them in the database, so they can be moved to their final S3 resting place when completing the multipart upload.

This changeset is not perfect; it introduces some special cases in UploadController to handle backups that was previously in BackupController, because UploadController is where the multipart routes are located. A subsequent pull request will pull these routes into a module or some other sharing pattern, along with hooks, so the backup controller and the upload controller (and any future controllers that may need them) can include these routes in a nicer way.
2021-11-11 08:25:31 +10:00
Rafael dos Santos Silva d4e35f50c2
PERF: Update like count in visible posts without an extra GET per like ()
PERF: Update like count in visible posts without an extra GET per like

Currently when a user is reading a topic and some post in it receive a
like from another user, the Ember app will be notified via MessageBus
and issue a GET to `/posts/{id}` to get the new like count. This worked
fine for us until today, but it can easily create a self-inflicted DDoS
when a topic with a large number of visitors gets a large number of
likes, since we will issue `visitors * likes` GET requests requests.

This patch optimizes this flow, by sending the new like count down in
the MessageBus notification, removing any need for the extra request.

It shouldn't cause any drift on the count because we send down the full
count instead of the difference too.

Possible follow-ups could include handling like removal.
2021-11-10 13:22:26 -03:00
Jarek Radosz b72688340f
FIX: `LocalJumpError` in rake tasks ()
`return` isn't allowed in a block context. A followup to 
2021-11-10 16:53:55 +01:00
Martin Brennan 6a68bd4825
DEV: Limit list multipart parts to 1 ()
We are only using list_multipart_parts right now in the
uploads controller for multipart uploads to check if the
upload exists; thus we don't need up to 1000 parts.

Also adding a note for future explorers that list_multipart_parts
only gets 1000 parts max, and adding params for max parts
and starting parts.
2021-11-10 08:01:28 +10:00
Jarek Radosz 25ef395af8
FIX: Don't fail if `s3_install_cors_rule` is off ()
Regressed in 
2021-11-10 08:00:30 +10:00
David Taylor 65a389c3ac
FIX: Allow bulk invites to be used with DiscourseConnect ()
Support for invites alongside DiscourseConnect was added in 355d51af. This commit fixes the guardian method so that the bulk invite button functionality also works.
2021-11-09 17:43:23 +00:00
Dan Ungureanu ec3758b573
FIX: Make PostRevisor more consistent ()
* FIX: Preserve field types when updating revision

When a post was edited quickly twice by the same user, the old post
revision was updated with the newest changes. To check if the change
was reverted (i.e. rename topic A to B and then back to A) a comparison
of the initial value and last value is performed. If the check passes
then the intermediary value is dismissed and only the initial value and
the last ones are preserved. Otherwise, the modification is dismissed
because the field returned to its initial value.

This used to work well for most fields, but failed for "tags" because
the field is an array and the values were transformed to strings to
perform the comparison.

* FIX: Reset last_editor_id if revision is reverted

If a post was revised and then the same revision was reverted,
last_editor_id was still set to the ID of the user who last edited the
post. This was a problem because the same person could then edit the
same post again and because it was the same user and same post, the
system attempted to update the last one (that did not exist anymore).
2021-11-09 16:29:37 +02:00
Dan Ungureanu 46fed1303f
FIX: Regression introduced in ()
* FIX: Regression introduced in 

Wrong method names were used to get Redis keys.

* DEV: Remove more stubs
2021-11-09 17:20:09 +11:00
Sam 337ef60303
DEV: increase lock timeout for multisite migration ()
- Increase lock timeout - given multisites may take a while to migrate
- Ensure we do not check for status while db is migrating
2021-11-09 12:06:06 +11:00
Krzysztof Kotlarek 8b93da9fe0
FIX: rename action_code_href to action_code_path ()
Small actions should use path instead of absolute url. getURL function is necessary to insert a potential subfolder prefix.
2021-11-08 14:32:17 +11:00
Martin Brennan fc98d1edfa
DEV: Improve s3:ensure_cors_rules logging () 2021-11-08 11:44:12 +10:00
Osama Sayegh e2afa1b799
FIX: Skip post validations for system revisions when author deletes post () 2021-11-08 09:33:41 +08:00
Jarek Radosz e6245bd603
DEV: Remove hints of jshint () 2021-11-08 09:12:37 +08:00
Martin Brennan 9a72a0945f
FIX: Ensure CORS rules exist for S3 using rake task ()
This commit introduces a new s3:ensure_cors_rules rake task
that is run as a prerequisite to s3:upload_assets. This rake
task calls out to the S3CorsRulesets class to ensure that
the 3 relevant sets of CORS rules are applied, depending on
site settings:

* assets
* direct S3 backups
* direct S3 uploads

This works for both Global S3 settings and Database S3 settings
(the latter set directly via SiteSetting).

As it is, only one rule can be applied, which is generally
the assets rule as it is called first. This commit changes
the ensure_cors! method to be able to apply new rules as
well as the existing ones.

This commit also slightly changes the existing rules to cover
direct S3 uploads via uppy, especially multipart, which requires
some more headers.
2021-11-08 09:16:38 +10:00
Krzysztof Kotlarek fe8087e523
FEATURE: small action post accepts href ()
Optionally add href to small action.
It can be used by discourse-assign to link to correct post from translation
2021-11-08 08:24:44 +11:00
Roman Rizzi 53abcd825d
FIX: Canonical URLs may be relative ()
FinalDestination's follow_canonical mode used for embedded topics should work when canonical URLs are relative, as specified in [RFC 6596](https://datatracker.ietf.org/doc/html/rfc6596)
2021-11-05 14:20:14 -03:00
Mark VanLandingham 67265a5045
DEV: Plugin instance method for push_notification_filters () 2021-11-03 12:21:33 -05:00