IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-07-29 15:54:48 -05:00
Code Issues Packages Projects Releases Wiki Activity
51,507 Commits 932 Branches 570 Tags
24e087e2bafe7feb4d6eb63b4d9ad1c85f867f69
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel WaterworthandPenar Musaraj 290306a932 SECURITY: Reduce maximum size of SVG sprite cache to prevent DoS 
Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
 2023-09-12 15:31:28 -03:00
Daniel Waterworth 40acb9a111 DEV: Run core system tests by default in docker test image (#23517) 2023-09-11 16:04:33 -05:00
Daniel Waterworth 70d082584c DEV: Allow explicitly enabling/disabling system tests in bin/turbo_rspec (#23515) 
This doesn't alter the default behavior.
 2023-09-11 13:11:06 -05:00
Daniel Waterworth 82a56334a3 PERF: Cache each theme field value once (#23192) 
Previously, theme fields from components would be cached for each of
their parent themes.
 2023-08-31 11:24:02 -05:00
Daniel Waterworth 91f560a521 DEV: Make every DistributedCache lazily instantiated (#23147) 2023-08-18 10:59:11 -05:00
Daniel Waterworth 80a0d88e4c FIX: Ensure javascript caches are unique per theme/theme_field (#23126) 
We were assuming that this was the case before, but not enforcing it.
 2023-08-17 13:57:04 -05:00
Daniel Waterworth 50d527b80c DEV: Remove db_timeout setting (#22912) 
It doesn't actually do anything.
 2023-08-01 14:17:43 -05:00
Daniel Waterworth 26e267478d SECURITY: Don't allow a particular site to monopolize the defer queue 2023-07-28 12:53:51 +01:00
Daniel Waterworth b7404373cf FIX: Always clear caches after committing the current transaction (#22550) 
Instead of having to remember every time, just always wait until the
current transaction (if it exists) has committed before clearing any
DistributedCache.

The only exception to this is caches that aren't caching things from
postgres.

This means we have to do the test setup after setting the test
transaction, because doing the test setup involves clearing caches.

Reapplying this - it now doesn't use after_commit if skip_db is set
 2023-07-12 09:49:28 -05:00
Daniel Waterworth cb794275a7 Revert "FIX: Always clear caches after committing the current transaction" (#22493) 
This reverts commit 8310c7842c.

This was breaking precompilation.
 2023-07-07 18:05:38 -05:00
Daniel Waterworth 9dd01ca2ef FIX: Always clear caches after committing the current transaction (#22491) 
Instead of having to remember every time, just always wait until the
current transaction (if it exists) has committed before clearing any
DistributedCache.

The only exception to this is caches that aren't caching things from
postgres.

This means we have to do the test setup after setting the test
transaction, because doing the test setup involves clearing caches.
 2023-07-07 14:24:56 -05:00
Daniel Waterworth 5e2edeb2f7 FIX: Set test transaction to before_all transaction (#22445) 
So that after_commit hooks work correctly for pre-fabricated objects.
 2023-07-06 12:23:28 -05:00
Daniel Waterworth 6f8056572e DEV: Refactor updating parent/child relationships between themes (#22244) 
The prior add_relative_themes! method was confusing and cleared the
cache repeatedly instead of once for the whole operation.
 2023-06-22 13:57:39 -05:00
Daniel Waterworth 50bded7b47 FIX: Force ordering to make things more consistent and fix flaky test (#22228) 2023-06-21 13:16:10 -05:00
Daniel Waterworth 0cec84206e DEV: Fix interactions between tests via plugin svg sprite cache (#22047) 2023-06-09 13:53:21 -05:00
Daniel Waterworth 67afd85aae Revert "DEV: Use runtime info to split test files for parallel testing (#21896)" (#22016) 
This reverts commit 14ed971db6.

This prevented the core backend tests from running in GitHub CI
 2023-06-08 15:13:26 -05:00
Daniel Waterworth 3d3e8c8fbd FIX: json_schemer no longer allows nil keys (#22015) 2023-06-08 15:12:47 -05:00
Daniel Waterworth 353c8ea51f DEV: Don't pass in extra, ignored parameters when rendering sass (#21591) 
As far as I can tell, these parameters do nothing.
 2023-05-16 12:14:06 -05:00
Daniel Waterworth 53d99d1a26 DEV: Skip flaky tests (#21534) 2023-05-15 07:51:25 +02:00
Daniel WaterworthandPenar Musaraj 0a96579cef DEV: Allow site setting errors to be displayed as html if they are safe (#21342) 
This is only useful for plugins currently

Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
 2023-05-04 15:01:19 -05:00
Daniel Waterworth bc236119d3 DEV: Increase docker.rake system test timeout time to match CI (#21339) 2023-05-02 12:12:03 -05:00
Daniel Waterworth a4dd758f5c DEV: Add 20m timeout to system tests (#21323) 2023-05-01 13:23:48 -05:00
Daniel Waterworth ae63d9ea09 PERF: Remove unnecessary queries from Theme#set_field (#21281) 2023-04-27 13:04:58 -05:00
Daniel Waterworth 38cebd3ed5 Revert "FEATURE: Better thread reply counter cache (#21108)" (#21192) 
This reverts commit 180e3e11d1.

Per internal discussions, this is a temporary revert, to investigate if this is causing a performance regression.
 2023-04-20 15:09:47 -05:00
Daniel Waterworth a4d51810e2 DEV: Correct ambiguous name (#21189) 
This file would do different things depending on whether
Migration::Migration existed beforehand.
 2023-04-20 11:28:08 -05:00
Daniel Waterworth c68497159f FIX: Use string for postgres recently readonly DistributedCache (#21040) 
Since DistributedCaches don't marshal timestamps
 2023-04-10 13:54:55 -05:00
Daniel Waterworth fcc73b441d FIX: Make emoji cache store marshalled objects (#21029) 
We only marshal arrays, hashes and sets, which meant that the emojis
here were just getting `to_s`ed.

This is a hack.
 2023-04-10 10:44:11 -05:00
Daniel Waterworth 0ff86feb96 DEV: Rely on helpers for ajax error handling to reduce repetition (#20988) 2023-04-06 11:25:24 -05:00
Daniel Waterworth 355b44472b DEV: Allow HTML errors whenever a popup is generated (#20989) 
Follow-up-to: 6bbf832400
 2023-04-06 10:00:54 -05:00
Daniel Waterworth cd6d47e012 FIX: Handle errors when we show the edit user directory columns modal (#20986) 2023-04-05 14:31:32 -05:00
Daniel Waterworth 79c87b5003 FIX: Show better default error when failing to delete all user posts (#20985) 2023-04-05 14:26:00 -05:00
Daniel Waterworth 852475dca4 DEV: Add yarn-app shim to run yarn using the app modules (#20983) 2023-04-05 13:12:58 -05:00
Daniel Waterworth 2df0eca39a DEV: Make postgres_readonly cache work like other caches (#20879) 
We didn't have an authoritative source for this data previously, so now
it's stored in redis.
 2023-03-30 09:14:59 -05:00
Daniel Waterworth d563b73202 DEV: Make category topic_ids cache work like other caches (#20814) 2023-03-27 09:23:29 -05:00
Daniel Waterworth 3e80ab3143 DEV: Make category subcategory_ids cache work like other caches (#20815) 2023-03-27 09:23:23 -05:00
Daniel Waterworth b2554e1490 DEV: Make hex cache work like other caches (#20816) 2023-03-27 09:22:53 -05:00
Daniel Waterworth 9d34b73a5e DEV: Make csp cache work like other caches (#20818) 2023-03-27 09:22:38 -05:00
Daniel Waterworth 0f4bb19524 DEV: make developer cache work like other caches (#20817) 2023-03-27 09:22:33 -05:00
Daniel Waterworth 0728fa055b DEV: Make theme cache work like other caches (#20813) 2023-03-24 12:37:16 -05:00
Daniel Waterworth 7e23e6c1e8 DEV: Make banner cache work like other caches (#20811) 2023-03-24 12:36:55 -05:00
Daniel Waterworth bc8ab33708 DEV: Disable test to see if this is what's causing ci failures (#20809) 2023-03-24 11:15:30 -05:00
Daniel Waterworth 52999d1422 DEV: Show which system tests are being executed in CI (#20795) 
... to see if it's always the same test causing timeouts
 2023-03-23 15:12:14 -05:00
Daniel Waterworth 7b01576c8d DEV: Remove emoji cache dead code (#20764) 
The cache is already not shared between app servers that have different
app_versions, so this check was redundant.
 2023-03-21 12:33:12 -05:00
Daniel Waterworth a0a6f6d71b FIX: Fix the emoji toned regexes (#20763) 2023-03-21 11:48:55 -05:00
Daniel Waterworth da0d20d4a9 DEV: Refactor svg sprite parsing (#20727) 
There was a lot of duplication in the svg parsing and coercion code. This reduces that duplication and causes svg sprite parsing to happen earlier so that more computation is cached.
 2023-03-20 11:41:23 -05:00
Daniel Waterworth 293cb7bde2 FIX: An ember build is required to run the system tests (#20725) 2023-03-17 13:20:49 -05:00
Daniel Waterworth 164b60cd07 DEV: Optionally, run system tests in docker:test 2023-03-15 16:46:48 -05:00
Daniel Waterworth 5324216740 DEV: Use rspec instead of turbo_rspec with one core 2023-03-15 16:46:48 -05:00
Daniel Waterworth 84f590ab83 DEV: Store theme sprites in the DB (#20501) 
Let's avoid fetching sprites from the CDN during page rendering.
 2023-03-14 13:11:45 -05:00
Daniel Waterworth b96a23978a PERF: Add index to speed up ReindexSearch job (#20151) 2023-02-21 13:16:43 -05:00
Daniel Waterworth 666536cbd1 DEV: Prefer \A and \z over ^ and $ in regexes (#19936) 2023-01-20 12:52:49 -06:00
Daniel Waterworth 3030a53819 FIX: Prevent concurrent updates to top_topics (#19854) 
to prevent lock timeouts
 2023-01-12 14:03:26 -06:00
Daniel Waterworth dfc449a32e FIX: Continue if checking themes if updating one fails (#19665) 2023-01-09 11:56:43 -06:00
Daniel Waterworth 97c5e19537 FIX: Don't assume a clean slate in tests (#19499) 
since plugins can have fixtures
 2022-12-19 12:12:03 -06:00
Daniel Waterworth d244eb0d7c FIX: Don't validate channel slug if it hasn't changed (#19498) 
This is generating lots of log noise for operations that aren't even
touching the slug.
 2022-12-19 12:11:51 -06:00
Daniel Waterworth 2b4009c6bc DEV: Fake sleeping in distributed mutex tests (#19472) 
otherwise they take a looong time
 2022-12-14 15:11:46 -06:00
Daniel Waterworth 3a4ac3a7c0 FIX: Don't update url in GitImporter (#19273) 
Since it's fetched and used elsewhere and expected to stay the same.
 2022-12-01 10:50:06 -06:00
Daniel Waterworth d9364a272e FIX: When following redirects before cloning, use the first git request (#19269) 
This is closer to git's redirect following behaviour. We prevented git
following redirects when we clone in order to prevent SSRF attacks.

Follow-up-to: 291bbc4fb9
 2022-11-30 14:21:09 -06:00
Daniel Waterworth aab4ea1849 Version bump to v2.9.0.beta14 (#19242) 2022-11-29 10:59:53 -06:00
Daniel Waterworth 84c83e8d4a SECURITY: Filter tags in user notifications for visibility (#19239) 2022-11-29 10:35:41 -06:00
Daniel Waterworth f895f27b02 FIX: When filtering tags for visibility, respect tag group permissions (#19152) 2022-11-22 12:55:57 -06:00
Daniel Waterworth 47709c6d49 DEV: Reinstate --single-branch when cloning themes (#19026) 2022-11-15 13:23:57 -06:00
Daniel Waterworth 6f48502dd2 DEV: Add rake task to install a theme from an archive (#18890) 2022-11-04 16:42:07 -05:00
Daniel Waterworth 291bbc4fb9 FIX: When cloning themes via HTTP, try the original URI too (#18870) 
This should fix fetching from gitlab.

In order to get SSRF protection, we had to prevent redirects when cloning via git, but some repos are behind redirects and we want to support those too. We use `FinalDestination` before cloning to try to simulate git with redirects, but this isn't quite how git works, so there's some discrepancies between our SSRF protected cloning behavior and normal git behavior that I'm trying to work around.

This is temporary fix. It would be better to use `FinalDestination` to simulate the first request that git makes. I aim to make it work like that in the not too distant future, but this is better for now.
 2022-11-03 15:19:08 -05:00
Daniel Waterworth 1398bd5f1f FIX: Theme import error handling needs to happen inside the hijack block (#18866) 
Otherwise the errors don't get caught.
 2022-11-03 14:02:26 -05:00
Daniel Waterworth 167181f4b7 DEV: Quote values when constructing SQL (#18827) 
All of these cases should already be safe, but still good to quote for
"defense in depth".
 2022-11-01 14:05:13 -05:00
Daniel Waterworth 563ec624b2 FIX: Allow email login for admins in staff-writes-only-mode (#18443) 2022-09-30 14:12:49 -05:00
Daniel Waterworth c1a7fa6b5d FIX: Allow logout for admins in staff-writes-only-mode (#18441) 2022-09-30 13:03:20 -05:00
Daniel Waterworth cb922ca8c8 DEV: update .ruby-version.sample (#18426) 2022-09-29 13:38:44 -05:00
Daniel Waterworth 69d74ae508 DEV: Differentiate staff-writes-only banner (#18364) 2022-09-26 13:16:29 -05:00
Daniel Waterworth e3d7253199 DEV: Only lock rows that need to change in migration (#18319) 2022-09-21 14:14:45 -05:00
Daniel Waterworth e37ced96bf DEV: Don't interpret user field names as HTML (#18317) 
This isn't a security bug, because only admins can create user fields
and we have to trust admins, because they can change themes, which are
shown site-wide and can contain unrestricted JS.
 2022-09-21 12:21:58 -05:00
Daniel Waterworth e0ece3a77e Revert "DEV: Improve multisite db scripts in dev (#17337)" (#17801) 
This reverts commit 2e4056d185.

Unfortunately, this broke db:create and db:drop when multisite config
wasn't present.
 2022-08-04 16:15:06 -05:00
Daniel Waterworth 83d3543e33 DEV: Guardians aren't active record objects, so shouldn't use fab! (#17789) 2022-08-03 19:17:40 -05:00
Daniel Waterworth e91cc340e6 FIX: Add ember redirect for tags/:tag_id -> tag/:tag_id (#17397) 
/tags/:tag_id is deprecated, but links may exist in posts.
 2022-07-08 14:39:43 -05:00
Daniel Waterworth d7886e4d18 FIX: Allow all subdomains of localhost in development (#17089) 
domains can contain numbers.

Follow-up-to: 00e756e358
 2022-06-14 14:54:49 -05:00
Daniel Waterworth 00e756e358 DEV: Allow all subdomains of localhost in development (#17018) 
By default in rails, it looks like only one level deep is allowed.
 2022-06-06 16:02:51 -05:00
Daniel Waterworth d7bc395182 FIX: Seed multisite dbs after migrating in development (#17017) 
Dumping the schema cache reset the current_db and we only need to do
this once.
 2022-06-06 14:43:43 -05:00
Daniel WaterworthandDavid Taylor f00e282067 FIX: Delete extraneous topic bookmarks (#16926) 
Otherwise the migration can fail

Co-authored-by: David Taylor <david@taylorhq.com>
 2022-05-26 11:58:15 -05:00
Daniel Waterworth 6e53f4d913 DEV: New readonly mode. Only applies to non-staff (#16243) 2022-05-17 13:06:08 -05:00
Daniel Waterworth 9eadabe9fc DEV: Let's deny access to sso endpoints when disabled consistently (#16752) 2022-05-13 14:33:28 -05:00
Daniel Waterworth 6a4696eec8 DEV: Add helper method for repeated sso logging pattern (#16749) 2022-05-13 12:19:44 -05:00
Daniel Waterworth 66a04c5cfe FIX: Prevent all kinds of login in readonly mode (#16743) 2022-05-13 10:52:01 -05:00
Daniel Waterworth 1d7e423f86 FIX: Make read only errors respect the request format (#16741) 2022-05-12 17:04:49 -05:00
Daniel Waterworth cc4171be11 DEV: Expose user action types where the user was the instigator (#16723) 2022-05-11 15:15:53 -05:00
Daniel Waterworth bc8968fd12 DEV: Move SidekiqLogsterReporter out of initializer (#16687) 
This fits more naturally in its own file.
 2022-05-09 13:01:31 -05:00
Daniel Waterworth f55edd54fd FIX: Don't allow DiscourseConnect logins in readonly mode (#16508) 2022-04-19 12:33:31 -05:00
Daniel Waterworth 6e9a068e44 FIX: Limit max word length in search index (#16380) 
Long words bloat the index for little benefit.
 2022-04-06 12:23:30 -05:00
Daniel Waterworth 9ce6280f51 DEV: Make tests more resilient (#16279) 
Since we give a 200 response for login errors, we should be checking
whether the error key exists in each case or not.

Some tests were broken, because they weren't checking.
 2022-03-25 10:44:12 -05:00
Daniel Waterworth 4a0f73a337 PERF: Turn common test prefixes into contexts in topics_controller_spec (#15439) 2022-01-03 11:00:03 -06:00
Daniel Waterworth 9e18868c31 DEV: Re-organize TopicsController#reset_new tests (#15399) 2021-12-23 12:29:51 -06:00
Daniel Waterworth 5ff0b86b57 PERF: Make tests faster by prefabricating more things (#15392) 2021-12-22 11:09:43 -06:00
Daniel Waterworth 80591724cf DEV: Avoid shadowing variables in topics_controller_spec (#15383) 2021-12-21 12:28:12 -06:00
Daniel Waterworth 7e0c1fb039 PERF: Make tests faster by prefabricating more things (#15370) 2021-12-20 12:59:10 -06:00
Daniel Waterworth ca0eb8041d PERF: Prefabricate more parts of users_controller_spec (#15335) 2021-12-16 13:36:49 -06:00
Daniel Waterworth 102fa71ef3 PERF: Speed up the tests by pre-fabricating more things (#15318) 2021-12-15 11:41:14 -06:00
Daniel Waterworth 61e449379c PERF: Prefabricate posters in topics_controller_spec (#15297) 
It would be clearer to prefabricate posts, but that changes redis and
enabling snapshotting for all the tests in topics_controller_spec is
expensive.
 2021-12-14 12:09:07 -06:00
Daniel Waterworth 9334abe249 PERF: Prefabricate more of topics_controller_spec.rb (#15281) 2021-12-13 13:44:55 -06:00
Daniel Waterworth 02245ce41f PERF: Redis snapshotting during tests (#15260) 
We can fake redis transactions so that `fab!` works for redis and PG
data, but it's too slow to be used indiscriminately. Instead, you can
opt into it with the `use_redis_snapshotting` helper.

Insofar as snapshotting allows us to `fab!` more things, it provides a
speedup.
 2021-12-10 14:25:26 -06:00
Daniel Waterworth ec36cddd2f FIX: Defer topic/post created events until emails have been added (#15252) 2021-12-09 14:45:07 -06:00