Commit Graph

49693 Commits

Author SHA1 Message Date
Blake Erickson dcceb91000
SECURITY: Prevent dismissal of topics that user can't see (#22086)
Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com>
2023-06-13 11:08:55 -06:00
Blake Erickson 644dded000
SECURITY: Use canonical url for topic embeddings (#22085)
This prevents duplicate topics from being created when using embed_urls
that only differ on query params.
2023-06-13 11:08:08 -06:00
Blake Erickson 56b74e6042
SECURITY: Limit ThemeField value length to prevent DoS (#22087)
Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>
2023-06-13 12:07:47 -05:00
Blake Erickson e576fdbe3a
SECURITY: set max-height property for iframes (#22084)
Co-authored-by: David Battersby <info@davidbattersby.com>
2023-06-13 11:07:32 -06:00
Régis Hanol 4cb3412a56
PERF: improve `findAllMatches` speed (#22083)
When we introduced unicode support in the regular expressions used in watched words (9a27803) we didn't realize the cost adding the `u` flag would be.

Turns out, it's pretty bad when you have lots of regular expressions to test. A customer had slightly less than 200 watched words, and it would freeze the browser for about 2s on the first check of those regular expressions (roughly 10ms per regular expression).

This commit introduces a new field (`word`) to the serialized watched words which is then converted to a very fast and cheap regular expression on the client-side. We use that regexp to quicly check whether a matcher is even worth trying so that we don't incure the cost of compiling the expensive unicode regexp.

This commit also busts the `WordWatcher` cache since we added a new field to be serialized.

One nice side effect of using `matchAll` instead of a `while / exec` loop is that the likeliness of having a bad regexp matching infinitely is vastly reduced 🙌
2023-06-13 18:34:28 +02:00
Blake Erickson 367b3be035
DEV: Cleanup unused group and post routes (#22067)
Cleaning up these routes because they aren't being used
and they don't have a corresponding controller method.

- `POST  /groups(.:format) groups#create`
- `DELETE /groups/:id(.:format) groups#destroy`
- `POST  /g(.:format) groups#create`
- `DELETE /g/:id(.:format) groups#destroy`
- `GET /posts(.:format) posts#index`
- `GET /posts/new(.:format) posts#new`
- `GET /posts/:id/edit(.:format) posts#edit`
2023-06-13 08:57:57 -06:00
Penar Musaraj 3c490b2db8
UX: Better alignment for experimental grids (#22066)
Improves the layout of most grids in posts, by using `object-fit: cover` for most images. This allows images to better fill up the space, without changing their aspect ratio.
2023-06-13 09:25:46 -04:00
Discourse Translator Bot 3da29a06fd
Update translations (#22081) 2023-06-13 15:18:44 +02:00
chapoi bb4b60d624
UX: remove rounded border on hover lightbox (#22080) 2023-06-13 13:31:28 +02:00
Loïc Guitaut 5257c80064 DEV: Set limits on custom fields
This patch sets some limits on custom fields:
- an entity can’t have more than 100 custom fields defined on it
- a custom field can’t hold a value greater than 10,000,000 characters

The current implementation of custom fields is relatively complex and
does an upsert in SQL at some point, thus preventing to simply add an
`ActiveRecord` validation on the custom field model without having to
rewrite a part of the existing logic.
That’s one of the reasons this patch is implementing validations in the
`HasCustomField` module adding them to the model including the module.
2023-06-13 11:47:21 +02:00
Loïc Guitaut c08a52e502 DEV: Clean up old polls data from custom fields
In early 2015, the poll plugin was writing its data to custom fields on
the post containing the poll. It was later changed to have dedicated SQL
tables and the polls were migrated but we forgot to clean the existing
data.
2023-06-13 11:28:26 +02:00
Jarek Radosz e6f8897450
DEV: Try to de-flake topic page specs (#22065) 2023-06-13 11:05:19 +02:00
Krzysztof Kotlarek 4270ab932a
FIX: change dismiss new button label (#22075)
Button which is opening modal to dismiss topics should be "Dismiss…"
2023-06-13 13:18:39 +10:00
dependabot[bot] 9854b034c6
Build(deps-dev): Bump terser in /app/assets/javascripts (#22074)
Bumps [terser](https://github.com/terser/terser) from 5.17.7 to 5.18.0.
- [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/terser/terser/compare/v5.17.7...v5.18.0)

---
updated-dependencies:
- dependency-name: terser
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-13 01:31:36 +02:00
dependabot[bot] 091e9a832c
Build(deps): Bump rubocop from 1.52.0 to 1.52.1 (#22070)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.52.0 to 1.52.1.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.52.0...v1.52.1)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-13 01:23:14 +02:00
dependabot[bot] 9ad0c3ddb5
Build(deps): Bump net-imap from 0.3.4 to 0.3.6 (#22069)
Bumps [net-imap](https://github.com/ruby/net-imap) from 0.3.4 to 0.3.6.
- [Release notes](https://github.com/ruby/net-imap/releases)
- [Commits](https://github.com/ruby/net-imap/compare/v0.3.4...v0.3.6)

---
updated-dependencies:
- dependency-name: net-imap
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-13 01:21:18 +02:00
dependabot[bot] b5358e803e
Build(deps-dev): Bump sinon in /app/assets/javascripts (#22073)
Bumps [sinon](https://github.com/sinonjs/sinon) from 15.1.0 to 15.1.2.
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md)
- [Commits](https://github.com/sinonjs/sinon/compare/v15.1.0...v15.1.2)

---
updated-dependencies:
- dependency-name: sinon
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-13 01:20:28 +02:00
Bianca Nenciu 774698491d
UX: Make user tips more visible (#22012)
Inverts the background of the user tip to make it more visible.
2023-06-12 21:08:49 +03:00
dependabot[bot] 7c768a2ff9
Build(deps-dev): Bump @babel/core in /app/assets/javascripts (#22026)
Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.22.1 to 7.22.5.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.22.5/packages/babel-core)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 16:50:43 +02:00
Kris 5ed24bc8a1
UX: dark color palettes need darker shadows (#22051) 2023-06-12 10:15:14 -04:00
dependabot[bot] 41423652c1
Build(deps-dev): Bump @babel/standalone in /app/assets/javascripts (#22027)
Bumps [@babel/standalone](https://github.com/babel/babel/tree/HEAD/packages/babel-standalone) from 7.22.4 to 7.22.5.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.22.5/packages/babel-standalone)

---
updated-dependencies:
- dependency-name: "@babel/standalone"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 15:47:34 +02:00
Jarek Radosz 843287d584
DEV: Increase topic_page_spec wait time (#22063) 2023-06-12 15:16:08 +02:00
Loudghiri Ahmed 589add7bb5
FIX: use `_presentChannels.size` instead of `_presentChannels.length` (#22053)
`_presentChannels` is a Set, not an Array. Previously this `else if` condition would never be hit.
2023-06-12 13:48:24 +01:00
Jarek Radosz b7568ea4a5
FIX: TOC anchors in a subfolder setup (#21985)
Clicking on TOC heading anchors in a subfolder setup was breaking the current URL for users.

Other than the fix this change introduces the ability to test the subfolder setup in system specs.
2023-06-12 13:59:54 +02:00
dependabot[bot] 0f4f8c45f9
Build(deps): Bump webpack in /app/assets/javascripts (#21987)
Bumps [webpack](https://github.com/webpack/webpack) from 5.85.1 to 5.86.0.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](https://github.com/webpack/webpack/compare/v5.85.1...v5.86.0)

---
updated-dependencies:
- dependency-name: webpack
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 13:59:23 +02:00
David Taylor cc2f18121d
DEV: Bump workbox packages from 4.3.1 to 7.0.0 (#22052) 2023-06-12 12:28:40 +01:00
Jarek Radosz cc15d1f86d
DEV: Fix subfolder setup in dev env (#21983)
1. ember proxy stuff still isn't in a great shape, live-reload doesn't work yet, uploads made w/o subfolder won't work, custom fonts don't work, service worker doesn't work. But otherwise it's fine :P
2. I don't know why `HTTP_IF_MODIFIED_SINCE` can be an empty string. Don't have time to investigate, and fast_blank makes this fix an easy solution ;)
2023-06-12 12:49:26 +02:00
Martin Brennan 7e0fcd1b42
FEATURE: Dynamic chunk size with uppy (#22061)
When we get to really big files, it's better to not have thousands
of small chunks, since we don't have a resume functionality if the
upload fails. Better to try upload less chunks even if those chunks
are bigger.

For example, with this change a 20GB file would go from 4000 chunks
of the default 5mb to 1000 chunks of the new 20mb size. Still a lot,
but perhaps more manageable.

This is somewhat experimental -- if we still don't see improvements
we can always change back.
2023-06-12 17:47:29 +10:00
chapoi fca6c1836c
UX: Chat unread indicator refactor (#22040)
* move the chat unread indicator to top to match the profile avatar indicator
* add white border to profile avatar indicator (badge notification) to match chat indicator and userstatus styling
* change `.urgent` to BEM
* congregate all styling into mixin
  * update chat index to use mixin
  * update thread indicator to use mixin
  * update header indicator to use mixin

---------

Co-authored-by: Joffrey JAFFEUX <j.jaffeux@gmail.com>
Co-authored-by: Martin Brennan <martin@discourse.org>
2023-06-12 14:33:45 +10:00
dependabot[bot] 3221495849
Build(deps-dev): Bump selenium-webdriver from 4.9.0 to 4.10.0 (#21991)
Bumps [selenium-webdriver](https://github.com/SeleniumHQ/selenium) from 4.9.0 to 4.10.0.
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.9.0...selenium-4.10.0)

---
updated-dependencies:
- dependency-name: selenium-webdriver
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 09:07:52 +08:00
dependabot[bot] 65aacc1775
Build(deps): Bump redis-namespace from 1.10.0 to 1.11.0 (#22028)
Bumps [redis-namespace](https://github.com/resque/redis-namespace) from 1.10.0 to 1.11.0.
- [Release notes](https://github.com/resque/redis-namespace/releases)
- [Changelog](https://github.com/resque/redis-namespace/blob/master/CHANGELOG.md)
- [Commits](https://github.com/resque/redis-namespace/compare/v1.10.0...v1.11.0)

---
updated-dependencies:
- dependency-name: redis-namespace
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 09:07:36 +08:00
Alan Guo Xiang Tan 5897709a90
DEV: Use runtime info to split test files for parallel testing (#22060)
Using the runtime information, we will be able to more efficiently group
the test files across the test processes hence leading to better
utilization of resources.
2023-06-12 09:07:17 +08:00
Alan Guo Xiang Tan b4611114f9
DEV: Use `concat-class` helper when setting class for `DButton` (#21998)
Why this change?

Currently, we're interpolating within a string to set the class for the
`DButton` component. However, the interpolation and formatting of our
handlebars templates result in unnecessary spaces being added to the
class attribute.

```
<button class="sidebar-section-header sidebar-section-header-collapsable btn-flat

    btn
    no-text
    " aria-controls="sidebar-section-content-categories" aria-expanded="true" title="Toggle section" type="button">
  ...
</button>
```

This makes the HTML elements for buttons hard to read especially when
we're debugging issues in the console. After this change, this is what
we get:

```
<button class="sidebar-section-header sidebar-section-header-collapsable btn-flat btn no-text" aria-controls="sidebar-section-content-categories" aria-expanded="true" title="Toggle section" type="button">
   ...
</button>
```
2023-06-12 08:29:21 +08:00
dependabot[bot] 7dab8e7e22
Build(deps): Bump parser from 3.2.2.1 to 3.2.2.3 (#22030)
Bumps [parser](https://github.com/whitequark/parser) from 3.2.2.1 to 3.2.2.3.
- [Changelog](https://github.com/whitequark/parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/whitequark/parser/compare/v3.2.2.1...v3.2.2.3)

---
updated-dependencies:
- dependency-name: parser
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 08:02:44 +08:00
dependabot[bot] 1a24739c9f
Build(deps): Bump sass-embedded from 1.62.1 to 1.63.3 (#22057)
Bumps [sass-embedded](https://github.com/ntkme/sass-embedded-host-ruby) from 1.62.1 to 1.63.3.
- [Commits](https://github.com/ntkme/sass-embedded-host-ruby/compare/v1.62.1...v1.63.3)

---
updated-dependencies:
- dependency-name: sass-embedded
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 08:01:01 +08:00
dependabot[bot] ef72d6faf3
Build(deps): Bump jwt from 2.7.0 to 2.7.1 (#22054)
Bumps [jwt](https://github.com/jwt/ruby-jwt) from 2.7.0 to 2.7.1.
- [Release notes](https://github.com/jwt/ruby-jwt/releases)
- [Changelog](https://github.com/jwt/ruby-jwt/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jwt/ruby-jwt/compare/v2.7.0...v2.7.1)

---
updated-dependencies:
- dependency-name: jwt
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 08:00:29 +08:00
dependabot[bot] 31a764bb24
Build(deps-dev): Bump mocha from 2.0.2 to 2.0.4 (#22055)
Bumps [mocha](https://github.com/freerange/mocha) from 2.0.2 to 2.0.4.
- [Changelog](https://github.com/freerange/mocha/blob/main/RELEASE.md)
- [Commits](https://github.com/freerange/mocha/compare/v2.0.2...v2.0.4)

---
updated-dependencies:
- dependency-name: mocha
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 08:00:18 +08:00
dependabot[bot] b5221a0205
Build(deps): Bump regexp_parser from 2.8.0 to 2.8.1 (#22056)
Bumps [regexp_parser](https://github.com/ammar/regexp_parser) from 2.8.0 to 2.8.1.
- [Changelog](https://github.com/ammar/regexp_parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ammar/regexp_parser/compare/v2.8.0...v2.8.1)

---
updated-dependencies:
- dependency-name: regexp_parser
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 08:00:07 +08:00
dependabot[bot] 010882c44e
Build(deps-dev): Bump capybara from 3.39.1 to 3.39.2 (#22058)
Bumps [capybara](https://github.com/teamcapybara/capybara) from 3.39.1 to 3.39.2.
- [Changelog](https://github.com/teamcapybara/capybara/blob/master/History.md)
- [Commits](https://github.com/teamcapybara/capybara/compare/3.39.1...3.39.2)

---
updated-dependencies:
- dependency-name: capybara
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 07:59:55 +08:00
dependabot[bot] 239942d726
Build(deps-dev): Bump sass from 1.62.1 to 1.63.3 in /app/assets/javascripts (#22059)
Bumps [sass](https://github.com/sass/dart-sass) from 1.62.1 to 1.63.3.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.62.1...1.63.3)

---
updated-dependencies:
- dependency-name: sass
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-12 07:59:44 +08:00
Penar Musaraj 1abfe2e61d
UX: Small spacing fix for grid items (#21979)
Supports spacing for videos and placeholder elements.
2023-06-09 15:28:50 -04:00
Kris ae8347d948
UX: minor #mention style adjustments (#22048) 2023-06-09 15:08:54 -04:00
Daniel Waterworth 0cec84206e
DEV: Fix interactions between tests via plugin svg sprite cache (#22047) 2023-06-09 13:53:21 -05:00
Joffrey JAFFEUX bf07845714
PERF: drop throttling from resize node (#22046)
This is actually making things more sluggish than necessary. If any perf issue happen out of this they should be handled in the consequences of the resizing, not the resizing itself.
2023-06-09 20:30:41 +02:00
Joffrey JAFFEUX 737e007f01
Revert "FIX: attempts to exit lock-on early (#21949)" (#22045)
This reverts commit ad0a8cccc8.
2023-06-09 20:06:34 +02:00
Joffrey JAFFEUX 99f0ace229
DEV: implements styleguide for chat header icon (#22033)
This commit also uses this opportunity to change component name from: `ChatHeaderIcon` to `Chat::Header::Icon`
2023-06-09 18:40:34 +02:00
Kris 6e395786bf
UX: increase contrast of "more" sidebar dropdown (#22044) 2023-06-09 12:38:44 -04:00
Meghna 124de2ba7c
UX: list group label indicator should match existing design (#21999)
* UX: list group label indicator should match existing design

* better formatting

* add slight left margin
2023-06-09 21:30:34 +05:30
Joffrey JAFFEUX 41fb88c7e0
FIX: scroll top after chat activation (#21952)
Currently navigating a long topic and then opening chat would cause the view to be scrolled to the bottom. Using `scrollTop` here ensures we correctly scroll to top.

This had been incorrectly moved into `deactivate` during another change.
2023-06-09 17:51:35 +02:00
Joffrey JAFFEUX 89d7b1861d
FIX: various mobile optimizations (#22043)
* FIX: increases resize observer throttle delay
25ms is not necessary and was sometimes causing jankyness.

* FIX: removes ios momentum fix delay
Instead of a 50ms, simply use next+schedule("afterRender") to attempt to have the shortest delay possible.

* FIX: backdrop event propagation
Prevents backdrop touch to propagate to underlying channel/thread.

* UX: adds is-active class to container of active message
This change allows to keep the background on the active message while the actions menu is displayed.

* FIX: prevents skip-link to be selected on press

* UX: allows to close actions menu instantly
The backdrop should always receive events, we don't need to wait for the menu to be fully displayed.

* UI: adds spacing between last message and composer

* UI: makes backdrop less dark

* FIX: makes events passive on long-press modifier
2023-06-09 17:37:26 +02:00