Commit Graph

44777 Commits

Author SHA1 Message Date
David Taylor ec7efbde1a
DEV: Update to Sprockets 4.0 (#16459)
The main difference is that Sprockets 4.0 no longer tries to compile everything by default. This is good for us, because we can remove all our custom 'exclusion' logic which was working around the old sprockets 3.0 behavior.

The other big change is that lambdas can no longer be added to the `config.assets.precompile` array. Instead, we can do the necessary globs ourselves, and add the desired files manually.

A small patch is required to make ember-rails compatible. Since we plan to remove this dependency in the near future, I do not intend to upstream this change.

I have compared the `bin/rake assets:precompile` output before and after this change, and verified that all files are present.
2022-04-13 10:21:59 +01:00
Alan Guo Xiang Tan 6fc52d95de DEV: Remove scoped order warning in PostDestroyer.
`Scoped order is ignored, it's forced to be batch order.`

`find_each` ignores the `order` scope and triggers a warning in
production which is noisy.

Follow-up to 7a284164ce
2022-04-13 09:34:36 +08:00
awesomerobot a47efcd6ec DEV: user-preference-page class on solo-perference 2022-04-13 09:32:58 +08:00
dependabot[bot] 7f2743b4b8 Build(deps): Bump parser from 3.1.1.0 to 3.1.2.0
Bumps [parser](https://github.com/whitequark/parser) from 3.1.1.0 to 3.1.2.0.
- [Release notes](https://github.com/whitequark/parser/releases)
- [Changelog](https://github.com/whitequark/parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/whitequark/parser/compare/v3.1.1.0...v3.1.2.0)

---
updated-dependencies:
- dependency-name: parser
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-04-13 09:30:23 +08:00
dependabot[bot] 55a2bc6b57 Build(deps): Bump public_suffix from 4.0.6 to 4.0.7
Bumps [public_suffix](https://github.com/weppos/publicsuffix-ruby) from 4.0.6 to 4.0.7.
- [Release notes](https://github.com/weppos/publicsuffix-ruby/releases)
- [Changelog](https://github.com/weppos/publicsuffix-ruby/blob/main/CHANGELOG.md)
- [Commits](https://github.com/weppos/publicsuffix-ruby/compare/v4.0.6...v4.0.7)

---
updated-dependencies:
- dependency-name: public_suffix
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-04-13 09:27:05 +08:00
Discourse Translator Bot a1d7e77967
Update translations (#16456) 2022-04-12 21:04:30 +02:00
Isaac Janzen 5f9c98dfc1
FIX: update dark mode emails styles (#16461)
- divider sometimes is too bright
- lists have dark text on dark copy
- border around the “secure media” message is bright
2022-04-12 13:13:34 -05:00
Bianca Nenciu 86c7e07428
FEATURE: Improve screened IPs roll up and extend for IPv6 (#15585)
This commit improves the logic for rolling up IPv4 screened IP
addresses and extending it for IPv6. IPv4 addresses will roll up only
up to /24. IPv6 can rollup to /48 at most. The log message that is
generated contains the list of original IPs and new subnet.
2022-04-12 21:07:37 +03:00
Penar Musaraj 0bef5af582
DEV: Cleanup `body.scrollTop` usage (#16445)
All current browser treat the HTML document (not the body element) as
the scrollable document element. Hence in all current browsers,
`document.body.scrollTop` returns 0. This commit removes all usage of
this property, because it is effectively 0.

Co-authored-by: David Taylor <david@taylorhq.com>
2022-04-12 13:23:57 -04:00
Kris 0e88cffaf4
UX: Make full topic row clickable on mobile (#16440) 2022-04-12 09:44:20 -04:00
Roman Rizzi 6f76a12e0a
FEATURE: Let sites add a sitemap.xml file. (#16357)
* FEATURE: Let sites add a sitemap.xml file.

This PR adds the same features discourse-sitemap provides to core. Sitemaps are only added to the robots.txt file if the `enable_sitemap` setting is enabled and `login_required` disabled.

After merging discourse/discourse-sitemap#34, this change will take priority over the sitemap plugin because it will disable itself. We're also using the same sitemaps table, so our migration won't try to create it
again using `if_not_exists: true`.
2022-04-12 10:33:59 -03:00
David Taylor 9c33f6de05
FIX: Ensure allowed_tags and allowed_tag_groups can be removed (#16454) 2022-04-12 11:14:29 +01:00
Alan Guo Xiang Tan e7f3702d9b SECURITY: Update Nokogiri to 1.13.4.
Nokogiri 1.13.4 updates zlib to 1.2.12 to address CVE-2018-25032.

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5
https://nvd.nist.gov/vuln/detail/CVE-2018-25032
2022-04-12 12:33:44 +08:00
Martin Brennan 9f2138dc92
FEATURE: Add a sidekiq job for syncing S3 ACLs (#16449)
Sometimes we need to update a _lot_ of ACLs on S3 (such as when secure media
is enabled), and since it takes ~1s per upload to update the ACL, this is
best spread out over many jobs instead of having to do the whole thing serially.

In future, it will be better to have a job that can be run based on
a column on uploads (e.g. acl_stale) so we can track progress, similar
to how we can set the baked_version to nil to rebake posts.
2022-04-12 14:26:42 +10:00
Alan Guo Xiang Tan 131a4674e3 Revert "Build(deps): Bump nokogiri from 1.13.3 to 1.13.4"
This reverts commit cbdf3cf8f4.

Will be commiting this as a security fix.
2022-04-12 11:40:07 +08:00
Blake Erickson 4c0a9fd4c3
FIX: Email logs not finding attached incoming email (#16446) 2022-04-11 21:22:15 -06:00
awesomerobot 264c8f5fd7 Improve docked progress position on mobile 2022-04-12 09:09:59 +08:00
awesomerobot be4699fc28 add classes to danger buttons on user admin 2022-04-12 09:09:04 +08:00
awesomerobot c4ec2049ac UX: add margin to security key button 2022-04-12 09:08:52 +08:00
dependabot[bot] cbdf3cf8f4 Build(deps): Bump nokogiri from 1.13.3 to 1.13.4
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.13.3 to 1.13.4.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/v1.13.4/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.3...v1.13.4)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-04-12 09:08:36 +08:00
Isaac Janzen 9de61f37a0
remove avatars next to 'read more' in summary email (#16439) 2022-04-11 14:07:37 -05:00
Jordan Vidrine 09ee9a6be6
UX: Less specific styling for Auth logins (#16393) 2022-04-11 12:33:09 -05:00
Isaac Janzen 6c0abe15e0
FEATURE: Add email dark mode (#16104)
implement dark mode emails when `SiteSetting.dark_mode_emails_active` is active.
2022-04-11 12:27:50 -05:00
Penar Musaraj a0ef25f4f0
DEV: Update Moment to 2.29.2 (#16423) 2022-04-11 13:27:24 -04:00
Keegan George 0a653179a5
FEATURE: Sortable json-editor items (#16403) 2022-04-11 13:24:14 -04:00
David Taylor 1e436f242e
DEV: Move tag_group cleanup from post_migrate -> migrate (#16434)
There is no need to wait until after the deploy for this cleanup. In fact, running it later will mean there could be a window of a few minutes during which the site is broken.

The only requirement is that it runs after the broken `20220401130745_create_category_required_tag_groups` migration.

Followup to 39a6de3d73
2022-04-11 13:28:24 +01:00
David Taylor 7b1686ad7d
FIX: Ensure category_required_tag_groups are destroyed with tag_groups (#16433) 2022-04-11 13:28:06 +01:00
dependabot[bot] 09c4a16b46
Build(deps): Bump rubocop from 1.26.1 to 1.27.0 (#16427)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.26.1 to 1.27.0.
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.26.1...v1.27.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-11 13:45:38 +02:00
dependabot[bot] 6db44ead15
Build(deps): Bump rubocop-ast from 1.16.0 to 1.17.0 (#16425)
Bumps [rubocop-ast](https://github.com/rubocop/rubocop-ast) from 1.16.0 to 1.17.0.
- [Release notes](https://github.com/rubocop/rubocop-ast/releases)
- [Changelog](https://github.com/rubocop/rubocop-ast/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop-ast/compare/v1.16.0...v1.17.0)

---
updated-dependencies:
- dependency-name: rubocop-ast
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-11 13:45:08 +02:00
Martin Brennan cecdef83a8
FIX: Fall back to clipboard.writeText if ClipboardItem not supported (#16419)
Firefox does not support window.ClipboardItem yet (it is behind
a flag (dom.events.asyncClipboard.clipboardItem) as at version 87.)
so we need to fall back to the normal non-async clipboard copy, that
works in every browser except Safari.

This commit also tests the clipboardCopyAsync function by stubbing out
the clipboard on the window.navigator.

This fixes an issue in the discourse-chat plugin, where the
"Quote in Topic" button errored in Firefox.
2022-04-11 13:00:45 +10:00
Alan Guo Xiang Tan f26d07c1ad DEV: Add pretender endpoint for category visible groups.
This was causing our build to become flaky.
2022-04-11 10:34:18 +08:00
Martin Brennan 6d2441041b
DEV: Minor in-progress-uploads refactor (#16430)
These calls were missed in ac672cfcc6
2022-04-11 11:50:06 +10:00
Penar Musaraj cd02ea07fc
FIX: Buggy topic scrolling on iOS 12 (#16422) 2022-04-09 09:44:36 -04:00
Rafael dos Santos Silva be519d2aec
PERF: Speed up admin user list main query (#16412)
This drops the join with the emails table since primary emails is already
on the users table.

Makes query 10x faster on large (6M+ users) sites.
2022-04-08 11:59:44 -03:00
Alan Guo Xiang Tan 0f7b9878ff SECURITY: Category group permissions leaked to normal users.
After this commit, category group permissions can only be seen by users
that are allowed to manage a category. In the past, we inadvertently
included a category's group permissions settings in `CategoriesController#show`
and `CategoriesController#find_by_slug` endpoints for normal users when
those settings are only a concern to users that can manage a category.
2022-04-08 13:46:20 +08:00
Bianca Nenciu 07d8189edd FIX: Serialize permissions for everyone group
The permissions for the 'everyone' group were not serialized because
the list of groups a user can view did not include it. This bug was
introduced in commit dfaf9831f7.
2022-04-08 09:25:29 +08:00
Alan Guo Xiang Tan 499793cbbc DEV: Remove comment that doesn't make any sense. 2022-04-08 09:21:45 +08:00
Roman Rizzi 39a6de3d73
FIX: Clean required category tag groups with invalid tag_group ids (#16414)
The category table's required_tag_group_id contained references to deleted tag groups, which we copied to the new table. The new serializer tries to get the associated tag group name but fails because the tag group is nil.

This PR adds an inner join in the original migration to make sure tag groups still exist and adds a new post-migration to fix already migrated sites.
2022-04-07 17:02:11 -04:00
David Taylor fdd4c91847 UX: Apply crawler styling to `<noscript>` content 2022-04-07 15:27:06 +01:00
David Taylor 683b172104 UX: Make header/footer HTML consistent for crawler and noscript
These were originally very similar, but have diverged over time. This makes it very difficult to manage styling.

This commit moves the noscript header and footer into partials so they can be reused in both the crawler view and the `<noscript>` view. It also makes browser-update render the noscript content **instead of** the `<section id='main'>`, rather than adding adding the noscript inside the `<section>`. This provides better parity with the server-rendered crawler view.
2022-04-07 15:27:06 +01:00
David Taylor 230e220710 UX: Make crawler view usable under different color schemes
- Ensure the set of rendered `<link rel=stylesheet>` tags is consistent
- Add var() references for all crawler-view styles. Basic color definitions are defined first, as a fallback for super old browsers
2022-04-07 15:27:06 +01:00
David Taylor e16f8a5ee6 FIX: Ensure legacy browser handling uses full <noscript> content
If the noscript tag contains a lot of data, browsers seem to split it across multiple `text` nodes, so we need to concatenate them.
2022-04-07 15:27:06 +01:00
David Taylor e9c1e3d022
DEV: Always run all three qunit partitions, even with earlier failure (#16411)
Previously, if Core QUnit 1 failed, then QUnit 2/3 wouldn't even be attempted. When dealing with multiple failures, this can make the feedback cycle. Setting `if: always()` ensures that the steps run regardless of any earlier failures. This is the same approach we take in the linting workflow.
2022-04-07 14:44:52 +01:00
David Taylor e22acaa565
DEV: Fix flaky `tags-test` (#16410)
The test was dependent on a translation string. Under certain seeds, the translation string for `{{category-drop}}`'s `noCategoriesLabel` is broken. This is because the value is calculated the first time a `{{category-drop}}` is rendered during the suite. If that first time happens to be during a test which is messing with `I18n.translations`, then it will cache a broken value. Maybe this should be fixed in a future commit... but for now moving to `data-value` will make the `tags-test` more robust and will stop the flakiness.
2022-04-07 14:39:52 +01:00
dependabot[bot] 9d9d13abf9
Build(deps): Bump msgpack from 1.5.0 to 1.5.1 (#16407)
Bumps [msgpack](https://github.com/msgpack/msgpack-ruby) from 1.5.0 to 1.5.1.
- [Release notes](https://github.com/msgpack/msgpack-ruby/releases)
- [Changelog](https://github.com/msgpack/msgpack-ruby/blob/master/ChangeLog)
- [Commits](https://github.com/msgpack/msgpack-ruby/compare/v1.5.0...v1.5.1)

---
updated-dependencies:
- dependency-name: msgpack
  dependency-type: indirect
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-07 11:37:11 +02:00
Vinoth Kannan eb628b0747
FIX: hide user notifications tab for moderator users. (#16406)
Moderators don't have access to notifications of other users. So we shouldn't display the notifications tab on other user profiles for them.

Co-authored-by: Alan Guo Xiang Tan <gxtan1990@gmail.com>
2022-04-07 14:37:37 +05:30
dependabot[bot] 1898a65a13 Build(deps): Bump msgpack from 1.4.5 to 1.5.0
Bumps [msgpack](https://github.com/msgpack/msgpack-ruby) from 1.4.5 to 1.5.0.
- [Release notes](https://github.com/msgpack/msgpack-ruby/releases)
- [Changelog](https://github.com/msgpack/msgpack-ruby/blob/master/ChangeLog)
- [Commits](https://github.com/msgpack/msgpack-ruby/compare/v1.4.5...v1.5.0)

---
updated-dependencies:
- dependency-name: msgpack
  dependency-type: indirect
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-04-07 15:48:40 +08:00
Martin Brennan 41fb4a3ca0
FIX: uppy-image-uploader and uppy-upload mixin minor issues (#16405)
Follow up to ac672cf. Fixes a
small issue with uppy-image-uploader where the Processing label
was shown for the whole upload. Also adds a couple of options to
pick-files-button to allow for it to be used in the uppy-image-uploader.

Also fixes an issue where the uppy-upload mixin was resetting prematurely
when all uploads in progress were complete, but it should have been doing
that on the uppy complete event instead.
2022-04-07 15:36:21 +10:00
Martin Brennan ac672cfcc6
DEV: Improvements to UppyUploadMixin to use ExtendableUploader (#16383)
This PR brings the `UppyUploadMixin` more into line with the `ComposerUppyUpload` mixin, by extending the `ExtendableUploader` . This also adds better tracking of and events for in progress uploads in the `UppyUploadMixin` for better UI interactions, and also opens up the use of `_useUploadPlugin` for the mixin, so anything implementing `UppyUploadMixin` can add extra uppy preprocessor plugins as needed.

This has been done as part of work on extracting uploads out of the chat composer. In future, we might be able to do the same for `ComposerUppyUpload`, getting rid of that mixin to standardise on `UppyUploadMixin` and have a separate `composer-uploads` component that lives alongside `composer-editor` like what we are doing in https://github.com/discourse/discourse-chat/pull/764
2022-04-07 12:59:06 +10:00
Kris 26b752dc24
DEV: pass user to badge page outlet (#16395) 2022-04-06 22:04:22 -04:00