215c0d5569
FEATURE: allow system api to target users via external id or user id
...
usage ?api_key=XYZ&api_user_external_id=ABC
usage ?api_key=XYZ&api_user_id=123
2018-01-12 17:40:18 +11:00
988b13ac77
FIX: GitHub auth always asking to verify email for new users ( #5487 )
2018-01-12 15:17:29 +11:00
49ed382c2a
FIX: return 429 when admin api key is limited on admin route
...
This also handles a general case where exceptions leak out prior to being handled by the application controller
2018-01-12 14:15:26 +11:00
b9a343afe7
FIX: Allow shared CDN for s3 and assets
2018-01-12 01:08:15 -02:00
b96ae14261
FEATURE: Display force_https warning in admin problems dashboard
2018-01-11 12:16:10 +05:30
9f7ae908d8
Add specs to check email domain whitelist/blacklist for To and Cc
2018-01-10 16:57:26 +01:00
8f21c96ea5
FIX: don't downcase watched words on input since it can break the watched_words_regular_expressions setting
2018-01-09 16:51:59 -05:00
672888f526
FIX: handle invalid password reset token
2018-01-09 23:48:17 +05:30
bc56d86a63
Support ruby 2.5.0
2018-01-09 16:03:17 +01:00
6c1ebbb95c
add test case for csv BOM handling
2018-01-09 15:49:41 +05:30
e90187cbf7
Merge pull request #5469 from tgxworld/add_guard_to_prevent_primary_email_from_being_reassigned
...
FIX: Add guard to prevent a primary `UserEmail` from being reassigned.
2018-01-09 13:35:08 +08:00
8ff5f5f2ef
FIX: cache admin locale file for 24 hours
2018-01-09 10:23:49 +11:00
cecd7d0d07
FEATURE: global rate limiter can bypass local IPs
2018-01-08 08:39:17 +11:00
e5affdf230
FIX: URI must be ascii only for URI.parse command
2018-01-07 02:31:35 +05:30
642645ba9a
FIX: broken select badge as user title ( #5474 )
...
* FIX: broken select badge as user title
* selected id wasn’t pass to underlying component
* <none> was rendered as an html tag <none></none>
* overriding a badge name wouldn’t work as it was using badge.name and not badge.display_name
* adds a spec to ensure this behavior is correct
2018-01-05 16:58:15 +01:00
f086d28b30
FIX: Do not validate messages sent to mailing list mirror
2018-01-05 11:21:53 +01:00
e0d73a957d
FEATURE: Allow posting via email to read-only mailing list mirror category
2018-01-05 11:21:53 +01:00
d7cd7e4dc7
FIX: Never mark emails sent to mailing list mirror as auto-generated
2018-01-05 11:21:53 +01:00
9030d3ef63
FIX: do not create duplicate topics
...
https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190
2018-01-04 23:53:52 +05:30
8a3bbcb19a
FIX: Add guard to prevent a primary `UserEmail` from being reassigned.
2018-01-04 19:40:50 +08:00
ceb7590bcb
FIX: bounced email can contain multiple status codes
2018-01-03 17:59:20 +01:00
9644569a28
FIX: Wildcard webhooks could send duplicated events.
2018-01-03 17:00:44 +08:00
647cf7545d
Fix randomly failing spec.
2018-01-03 14:42:16 +08:00
38269c416d
FIX: return regular notification level for categories when not set by user
2017-12-30 20:36:58 +01:00
805d1c25d3
Merge pull request #5451 from tgxworld/treat_non_ascii_urls_as_valid
...
Treat non-ascii URLs in `UrlValidator`.
2017-12-27 14:14:20 +08:00
a9e2fc59c4
FIX: [constructor] bbcode would cause markdown crash
2017-12-27 16:11:30 +11:00
ef4c6c67ba
fix the build
2017-12-23 14:42:40 +05:30
0514ac4ee2
FIX: verify presence of 'sso url' before enabling 'enable sso'
2017-12-23 13:30:49 +05:30
d6b22e6cc1
FIX: whitelist oneboxed iframes
2017-12-23 01:56:33 +01:00
69a90f31fb
FEATURE: Allow Forums to disable the Backups feature
2017-12-21 15:22:04 -05:00
7b58afe677
FIX: ProcessPost job failed for posts that have no user
2017-12-21 14:45:59 +01:00
4b51871f6a
Treat non-ascii URLs in `UrlValidator`.
2017-12-21 14:22:55 +08:00
6ecf37c482
Improve URL validation to check for a valid host.
...
Parsing a URL with `URI` is not sufficient as the following cases
are considered valid:
URI.parse("http://https://google.com ")
=> #<URI::HTTP http://https//google.com >
2017-12-21 13:50:15 +08:00
21e1b05c7e
FIX: Don't disable details when below truncate limit
2017-12-20 15:45:00 -05:00
7f69362d9d
FIX: external links in whisper ended up in a white page
...
FIX: clicking a link in a onebox wasn't properly extracting the post_id
2017-12-20 17:55:15 +01:00
6c4ee9d5b5
FEATURE: Trigger user webhook when a user logs in/out.
...
https://meta.discourse.org/t/how-do-you-learn-how-to-build-these-plugins/57946/10?u=tgxworld
2017-12-20 17:47:30 +08:00
6a2bce1931
FIX: Data loss on update of single user_field.
...
https://meta.discourse.org/t/api-data-loss-caused-by-changed-behaviour-of-custom-user-field-update/74990
2017-12-20 16:33:23 +08:00
7aa56fc9d9
refinement and test for batch mode on feature_topics
2017-12-20 13:58:05 +11:00
eab66065d1
FEATURE: search log term details page ( #5445 )
2017-12-20 13:41:31 +11:00
a0aca83c12
FIX: Broken spec
2017-12-19 17:55:41 -05:00
b3fda0ea86
FIX: details tags broke excerpts
2017-12-19 17:28:55 -05:00
24e89b6b38
FIX: validates 'ThemeField' name when used in a SCSS variable
2017-12-19 16:10:44 +01:00
fc6cb7bbe3
Merge pull request #5444 from tgxworld/remove_phantomjs
...
Switch to chrome headless mode instead of phantomjs.
2017-12-19 19:42:40 +08:00
6a4f391e38
Switch to chrome headless mode instead of phantomjs.
2017-12-19 16:00:43 +08:00
57a1190b07
FIX: correct issue with search omitting words with multiple dots
...
Previously we used to break up words with dots incorrectly leading to
missing search terms
2017-12-19 16:04:24 +11:00
30ddc1f222
Don't swallow errors when failing to create message for post action.
2017-12-19 10:58:26 +08:00
b39d3a863d
FIX: `moderators` group wasn't being updated to be messagable by everyone.
...
https://meta.discourse.org/t/custom-flag-not-showing-text/76244
2017-12-19 10:14:56 +08:00
1abc276451
FIX: properly omit inactive and silenced users from directory
2017-12-19 12:53:59 +11:00
97ceebb570
SECURITY: Don't pass email backup token to sidekiq as a parameter.
...
* This exposes the token in the Sidekiq dashboard which can be
viewed by an admin and defeats the purpose of using a token
in the download backup email ink.
2017-12-18 11:25:22 +08:00
5e90abfaea
FIX: use hijack for emoji uploads
2017-12-18 10:31:19 +11:00
81b3a4a3da
improve spec
2017-12-15 11:42:51 +11:00
b91f83eb7d
Ignore auto-quote/reply when counting replies
2017-12-15 00:38:14 +01:00
092c976d7c
FIX: prevent 💥 when selecting replies to posts quoting themselves
2017-12-15 00:23:51 +01:00
3cbaea81bd
Merge pull request #5428 from discourse/fix-pending-users-count
...
FIX: incorrect pending_users_reminder user count
2017-12-14 14:05:37 -05:00
f2565f6c7e
SECURITY: Any group can be invited into a PM.
2017-12-14 14:57:48 +08:00
96584403cd
SECURITY: prevent staged accounts from changing email
2017-12-14 17:16:49 +11:00
67aecff59c
FEATURE: store twitter supplied email for auditing
2017-12-14 15:54:32 +11:00
11050e5d10
Don't override count value that has been set by query.count
2017-12-13 18:48:46 -08:00
5db3d39b05
FIX: Post.reply_ids should also handle quotes
2017-12-14 00:43:48 +01:00
1b4483c942
FEATURE: Added 'select +below' and 'select +all replies' options to selecting posts
2017-12-13 22:12:06 +01:00
f525d83b53
FIX: empty uploads and blank filenames caused errors during validation
2017-12-13 22:03:31 +01:00
3f1d6a302e
FIX: links with query params to external sites fail to load if ga universal auto link domains is used
2017-12-13 13:58:44 -05:00
7aee1e3083
Remove specs that makes the build very sad.
2017-12-13 17:51:52 +08:00
d5293aeae2
Clean `Topic#slug` when `SiteSetting.slug_generation_method` changes.
...
https://meta.discourse.org/t/removing-the-concept-of-slugs-for-some-languages/26643/24?u=tgxworld
2017-12-13 16:11:07 +08:00
b998efdc94
FIX: do not send mailing list emails to unapproved users
2017-12-13 15:13:17 +11:00
a393d3bcbb
FIX: ensure staged accounts are always inactive
...
If for any reason active is stored in the user model, clear it out
prior to creating an account
2017-12-13 14:22:16 +11:00
a7c1b0c81f
FIX: path whitelist for embedded comments didn't work with non-ASCII chars
2017-12-12 20:17:46 +01:00
e30851e45a
Move escape_uri method to a more suitable place
2017-12-12 20:17:46 +01:00
492af81e67
FIX: save registration_ip_address for staged users logging in via social auth
2017-12-12 17:41:16 +05:30
62a5b174e1
FIX: wasn't able to use the same username when taking over a staged account
2017-12-12 11:26:00 +01:00
6ade508f39
FIX: Prevent 'rack.input' missing error.
2017-12-12 16:40:35 +08:00
1d43d7f136
optimize spec
2017-12-12 13:00:53 +05:30
ff6dda85b7
FIX: replace curly quotes to regular quotes in search terms
2017-12-12 11:17:28 +05:30
d21db0f186
add a test case to verify presence of registration_ip_address for staged users
2017-12-11 21:33:00 +05:30
365bd771d9
Fix the build.
2017-12-11 17:03:05 +08:00
4bd5acec47
FIX: `Topic#featured_link` may contain more than a URL.
2017-12-11 16:36:19 +08:00
3c56c9b637
FIX: strip webhook payload_url
2017-12-11 13:48:11 +05:30
63bdc4056d
More log suppressions for rate limit exceeded
2017-12-11 17:52:57 +11:00
4986ebcf24
FEATURE: optional default off global per ip rate limiter
2017-12-11 17:52:57 +11:00
68d3c2c74f
FEATURE: add global rate limiter for admin api 60 per minute
...
Also move configuration of admin and user api rate limiting into global
settings. This is not intended to be configurable per site
2017-12-11 11:07:22 +11:00
74b9828731
FIX: Remove mentions filters from user and groups
...
Additionally return no data if disabled
2017-12-07 16:29:02 -05:00
5003f07b2c
FEATURE: new site setting show_inactive_accounts
2017-12-07 19:22:41 +05:30
f0ef307d2d
FIX: topic timer offset applied two times
...
timezone offset was calculated and sent from browser to server, it would be applied on utc time generated from '2013-11-22 5:00' format for example and then sent back to browser which would display it thinking it's UTC time using `moment(utc time)` when it's in fact an UTC time we have offseted with the initial user timezone.
This is impossible to automatically test in the current app state. Easiest reproduction is in live browser after setting your timezone to `America/New_York`, when setting a topic timer to later_today, after save, the time under the topic should be off to something roughly equal +1/-1 hour to your timezone offset.
2017-12-07 14:42:58 +01:00
47c44356f8
FIX: load balanced servers do not share monotonic clock
...
This means then when a service is load balanced and you reach rate limits
there was a case where they counting was way off
also remove the stub from clock_gettime cause we need to be super careful with
it, so we should probably just stub by hand when needed
2017-12-07 11:48:11 +11:00
90a55d6f7c
FIX: handle CORS in hijacked requests
2017-12-07 10:31:04 +11:00
16738cfb1b
FEATURE: convert plain text emails to markdown
2017-12-06 01:47:51 +01:00
5f318a5241
FEATURE: Replace SimpleRSS with Ruby RSS module ( #5311 )
...
* SPEC: PollFeedJob parsing atom feed
* add FeedItemAccessor
It is to provide a consistent interface to access a feed item's tag
content.
* add FeedElementInstaller
to install non-standard and non-namespaced feed elements
* FEATURE: replace SimpleRSS with Ruby RSS module
* get FinalDestination and download with Excon
* support namespaced element with FeedElementInstaller
2017-12-06 10:45:09 +11:00
410994b7f5
FEATURE: Show a button to Staff for "Moderation History" on posts/topics
...
When clicked, it pops up a modal showing a history of moderation actions
taken on the post or topic.
2017-12-05 15:20:20 -05:00
6e054b2572
FEATURE: Convert HTML to Markdown while pasting in composer
2017-12-05 12:23:39 -05:00
995bf3c84e
correct spec on Ruby 2.3
2017-12-05 07:04:41 +11:00
5a9622163d
FIX: regression around rate limiter
2017-12-04 21:44:16 +11:00
dd70ef3abf
Revert "Revert "PERF: improve speed of rate limiter""
...
This reverts commit 2373d85239
2017-12-04 21:23:11 +11:00
2373d85239
Revert "PERF: improve speed of rate limiter"
...
This reverts commit a9bcdd7f27
2017-12-04 21:19:28 +11:00
d041377ccf
correct test that does not work with discobot
2017-12-04 18:20:05 +11:00
a9bcdd7f27
PERF: improve speed of rate limiter
...
Also
- adds a global rate limiter option
- cleans up usage in tests
- fixes freeze_time so it handles clock_gettime
2017-12-04 18:17:30 +11:00
af061efcf5
DEV: if plugins are installed do not fail the test
2017-12-04 18:17:30 +11:00
b18cc81609
Make rubocop happy.
2017-12-04 10:55:31 +08:00
22140efa70
Tests are still leaking connection after skipping.
...
* Could be in the setup.
2017-12-04 10:46:30 +08:00
e73fbfe265
FIX: `Topic#featured_link_root_domain` extracts URL before parsing.
2017-12-04 10:00:07 +08:00
4c8402c50f
Skip test that is leaking connections.
2017-12-04 09:26:51 +08:00
Sam
Vinoth Kannan
Rafael dos Santos Silva
Gerhard Schlager
Neil Lalonde
Arpit Jalan
Jan Suchal
Guo Xiang Tan
Joffrey JAFFEUX
Guo Xiang Tan
Régis Hanol
Robin Ward
Philipp Daniels
scossar
Kyle Zhao
Vinoth Kannan