IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-09-05 04:40:41 -05:00
Code Issues Packages Projects Releases Wiki Activity
32,667 Commits 1,018 Branches 579 Tags
bcca2b5d738c7e0560f491f8bcc1e9ac3dfd78c4
Commit Graph
76 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kyle Zhao dec8e5879a FEATURE: set CSP base-uri and object-src to none (#6863) 2019-01-09 15:04:50 -05:00
Kyle Zhao 61dcd7c52c FIX: validate YAML before save to avoid race condition 2018-12-25 15:08:17 +02:00
Kyle Zhao b0c2e9bb05 minor changes to default script-src (#6770) 
- add report-sample to force require a sample of the violating code
- do not whitelist GA/GTM's entire domain
 2018-12-14 08:17:31 -05:00
Kyle Zhao 92df7b212c rename visible to visibleSiteSettings 2018-12-13 13:00:13 +11:00
Kyle Zhao c9279a118e FIX: always show filtered site settings 2018-12-13 13:00:13 +11:00
Kyle Zhao 97e6e3b133 DEV: duplicate and unreachable code after return 2018-12-05 09:17:20 -05:00
Kyle Zhao 488fba3c5f FEATURE: allow plugins and themes to extend the default CSP (#6704) 
* FEATURE: allow plugins and themes to extend the default CSP

For plugins:

```
extend_content_security_policy(
  script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'],
  style_src: ['https://domain.com/style.css']
)
```

For themes and components:

```
extend_content_security_policy:
  type: list
  default: "script_src:https://domain.com/|style_src:https://domain.com"
```

* clear CSP base url before each test

we have a test that stubs `Rails.env.development?` to true

* Only allow extending directives that core includes, for now
 2018-11-30 09:51:45 -05:00
Kyle Zhao 80398d0b8f Extract inline JS on embedded comments (#6645) 
* use the meta refresh tag instead

* extract inline JS in embedded comment
 2018-11-22 10:02:58 -05:00
Kyle Zhao 8e32aa1483 FEATURE: show post approvals in Moderation History (#6643) 2018-11-22 10:22:23 +08:00
Kyle Zhao e25b3965a7 do not overwrite hostname in development (#6623) 2018-11-20 14:34:02 +11:00
Kyle Zhao 962fbd1ec7 include '/plugins/' directory for script-src and blob for worker-src 
- plugins may include additional static JS assets
- ACE.js editor register a service worker with a blob for syntax
checking
 2018-11-16 16:31:01 -05:00
Kyle Zhao 7cb6082f91 FIX: S3 CDN for markdown it bundle 2018-11-15 16:55:20 -05:00
Kyle Zhao 6fba8b8aef CSP: include worker_src 
`worker_src` fallbacks to `script_src`, but #6611 made `script_src` too
restrict to include the service worker.
 2018-11-15 13:57:15 -05:00
Kyle Zhao 5f754b43f1 extract inline onpopstate handler on 404 page (#6613) 2018-11-15 13:35:38 -05:00
Kyle Zhao 055d59373a CSP: drop 'self' in script-src (#6611) 2018-11-15 12:14:16 -05:00
Kyle Zhao 38a9bc740d FIX: change title when primary group changes (#6602) 2018-11-14 08:28:41 +08:00
Kyle Zhao d25ae13f0f FIX: stricter window.opener checks (#6578) 2018-11-13 09:56:31 +11:00
Kyle Zhao 3493ea85cc remove Logster from CSP whitelist (#6593) 
Logster 1.3 no longer has inline JS and is now CSP compliant
 2018-11-13 09:55:57 +11:00
Kyle Zhao 931480f7e3 DEV: run linter on Travis (#6595) 2018-11-12 14:39:58 -05:00
Kyle Zhao f9b36820ef FIX: only extract script tags with certain types (#6553) 
`script` tags with custom types (e.g. `text/template`) are not executed
by the browser, and should not be extracted into an external theme
JavaScript
 2018-11-01 16:01:46 -04:00
Kyle Zhao 57ab6bcba1 SECURITY: update loofah for CVE-2018-16468 2018-10-30 10:51:03 -04:00
Kyle Zhao a6eca28ec6 CSP - extract all other inline JavaScripts (#6528) 
* wizard page inline js

* print topic inline js

* drop JS for preventing double submission

this is the default behavior with Rails' UJS `disable_with` helper

* omniauth complete redirect JS

* account activate inline js
 2018-10-25 09:52:01 -04:00
Kyle Zhao 63356d883e FIX: GlobalPath#upload_cdn_path when S3 bucket has a folder (#6523) 2018-10-24 14:34:10 +11:00
Kyle Zhao 2cc195f3d9 prettier linting fix 2018-10-22 14:18:26 -04:00
Kyle Zhao e9a971a2b6 FEATURE: [Experimental] Content Security Policy (#6514) 
do not register new MIME type, parse raw body instead
 2018-10-22 13:22:23 -04:00
Kyle Zhao dca830cb73 Revert "FEATURE: [Experimental] Content Security Policy (#6504)" 
This reverts commit fb8231077a.
 2018-10-19 11:53:29 -04:00
Kyle Zhao fb8231077a FEATURE: [Experimental] Content Security Policy (#6504) 2018-10-19 10:39:22 -04:00
Kyle Zhao 0f1afad6da FIX: extracted theme JavaScripts for multisite (#6502) 
* FIX: extracted theme javascripts for multisite

* onceoff to rebake all theme fields
 2018-10-18 17:05:34 +11:00
Kyle Zhao 99d1ded3b3 rename route /javascripts to /theme-javascripts (#6495) 2018-10-15 11:32:52 -04:00
Kyle Zhao 6acdea37c4 DEV: extract inline js when baking theme fields (#6447) 
* extract inline js when baking theme fields
* destroy javascript cache when destroying theme fields

This work is needed to support CSP work
 2018-10-15 15:55:23 +11:00
Kyle Zhao ffc241eb25 FIX: multiple loadScript to the same url may resolve prematurely (#6474) 
This is how `loadScript(url)` currently deals with multiple concurrent requests

1. Check existing `<script>` tags, and mark existing scripts (other than the 
   input `url`) as loaded
2. Find "true" `url` of the requested resource (CDN, subfolder path, etc)
3. Check if we have loaded the resource with that "true" `url`, and resolve 
   immediately if we have
4. Otherwise insert a `<script>` tag with the "true" `url` to load it

For example, in a subfolder install:

- Input `url` = `/javascripts/script.js`
- "True" `url` = `/subfolder/javascript/script.js`

And the _very_ subtle bug here is that we should use also use the true `url` 
for step (1), because:

- Since the input and true `url` are different, we mistakenly mark the true 
  `url` as loaded in step one 
- After finding the true `url`, and setting `loaded[trueUrl] = true` in (1), we
  resolve the promise prematurely, when the resource could still be loading
 2018-10-11 08:55:36 +08:00
Kyle Zhao acba7d2a5d Extract discourse_javascript.html.erb to a scrip include 
* extract omniauth auth complete inline JS

* extract Ember error logging inline JS

* transpile `authentication-complete`

This is CSP related work
 2018-10-09 16:50:45 +11:00
Kyle Zhao 8b2a379e4e DEV: transpile certain ES6 files without producing a module (#6460) 
`.js.no-module.es6` files will be transpiled without producing a module.

import/export statements are deliberately not supported, so one would still need to use 
`const module = require('moduleName').default.`
 2018-10-09 09:18:23 +08:00
Kyle Zhao 9bbc1ae7b2 FIX: raise if staged user creation failed (#6461) 2018-10-08 15:45:23 +08:00
Kyle Zhao 7591da1e64 FIX: s3BaseUrl with small s 2018-10-02 13:06:33 +08:00
Kyle Zhao d9bea66365 UX: confirmation before changing group membership in admin (#6426) 2018-10-01 21:34:08 -07:00
Kyle Zhao ab448ca8f3 extract client side Discourse setup inline JS (#6409) 2018-10-01 21:29:04 -07:00
Kyle Zhao d0f660806d FIX: close data-preloaded div tag 2018-10-01 15:24:27 +08:00
Kyle Zhao 4b517d460d FIX: dashboard test depended on the last month has 31 days 2018-10-01 12:31:27 +08:00
Kyle Zhao 373d6e3fe6 always loadScript with a script tag (#6411) 
to avoid Content Security Policy unsafe-line violations
 2018-10-01 10:06:01 +08:00
Kyle Zhao 819f090d6a move large blobs out of <head> (#6428) 
it unnecessarily bloats the section and increases the payload
dramatically for open graph tags.
 2018-09-28 17:28:33 +08:00
Kyle Zhao e2462ada68 FIX: make theme import's public key field readonly (#6424) 
`disabled` attribute prevents the user from clicking or selecting in the
control whereas `readonly` does not.
 2018-09-24 09:12:49 +08:00
Kyle Zhao e402394375 FEATURE: auto grant an available title when removing old title 
* FEATURE: auto grant an available title when removing old title
 2018-09-21 12:06:08 +10:00
Kyle Zhao 4bb980b9f7 FEATURE: do not allow moderators to export user list (#6418) 2018-09-21 09:07:13 +08:00
Kyle Zhao 7a0232249a extract inline JS that's used to store preloaded data (#6370) 2018-09-17 16:31:46 +08:00
Kyle Zhao 7b19ed06c1 reworked specs of existing group behavior 2018-09-17 17:46:43 +10:00
Kyle Zhao 6751662bf8 DEV: yarn prettier in Danger (#6405) 
Use `yarn --silent` to suppress yarn console logs, and only allow for
prettier output.

Escape sequence (`\n`) does not work in single quotes
 2018-09-17 15:10:00 +08:00
Kyle Zhao 6659417807 FEATURE: match user title when primary group changes 
When primary group changes and the user's title is the previous primary
group's title, change the title to the new primary group's title
 2018-09-17 15:08:39 +10:00
Kyle Zhao f666d72606 extract inline JS for google tag manager 2018-09-17 09:56:00 +10:00
Kyle Zhao 38c70bfda2 extract inline JS for google analytics 2018-09-17 09:56:00 +10:00
Kyle Zhao f1cb431968 FIX: rescue ActiveRecord::RecordInvalid in find_or_create_by_safe! (#6385) 
AR uniqueness validation could raise ActiveRecord::RecordInvalid
 2018-09-12 11:03:12 +10:00
Kyle Zhao e25a6e085e FIX: drop title updates through RSS feeds 
can create an update loop
 2018-08-28 16:25:04 +10:00
Kyle Zhao baf413d527 FIX: update TopicEmbed's title and user correctly 2018-08-21 18:31:01 +08:00
Kyle Zhao 983dba37ce FIX: use BasicUserSerializer for user_badge.granted_by (#6266) 
BasicUserSerializer contains enough information for the badges page,
while UserSerializer issues ~100 SQL queries on the fly when serializing
the field without preloading.
 2018-08-14 08:11:14 +10:00
Kyle Zhao 1ed3a89ac9 UX: clear topic timer text when manually closing/opening (#6123) 
* UX: clear topic timer text when manually closing/opening

* added test for clearing topic timer status text
 2018-07-26 11:48:38 +10:00
Kyle Zhao c9d4288214 UX: auto fix order when reordering categories (#6149) 
* set correct position number when moving up/down

* UX: drop 'fix order' and auto re-order subcategory

- auto "fix position" on save
- place subcategories after parent category and maintain the relative
positions on save
 2018-07-24 10:25:40 +10:00
Kyle Zhao 2901691e87 FEATURE: per-category approval settings (#5778) 
- disallow moving topics to a category that requires topic approval
 2018-07-13 12:51:08 +10:00
Kyle Zhao 0cc4b42180 FIX: TopicEmbed.import should update title and author 2018-05-02 17:12:31 +10:00
Kyle Zhao 3e7638e3f5 Improve docker performance with delegated mount flag (#5760) 2018-04-16 10:56:35 +02:00
Kyle Zhao f7bd05e534 FEATURE: set 'Retry-After' header for 429 responses (#5659) 2018-03-13 23:12:41 +08:00
Kyle Zhao afaf9fd54c FIX: mods should be able to grant badges in post wrench (#5522) 2018-01-25 13:52:05 +11:00
Kyle Zhao 83c549bd31 FEATURE: grant badges in post admin wrench (#5498) 
* FEATURE: grant badges in post admin wrench

* only grant manually grantable badges

* extract GrantBadgeController mixin
 2018-01-22 14:10:53 +11:00
Kyle Zhao c52f747031 FEATURE: Catalan Translations (#5404) 2017-12-07 10:36:25 +01:00
Kyle Zhao 5f318a5241 FEATURE: Replace SimpleRSS with Ruby RSS module (#5311) 
* SPEC: PollFeedJob parsing atom feed

* add FeedItemAccessor

It is to provide a consistent interface to access a feed item's tag
content.

* add FeedElementInstaller

to install non-standard and non-namespaced feed elements

* FEATURE: replace SimpleRSS with Ruby RSS module

* get FinalDestination and download with Excon

* support namespaced element with FeedElementInstaller
 2017-12-06 10:45:09 +11:00
Kyle Zhao c1926e6dd2 FIX: do not generate multiple detail blocks when the selected input (#5290) 
consists of multiple lines
 2017-11-06 18:03:52 +11:00
Kyle Zhao 82c18f6ca3 fix: undefined variable in post:rebake_match 2017-10-24 20:05:58 -04:00
Kyle Zhao 0342324b47 FEATURE: support regex in rake post:remap (#5201) 2017-10-04 11:47:53 +11:00
Kyle Zhao 15cd3b78ae integration test for PollFeed job 2017-10-02 01:16:11 -04:00
Kyle Zhao ac666ddf17 PollFeed: check 'content:encoded' for content first 2017-10-02 01:16:11 -04:00
Kyle Zhao 133ab03c01 fix 'details' button acceptance test 2017-08-25 08:36:32 -07:00
Kyle Zhao 5868508e98 GH#retrieve_avatar: simplify conditional and restructured testing 2017-08-22 23:46:50 -04:00
Kyle Zhao 49f0119c12 FEATURE: import Github profile picture 2017-08-22 20:23:47 -04:00
Kyle Zhao 1a32de722b last attempt at fixing user page layout 
drop the width setting on the right column *completely* so it can
 adjust on it own

https://meta.discourse.org/t/long-words-not-wrapping-in-user-activity-page/68181
 2017-08-18 17:28:50 -04:00
Kyle Zhao 375153ce57 fixes overflowing div width on user activity page 
detailed explanation: https://meta.discourse.org/t/long-words-not-wrapping-in-user-activity-page/68181/8?u=xrav3nz
 2017-08-18 01:01:09 -04:00
Kyle Zhao 9c6c4a7705 restructure search-test to test all filters w/ variable visibiltiy 2017-08-09 04:42:50 -04:00
Kyle Zhao cea2a9fe53 UX: exclude irrelevant search filters for anonymous users 
On the advanced search page, filters like "I've read", "I'm watch
-ing", etc, are irrelevant to anonymous users and should be hidden
 2017-08-08 15:25:40 -04:00