a89f60b85b
Merge pull request #4631 from tgxworld/prevent_users_from_changing_permissions_of_non_real_users
...
FIX: Do not allow admins to meddle with admin and moderation access o…
2017-01-04 09:10:27 +08:00
cf7774bdd9
FEATURE: Block muted users from sending you PMs
2017-01-03 14:51:53 -05:00
c68bcfeb72
Improve spec.
2017-01-03 15:36:36 +08:00
ad4a96d387
FIX: Only send membership request to the last 5 active group owners.
2017-01-03 15:33:57 +08:00
495a511862
simplify quote markup in emails
2017-01-02 21:37:01 +05:30
f1beef43a8
Merge pull request #4618 from tgxworld/fix_invalid_emails
...
FIX: Don't allow invalid email to be saved.
2016-12-30 07:11:48 +08:00
c7b151683d
FIX: Do not allow admins to meddle with admin and moderation access of non real users.
2016-12-29 11:11:33 +08:00
9c40657ba4
FIX: error during signup saying "Password is the same as your current password" due to automatic group membership granting a trust level
2016-12-28 17:36:04 -05:00
d28d8a1f85
FIX: order by op_likes leads to broken browsing
2016-12-27 19:08:54 +11:00
d72cbcb2a4
FEATURE: new setting to validate user website
2016-12-26 21:29:27 +05:30
5aee2673c7
FIX: Push null fields to last when sorting group members.
2016-12-22 14:55:24 +08:00
8551d821a0
FEATURE: Add site setting to disable group directory.
2016-12-22 14:14:22 +08:00
c531f4ded5
remove rails-observers
...
Rails yanked out observers many many years ago, instead the functionality
was yanked out to a gem that is very lightly maintained.
For example: if we want to upgrade to rails 5 there is no published gem
Internally the usage of observers had quite a few problem.
The series of refactors renamed a bunch of classes to give us more clarity
and removed some magic.
2016-12-22 16:46:53 +11:00
019f1a1d06
UserEmailObserver is now removed
...
no big surprises here was pretty straightforward
after_commit semantics sure are weird though
2016-12-22 16:46:53 +11:00
2f6a4cc6de
remove UserActionObserver, replace with after_save and service
...
interestingly there was some left over dead code from when stars
existed in the topic_users table
2016-12-22 16:46:53 +11:00
0a78ae739d
Remove SearchObserver, aim is to remove all observers
...
rails-observers gem is mostly unmaintained and is a pain to carry forward
new implementation contains significantly less magic as a bonus
2016-12-22 13:13:14 +11:00
28befcb5d4
Fix specs.
2016-12-21 21:21:39 +08:00
076a08d8e1
FIX: Unactivated users should not be automatically added into groups as well.
2016-12-21 18:15:01 +08:00
7228081820
FIX: Automatic group membership should not add staged or unactivated users.
2016-12-21 18:04:26 +08:00
13c6191e89
FIX: Don't allow invalid email to be saved.
2016-12-21 17:47:11 +08:00
5d7f3223f0
SECURITY: Users can only bookmark posts which they can see.
2016-12-21 12:01:26 +08:00
c75bebdea2
FIX: uncategorized setting to control whether topic featured links are allowed
2016-12-20 15:55:30 -05:00
9db5d5b6a7
FIX: Incorrect serializer for groups page.
2016-12-20 15:44:22 +08:00
7c7c233c1c
FIX: Can't update `Groups#allow_membership_requests` in admin.
2016-12-20 15:14:35 +08:00
502e114c60
FIX: Incorrect count when loading more groups.
2016-12-20 14:39:44 +08:00
193f8301a4
FIX: Do not show automatic groups to normal users.
2016-12-20 14:26:49 +08:00
52cd9972bb
FIX: prevent DDoS with lots of _oneboxable_ links
...
FIX: ensure the onebox route is only allowed to logged in users
FIX: only allow 1 outgoing onebox preview per user
FIX: client should only do 1 preview at a time
2016-12-20 00:31:10 +01:00
2b808ad9da
Merge pull request #4609 from joebuhlig/category-topics-wiki
...
FEATURE: Category setting to make all topics wikis
2016-12-20 09:15:51 +11:00
74956694e5
If summary email finds no topics, show topics more than 1 day old from new users
2016-12-19 14:54:08 -05:00
923cf73c6e
Topic Featured Links: move data from custom fields to topics and categories tables. Invert behaviour of topic_featured_link_allowed checkbox. Fix a bug with invalid topic records due to changing that category checkbox.
2016-12-19 14:54:07 -05:00
a2096a01fb
add test case for handling uploads without extension
2016-12-20 00:46:47 +05:30
e03d5e2140
Reapply Ember 2.10 for good this time!
...
This reverts commit ddd299f4aa
2016-12-19 11:19:10 -05:00
87251fded7
FEATURE: Category setting to make all topics wikis
...
FEATURE: Category setting to make all topics wikis
2016-12-19 06:42:18 -06:00
18c8323987
FIX: Incorrect path for redirect.
2016-12-19 18:12:15 +08:00
e0ff57ca75
SECURITY: prevent reuse of password reset
2016-12-19 18:00:22 +11:00
eb2db23b40
FEATURE: remove email_token_grace_period_hours
...
The site setting email_token_grace_period_hours just causes confusion and
should not be used anyway.
Out of the box, tokens stop working once confirmed, no need to add complexity here
2016-12-19 17:15:20 +11:00
0599bd0154
FEATURE: add referrer never tag to password reset page
2016-12-19 11:01:58 +11:00
15b5fddd49
SECURITY: protect upload params, only allow very strict filenames
2016-12-19 10:16:18 +11:00
ab6843dcde
FIX: username route was broken
2016-12-16 23:56:22 +05:30
d8541c589a
FIX: Incorrect route for updating username.
2016-12-17 00:23:12 +08:00
ddd299f4aa
Revert "Revert "Revert Ember 2.10+ for a short while""
...
This reverts commit 76bbc481cb
2016-12-16 10:29:30 -05:00
76bbc481cb
Revert "Revert Ember 2.10+ for a short while"
...
This reverts commit 21682fd60b
2016-12-16 09:52:29 -05:00
61eb134181
FEATURE: setting to allow arbitrary redirects from sso origin
...
if sso_allows_all_return_paths is set to true you can redirect off-site from sso success
2016-12-16 13:37:44 +11:00
6ff309aa80
SECURITY: don't grant same privileges to user_api and api access
...
User API is no longer gets bypasses that standard API gets.
Only bypasses are CSRF and XHR requirements.
2016-12-16 12:05:43 +11:00
197517d55e
FIX: locally uploaded audio & video files should onebox even when the extension is uppercase
2016-12-15 23:21:44 +01:00
21682fd60b
Revert Ember 2.10+ for a short while
2016-12-15 16:43:38 -05:00
ba8c6fd840
FIX: PhantomJS was crashing
2016-12-15 12:30:20 -05:00
98f4a2adcb
FIX: on 404 from brotli asset path return a correctly encoded doc
...
old implementation would cache the 404 for 1 year with incorrect encoding
hilarity would ensue
2016-12-15 16:05:20 +11:00
13c344245d
Merge pull request #4603 from tgxworld/group_index_page
...
FEATURE: Add groups page.
2016-12-14 23:26:05 +08:00
20f9aad539
Merge pull request #4599 from tgxworld/remove_rspec_given
...
Remove RSpec given.
2016-12-14 17:42:30 +08:00
Guo Xiang Tan
Robin Ward
Arpit Jalan
Neil Lalonde
Sam
Régis Hanol
Joe Buhlig