Commit Graph

29038 Commits

Author SHA1 Message Date
Blake Erickson d89b537d8f SECURITY: Fix XSS in full name composer reply
We are using htmlSafe when rendering the name field so we need to escape
any html being passed in.
2023-03-16 15:27:09 -06:00
Penar Musaraj c213cc7211
DEV: Fix tag route fixture param (#20693)
This tag route is /tag/important/l/latest.json so the tag name should also be important.
2023-03-16 11:27:04 -04:00
Loïc Guitaut 0bd64788d2 SECURITY: Rate limit the creation of backups 2023-03-16 16:09:22 +01:00
David Taylor 9d1423b5aa
DEV: Drop impossible conditional from admin-logs-staff-action-logs (#20687)
`Object.keys(filters)` will never return 0
2023-03-16 12:27:27 +00:00
David Taylor c190994046
DEV: Update admin modal controllers to native class syntax (#20685)
This commit was generated using the ember-native-class-codemod along with a handful of manual updates
2023-03-15 17:39:33 +00:00
dependabot[bot] 62bbdd25ab
Build(deps): Bump @babel/core in /app/assets/javascripts (#20681)
Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.21.0 to 7.21.3.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.21.3/packages/babel-core)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-15 14:29:16 +01:00
dependabot[bot] 2ea6675671
Build(deps): Bump sass from 1.59.2 to 1.59.3 in /app/assets/javascripts (#20682)
Bumps [sass](https://github.com/sass/dart-sass) from 1.59.2 to 1.59.3.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.59.2...1.59.3)

---
updated-dependencies:
- dependency-name: sass
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-15 14:27:17 +01:00
David Taylor e700f0af93
DEV: Update admin routes to native class syntax (#20686) 2023-03-15 13:17:51 +00:00
David Taylor be354e7950
DEV: Update admin controllers to native class syntax (#20674)
This commit was generated using the ember-native-class-codemod along with a handful of manual updates
2023-03-15 09:42:12 +00:00
Daniel Waterworth 84f590ab83
DEV: Store theme sprites in the DB (#20501)
Let's avoid fetching sprites from the CDN during page rendering.
2023-03-14 13:11:45 -05:00
Isaac Janzen dfd6d6b999
FIX: Latest post created_at on topic-timeline not updating (#20665)
# Context
https://meta.discourse.org/t/timeline-timestamp-not-updating/256447/1

During the upgrade of the topic-timeline to glimmer the "latest post" timestamp was not updating on the timeline in relation to the relative age of the post. It was only updating on a hard refresh.

# Fix
Use the `age-with-tooltip` helper to update the created_at date automatically as time passes.

# Additional
Add the ability to pass params to `age-with-tooltip` so that we can include options like `addAgo` and `defaultFormat`
2023-03-14 11:08:23 -05:00
Kris 22a7818399
FIX: update LoadMore selector for user tables (#20676) 2023-03-14 11:10:51 -04:00
Penar Musaraj a208ed0925
UX: Improve menu panel height fallback for older browsers (#20673)
Tested with Chrome <100, Firefox <100 and Samsung Internet 20, using
percentage-based height here works better for these browsers.

This was especially a problem for the Samsung Internet browser, because
it previously was hiding the "Dismiss" button on the user profile menu.
2023-03-14 10:41:38 -04:00
David Taylor b5721b7b4f
FIX: `default_list_filter = none` navigation and preloading (#20641)
When a category has default_list_filter=none, there were a number of issues which this commit resolves:

1. When using the breadcrumbs to navigate a `default_list_filter=none` category, adding a tag filter would not apply the no-subcategories filter, but the subcategories dropdown would still say 'none'. This commit adjusts `getCategoryAndTagUrl` so that `/none` is added to the URL

2. When landing on `/tags/c/{slug}/{id}/{tag}`, for a default_list_filter=none category, it would include subcategories. This commit introduces a client-side redirect to match the behavior of `/c/{slug}/{id}`

3. When directly navigating to `/c/{slug}/{id}`, it was correctly redirecting to `/c/{slug}/{id}/none`, BUT it was still using the preloaded data for the old route. This has been happening since e7a84948. Prior to that, the preloaded data was discarded and a new JSON request was made to the server. This commit restores that discarding behavior. In future we may want to look into making this more efficient.

System specs are introduced to provide end-end testing of this functionality
2023-03-14 10:46:05 +00:00
Loïc Guitaut 8a8f2758d5 DEV: Refactor `Jobs::UserEmail` a little 2023-03-14 09:23:06 +01:00
Isaac Janzen ab442058c0
FIX: Broken topic-timeline summarize topic button (#20661)
# Context
During the octane upgrade of the Topic Timeline the `summarize-topic` button was neglected, leaving it in a broken state. 

# Fix
Update the button to replicate the original functionality


<img width="351" alt="Screenshot 2023-03-13 at 12 41 25 PM" src="https://user-images.githubusercontent.com/50783505/224785657-fc8124fe-f1d9-4cc8-917b-9cd859517da3.png">

_updated timeline with summarize button_
2023-03-13 13:12:33 -05:00
Andrei Prigorshnev 72726830b5
FIX: anonymous users cannot load topics with mentions with a user status that has an end date (#20660)
Steps to reproduce:
1. Create a post with a mention of a user that has user status with an end date
2. Try to load the topic with that post as an anonymous user

You'll see a topic with blank content.
2023-03-13 19:57:09 +04:00
David Taylor f91af69ec4
FIX: Avatar upload error (#20658)
Followup to 4f9afabf87
2023-03-13 10:59:42 +00:00
dependabot[bot] 59e5485408
Build(deps): Bump sass from 1.58.3 to 1.59.2 in /app/assets/javascripts (#20656)
Bumps [sass](https://github.com/sass/dart-sass) from 1.58.3 to 1.59.2.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.58.3...1.59.2)

---
updated-dependencies:
- dependency-name: sass
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-13 11:01:41 +01:00
dependabot[bot] 05e713d098
Build(deps): Bump node-fetch from 3.3.0 to 3.3.1 in /app/assets/javascripts (#20655)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-13 08:45:43 +08:00
dependabot[bot] b5bb41493a
Build(deps): Bump eslint from 8.35.0 to 8.36.0 in /app/assets/javascripts (#20652)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-13 08:45:24 +08:00
dependabot[bot] 8c653cbc91
Build(deps): Bump sinon from 15.0.1 to 15.0.2 in /app/assets/javascripts (#20653)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-13 08:12:35 +08:00
dependabot[bot] ad6edfc08a
Build(deps): Bump jsdom from 21.1.0 to 21.1.1 in /app/assets/javascripts (#20651)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-13 08:12:19 +08:00
dependabot[bot] 173a3b4d02
Build(deps): Bump webpack from 5.76.0 to 5.76.1 in /app/assets/javascripts (#20654)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-13 08:10:09 +08:00
Alan Guo Xiang Tan e4b11e7643
FEATURE: Only list watching group messages in messages notifications panel (#20630)
Why is this change required?

Prior to this change, we would list all group messages that a user
has access to in the user menu messages notifications panel dropdown.
However, this did not respect the topic's notification level setting and
group messages which the user has set to 'normal' notification level were
being displayed

What does this commit do?

With this commit, we no longer display all group messages that a user
has access to. Instead, we only display group messages that a user is
watching in the user menu messages notifications panel dropdown.

Internal Ref: /t/94392
2023-03-13 08:09:38 +08:00
Kris 44bc284e0f
UX: avoid overflow clipping descenders (#20643) 2023-03-10 16:49:06 -05:00
Kris 03e3fd742e
UX: some admin theme list style adjustments (#20625) 2023-03-10 15:15:31 -05:00
Blake Erickson 943068a634
FIX: Welcome topic banner showing after general category is deleted (#20639)
If you happen to delete the general category before editing the welcome
topic, the banner will still display. This fix adds a after destroy hook
that will clear the entries for the welcome topic banner in the redis
cache.
2023-03-10 12:33:12 -07:00
David Taylor 6bb89ffea8
DEV: Resolve `d-button-action-string` deprecation in `exception.hbs` (#20638) 2023-03-10 16:56:40 +00:00
David Taylor 3e8d349465
DEV: Correct core test run detection for theme-qunit (#20635)
Followup to 8f1a5c9392
2023-03-10 12:40:59 +00:00
David Taylor 8f1a5c9392
DEV: Fail core JS test runs if deprecations are triggered (#20614)
It's important to keep our core log output as clean as possible to avoid 'crying wolf', and so that any deprecations triggered by plugin/theme tests are indeed caused by that theme/plugin, and not core.

This commit will make the core test suite fail if any deprecations are triggered. If a new deprecation is introduced (e.g. as part of a dependency update) and we need more time to resolve it it can be silenced via ember-deprecation-workflow.

This does not affect plugin/theme test runs.
2023-03-10 10:39:42 +00:00
David Taylor 270e98e45f
DEV: Include ember deprecation messages in production builds (#20587)
By default, Ember uses a babel transformation to strip out calls to `deprecate()` in production builds. Given that Discourse is a development platform for third-party themes/plugins, having deprecation messages visible in production is essential - many themes/plugins do not have comprehensive test-suites, and rely on production feedback to prompt changes. This commit patches Ember to print its deprecation messages to the console in production. In future we intend to improve the visibility of these to hosting providers and/or site admins.

There are two main parts to this commit:

1. Use yarn's 'resolutions' feature to point `babel-plugin-debug-macros` to a discourse-owned fork. This fork prevents `deprecate()` calls from being stripped. Relevant change can be found at https://github.com/discourse/babel-plugin-debug-macros/commit/d179d613bf

2. Introduce a production shim for Ember's deprecation library, including the `registerDeprecationHandler` API. The default implementation is stripped out of production builds via an `if(DEBUG)` wrapper.

Long term we hope that this kind of functionality can be made available in Ember itself via a flag.
2023-03-10 10:37:28 +00:00
dependabot[bot] 29727408d6
Build(deps): Bump terser in /app/assets/javascripts (#20621)
Bumps [terser](https://github.com/terser/terser) from 5.16.5 to 5.16.6.
- [Release notes](https://github.com/terser/terser/releases)
- [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/terser/terser/compare/v5.16.5...v5.16.6)

---
updated-dependencies:
- dependency-name: terser
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-10 10:11:27 +00:00
Ted Johansson 87ec058b8b
FEATURE: Configurable auto-bump cooldown (#20507)
Currently the auto-bump cooldown is hard-coded to 24 hours.

This change makes the highlighted 24 hours part configurable (defaulting to 24 hours), and the rest of the process remains the same.

This uses the new CategorySetting model associated with Category. We decided to add this because we want to move away from custom fields due to the lack of type casting and validations, but we want to keep the loading of these optional as they are not needed for almost all of the flows.

Category settings will be back-filled to all categories as part of this change, and creating a new category will now also create a category setting.
2023-03-10 13:45:01 +08:00
Martin Brennan 168de52538
DEV: Change sidebar header dropdown to use wait_for_animation (#20627)
* DEV: Change sidebar header dropdown to use wait_for_animation

Introduced in 54351e1b8a, this
helper should remove the need to have to add the .animated
CSS class in JS for the sidebar.

* DEV: Revert spec change
2023-03-10 14:54:57 +10:00
Sam 5893ad46ba
Revert "FIX: tag dropdown not working with default_list_filter (#20608)" (#20631)
This reverts commit 0df7743d78.

This causes too much instability in the unit test system, reverting
2023-03-10 13:45:34 +11:00
Osama Sayegh 118ce348f4
DEV: Let unread topics come through to /new when new new view is enabled (#20628)
Currently, if a user has opted into the new new experiment (introduced in a509441) and they click on the "See # new or updated topics" banner (screenshot below) at the top of the /new topics list, only new topics are loaded even if there are tracked topics with new replies.

This is unexpected in the new new view experiment because /new in this experiment is supposed to show both new and unread topics so it should listen for both new topics and new replies for existing/tracked topics. This PR addresses this inconsistency and makes it so that clicking the banner load all new and updated topics.
2023-03-10 09:57:35 +08:00
Sam 0df7743d78
FIX: tag dropdown not working with default_list_filter (#20608)
If you set a category to `default_list_filter` none. Information
was not passed to the tag route and routing was incorrect.

This patch fails, cause on reload route does not point to the right place.


```
-- a/app/assets/javascripts/discourse/app/routes/tag-show.js
+++ b/app/assets/javascripts/discourse/app/routes/tag-show.js
@@ -89,6 +89,8 @@ export default DiscourseRoute.extend(FilterModeMixin, {
       filter = `tag/${tagId}/l/${topicFilter}`;
     }
     const list = await findTopicList(
       this.store,
       this.topicTrackingState,
@@ -123,7 +125,7 @@ export default DiscourseRoute.extend(FilterModeMixin, {
   },

   setupController(controller, model) {
-    const noSubcategories =
+    this.noSubcategories =
       this.noSubcategories === undefined
         ? model.category?.default_list_filter === NONE
         : this.noSubcategories;
@@ -133,7 +135,7 @@ export default DiscourseRoute.extend(FilterModeMixin, {
       ...model,
       period: model.list.for_period,
       navMode: this.navMode,
-      noSubcategories,
+      noSubcategories: this.noSubcategories,
       loading: false,
     });
 ```

Long term we don't want to hide this logic from the routing (even in
the category case) it just cause unneeded confusion and fragility.
2023-03-10 11:37:55 +11:00
Selase Krakani 0603bd57df
FIX: Ensure `form_template_ids` is defined on new category records (#20610)
Navigating to the topic template tab on a new category form resulted in
exceptions because the `form_template_ids` property was undefined.

This fix sets the `form_template_ids` property on new category records.
2023-03-09 23:34:08 +00:00
Blake Erickson 2d0ad48dd1
Revert "DEV: Add crossOrigin to video tag (#20617)" (#20624)
This reverts commit f6063c684b.

Videos on sites with a cdn enabled aren't playing w/ a default cdn
config. They are showing a "CORS request did not succeed" error.
2023-03-09 16:20:35 -07:00
Blake Erickson f6063c684b
DEV: Add crossOrigin to video tag (#20617)
* DEV: Add crossOrigin to video tag

This is a follow-up commit to f144c64e13
which enables the ability to generate thumbnail images for video
uploads.

In order for the html5 canvas element to create an image or blob the
source video element needs to to have the crossOrigin attribute set to
"anonymous" because a cdn is likely being used in production
environments.

We are already doing something similar in
e292c45924/app/assets/javascripts/discourse/app/lib/update-tab-count.js (L63)
2023-03-09 13:19:19 -07:00
David Taylor 4f9afabf87
DEV: Resolve avatar-selector `computed-property.override` deprecation (#20616) 2023-03-09 18:05:46 +00:00
Blake Erickson f144c64e13
Generate thumbnail images for video uploads (#19801)
* FEATURE: Generate thumbnail images for uploaded videos

Topics in Discourse have a topic thumbnail feature which allows themes
to show a preview image before viewing the actual Topic.

This PR allows for the ability to generate a thumbnail image from an
uploaded video that can be use for the topic preview.
2023-03-09 09:26:47 -07:00
chapoi dd07e0dbd0
FIX: review q issues (#20558)
* DEV: specify type of flag in status

* FIX: passing missing parameter

* DEV: pass type for reviewable score table

* UX: add missing queued-topic styling

* UX: fix img overflow

* UX: add styling for queued user

* UX: fix user flag color

* UX: prevent overflow

* UX: add copy for filters

* FIX: fix typo in css for akismet flagging

* UX: copy change for flag something else

* UX: prevent overflow

* Fixing reviewable-status css classes

* Changes based on no longer using humanType

* Need to use type rather than humanType for reviewable-status

* FIX: linting

---------

Co-authored-by: Martin Brennan <martin@discourse.org>
2023-03-09 16:02:13 +01:00
Penar Musaraj 673cd4196f
FIX: Don't send image sizes for emojis/avatars (#20589)
When using the "review media unless trust level" setting, posts with emojis or quotes will end up in the review queue even though they don't have any uploaded media. That is because our heuristic for this in the new post manager relies on image_sizes. This commit skips sending image_sizes for emojis and avatars. 

Co-authored-by: Régis Hanol <regis@hanol.fr>
2023-03-09 09:53:27 -05:00
Kris 3cab9d5f80
UX: position of group user table dropdown, border (#20593) 2023-03-09 09:39:02 -05:00
David Taylor b1727d9748
DEV: Resolve topic#details computed-property.override deprecation (#20612) 2023-03-09 13:44:50 +00:00
David Taylor 059ac3d31a
DEV: Unsilence and resolve setting-on-hash deprecation (#20611)
Select-kit was mutating a passed-in options hash to apply its own deprecations. This commit updates it to apply deprecated changes to the downstream `this.selectKit.options` object instead.
2023-03-09 13:44:31 +00:00
David Taylor a99218677f
DEV: Unsilence two ember deprecations (#20609)
Neither of these are triggered in the core test suite. Unsilence so that plugins/themes receive deprecation notices.
2023-03-09 12:24:15 +00:00
Selase Krakani ec40693f89
FIX: Ensure `required_tag_group` is defined on new category records (#20600)
Attaching required tag groups to new categories failed because
`required_tag_group` was undefined on the new category records

This fix sets an empty `required_tag_group` property on the new category
records.
2023-03-09 11:57:37 +00:00