* this mailer needs some more cleanup and specs;
this commit just adds the missing method so the
mailer does not error completely in secure media
environments
* strip out the href and xlink:href attributes from use element that
are _not_ anchors in svgs which can be used for XSS
* adding the content-disposition: attachment ensures that
uploaded SVGs cannot be opened and executed using the XSS exploit.
svgs embedded using an img tag do not suffer from the same exploit
* add composer:saved, composer:created-post, and composer:edited-post
appEvents inside the composer controller, to make it easier to detect
these events in plugins
* the post_actions table has no FK to users, so if a user has been
deleted we may end up with dangling post_action records, which then
interferes with the bookmarks migration because bookmarks DO have
an FK to users
In my original PR (#9647) I attempted to solve the problem of
using fake timers in acceptance tests by using the new sinon
clock.tickAsync methods. This way of doing things seems to be flawed,
however, as we are getting random spec timeouts starting with the
bookmark acceptance test where this was introduced.
I think I was going about things the wrong way. This commit introduces
a new function with callback (acceptanceUseFakeClock) that sets up the
fake timers using sinon.useFakeTimers with the shouldAdvanceTime option
set to true. This advances time at a normal rate of 20ms per tick, which
means that we are not freezing any time and existing setTimeout funcs.
should proceed as normal. Along with this the callback passed will
run clock.reset() at the end to make sure all the timers are cleaned
up correctly.
There is an optional third parameter after the callback, which is the
timezone. If the user is logged in for the acceptance test then their
timezone is used, otherwise we default to America/Denver.
Usage is (inside an acceptance test):
```
test("Name of the test", async assert => {
// first parameter is time to start fake clock at
await acceptanceUseFakeClock("2020-05-04T13:00:00", async () => {
// test code goes here e.g. await visit("/url");
});
});
```
* the spec to check if changing the topic between PM and
public to see if the upload security status is changed
is already covered extensively in topic_upload_security_manager_spec.rb
if SiteSetting.secure_media is disabled we still want to
redirect to the signed url for uploads that are marked as
secure because their ACLs are probably still private
* i was incorrectly toggling the transformed post property
instead of the actual property in the emberjs post model
which broke the bookmark/unbookmark functionality
* instead of using encodeURIComponent in imageNameFromFileName,
we just replace the bad characters that we wanted to get rid
of in the first place where we introduced encodeURIComponent.
as per review
* When viewing a tag, the search widget will now show a checkbox to scope the search by tag, which will limit search results to that tag on desktop and mobile
* Fix user title logic when badge name customized
* Fix an issue where a user's title was not considered a badge granted title when the user used a badge for their title and the badge name was customized. this affected the effectiveness of revoke_ungranted_titles! which only operates on badge_granted_titles.
* When a user's title is set now it is considered a badge_granted_title if the badge name OR the badge custom name from TranslationOverride is the same as the title
* When a user's badge is revoked we now also revoke their title if the user's title matches the badge name OR the badge custom name from TranslationOverride
* Add a user history log when the title is revoked to remove confusion about why titles are revoked
* Add granted_title_badge_id to user_profile, now when we set badge_granted_title on a user profile when updating a user's title based on a badge, we also remember which badge matched the title
* When badge name (or custom text) changes update titles of users in a background job
* When the name of a badge changes, or in the case of system badges when their custom translation text changes, then we need to update the title of all corresponding users who have a badge_granted_title and matching granted_title_badge_id. In the case of system badges we need to first get the proper badge ID based on the translation key e.g. badges.regular.name
* Add migration to backfill all granted_title_badge_ids for both normal badge name titles and titles using custom badge text.
* If a staff user created only a security key as their single 2FA option. they continued to be prompted to create a 2FA option because we only considered this condition satisfied if a TOTP was added.
* The condition is now satisfied if TOTP OR security keys are enabled.
Meta thread: https://meta.discourse.org/t/cant-dismiss-unread-if-last-post-is-an-assign-or-whisper/131823/7
* when sending a whisper, the highest_staff_post_number is set
in the next_post_number method for a Topic, but the
highest_post_number is left alone. this leaves a situation
where highest_staff_post_number is > highest_post_number
* when TopicsBulkAction#dismiss_posts was run, it was only setting the topic_user
highest_seen_post_number using the highest_post_number from the topic, so if
the user was staff and the last post in a topic was a whisper
their highest seen number was not set, and the topic stayed unread
Found through testing that the bug wasn't to do with Assign/Unassign as they do not affect the post numbers, only whispering does.
Martin Brennan