IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-07-29 23:58:12 -05:00
Code Issues Packages Projects Releases Wiki Activity

FIX: Disallow editing of remote themes (#11189)

Browse Source 
Allowing the editing of remote themes has been something Discourse has advised against for some time. This commit removes the ability to edit or upload files to remote themes from Admin > Customize to enforce the recommended practice.
This commit is contained in:
Justin DiRose
2020-11-13 09:57:49 -06:00
committed by GitHub
parent dc005c593e
commit 65e123498b
4 changed files with 65 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/assets/javascripts/admin/addon/routes/admin-customize-themes-edit.js
+4
View File
@@ -28,6 +28,10 @@ export default Route.extend({
const fields = wrapper.model
.get("fields")
[wrapper.target].map((f) => f.name);
if (wrapper.model.remote_theme) {
this.transitionTo("adminCustomizeThemes.index");
return;
}
if (!fields.includes(wrapper.field_name)) {
this.transitionTo(
"adminCustomizeThemes.edit",
app/assets/javascripts/admin/addon/templates/customize-themes-show.hbs
+40 -37
View File
@@ -1,4 +1,5 @@
<div class="show-current-style">
{{plugin-outlet name="admin-customize-themes-show-top" args=(hash theme=model)}}
<div class="title">
{{#if editingName}}
{{text-field value=model.name autofocus="true"}}
@@ -191,45 +192,47 @@
{{/d-section}}
{{/if}}
<div class="control-unit">
<div class="mini-title">{{i18n "admin.customize.theme.css_html"}}</div>
{{#if model.hasEditedFields}}
<div class="description">{{i18n "admin.customize.theme.custom_sections"}}</div>
<ul>
{{#each editedFieldsFormatted as |field|}}
<li>{{field}}</li>
{{/each}}
</ul>
{{else}}
<div class="description">
{{i18n "admin.customize.theme.edit_css_html_help"}}
</div>
{{/if}}
{{#unless model.remote_theme}}
<div class="control-unit">
<div class="mini-title">{{i18n "admin.customize.theme.css_html"}}</div>
{{#if model.hasEditedFields}}
<div class="description">{{i18n "admin.customize.theme.custom_sections"}}</div>
<ul>
{{#each editedFieldsFormatted as |field|}}
<li>{{field}}</li>
{{/each}}
</ul>
{{else}}
<div class="description">
{{i18n "admin.customize.theme.edit_css_html_help"}}
</div>
{{/if}}
{{d-button
class="btn-default edit"
action=(action "editTheme")
label="admin.customize.theme.edit_css_html"}}
</div>
{{d-button
class="btn-default edit"
action=(action "editTheme")
label="admin.customize.theme.edit_css_html"}}
</div>
<div class="control-unit">
<div class="mini-title">{{i18n "admin.customize.theme.uploads"}}</div>
{{#if model.uploads}}
<ul class="removable-list">
{{#each model.uploads as |upload|}}
<li>
<span class="col">${{upload.name}}: <a href={{upload.url}} rel="noopener noreferrer" target="_blank">{{upload.filename}}</a></span>
<span class="col">
{{d-button action=(action "removeUpload") actionParam=upload class="second btn-default btn-default cancel-edit" icon="times"}}
</span>
</li>
{{/each}}
</ul>
{{else}}
<div class="description">{{i18n "admin.customize.theme.no_uploads"}}</div>
{{/if}}
{{d-button action=(action "addUploadModal") class="btn-default" icon="plus" label="admin.customize.theme.add"}}
</div>
<div class="control-unit">
<div class="mini-title">{{i18n "admin.customize.theme.uploads"}}</div>
{{#if model.uploads}}
<ul class="removable-list">
{{#each model.uploads as |upload|}}
<li>
<span class="col">${{upload.name}}: <a href={{upload.url}} rel="noopener noreferrer" target="_blank">{{upload.filename}}</a></span>
<span class="col">
{{d-button action=(action "removeUpload") actionParam=upload class="second btn-default btn-default cancel-edit" icon="times"}}
</span>
</li>
{{/each}}
</ul>
{{else}}
<div class="description">{{i18n "admin.customize.theme.no_uploads"}}</div>
{{/if}}
{{d-button action=(action "addUploadModal") class="btn-default" icon="plus" label="admin.customize.theme.add"}}
</div>
{{/unless}}
{{#if extraFiles.length}}
<div class="control-unit">