439cc5b023
What is the problem here? In multiple controllers, we are accepting a `limit` params but do not impose any upper bound on the values being accepted. Without an upper bound, we may be allowing arbituary users from generating DB queries which may end up exhausing the resources on the server. What is the fix here? A new `fetch_limit_from_params` helper method is introduced in `ApplicationController` that can be used by controller actions to safely get the limit from the params as a default limit and maximum limit has to be set. When an invalid limit params is encountered, the server will respond with the 400 response code. |
||
|---|---|---|
| .. | ||
| app | ||
| assets | ||
| config | ||
| db | ||
| lib | ||
| public | ||
| spec | ||
| test/javascripts | ||
| README.md | ||
| plugin.rb | ||
README.md
⚠️ This plugin is still in active development and may change frequently
Documentation
The Discourse Chat plugin adds chat functionality to your Discourse so it can natively support both long-form and short-form communication needs of your online community.
For documentation, see Discourse Chat
Plugin API
registerChatComposerButton
Usage
api.registerChatComposerButton({ id: "foo", ... });
Options
Every option accepts a value or a function, when passing a function this will be the chat-composer component instance. Example of an option using a function:
api.registerChatComposerButton({
id: "foo",
displayed() {
return this.site.mobileView && this.canAttachUploads;
},
});
Required
idunique, used to identify your button, eg: "gifs"actioncallback when the button is pressed, can be an action name or an anonymous function, eg: "onFooClicked" or() => { console.log("clicked") }
A button requires at least an icon or a label:
icon, eg: "times"label, text displayed on the button, a translatable key, eg: "foo.bar"translatedLabel, text displayed on the button, a string, eg: "Add gifs"
Optional
position, can be "inline" or "dropdown", defaults to "inline"title, title attribute of the button, a translatable key, eg: "foo.bar"translatedTitle, title attribute of the button, a string, eg: "Add gifs"ariaLabel, aria-label attribute of the button, a translatable key, eg: "foo.bar"translatedAriaLabel, aria-label attribute of the button, a string, eg: "Add gifs"classNames, additional names to add to the button’s class attribute, eg: ["foo", "bar"]displayed, hide/or show the button, expects a booleandisabled, sets the disabled attribute on the button, expects a booleanpriority, an integer defining the order of the buttons, higher comes first, eg:700dependentKeys, list of property names which should trigger a refresh of the buttons when changed, eg:["foo.bar", "bar.baz"]