f4f8a293e7
FEATURE: Implement 2factor login TOTP
...
implemented review items.
Blocking previous codes - valid 2-factor auth tokens can only be authenticated once/30 seconds.
I played with updating the “last used” any time the token was attempted but that seemed to be overkill, and frustrating as to why a token would fail.
Translatable texts.
Move second factor logic to a helper class.
Move second factor specific controller endpoints to its own controller.
Move serialization logic for 2-factor details in admin user views.
Add a login ember component for de-duplication
Fix up code formatting
Change verbiage of google authenticator
add controller tests:
second factor controller tests
change email tests
change password tests
admin login tests
add qunit tests - password reset, preferences
fix: check for 2factor on change email controller
fix: email controller - only show second factor errors on attempt
fix: check against 'true' to enable second factor.
Add modal for explaining what 2fa with links to Google Authenticator/FreeOTP
add two factor to email signin link
rate limit if second factor token present
add rate limiter test for second factor attempts
2018-02-21 09:04:07 +08:00
b4aa0b096e
FIX: Couldn't like staff when `allow_flagging_staff` was set
2018-02-14 15:46:04 -05:00
4dfe659189
Rename `allow staff flags` to `allow flagging staff`
2018-02-12 15:27:26 -05:00
6287631745
FEATURE: New site setting, `allow staff flags`, false by default
...
For some large communities, it makes sense to disable flagging of
staff posts.
2018-02-12 14:56:21 -05:00
932a1a1187
Remove use of deprecated site setting.
2018-02-12 14:26:22 +08:00
dedeb2deb8
FIX: Don't show the link button in the composer if linking is disabled
2018-02-08 12:56:10 -05:00
b2b6dc68a6
FEATURE: a setting to customize the minimum TL to flag a post
2018-02-06 17:12:27 -05:00
2f19588311
FIX: If personal messages are disabled, don't show messages for groups
2018-02-02 16:35:54 -05:00
ff0376a80b
rename 'enable_private_messages' to 'enable_personal_messages'
2018-02-01 13:25:29 +05:30
9721fb7573
Linting
2018-01-26 14:35:04 -05:00
6b04967e2f
FEATURE: Staff members can lock posts
...
Locking a post prevents it from being edited. This is useful if the user
has posted something which has been edited out, and the staff members don't
want them to be able to edit it back in again.
2018-01-26 14:01:30 -05:00
782d75069e
FIX: UX improvements for system messages when PMs are disabled
2018-01-23 13:12:11 -05:00
1f14350220
Rename "Blocked" to "Silenced"
2017-11-10 14:10:27 -05:00
9dc9ca4ac0
FIX: be consistent with how first posts in topics are counted. do like DirectoryItem.refresh_period :all
2017-11-10 12:18:25 -05:00
fb5b9b6d06
FIX: don't offer the "Something Else" flag reason to TL0 users since they don't have permission to send private messages
2017-10-24 11:47:42 -04:00
838568cbc3
Refactor flag types for more customization
2017-10-19 13:55:23 -04:00
25c25ae423
FEATURE: Allow user to leave a PM.
2017-10-19 12:32:55 +08:00
79f3d299a1
Don't allow category definition topics to be converted to PMs ( #5216 )
2017-10-02 10:04:58 +02:00
561fa7d0cd
FEATURE: Site Setting to hide suspension reason on the public profile
2017-09-25 12:25:14 -04:00
5d4221fbe1
PERF: Avoid calling expensive `PostGuardian#can_see_post?` multiple times.
...
Before
```
Your Results: (note for timings- percentile is first, duration is second
in millisecs)
---
topic_admin:
50: 19
75: 19
90: 21
99: 27
topic:
50: 56
75: 62
90: 64
99: 99
timings:
load_rails: 1262
ruby-version: 2.4.1-p111
rss_kb: 198432
pss_kb: 136612
virtual: physical
architecture: amd64
operatingsystem: Ubuntu
memorysize: 15.59 GB
kernelversion: 4.10.0
physicalprocessorcount: 1
processor0: Intel(R) Core(TM) i7-6700K CPU @ 4.00GHz
rss_kb_9877: 327892
pss_kb_9877: 263671
rss_kb_9946: 325468
pss_kb_9946: 261671
rss_kb_10153: 326456
pss_kb_10153: 262657
```
After
```
Your Results: (note for timings- percentile is first, duration is second
in millisecs)
---
topic_admin:
50: 18
75: 18
90: 20
99: 28
topic:
50: 41
75: 42
90: 46
99: 49
timings:
load_rails: 1201
ruby-version: 2.4.1-p111
rss_kb: 187936
pss_kb: 123596
virtual: physical
architecture: amd64
operatingsystem: Ubuntu
memorysize: 15.59 GB
kernelversion: 4.10.0
physicalprocessorcount: 1
processor0: Intel(R) Core(TM) i7-6700K CPU @ 4.00GHz
rss_kb_26478: 342360
pss_kb_26478: 276696
rss_kb_26547: 340368
pss_kb_26547: 275930
rss_kb_26747: 338964
pss_kb_26747: 274466
```
2017-09-08 14:07:24 +08:00
5012d46cbd
Add rubocop to our build. ( #5004 )
2017-07-28 10:20:09 +09:00
addc85cd08
FIX: Don't let users edit wiki posts unless they can reply
2017-05-08 16:23:11 -04:00
a28704bcee
FIX: Can't recover a post when its user has been deleted.
...
https://meta.discourse.org/t/moving-posts-to-new-topic/58436
2017-03-06 14:29:06 +08:00
c76f6856ea
FEATURE: reply as new message to the same recipients
2017-01-27 12:24:31 +08:00
5d7f3223f0
SECURITY: Users can only bookmark posts which they can see.
2016-12-21 12:01:26 +08:00
c75bebdea2
FIX: uncategorized setting to control whether topic featured links are allowed
2016-12-20 15:55:30 -05:00
923cf73c6e
Topic Featured Links: move data from custom fields to topics and categories tables. Invert behaviour of topic_featured_link_allowed checkbox. Fix a bug with invalid topic records due to changing that category checkbox.
2016-12-19 14:54:07 -05:00
05f55dbc10
FEATURE: Group logs.
2016-12-12 17:29:54 +08:00
52763f5115
FEATURE: Allow posting a link with topics
2016-12-05 17:20:54 +01:00
3aa22715af
A new guard for changing post timestamps called can_change_post_timestamps?
2016-11-06 20:14:09 +01:00
674264726d
FIX: should not be allowed to see users list of people who started a PM
2016-10-19 17:36:35 +11:00
4d8d5613e4
FEATURE: add min_trust_level_to_edit_post
...
add minimum trust level to edit post (default 0)
2016-10-01 02:12:27 +10:00
e78b7a243e
FIX: Don't enqueue posts if the user can't create them (ex: closed)
2016-09-09 12:15:56 -04:00
46b34e3c62
FEATURE: remove user option for edit history public
...
Users can no longer opt-in for "public" edit history
if site owner disables it.
This feature adds cost and complexity to post rendering since
user options need to be premeptively loaded for every user in the
stream. It is also confusing to explain to communities with private edit
history.
2016-07-16 21:30:00 +10:00
b65f2fc565
we can't see a nil category
2016-07-02 12:21:14 +02:00
5eda2f43c6
small topic/category guardians refactor
2016-06-27 14:36:57 +02:00
800081f606
FIX: staged users weren't able to reply in restricted categories
2016-06-26 19:25:45 +02:00
f3f6c2f98f
FEATURE: tag groups
2016-06-06 14:18:48 -04:00
0f8b4dcc86
FIX: trust level 3 should not be able to edit topics in categories that restrict them from doing so
2016-06-01 15:42:10 -04:00
1e57bbf5c8
Lots bounce emails related fixes
...
- Show bounce score on user admin page
- Added reset bounce score button on user admin page
- Only whitelisted email types are sent to emails with high bounce score
- FIX: properly detect bounces even when there is no TO: header in the email
- Don't desactivate a user when reaching the bounce threshold
2016-05-06 19:34:33 +02:00
b25d950d99
FEATURE: allow moderators to convert a private message to public topic or vice versa
2016-05-04 22:47:32 +05:30
acfb540952
FEATURE: move a topic from PM to regular topic or vice versa
2016-05-02 21:34:05 +05:30
9e50f36c50
Merge pull request #4137 from cpradio/add-warning-to-flag
...
FEATURE: Add warning input to flag dialog when notifying a user
2016-04-15 16:23:22 +10:00
8ba57c0ffd
FIX: restrict moderators from creating/editing topics in readonly categories
...
In the past moderators had blanket access to all categories they were allowed
to see. This tightens down the restriction.
2016-04-13 15:59:38 +10:00
95fa340601
Added spec tests
2016-04-03 19:44:14 -04:00
094f7a73d5
FIX: allow post editing but do not allow ninja edit for active flagged post
2016-03-31 00:11:08 +05:30
6f0137dec9
FEATURE: disable post editing when the post has active flag
2016-03-30 23:28:49 +05:30
3e32393ab6
FIX: do not allow normal users to wiki edit-expired posts
2016-03-15 15:05:57 +05:30
415efd0f5b
FIX: staged user doesn't get notified for replies in topics they created in secured categories
2016-02-24 11:30:17 +01:00
3829c78526
PERF: shift most user options out of the user table
...
As it stands we load up user records quite frequently on the topic pages,
this in turn pulls all the columns for the users being selected, just to
discard them after they are loaded
New structure keeps all options in a discrete table, this is better organised
and allows us to easily add more column without worrying about bloating the
user table
2016-02-17 18:08:25 +11:00
106e3c897f
FIX: TL3 users should not be able to edit title of archived topics
2016-01-29 01:16:41 +05:30
685ba1eb7f
FEATURE: blocked users can send and reply to private messages from staff
2016-01-22 12:54:24 -05:00
06bac23e5f
FEATURE: allow users to wikify their own posts based on trust level
2016-01-12 08:44:25 +05:30
3aa5129f54
FEATURE: allow group members to see all messages on group page
2015-12-07 23:19:33 +01:00
6dd4bc7d57
FEATURE: support group owner, capable of controlling group membership
...
Group owners are regular users that can add or remove users to a group
The Admin UX allows admins to appoint group owners
The public group UX will display group owners first and unlock UI to
add and remove members
Group owners can only be appointed on non automatic groups
Group owners may not appoint another group owner
2015-11-10 00:56:57 +11:00
e29fe77b45
FEATURE: make trust level for message sending configurable
...
- add min_trust_to_send_messages site setting (default 1) to allow admins
to configure when messages can be sent between members
2015-10-12 11:15:48 +11:00
a61765b9e4
PERF: improve perf of initial payload
...
also reduce querying in topic query
2015-09-23 13:13:50 +10:00
4f7140fb32
FIX: properly filter whispers in user stream
2015-09-22 00:50:52 +02:00
c9e4745fe8
FIX: Return 410 Gone for deleted topics you could otherwise see
2015-09-18 00:14:43 -07:00
5af0f5f80e
FEATURE: Whisper posts
2015-09-11 14:05:21 -04:00
d5a2029026
FIX: category permissions weren't properly loaded when /categories is the homepage
...
FIX: don't scope to a specific category when creating a new topic from /categories
2015-09-07 18:52:53 +02:00
f9069c350f
FIX: Permission issues when editing topics
...
If a user can't create a topic in a category, they should'be be
able to edit topics.
2015-04-30 17:08:12 -04:00
a737090442
- FEATURE: revamped poll plugin
...
- add User.staff scope
- inject MessageBus into Ember views (so it can be used by the poll plugin)
- REFACTOR: use more accurate is_first_post? method instead of post_number == 1
- FEATURE: add support for JSON-typed custom fields
- FEATURE: allow plugins to add validation
- FEATURE: add post_custom_fields to PostSerializer
- FEATURE: allow plugins to whitelist post_custom_fields
- FIX: don't bump when post did not save successfully
- FEATURE: polls are supported in any post
- FEATURE: allow for multiple polls in the same post
- FEATURE: multiple choice polls
- FEATURE: rating polls
- FEATURE: new dialect allowing users to preview polls in the composer
2015-04-23 19:33:29 +02:00
19a9a8b408
`NewPostManager` determines whether to queue a post or not
2015-04-15 14:54:36 -04:00
4bfca12b11
FEATURE: anonymous_account_duration_minutes , cycle anon accounts after N minutes from last post
...
fixes it so anon users can not like stuff
2015-04-08 12:30:02 +10:00
608647d02f
FEATURE: Anonymize User. A way to remove a user but keep their topics and posts.
2015-03-10 11:59:08 -04:00
1c0658e204
FIX: People could retitle restricted topics
...
Sort of a security fix but not really
2015-02-25 21:09:53 -08:00
1a070b16e4
FIX: use the 'post edit time limit' for topics too
2015-02-25 20:53:21 +01:00
e207ca36ee
Easier helper for filtering secured categories
2015-02-12 11:52:59 -05:00
14a8b3e29c
FIX: In case a topic is deleted, allow us to serialize their posts
2015-02-03 14:51:50 -05:00
b413c6249d
FIX: allow TL4 user to rebake post
2015-02-03 22:49:01 +05:30
a2b284a0a4
table & model changes for group managers with permission to edit membership
2015-01-15 11:44:42 -08:00
6cec925f26
FIX: all PMs should be flaggable
2015-01-08 16:06:43 +01:00
e20078a9dc
PERF: fix performance issue when displaying the user card for admins
2015-01-05 19:49:32 +01:00
3cb25b019e
FIX: when private messages are disabled in settings, flag modal shouldn't show private message options
2014-12-19 16:47:39 -05:00
07211489f0
FIX: hide restricted profile info from TL0 users to anonymous in 'JS-off' page
2014-11-27 19:51:13 +01:00
a036ac7bdc
FIX: users can see the raw email source of their own posts
2014-11-12 14:49:42 +01:00
e7f251c105
LOTS of changes to properly handle post/topic revisions
...
FIX: history revision can now properly be hidden
FIX: PostRevision serializer is now entirely dynamic to properly handle
hidden revisions
FIX: default history modal to "side by side" view on mobile
FIX: properly hiden which revision has been hidden
UX: inline category/user/wiki/post_type changes with the revision
details
FEATURE: new '/posts/:post_id/revisions/latest' endpoint to retrieve
latest revision
UX: do not show the hide/show revision button on mobile (no room for
them)
UX: remove CSS transitions on the buttons in the history modal
FIX: PostRevisor now handles all the changes that might create new
revisions
FIX: PostRevision.ensure_consistency! was wrong due to off by 1
mistake...
refactored topic's callbacks for better readability
extracted 'PostRevisionGuardian'
2014-10-27 22:06:43 +01:00
72873b8368
further optimize raw email feature
2014-10-18 00:50:02 +05:30
19d5362c6b
FEATURE: ability to hide or show specific post revisions
2014-10-14 07:19:45 -07:00
7e309a21cf
FEATURE: hide emails behind a button for staff members
2014-09-29 22:31:05 +02:00
0b13f6572f
FEATURE: staff option to unhide a post
2014-09-22 18:55:13 +02:00
309b67add4
FIX: If a post has been hidden due to flagging, don't use the absolute
...
edit window for edit prevention.
2014-09-16 11:21:14 -04:00
e56fcf0c43
FEATURE: add 'rebake post' in post wrench menu
2014-09-11 16:04:40 +02:00
0f585bcdbe
FIX: PM should never be allowed to have a category
...
FIX: TL3 should not be allowed to muck with PM titles
2014-09-11 17:39:34 +10:00
18f8038015
FEATURE: add new 'convert to staff message' in post wrench menu
2014-09-10 23:08:33 +02:00
69bc552054
FEATURE: Actually show more notifications
...
The "Show more notifications..." link in the notifications dropdown now
links to /my/notifications, which is a historical view of all
notifications you have recieved.
Notification history is loaded in blocks of 60 at a time.
Admins can see others' notification history. (This was requested for
'debugging purposes', though that's what impersonation is for, IMO.)
2014-09-09 16:29:08 -07:00
59d04c0695
Internal renaming of elder,leader,regular,basic to numbers
...
Changed internals so trust levels are referred to with
TrustLevel[1], TrustLevel[2] etc.
This gives us much better flexibility naming trust levels, these names
are meant to be controlled by various communities.
2014-09-05 15:20:52 +10:00
05d2083796
FIX: can delete category if topic_count < 0
2014-08-22 12:25:28 -04:00
2f32af3941
FIX: staff should be able to edit topics that have been archived
2014-08-15 12:45:05 -04:00
0e5ab97a87
BUG: staff should not be allowed to edit emails when email_editable is false
2014-08-15 12:41:01 +10:00
5caf72510c
Prevent deleting the static page doc topics
2014-08-13 17:03:45 -04:00
3ae1ebdfc3
FIX: use PostDestroyer when deleting/recovering a topic
2014-08-07 19:12:35 +02:00
6eaaf6714c
FIX: logic for can_see_topic?
2014-08-05 14:37:53 +10:00
e7e70d14da
Merge pull request #2591 from BenLubar/benlubar-edit-history-public
...
add profile option for edit history visibility
2014-07-30 14:09:10 +10:00
fc22127726
FIX: only admin can edit faq, tos, and privacy policy
2014-07-29 10:40:09 -04:00
bddffa7f9a
FEATURE: flag dispositions normalization
...
All flags should end up in one of the three dispositions
- Agree
- Disagree
- Defer
In the administration area, the *active* flags section displays 4 buttons
- Agree (hide post + send PM)
- Disagree
- Defer
- Delete
Clicking "Delete" will open a modal that offer to
- Delete Post & Defer Flags
- Delete Post & Agree with Flags
- Delete Spammer (if available)
When the flag has a list associated, the list will now display 1
response and 1 reply and a "show more..." link if there are more in the
conversation. Replying to the conversation will NOT give a disposition.
Moderators must click the buttons that does that.
If someone clicks one buttons, this will add a default moderator message
from that moderator saying what happened.
The *old* flags section now displays the proper dispositions and is
super duper fast (no more N+9999 queries).
FIX: the old list includes deleted topics
FIX: the lists now properly display the topic states (deleted, closed,
archived, hidden, PM)
FIX: flagging a topic that you've already flagged the first post
2014-07-28 19:28:07 +02:00
ac8c2e1e07
discourse#2591
2014-07-27 12:12:36 -05:00
44dc4b4a17
add profile option for edit history, visible only when edit history is disabled globally.
2014-07-26 23:04:46 -05:00
19b757b058
FEATURE: Hide deleted posts by default for staff
2014-07-17 10:40:15 -07:00
5c70d878a7
FEATURE: show a reason why a category can't be deleted
2014-07-16 15:43:51 -04:00
7dcf2a2c4f
FEATURE: show the user's flagged/deleted posts
2014-07-16 21:04:55 +02:00
ee1d78c73e
BUGFIX: edit history on wiki posts should be visible
2014-06-26 19:19:35 +02:00
a2fec165d5
Disable editing of hidden posts within a timeframe from when the post
...
was initially hidden.
2014-06-20 15:38:03 -04:00
faed17aa18
Moderators should always be able to create topics too
2014-06-09 15:28:03 -04:00
4d50d0d109
FIX: admins should be able to create topics, even if min_trust_to_create_topic is higher than their trust level
2014-06-09 11:03:21 -04:00
960d64930c
Wiki Post
2014-05-13 08:53:11 -04:00
e68e97d986
FIX: moderators can't see private topics that they aren't invited to see.
2014-05-12 15:26:46 -04:00
fca6738212
BUGFIX: could not see the revisions of a post in a deleted topic
2014-05-12 16:30:10 +02:00
ba0084edee
FEATURE: vanilla import
2014-04-18 18:42:31 +02:00
91bfd47419
FIX: don't show contents of hidden posts when quoting the post and when replying as new topic. Also don't allow public to view edit history of hidden posts.
2014-04-15 12:49:08 -04:00
d08973d60e
improve logic for mod category management
2014-04-15 16:49:22 +10:00
b7caa33841
Site setting to allow mods to create categories
2014-04-15 16:42:45 +10:00
1540a3d5e5
Allow changing ownwership of posts by admins
2014-04-08 01:47:42 -07:00
2c725e2779
FEATURE: Trust level 4 abilities: pin/unpin, close, archive, make invisible, split/merge topic
2014-03-17 14:50:28 -04:00
e904b2faad
Adding name to the list of uneditable items in preferences UI
...
* If enable_names, enable_sso, and sso_overrides_name settings are true.
* Added serialization of can_edit_name so the UI has access to the right.
2014-03-13 13:26:40 -07:00
fd1c824187
Revert "Merge pull request #2116 from LessonPlanet/disable-name-edit-for-sso"
...
This reverts commit 91aa21671af19596af0d
2014-03-13 18:17:59 +01:00
283dc7dd2d
Trust level 4: add ability to edit any post and see edit history
2014-03-13 10:47:49 -04:00
e8c7c6fab7
Adding name to the list of uneditable items in preferences UI
...
* If enable_names, enable_sso, and sso_overrides_name settings are true.
2014-03-12 17:09:53 -07:00
2838e1c3b5
FIX: don't show option to flag with notify_user to trust level 0 users. they can't send private messages.
2014-03-10 11:48:40 -04:00
23d7b17f1a
Disabled editing of SSO overridden fields
2014-03-08 01:16:49 -05:00
b696c96a19
Look at the age of a user's first post to determine if the user can be nuked, instead of looking at when the user registered.
2014-02-20 12:29:40 -05:00
8711762143
Users who have made no more than one post can delete their own accounts from their user preferences page.
2014-02-13 13:52:06 -05:00
f73a3f252a
FIX: Don't allow parent categories to be deleted. Also, remove
...
duplicated logic and rely on the server response for `can_delete`
status.
2014-02-12 17:24:25 -05:00
d9c05fcfc8
SECURITY: dissalow mods from seeing PMs
2014-02-07 14:24:19 +11:00
93434be16d
SECURITY: reduce moderator rights
...
You can now hide particular categories from certain moderators
2014-02-07 14:11:52 +11:00
4fb274fb9d
BUGFIX: history link doesn't work on deleted posts
2014-02-04 20:05:50 +01:00
1fd71bb237
BUGFIX: make the system_user an elder (TL=4)
...
Otherwise it won't be able to create topic when the `min_trust_to_create_topic` is > 0
2014-01-21 15:21:38 +01:00
8c29ed870e
Non-staff users may not delete their posts in archived topics.
2014-01-17 17:42:12 -05:00
7c8ea8c166
Trust level 3 users can edit topic titles and change category
2014-01-16 11:59:26 -05:00
89908cdb47
Admins don't see uncategorized on /categories if it has no topics and allow_uncategorized_topics is false
2014-01-15 14:11:36 -05:00
ffb29dea77
Refactor guardian as dissused in this topic https://meta.discourse.org/t/so-you-want-to-help-out-with-discourse/3823/41?u=hunter
...
Creates a mixin for the ensure_* functions and creates seperate mixins for functions dealing with posts, categories, and topics.
2014-01-10 21:22:54 -06:00
Jeff Wong
Robin Ward
Guo Xiang Tan
Arpit Jalan
Neil Lalonde
OsamaSayegh
Guo Xiang Tan
Leo McArdle
Erick Guan
Kiffin Gish
Sam
Régis Hanol
cpradio
Kane York
Jason W. May
David McClure
Ben Lubar
Wojciech Zawistowski
Forest Carlisle
Douglas Browne
Patrick