discourse/spec
Martin Brennan 61c87fb59f
FIX: Properly attach secure images to email for non-secure uploads (#23865)
There are cases where a user can copy image markdown from a public
post (such as via the discourse-templates plugin) into a PM which
is then sent via an email. Since a PM is a secure context (via the
.with_secure_uploads? check on Post), the image will get a secure
URL in the PM post even though the backing upload is not secure.

This fixes the bug in that case where the image would be stripped
from the email (since it had a /secure-uploads/ URL) but not re-attached
further down the line using the secure_uploads_allow_embed_images_in_emails
setting because the upload itself was not secure.

The flow in Email::Sender for doing this is still not ideal, but
there are chicken and egg problems around when to strip the images,
how to fit in with other attachments and email size limits, and
when to apply the images inline via Email::Styles. It's convoluted,
but at least this fixes the Template use case for now.
2023-10-17 14:08:21 +10:00
..
fabricators FEATURE: granular webhooks (#23070) 2023-10-09 03:35:31 +00:00
fixtures SECURITY: Reduce maximum size of SVG sprite cache to prevent DoS 2023-09-12 15:31:28 -03:00
helpers DEV: Update application_helper_spec following 1bd00076 (#23413) 2023-09-05 20:56:03 +01:00
import_export DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
initializers DEV: Fix test (#22018) 2023-06-08 16:12:13 -05:00
integration DEV: Prevent videos from preloading metadata (#23807) 2023-10-12 13:47:48 -06:00
integrity DEV: Remove enable_experimental_hashtag_autocomplete logic (#22820) 2023-08-08 11:18:55 +10:00
jobs FEATURE: option to automatically delete unused tags (#23864) 2023-10-11 23:58:56 +00:00
lib FIX: Properly attach secure images to email for non-secure uploads (#23865) 2023-10-17 14:08:21 +10:00
mailers FIX: Order tags shown in email subject by topics count and name (#22586) 2023-07-13 15:39:58 +08:00
migrations DEV: Switch over category settings to new table - Part 3 (#20657) 2023-09-12 09:51:49 +08:00
models FIX: Properly attach secure images to email for non-secure uploads (#23865) 2023-10-17 14:08:21 +10:00
multisite DEV: Add S3 upload system specs using minio (#22975) 2023-08-23 11:18:33 +10:00
requests SECURITY: Prevent arbitrary topic custom fields from being set 2023-10-16 10:34:35 -04:00
script/import_scripts DEV: Fix flaky core backend spec (#22650) 2023-07-18 07:01:19 +08:00
serializers DEV: Add UI for passkeys (3/3) (#23853) 2023-10-13 12:24:06 -04:00
services DEV: Add failing test for pull-hotlinked codeblocks (#23682) 2023-09-29 09:55:51 +01:00
support DEV: Replace custom Onebox symbolize_keys implementation with ActiveSupport (#23828) 2023-10-09 09:32:09 +02:00
system UX: improve touch, swipe, panning performance on mobile menus (#23775) 2023-10-16 11:27:00 -07:00
tasks DEV: Add gjs support for themes (#23473) 2023-10-02 12:36:06 +02:00
views DEV: Fix random typos (#22078) 2023-06-13 22:02:21 +02:00
rails_helper.rb DEV: Allow Capybara's server port to be configurable (#23606) 2023-09-15 11:46:03 +08:00
regenerate_swagger_docs DEV: Add API docs for uploads and API doc watcher (#15387) 2021-12-23 08:40:15 +10:00
swagger_helper.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00