Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/app/serializers
History
Martin Brennan 7c32411881
FEATURE: Secure media allowing duplicated uploads with category-level privacy and post-based access rules (#8664) 
### General Changes and Duplication

* We now consider a post `with_secure_media?` if it is in a read-restricted category.
* When uploading we now set an upload's secure status straight away.
* When uploading if `SiteSetting.secure_media` is enabled, we do not check to see if the upload already exists using the `sha1` digest of the upload. The `sha1` column of the upload is filled with a `SecureRandom.hex(20)` value which is the same length as `Upload::SHA1_LENGTH`. The `original_sha1` column is filled with the _real_ sha1 digest of the file. 
* Whether an upload `should_be_secure?` is now determined by whether the `access_control_post` is `with_secure_media?` (if there is no access control post then we leave the secure status as is).
* When serializing the upload, we now cook the URL if the upload is secure. This is so it shows up correctly in the composer preview, because we set secure status on upload.

### Viewing Secure Media

* The secure-media-upload URL will take the post that the upload is attached to into account via `Guardian.can_see?` for access permissions
* If there is no `access_control_post` then we just deliver the media. This should be a rare occurrance and shouldn't cause issues as the `access_control_post` is set when `link_post_uploads` is called via `CookedPostProcessor`

### Removed

We no longer do any of these because we do not reuse uploads by sha1 if secure media is enabled.

* We no longer have a way to prevent cross-posting of a secure upload from a private context to a public context.
* We no longer have to set `secure: false` for uploads when uploading for a theme component.
 		2020-01-16 13:50:27 +10:00
..
concerns DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
about_serializer.rb FEATURE: list category moderators on the about page (#7916) 2019-07-31 16:46:58 +03:00
admin_badge_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
admin_badges_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
admin_detailed_user_serializer.rb FIX: Ensure enforce 2FA for staff satisfied by security keys (#8316) 2019-11-08 15:11:53 +10:00
admin_email_template_serializer.rb Different fix (#7815) 2019-07-02 11:53:16 +10:00
admin_plugin_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
admin_user_action_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
admin_user_list_serializer.rb FIX: Make sure the suspended status is up to date (#8432) 2019-11-28 16:46:14 +01:00
admin_user_serializer.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
admin_web_hook_event_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
admin_web_hook_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
api_key_serializer.rb FEATURE: Hash API keys in the database (#8438) 2019-12-12 11:45:00 +00:00
application_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
archetype_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
auth_provider_serializer.rb FEATURE: Use full page redirection for all external auth methods (#8092) 2019-10-08 12:10:43 +01:00
backup_file_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
badge_grouping_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
badge_index_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
badge_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
badge_type_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
basic_category_serializer.rb FIX: Show uncategorized description on categories page 2020-01-03 11:46:18 -05:00
basic_group_history_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
basic_group_serializer.rb FIX: Keep emoji images in group bio excerpt (#8329) 2019-11-11 18:42:08 +02:00
basic_group_user_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
basic_post_serializer.rb PERF: avoid N+1 on topic view 2019-08-19 17:20:56 +10:00
basic_topic_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
basic_user_badge_serializer.rb FIX: 500 error for missing badge grouping (#8446) 2019-12-03 18:37:01 +11:00
basic_user_serializer.rb FIX: correct user serializer user method for extended serializer (#8590) 2019-12-19 09:48:01 -08:00
category_and_topic_lists_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
category_detailed_serializer.rb UX: Improve sub-sub-categories styling in categories list (#8593) 2019-12-19 17:09:45 +02:00
category_list_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
category_serializer.rb FEATURE: remove support for 'suppress_from_latest' category setting. (#8308) 2019-11-18 12:28:35 +05:30
category_upload_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
color_scheme_color_serializer.rb FEATURE: Allow themes to override color transformation variables (#7987) 2019-08-12 11:02:38 +01:00
color_scheme_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
current_user_serializer.rb FIX: Muted tags are respected by TopicTrackingState (#8467) 2019-12-10 09:50:05 +11:00
detailed_tag_serializer.rb FEATURE: Tag synonyms 2019-12-04 13:33:51 -05:00
detailed_user_badge_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
directory_item_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
directory_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
discourse_version_check_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
draft_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
email_log_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
email_style_serializer.rb FEATURE: customization of html emails (#7934) 2019-07-30 15:05:08 -04:00
embeddable_host_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
embedding_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
emoji_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
flagged_topic_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
flagged_topic_summary_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
flagged_user_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
gap_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
group_post_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
group_post_user_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
group_requester_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
group_show_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
group_user_serializer.rb FEATURE: Add timezone to core user_options (#8380) 2019-11-25 10:49:27 +10:00
grouped_screened_url_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
grouped_search_result_serializer.rb FEATURE: when under extreme load disable search 2019-07-02 11:22:01 +10:00
hidden_profile_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
incoming_email_details_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
incoming_email_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
invite_serializer.rb FIX: show updated_at for invite sent date. 2019-11-26 13:22:48 +05:30
invited_user_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
listable_topic_serializer.rb FEATURE: Dismiss new per category (#8330) 2019-11-14 11:16:13 +11:00
new_post_result_serializer.rb Support for custom messages and redirects when creating posts (#8434) 2019-11-29 09:30:54 -05:00
notification_serializer.rb FIX: Include user id in notification webhook (#8195) 2019-10-21 16:24:41 -06:00
penalty_counts_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
permalink_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
post_action_type_serializer.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
post_action_user_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
post_item_excerpt.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
post_revision_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
post_serializer.rb FIX: Hide old bookmark button on post-menu if SiteSetting.enable_bookmarks_with_reminders 2019-12-12 16:28:01 +10:00
post_stream_serializer_mixin.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
post_wordpress_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
primary_group_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
queued_post_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reviewable_action_serializer.rb DEV: Allow specifying button class in reviewable action definitions (#8093) 2019-09-18 11:28:59 +01:00
reviewable_bundled_action_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reviewable_conversation_post_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reviewable_conversation_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reviewable_editable_field_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reviewable_explanation_serializer.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
reviewable_flagged_post_serializer.rb FEATURE: Show "in reply to" on the review queue 2019-06-05 12:34:41 -04:00
reviewable_history_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reviewable_perform_result_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reviewable_queued_post_serializer.rb FEATURE: Allow viewing of raw emails for reviewable queued posts (#7910) 2019-07-19 11:56:14 -04:00
reviewable_score_explanation_serializer.rb FIX: Store user_accuracy_bonus to clarify explanations (#8165) 2019-10-08 09:49:07 -04:00
reviewable_score_serializer.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
reviewable_score_type_serializer.rb REFACTOR: Replace score bonuses with low/med/high priorities 2019-05-23 11:54:45 -04:00
reviewable_serializer.rb Return full URLs in review serializer for both post and topic 2019-11-14 15:58:21 -08:00
reviewable_settings_serializer.rb REFACTOR: Replace score bonuses with low/med/high priorities 2019-05-23 11:54:45 -04:00
reviewable_topic_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
reviewable_user_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
screened_email_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
screened_ip_address_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
screened_url_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
search_logs_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
search_post_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
search_result_user_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
search_topic_list_item_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
similar_topic_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
single_sign_on_record_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
site_category_serializer.rb FEATURE: categories can require topics have a tag from a tag group 2019-10-31 16:10:19 -04:00
site_serializer.rb DEV: Improve support for extending flags. (#8619) 2019-12-27 08:41:50 -03:00
site_text_serializer.rb Different fix (#7815) 2019-07-02 11:53:16 +10:00
skipped_email_log_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
suggested_topic_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
suggested_topics_mixin.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
tag_group_serializer.rb FEATURE: Tag synonyms 2019-12-04 13:33:51 -05:00
tag_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
theme_serializer.rb FEATURE: allow disabling theme components (#7812) 2019-07-03 18:18:11 +10:00
theme_settings_serializer.rb FEATURE: Load theme setting descriptions from theme locale files 2019-05-31 14:49:59 +01:00
theme_translation_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
top_list_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_embed_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_flag_type_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_link_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_list_item_serializer.rb No need for return in last statement of method 2019-11-14 14:32:22 -05:00
topic_list_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_pending_post_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_post_count_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_poster_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_timer_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_tracking_state_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_view_details_serializer.rb FEATURE: wiki editors are allowed edit tags for wiki topics. 2019-10-23 23:35:38 +05:30
topic_view_posts_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
topic_view_serializer.rb FEATURE: Include image url in topic serializer 2019-10-21 22:02:49 -06:00
topic_view_wordpress_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
trust_level3_requirements_serializer.rb DEV: Upgrading Discourse to Zeitwerk (#8098) 2019-10-02 14:01:53 +10:00
trust_level_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
upload_serializer.rb FEATURE: Secure media allowing duplicated uploads with category-level privacy and post-based access rules (#8664) 2020-01-16 13:50:27 +10:00
user_action_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_auth_token_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_badge_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_badges_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_field_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_history_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_name_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_option_serializer.rb FEATURE: Add timezone to core user_options (#8380) 2019-11-25 10:49:27 +10:00
user_serializer.rb PERF: Reduce DB queries when serializing ignore/mute information (#8629) 2020-01-02 13:04:08 +00:00
user_summary_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
user_wordpress_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
watched_word_list_serializer.rb FEATURE: Add a test facility to the watched words admin interface 2019-08-02 15:29:12 +01:00
watched_word_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
web_hook_category_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
web_hook_flag_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
web_hook_group_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
web_hook_post_serializer.rb FEATURE: add `topic_filtered_posts_count` attribute to web hook post serializer. 2019-12-04 22:52:44 +05:30
web_hook_topic_view_serializer.rb FIX: Exclude image_url from web_hook_topic_view_serializer 2019-10-22 11:53:24 -03:00
web_hook_user_serializer.rb DEV: Remove unused omit_stats variable from user serializer (#8513) 2019-12-12 13:27:23 +11:00
wizard_field_choice_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
wizard_field_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
wizard_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00
wizard_step_serializer.rb DEV: enable frozen string literal on all files 2019-05-13 09:31:32 +08:00