Commit Graph

333 Commits

Author SHA1 Message Date
David Taylor
7e4e8c8ad2
SECURITY: Fix invite link validation (stable) (#18818)
See https://github.com/discourse/discourse/security/advisories/GHSA-x8w7-rwmr-w278

Co-authored-by: Martin Brennan <martin@discourse.org>
2022-11-01 16:50:14 +00:00
David Taylor
ec9734bc42
SECURITY: Expand and improve SSRF Protections (stable) (#18816)
See https://github.com/discourse/discourse/security/advisories/GHSA-rcc5-28r3-23rr

Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com>
Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>
2022-11-01 16:34:12 +00:00
Alan Guo Xiang Tan
3d581ce159 SECURITY: Category group permissions leaked to normal users.
After this commit, category group permissions can only be seen by users
that are allowed to manage a category. In the past, we inadvertently
included a category's group permissions settings in `CategoriesController#show`
and `CategoriesController#find_by_slug` endpoints for normal users when
those settings are only a concern to users that can manage a category.
2022-04-08 11:04:59 +02:00
Martin Brennan
f0574564c4 DEV: Fix failing share topic tests (#16309)
Since 3fd7b31a2a some tests
were failing with this error:

> Error: Unhandled request in test environment: /c/feature/find_by_slug.json
> (GET) at http://localhost:7357/assets/test-helpers.js

This commit fixes the issue by adding the missing pretender. Also
noticed while fixing this that the parameter for the translation
was incorrect -- it was `group` instead of `groupNames`, so that
is fixed here too, along with moving the onShow functions into
@afterRender decorated private functions. There is no need for the
appevent listeners.
2022-04-08 11:04:59 +02:00
Bianca Nenciu
1516dd75f5 FIX: Show restricted groups warning when necessary (#16236)
It was displayed for the "everyone" group too, but that was not
necessary.
2022-04-08 11:04:59 +02:00
Andrei Prigorshnev
2c8f62e271
FIX: backport caret moves to a wrong position when uploading an image via toolbar (#15865)
* FIX: Caret moves to a wrong position when uploading an image via toolbar

* Skip the test
2022-02-17 13:44:21 +11:00
Martin Brennan
7dd9dd848a
FIX: Table pasting issues with uppy (#15787) (#15812)
When changing to uppy for file uploads we forgot to add
these conditions to the paste event from 9c96511ec4

Basically, if you are pasting more than just a file (e.g. text,
html, rtf), then we should not handle the file and upload it, and
instead just paste in the text. This causes issues with spreadsheet
tools, that will copy the text representation and also an image
representation of cells to the user's clipboard.

This also moves the paste event for composer-upload-uppy to the
element found by the `editorClass` property, so it shares the paste
event with d-editor (via TextareaTextManipulation), which makes testing
this possible as the ember paste bindings are not picked up unless both
paste events are on the same element.
2022-02-04 11:44:30 +11:00
Robin Ward
a560f9d44b FIX: This was causing a flaky test in Ember CLI
The path should be `/topics/bulk` not `topics/bulk` (leading slash.)
2022-01-26 14:53:25 -05:00
Andrei Prigorshnev
cd68279f5c
DEV: use query() instead of queryAll() in tests (#15681) 2022-01-24 11:27:58 +11:00
Bianca Nenciu
3bb1cd5c4d
FIX: Select topics instead of posts (#15674)
A code error caused post objects to be added to the selected array.
2022-01-21 19:52:09 +02:00
Natalie Tay
3050fe893b
DEV: Quick fix to flaky test (#15644)
We know that the real problem has got to do with cloaking (/t/10298), but while we find out precisely why, here's a quick fix.

Similar to #15627
2022-01-19 11:23:35 +08:00
Natalie Tay
f2902d3830
FIX: Attempt to fix flaky test by using a shorter topic (#15627)
As part of /t/10298, try to remove the first flaky test in the list.

One finding is that the /t/280 topic has a very long post stream, so that may have caused some delay when rendering the topic. One way is to wait for the first expected element to load, but that doesn't scale well given how many waits we will need to add. So I chose to render a shorter topic instead.
2022-01-18 19:22:49 +08:00
Alan Guo Xiang Tan
0aacd63436 FIX: Autocomplete incorrectly replacing text if used mid sentence.
* Adds test to document the behavior we were seeing.
2022-01-18 14:25:39 +08:00
Andrei Prigorshnev
59d78dcfcc
DEV: Restore tests for inserting images as separate paragraphs (#15601) 2022-01-17 17:30:38 +04:00
Jarek Radosz
f0abad6998
DEV: Use a real image to fix a net::err in tests (#15597) 2022-01-17 08:57:52 +01:00
Robin Ward
e1fb020a63
DEV: Improve stability of Tests (#15591)
* The current evaluation of uppy promises is causing the entire suite to fail
if there's an exception. Instead of using `done` we use the simpler
pattern of returning the promise from the test to force Qunit to wait
until it's completed.

* In some browser conditions `/last.json` will be requested depending on the
particular scroll / performance. This causes the tests not to fail if
that is the case.

* Keyboard shortcuts were not being fully cleared between runs,
  resulting in tests failures.
2022-01-17 08:57:05 +01:00
Martin Brennan
bc8cb38081
DEV: Skip failing flaky tests for now (#15605)
At Sam's request, these are causing a lot of build
problems right now.
2022-01-17 15:43:38 +10:00
Joffrey JAFFEUX
a9d69b0e88
DEV: fix tests (#15587)
These tests have been constantly failing locally for me on /qunit. Also it feels better to just rely on native component behavior.
2022-01-14 16:59:26 +01:00
David Taylor
6750c682ac DEV: Add integration test for refreshing discovery-topics views
This test would have detected the regression which was fixed in f94c01b233
2022-01-12 12:18:37 +00:00
David Taylor
78c6fc6e43 DEV: Use Ember router to determine currentURL
This means that our DiscourseURL logic will work consistently in tests, where `window.location` doesn't get updated.

To make it work properly, our `replaceState` implementation needed to be updated so that it writes the new URL to Ember's router, rather than bypassing the router and going straight to the `location` API.

A couple of tests needed updating following this fix:
- the composer-test was asserting that the new reply should be missing from the DOM... when really it **should** be in the DOM, and this fix to the test environment makes it so
- the topic-test was making a fake topic fixture based on the data from a topic with a different id. This was causing the topic route to get confused, and 'fix' the currentURL. This commit updates it to use a fixture with consistent data.

This commit also removes the feature detection of `window.history`. It's feature-detected within `discourse-location`. Plus, we don't support any browsers without it.
2022-01-12 12:18:37 +00:00
David Taylor
8eb61de1cd
FIX: Handling of /p/### URLs within Ember (#15536) 2022-01-11 13:10:46 +00:00
David Taylor
b537d591b3
FIX: allow slug-less topic URLs to work within the same topic (#15508)
- Update the TOPIC_URL_REGEXP in `lib/url` so that `navigatedToPost` doesn't attempt to handle slug-less URLs. Slugs must contain at least one non-numeric character, so we can use that fact to make the regex more specific. We want slug-less URLs to be routed as a normal Ember transition, so that `topic-by-slug-or-id` can catch them and re-write the URL to include the slug.

- Update the `topic-by-slug-or-id` afterModel to ensure that the Ember router is used to handle the redirect, rather than DiscourseURL. This guarantees that it will function as a redirect (DiscourseURL.routeTo sometimes bypasses the router). This solves the history problem which was worked-around in 27211ee7bb.

- Update routes/topic to recover from aborted transitions gracefully. This means that following an aborted transition, the browser URL continues to be updated with post numbers as the user scrolls down the page.
2022-01-11 10:37:37 +00:00
Jarek Radosz
2dcad9772f FIX: Don't display duplicated emoji in picker 2022-01-11 10:37:02 +08:00
Jarek Radosz
933f6780ee
FIX: Update recent emoji list when selecting from it (#15514)
…after you re-open the modal or select another emoji.

Reason:
Even the most used emoji would be knocked off the list after a while, if you use any emoji outside the recent. Consider the sequence:

, 😃,  (from recent), 😀,  (from recent), 😛,  (from recent), 😎,  (from recent), and so on

With the previous logic, the check mark emoji would leave the list, even though it used constantly and (and the time of removal) would the the second most recent used emoji.

---

It doesn't update the list when you use the recent list so that you can click an emoji repeatedly and it doesn't shift from under your mouse cursor.
2022-01-11 00:00:47 +01:00
Rafael dos Santos Silva
06bba76719
DEV: Update emojis constants (#15506)
Follow up to d1cfabd so the new emojis are usable by the app
2022-01-10 14:53:52 -03:00
David Taylor
ef37186be3
DEV: Allow click-interceptor in tests and add navigation test (#15499)
The app's wrapper element ID is different in tests. `app.rootElement` allows us to consistently obtain the selector in the initializer, so it works correctly regardless of the app's configuration.
2022-01-10 15:45:44 +00:00
Penar Musaraj
be599513e3
FEATURE: use raster image and autofill in 2FA input (#15429)
- switches to a raster image QR code so it can be long-pressed (or right
clicked) and added to iCloud keychain
- adds `autocomplete="one-time-code"` to the 2FA input for better
discoverability
2022-01-04 15:31:46 +11:00
Arpit Jalan
b75cbec4b6
FEATURE: allow sending message via a link to multiple users (#15412)
https://meta.discourse.org/t/possible-to-compose-pre-filled-multi-user-private-message-via-url/78020
2021-12-28 06:35:22 +05:30
Jarek Radosz
0b34d5ac6c
UX: Maximize the preview space in composer (#15188)
A follow-up to #15117 and #15141. Applies the previous changes to PM-specific fields, makes the preview area take the all the available height of the composer, and unifies more spacing between composer elements.
2021-12-24 12:38:33 +01:00
Joffrey JAFFEUX
81b0ac1766
FIX: uses new format for search tag endpoint to prevent issues (#15328)
Due to our usage of fixtures, backend changes didn't get catch.
2021-12-16 11:57:47 +01:00
Angus McLeod
df3886d6e5
FEATURE: Experimental support for group membership via google auth (#14835)
This commit introduces a new site setting "google_oauth2_hd_groups". If enabled, group information will be fetched from Google during authentication, and stored in the Discourse database. These 'associated groups' can be connected to a Discourse group via the "Membership" tab of the group preferences UI. 

The majority of the implementation is generic, so we will be able to add support to more authentication methods in the near future.

https://meta.discourse.org/t/managing-group-membership-via-authentication/175950
2021-12-09 12:30:27 +00:00
Krzysztof Kotlarek
412a6c0e8c
FIX: edit tag test (#15207)
Broken with PR https://github.com/discourse/discourse/pull/15149
2021-12-07 07:24:55 +01:00
Krzysztof Kotlarek
a616bc296a
FIX: tag transition only if tag name changed (#15149)
We need to change path only if tag name is changed. If a description is added, we don't need to reload.
2021-12-07 05:44:55 +01:00
Kris
b01ded9c89
UX: Improve tag info style (#15177) 2021-12-03 10:22:05 -05:00
Jarek Radosz
7456a59022
FEATURE: Add the ability to go back and forth between PM and New Topic (#15173)
Before this, if you were composing a new topic and then switched the mode to "New Message", the dropdown would disappear.

So if you changed your mind, you'd have to copy the text you typed, cancel, click "New Topic" again, and then paste the text. (and if you already had a title entered too, things would be more complicated…)
2021-12-02 19:46:40 +01:00
Andrei Prigorshnev
f37375f582
DEV: avoid sending events to a destroying object and enable few skipped tests (#15030) 2021-12-01 18:21:44 +04:00
Martin Brennan
dce6c6fb50
FIX: Native File object was not passed to uploadHandler (#15146)
The commit 20b2a42f49 broke
upload handlers, because previously we passed through the
native File object to the handler, not the uppy-wrapped
File object.
2021-12-01 09:01:53 +10:00
Krzysztof Kotlarek
9cabd3721b
FEATURE: ability to add description to tags (#15125)
Ability to add description to tags, which will be displayed on hover.
2021-12-01 09:18:56 +11:00
Jarek Radosz
24356e339b
DEV: Fix pending posts page, make tests work in legacy env (#15132)
* Running the tests only in the ember cli env hid the fact that the pending posts feature wasn't working in the legacy environment
* Tests were using ember-cli-only APIs while there are widely used testing APIs in Discourse that support both ember envs
* `ember-test-selectors` was in both dependencies and devDependencies in discourse/package.json
* `qunit-dom` in package.json was not only unused but also defunct, as it wasn't pulled into the legacy env app

A followup to #14501, and #15128.
2021-11-30 13:01:39 +01:00
Jarek Radosz
6662101208
DEV: Fix a test leak (#15135)
The leak was introduced in #11722 and a test was added that relied on it in #14563

This PR fixes the leak (bookmarks-test), fixes the test that relied on it (fast-edit-test), and repleces some ad-hoc code with cloneJSON helper (other files)
2021-11-30 13:45:26 +11:00
Martin Brennan
f70e6c302f
DEV: Switch to using uppy uploads in composer by default (#15058)
This is a big change to change over to using the uppy
upload mixin in the composer by default. This gets rid
of the temporary composer-editor-uppy component, as well
as removing the old ComposerUpload mixin and copying over
any missing functions that were not yet implemented by
ComposerUploadUppy. This has been working well on our
hosting for some time now and has led us to several
bug fixes.

This commit also deletes the old plugin API for adding
preprocessors for the uploads. The accepted method of doing
this now is via an uppy preprocessor plugin, which we have
several examples of in the core codebase.

Leaving the `enable_experimental_composer_uploader` site setting
intact for now because some plugins still rely on it, this
will be removed at a later date.

One step closer to ending the jQuery file uploader saga...
2021-11-30 08:33:06 +10:00
Loïc Guitaut
a5fbb90df4 FEATURE: Display pending posts on user’s page
Currently when a user creates posts that are moderated (for whatever
reason), a popup is displayed saying the post needs approval and the
total number of the user’s pending posts. But then this piece of
information is kind of lost and there is nowhere for the user to know
what are their pending posts or how many there are.

This patch solves this issue by adding a new “Pending” section to the
user’s activity page when there are some pending posts to display. When
there are none, then the “Pending” section isn’t displayed at all.
2021-11-29 10:26:33 +01:00
Martin Brennan
20b2a42f49
DEV: Send multiple files in batches to composer upload handlers when using uppy (#15124)
In jQuery file upload land, we were sending a single file through
at a time to matching upload handlers. This in turn required plugin
authors to marshal the files as they came through one by one if they
wanted to group them together to do something with them. Now that
we are using uppy, files come through in the groups they are added
in (for example dropping multiple, selecting multiple from the system
file dialogue).

This commit changes the matching upload handlers to send through
all matching files at once instead of piecemeal.
2021-11-29 11:19:02 +10:00
Robin Ward
f1178514fa Segment Ember CLI tests
Note `/topics/bulk` missing the first slash seems to expose an error not
present without segmentation.
2021-11-26 12:14:30 -05:00
Penar Musaraj
d99deaf1ab
FEATURE: show recent searches in quick search panel (#15024) 2021-11-25 15:44:15 -05:00
Penar Musaraj
1166afa4e8
FIX: Software update prompt position on themes with extra header (#15094) 2021-11-25 11:16:55 -05:00
Natalie Tay
4c46c7e334
DEV: Remove xlink hrefs (#15059) 2021-11-25 15:22:43 +11:00
Bianca Nenciu
59e0ed8820
FEATURE: Highlight changed tags in post revisions (#15072) 2021-11-24 18:51:25 +02:00
Natalie Tay
d46e450733
Refine dismiss notification confirmation (#15017) 2021-11-22 09:11:24 +08:00
jbrw
97b27a7426
FIX: Remove 'Open Draft' label after topic draft deleted (#14997)
* FIX: Remove 'Open Draft' label after topic draft deleted
2021-11-19 11:00:11 -05:00