Revert "Revert "Merge branch 'master' of https://github.com/discourse/discourse""

This reverts commit 20780a1eeed56b321daf18ee6bbfe681a51d1bf4.

* SECURITY: re-adds accidentally reverted commit:
  03d26cd6: ensure embed_url contains valid http(s) uri
* when the merge commit e62a85cf was reverted, git chose the 2660c2e2 parent to land on
  instead of the 03d26cd6 parent (which contains security fixes)

plugins/discourse-narrative-bot/db/fixtures/001_discobot.rb

@@ -4,20 +4,20 @@ discobot_username = 'discobot'
 
 def seed_primary_email
   UserEmail.seed do |ue|
-    ue.id = -2
+    ue.id = DiscourseNarrativeBot::BOT_USER_ID
     ue.email = "discobot_email"
     ue.primary = true
-    ue.user_id = -2
+    ue.user_id = DiscourseNarrativeBot::BOT_USER_ID
   end
 end
 
-unless user = User.find_by(id: -2)
+unless user = User.find_by(id: DiscourseNarrativeBot::BOT_USER_ID)
   suggested_username = UserNameSuggester.suggest(discobot_username)
 
   seed_primary_email
 
   User.seed do |u|
-    u.id = -2
+    u.id = DiscourseNarrativeBot::BOT_USER_ID
     u.name = discobot_username
     u.username = suggested_username
     u.username_lower = suggested_username.downcase
@@ -26,22 +26,9 @@ unless user = User.find_by(id: -2)
     u.approved = true
     u.trust_level = TrustLevel[4]
   end
-
-  # TODO Pull the user avatar from that thread for now. In the future, pull it from a local file or from some central discobot repo.
-  if !Rails.env.test?
-    begin
-      UserAvatar.import_url_for_user(
-        "https://cdn.discourse.org/dev/uploads/default/original/2X/e/edb63d57a720838a7ce6a68f02ba4618787f2299.png",
-        User.find(-2),
-        override_gravatar: true
-      )
-    rescue
-      # In case the avatar can't be downloaded, don't fail seed
-    end
-  end
 end
 
-bot = User.find(-2)
+bot = User.find(DiscourseNarrativeBot::BOT_USER_ID)
 
 # ensure discobot has a primary email
 unless bot.primary_email
@@ -62,4 +49,4 @@ if !bot.user_profile.bio_raw
   )
 end
 
-Group.user_trust_level_change!(-2, TrustLevel[4])
+Group.user_trust_level_change!(DiscourseNarrativeBot::BOT_USER_ID, TrustLevel[4])

plugins/discourse-narrative-bot/db/post_migrate/20200520015508_clear_last_gravatar_download_attempt_on_user_avatars.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class ClearLastGravatarDownloadAttemptOnUserAvatars < ActiveRecord::Migration[6.0]
+  def up
+    execute <<~SQL
+      UPDATE user_avatars
+      SET last_gravatar_download_attempt = null
+      WHERE user_id = -2 AND custom_upload_id IS NULL AND gravatar_upload_id IS NULL
+    SQL
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration
+  end
+end

plugins/discourse-narrative-bot/plugin.rb

@@ -55,6 +55,7 @@ after_initialize do
 
   module ::DiscourseNarrativeBot
     PLUGIN_NAME = "discourse-narrative-bot".freeze
+    BOT_USER_ID = -2
 
     class Engine < ::Rails::Engine
       engine_name PLUGIN_NAME
@@ -271,4 +272,9 @@ after_initialize do
       end
     end
   end
+
+  UserAvatar.register_custom_user_gravatar_email_hash(
+    DiscourseNarrativeBot::BOT_USER_ID,
+    "discobot@discourse.org"
+  )
 end

plugins/discourse-narrative-bot/spec/discourse_narrative_bot/track_selector_spec.rb

@@ -472,7 +472,7 @@ describe DiscourseNarrativeBot::TrackSelector do
           let(:post) { Fabricate(:post, topic: topic) }
 
           after do
-            Discourse.redis.flushall
+            Discourse.redis.flushdb
           end
 
           describe 'when random reply massage has been displayed in the last 6 hours' do

plugins/discourse-narrative-bot/spec/jobs/send_advanced_tutorial_message_spec.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'rails_helper'
+
 RSpec.describe Jobs::SendAdvancedTutorialMessage do
   before do
     Jobs.run_immediately!