Commit Graph

41882 Commits

Author SHA1 Message Date
36efc740d1 Build(deps): Bump loofah from 2.9.1 to 2.10.0 (#13305)
Bumps [loofah](https://github.com/flavorjones/loofah) from 2.9.1 to 2.10.0.
- [Release notes](https://github.com/flavorjones/loofah/releases)
- [Changelog](https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md)
- [Commits](https://github.com/flavorjones/loofah/compare/v2.9.1...v2.10.0)

---
updated-dependencies:
- dependency-name: loofah
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-06-07 00:24:35 +02:00
9ebc9541b9 FIX: Size of emoji in poll options (#13294)
Fixes a regression in 33cb1b
2021-06-04 18:27:25 -04:00
ee6ff9f1d7 FIX: Use newly created PushSubscription object for push test message (#13293) 2021-06-04 16:05:46 -03:00
46cd355046 FIX: Allow any other tag to be a synonym (#13290)
Tag-chooser component expects an array of blocked tags, but was passed
a string instead. That made tag-chooser to not allow any tags that were
a substring of the current one.
2021-06-04 21:51:53 +03:00
c4e801852f A11Y: Improve topic details toggle button label (#13287) 2021-06-04 13:28:18 -04:00
2c6ceec9ea A11Y: Add aria-label to modal close button (#13288) 2021-06-04 13:28:04 -04:00
78029fd913 A11Y: Include aria-label for avatar images in widgets (#13286) 2021-06-04 13:26:08 -04:00
5d2b836ae5 DEV: Move pretty-text into vendor and use that (#13273)
In Ember CLI addons get put into the vendor bundle, as opposed to their
own bundle like we're doing in the Rails app. We never use pretty-text
without our vendor bundle so this should have no difference on
performance.

We need to keep the pretty-text bundle for server side cooking.
2021-06-04 11:01:59 -04:00
70eddbece1 UX: Copy edit (#13285) 2021-06-04 15:16:52 +03:00
476dfaed2f FIX: Composer doesn't show an error message in case of a network issue and stops updating draft after (#13268) 2021-06-04 16:15:47 +04:00
da2889a7a8 DEV: Add more verbose logging for image uploads (#13270)
Image optimization fails randomly (very rare) without a trace and it is
near impossible to find culprit image, reproduce the issue and attempt
to fix.
2021-06-04 15:13:58 +03:00
9431051ac1 FIX: misspelling in associate_accounts_controller_spec.rb
non-existant -> non-existent
2021-06-04 13:55:35 +08:00
b01e4738ab DEV: Add more keyboard shortcut acceptance tests (#13280)
This adds acceptance tests for keyboard shortcuts to
dismiss new and unread topics.

Also, I cleaned out a few old specs for the unit test for
keyboard-shortcuts. Some were introduced way back in
5100c2bbd2
but then supplanted by
9548876c2d
and never cleaned up, so they were doing nothing.

Follow up to https://review.discourse.org/t/fix-dismiss-topics-keyboard-shortcut-not-working-pr-13260/22157/4?u=martin
2021-06-04 14:04:20 +10:00
27763da412 Build(deps): Bump nokogiri from 1.11.6 to 1.11.7 (#13275)
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.11.6 to 1.11.7.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.11.6...v1.11.7)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-06-04 13:05:36 +10:00
e3b0abc575 UX: Revert some search dropdown styles (#13274) 2021-06-03 22:54:22 -04:00
982eaab9b0 PERF: Defer setting of distributed cache in category.
See follow up commit for rational.

Follow-up to 8cfe203
2021-06-04 10:49:54 +08:00
9625208f40 DEV: Clean up state leak in BootstrapController spec.
The state leak was causing `ExtraLocalesController.client_overrides_exist?` specs to fail randomly.

Follow-up to 19763065394e09de2c162a869aa953c7cd4e6fa3
2021-06-04 10:10:11 +08:00
33cb1b7cf1 FIX: Ensure images in polls don't cause abrupt scrolling (#13272)
In some very rare cases, poll options can end up with images that have
no dimensions, in which case, navigating to replies in that post stream
might result in unexpected scrolling (as the browser loads the images
and adjusts its layout).

This ensures that if width/height attributes are missing from an image,
the image is forced to display within a 200 by 200 pixels space.

Co-authored-by: David Taylor <david@taylorhq.com>
2021-06-03 22:09:59 -04:00
3c1f4d5771 FIX: Clear post action types application serializer fragment cache.
The bug was introduced in dc10bdee3dd23ae8d2acb4729c119e4b0b3f4853
2021-06-04 09:14:49 +08:00
cadf5eafe6 DEV: Move Discourse app specific concern out of unicorn conf. 2021-06-04 09:13:34 +08:00
a8667b5454 PERF: Defer setting of distributed cache in more spots.
See follow up commit for rational.

Follow-up to 8cfe203383367cc7a3cf31b3c3960b7b7aac92ef
2021-06-04 09:13:18 +08:00
cd9941e0ca UX: more consistent setting/edit buttons (#13276) 2021-06-03 18:33:36 -04:00
9d8bc6a405 FIX: Return naturalWidth and naturalHeight for Composer image sizes (#13271)
Rather than returning the size of the currently rendered image in the composer window (which is dependent on browser settings such as window size and zoom level), return the actual dimensions of the image file itself.

(Also see commit abac61449282cce61886fb1b50a3587a579e6406 which was an earlier attempt to fix this by excluding Oneboxed images entirely. That was reverted as the CSS selector didn’t work on all browsers.)
2021-06-03 16:21:56 -04:00
9a449ac534 UX: Adjustments to tag groups layout (#13269) 2021-06-03 13:58:28 -04:00
b27674597c FIX: redirect non-staff user to homepage when deleting own topic (#13267) 2021-06-03 20:27:29 +05:30
4134173bbf FEATURE: Add global admin api key rate limiter (#12527) 2021-06-03 10:52:43 +01:00
58b30fb510 PERF: Preload settings, groups and badge icons in SvgSprite.
Identified as a hot path in production. Preload it early instead of
executing the queries in a live request.
2021-06-03 16:45:56 +08:00
eb2c399445 FEATURE: Use group SMTP settings for sending user notification emails (initial) (#13220)
This PR changes the `UserNotification` class to send outbound `user_private_message` using the group's SMTP settings, but only if:

* The first allowed_group on the topic has SMTP configured and enabled
* SiteSetting.enable_smtp is true
* The group does not have IMAP enabled, if this is enabled the `GroupSMTPMailer` handles things

The email is sent using the group's `email_username` as both the `from` and `reply-to` address, so when the user replies from their email it will go through the group's SMTP inbox, which needs to have email forwarding set up to send the message on to a location (such as a hosted site email address like meta@discoursemail.com) where it can be POSTed into discourse's handle_mail route.

Also includes a fix to `EmailReceiver#group_incoming_emails_regex` to include the `group.email_username` so the group does not get a staged user created and invited to the topic (which was a problem for IMAP), as well as updating `Group.find_by_email` to find using the `email_username` as well for inbound emails with that as the TO address.

#### Note

This is safe to merge without impacting anyone seriously. If people had SMTP enabled for a group they would have IMAP enabled too currently, and that is a very small amount of users because IMAP is an alpha product, and also because the UserNotification change has a guard to make sure it is not used if IMAP is enabled for the group. The existing IMAP tests work, and I tested this functionality by manually POSTing replies to the SMTP address into my local discourse.

There will probably be more work needed on this, but it needs to be tested further in a real hosted environment to continue.
2021-06-03 14:47:32 +10:00
3249312c81 FIX: Escape periods in current user's username before generating RegExp (#13247)
If we don't escape periods, they are interpreted as wildcards and it
becomes impossible to visit profiles of other users whose usernames
match. E.g., if your username was `a.c` and attempted to visit `abc`'s
profile, you would be incorrectly redirected to your own profile.
2021-06-03 14:15:38 +10:00
f3e021ad45 UX: Update search panel styles, consistency (#13262) 2021-06-03 14:14:24 +10:00
d184fe59ca FEATURE: Censor Oneboxes (#12902)
Previously onebox content was not passed by the censor regex, meaning you could sneak in censored words via onebox.
2021-06-03 11:39:12 +10:00
58cb120aa2 DEV: Minor code clean up in assets.rake. (#13245) 2021-06-03 11:37:06 +10:00
b57dca90fc Revert "FIX: Ignore allowlistgeneric Onebox image sizes (#13240)" (#13261)
This reverts commit abac61449282cce61886fb1b50a3587a579e6406.

The CSS selector I was trying to use does not appear to be widely supported.
2021-06-02 21:36:46 -04:00
648d2fd793 DEV: Add test for link watched words (#13251) 2021-06-03 11:36:07 +10:00
8cfe203383 PERF: Defer setting of distributed cache in performance critical paths.
Setting a key/value pair in DistributedCache involves waiting on the
write to Redis to finish. In most cases, we don't need to wait on the
setting of the cache to finish. We just need to take our return value
and move on.
2021-06-03 09:30:52 +08:00
83211cff25 FIX: Change order of topic_tracking_state SELECT SQL (#13259)
This allows us to do DISTINCT on the topic_id to remove
duplicates (e.g. in extensions to the report SQL), and
also introduces an additional_join_sql string to allow
extensions to JOIN additional tables.
2021-06-03 11:21:33 +10:00
006d52f32b FIX: Dismiss topics keyboard shortcut not working (#13260)
This issue is a result of
7a79bd7da3,
where the ID for the bottom Dismiss Topic buttons changed to
dismiss-topic-bottom.
2021-06-03 11:20:20 +10:00
abac614492 FIX: Ignore allowlistgeneric Onebox image sizes (#13240)
* FIX: Ignore `allowlistgeneric` Onebox image sizes

The size of an image contained within the preview pane of a Composer window may vary depending on the configuration of the browser displaying the Composer (e.g., dimension of browser window, zoom level, etc.).

Presently, the dimensions of the images from the browser creating the post containing the Onebox will be used to render the Onebox to anyone who views the post. It is safer to let the backend figure out the dimensions of the images. Therefore, exclude `.onebox.allowlistedgeneric` images from the list of `image_sizes` sent to the backend.

* DEV: Replace jQuery selector with pure JS

* DEV: remove more jQuery
2021-06-02 20:02:13 -04:00
188ac1c51f FIX: Add check for if element doesnt exist on ensureDropClosed (#13256) 2021-06-02 13:44:21 -05:00
3bb765ac92 DEV: Remove the remaining Travis code (#13255)
The second attempt at #10041 now that all our plugins use GitHub Actions CI instead.
2021-06-02 20:29:47 +02:00
4a7c043382 DEV: bundle update fastimage (#13253)
FastImage 2.2.4 - includes a fix for BOM characters in SVG files, and HEIC support
2021-06-02 14:06:20 -04:00
d3e9a028f5 SECURITY: Do not allow unauthorized access to category edit UI (#13252) 2021-06-02 13:18:45 -04:00
fd9ef14ec0 FIX: Show required tags to staff by default and override limit (#13242)
This improves the display of available tags in categories that are
configured to require at least (x) tags from a tag group.

There are two changes included:
- regular users will now see all the available tags in the required tag
group (previously they could see a max. of 5 tags)
- staff users will now see the tags from the required tag group when
the tag group contains more tags than the default limit (also set to 5)

Both changes only apply to the default query (i.e. no search terms).
2021-06-02 12:43:34 -04:00
e81a5182b3 FEATURE: Stage post edits immediately (#13249)
After editing a post, it is refreshed by two ways. One of them is
triggered by the client side which will route the client to the edited
post and force a reload this way. The other way is via Message Bus.

This commit ignores both of the ways and tries to update the post
immediately and then refresh the post stream.
2021-06-02 17:30:36 +03:00
2672358b72 FIX: active record annotation of topic model (#13250)
I've removed constraint from the excerpt column in 00300b1, but forgot to change annotation
2021-06-02 18:16:03 +04:00
447d8dfc44 UX: Use icons as bulleted list in invite modal (#13229) 2021-06-02 16:28:54 +03:00
d2135b23c4 FIX: Do not require trust level to invite to group (#13230)
It used to require SiteSetting.min_trust_level_to_allow_invite to
invite a user to a group, even if the user existed and the inviter was
a group owner.
2021-06-02 16:28:21 +03:00
9d6780f03d DEV: Remove emoji_one files (#13236)
And add a symlink so requests to those assets fallback to the default
emoji set (Twitter).
2021-06-02 09:18:25 -04:00
932a2fe419 FIX: PG::StringDataRightTruncation when linking posts (#13134)
Users who use encoded slugs on their sites sometimes run into 500 error when pasting a link to another topic in a post. The problem happens when generating a backward "reflection" link that would appear in a linked topic. Link URL restricted on the database level to 500 chars in length. At first glance, it should work since we have a restriction on topic title length.

But it doesn't work when a site uses encoded slugs, like here (take a look at the URL). The link to a topic, in this case, can be much longer than 500 characters.

By the way, an error happens only when generating a "reflection" link and doesn't happen with a direct link, we truncate that link. It works because, in this case, the original long link is still present in the post body and can be used for navigation. But we can't do the same for backward "reflection" links (without rewriting their implementation), the whole link must be saved to the database.

The simplest and cleanest solution will be just to remove the restriction on the database level. Abuse is impossible here since we are already protected by the restriction on topic title length. There aren’t performance benefits in using length-constrained columns in Postgres, in fact, length-constrained columns need a few extra CPU cycles to check the length when storing data.
2021-06-02 15:27:04 +04:00
b7b8f5e6f3 FIX: Moderator actions and small actions shouldn't prevent fully merged topics from closing (#13200)
When a topic is fully merged into another topic we close it and schedule its deleting. But, because of a bug, if the merged topic contains some moderator actions or small actions it won't be merged. This change fixes this problem.

An important note: in general, we don't want to close a topic after moving posts if it still contains some regular posts or whispers. But when we are moving posts to a private message we don't want the notice about it to be publicly visible. So we use whispers with action_code == 'split_topic' instead of small_actions in such cases and we should ignore this specific kind of whispers when decide if we should close the merged topic.
2021-06-02 13:42:03 +04:00