Commit Graph
100 Commits
Author SHA1 Message Date
Sam f8305f53c7 FEATURE: special offline support restricted to Android only
The special offline page with fetch interception in service worker
is only strongly required on Android ad a pre-req for PWAs

This is now strongly restricted only to Android while iOS PWA support
gets better

Long term if we build offline support we can unlock it more globally
2018-10-29 16:29:19 +11:00
Sam 5c86e2d749 tweaks to related message list generation
- exclude users in groups I am in from related message search
- correctly limit number of related messages
2018-10-29 16:09:58 +11:00
Sam 9933059426 FEATURE: push related PMs to take first 3 slots
Previously the related PMs were last meaning you would have to work through
all unread to see them.

Also amends it so it either asks for related by group OR user not both.
2018-10-29 10:47:59 +11:00
Sam Saffron abaa3f0650 FEATURE: add server:before-head-close-crawler outlet for plugins
This outlet allows plugins to inject html prior to closing head tag
2018-10-25 16:31:05 +11:00
Sam e955a7b49d Revert "Revert "FIX: GlobalPath#upload_cdn_path when S3 bucket has a folder (#6523)""
This reverts commit 322b27b6dc.

Oops rushed on the revert here... should be good
2018-10-24 15:14:01 +11:00
Sam 322b27b6dc Revert "FIX: GlobalPath#upload_cdn_path when S3 bucket has a folder (#6523)"
This reverts commit 63356d883e.

This caused an outage, got to revert
2018-10-24 15:03:58 +11:00
Sam 5fd94d3211 PERF: limit unread count to 99 in blue circle
This revises: https://github.com/discourse/discourse/commit/e605542c4e1ee8f67dffd06e7422cc17c83c243e

Previous commit was faulty
2018-10-24 12:10:27 +11:00
Sam e605542c4e PERF: limit unread count to 99 in the blue circle
This safeguard is in place to avoid very expensive queries on the server
side
2018-10-24 11:53:28 +11:00
Sam 29fdb50338 FIX: if poll has not options do not break serializer
Note: we have a proper rewrite of this plugin in progress
it will address this issue in a proper way
2018-10-24 10:04:17 +11:00
Sam Saffron 64aca0dc1b FIX: remove duplicate referrer policy
Rails already ships with strict-origin-when-cross-origin, no need
to also add no-referrer-when-downgrade

see: https://meta.discourse.org/t/harden-referrer-policy-header/100172
2018-10-24 08:38:39 +11:00
Sam de6b585368 minor, bypass gravatar update if user does not match
this protects against a race condition that can happen when a user record
is destroyed reasonably quickly
2018-10-23 12:20:41 +11:00
Sam b74dd7d379 FIX: stop logging every 404 error when searching for gravatars 2018-10-23 11:43:14 +11:00
Sam adab7a3a48 improve test, also ensure no zero size is generated 2018-10-23 08:50:07 +11:00
Sam bea8d337b2 DEV: ensure resizing test does not raise bad error
Current resizing test was showing binary diff in terminal and failing
in latest image magick 7, this fixes both issues
2018-10-23 08:45:06 +11:00
Sam 9bfc939692 cleanup so gravatar download failures are consistent
previously we would ignore socket error, but this would mean that
there could be conditions where we would keep trying to download
gravatars forever (in an hourly job)
2018-10-19 12:51:55 +11:00
Sam 19d7543004 FIX: clear color scheme cache when clearing theme cache 2018-10-16 12:00:46 +11:00
Sam fc94732f88 avoid looking up badge multiple times in spec 2018-10-16 10:42:16 +11:00
Sam 8d06731484 FIX: reduce amount of work onceoff does
In the past onceoff was forcing inline download of gravatars,
this can be so expensive that it will never finish

This fix ensures it only marks avatars stale which will be picked
up by regular schedules
2018-10-16 10:29:16 +11:00
Sam 4c8fe13500 FIX: remove code that restricted "header" theme field from admin
There was some old code that restricted a percentage of a themes code from
admin, only when admin was refreshed, this leads to lots of confusion

Conditional is now removed
2018-10-15 17:29:10 +11:00
Sam 3aceda2dfd Update to latest version of message bus
This includes DistributedCache which we will be using and perf fixes
2018-10-15 13:49:04 +11:00
Sam 057087e0e8 FEATURE: log long running jobs in the defer queue
If a job in the defer queue takes longer than 90 seconds log an error
2018-10-12 17:03:47 +11:00
Sam a1c912b630 Return 400 instead of 404 for bad token 2018-10-12 10:51:41 +11:00
Sam 45f01e637b FIX: when associating Github account disassociate others
There are some cases where an email floats from one GitHub account to another
if this happens just take over the Github mapping record
2018-10-10 15:46:50 +11:00
Sam 59ce11d10c ignore maxmind db 2018-10-10 14:30:51 +11:00
Sam 9b01e2b855 FIX: maxmind download task does not need environment 2018-10-10 11:16:28 +11:00
Sam 550e108a8c FEATURE: only export settings that changed via rake task 2018-10-08 11:54:52 +11:00
Sam 5b630f3188 FIX: stop logging every time invalid params are sent
Previously we were logging warning for invalid encoded params, this can
cause a log flood
2018-10-05 14:33:19 +10:00
Sam 378584fdc0 correct under reporting of memory in memory profiler 2018-10-04 17:02:53 +10:00
Sam 0e10b47618 UX: make responsive_post_image_sizes a visible site setting
This is useful for sites that want to cut bandwidth by decreasing
fidelity of thumbnails.
2018-10-03 15:06:37 +10:00
Sam eba3117e08 Missed one spot where url needed cooking 2018-10-03 15:06:37 +10:00
Sam 41eacd859e temporarily comment out test 2018-10-03 14:07:30 +10:00
Sam ad0e768742 FEATURE: add support for responsive images in posts
When creating lightboxes we will attempt to create 1.5x and 2x thumbnails
for retina screens, this can be controlled with a new hidden site setting
called responsice_post_image_sizes, if you wish to create 3x images run

SiteSetting.responsive_post_image_sizes = "1|1.5|2|3"


The default should be good for most of the setups as it balances filesize
with quality. 3x thumbs can get big.
2018-10-03 13:44:53 +10:00
Sam a6f0436a29 FEATURE: change default to enable login by email out-of-the-box 2018-10-03 10:16:52 +10:00
Sam 580c923ff3 UX: remove flex basis from first item
We do not want to take up 100% width for name/username on first line
2018-10-02 13:16:51 +10:00
Sam 120c220c18 UX: correct ordering of username / fullname in UX 2018-10-02 12:56:50 +10:00
Sam Saffron a2b6eed284 FIX: correct compilation issues on clang 10
In MacOS we need different compilation flags now that some are
deprecated in clang 10, this is not specific to mojave which was
the previous fix
2018-09-28 09:42:06 +08:00
Sam Saffron afd2edabe4 DEV: update mini_racer for Mojave support
MacOS Mojave deprecates some libraries making it a bit
harder to compile Mini Racer, this release adds support
2018-09-26 07:43:34 +08:00
Sam e622adfb89 correct warning 2018-09-21 12:05:08 +10:00
Sam ae674dcb4e Merge branch 'theme-select-mobile' of https://github.com/jjaffeux/discourse 2018-09-21 12:04:07 +10:00
Sam df45e82377 SECURITY: only allow picking of avatars created by self (#6417)
* SECURITY: only allow picking of avatars created by self

Also adds origin tracking to all uploads including de-duplicated uploads
2018-09-19 22:33:10 -07:00
Sam e0be5145cf FIX: correct readonly timeout
So it only applies in readonly mode
2018-09-20 15:15:46 +10:00
Sam e0e6dae6a7 minor cleanup to previous commit from code review 2018-09-19 16:07:29 +10:00
Sam 5302709343 FIX: in redis readonly raise an exception from DistributedMutex
If we detect redis is in readonly we can not correctly get a mutex
raise an exception to notify caller

When getting optimized images avoid the distributed mutex unless
for some reason it is the first call and we need to generate a thumb

In redis readonly no thumbnails will be generated
2018-09-19 15:50:58 +10:00
Sam 7d6b348d0b SECURITY: correct XSS on long topic titles 2018-09-18 08:54:44 +10:00
Sam 0e9841b995 SECURITY: remove admin memory diagnostics routes 2018-09-18 08:35:09 +10:00
Sam 33541c4096 FEATURE: unconditionally omit no-follow for staff
Previously TL2 and below staff would have links
no-followed which was never intended
2018-09-17 12:02:20 +10:00
Sam 37c5280f73 correct spec 2018-09-17 11:37:01 +10:00
Sam e15a1e7c38 lint code 2018-09-17 11:10:09 +10:00
Sam 725d2c0d47 correct spec 2018-09-17 10:54:35 +10:00
Sam b63630d70b use Mixin postfix when importing tags mixin 2018-09-17 10:46:57 +10:00
Sam bc4e2aa07c correct prettier offence 2018-09-17 10:30:36 +10:00
Sam 173d0d53d5 correct erratic spec 2018-09-17 10:12:00 +10:00
Sam 419b14e58b FIX: correctly keep stylesheet cache entries
The intent from day one was to keep MAX_TO_KEEP stylesheets per target
however the DELETE statement did not perform target filtering

This meant we often deleted the wrong stylesheets from the cache
2018-09-14 12:54:11 +10:00
Sam 5bb7cc8710 FIX: update PG gem
We need the newer PG gem to fix issues around rb_wait_for_single_fd that
pop up in rare conditions
2018-09-13 21:57:20 +10:00
Sam 49f1f10f75 file is a .js file so don't use let 2018-09-13 14:58:45 +10:00
Sam daa02431df FIX: remove div used to measure textarea position
Also corrects the positioning of autocomplete (when typing @ or emoji)

Previously there were edge conditions where autocomplete would be hundreds
of pixels away due to a bug measuring.


This correct an issue where Firefox ends up having an enormous blank space
at the bottom of topics after editing.
2018-09-13 14:53:32 +10:00
Sam d1984a0b4d FIX: display a correct error when attempting to agree on a deferred flag
Previously we would raise a 500 error if a moderator tried to agree on a
flag another moderator deferred.

This can happen cause the UX for flags does not live refresh as flags
are handled
2018-09-12 13:16:59 +10:00
Sam 103f9b5dc7 UX: missing translation in AWS site settings 2018-09-11 09:34:02 +10:00
Sam e64402cb3b SECURITY: correct edge case when SSO provides unvalidated emails 2018-09-11 08:24:02 +10:00
Sam 879067d000 FIX: check admin theme cookie against user selectable
previously admin got a free pass and could set theme via cookie to anything
including themes that are not selectable

this refactor ensures that only "preview" gets a free pass, all the rest
goes through the same pipeline
2018-09-07 10:47:28 +10:00
Sam 56b6a4779d FIX: make route to tag more robust
There are some edge cases where code would fail here, so adding protection
2018-09-06 17:24:32 +10:00
Sam 5bdc00c3be FIX: do not automatically route all actions to hovered posts
This feature (hitting d when a post is hovered with mouse deletes) causes a lot of confusion and is very risky.
2018-09-06 10:34:58 +10:00
Sam d9c0dc8687 correct prev commit
s3. did not exists it is s3-
2018-09-05 16:11:44 +10:00
Sam 83e1315e42 FIX: correct urls in uploads table to point at dualstack
Last week we added support for dual stack urls but did not remap the
the old records in the uploads and optimized images table

This caused a few minor edge cases worst was that if you rebaked old
images S3 CDN was not repopulated.
2018-09-05 15:58:04 +10:00
Sam 6e3f249aea Disable auth token logging
We have a work in progress feature that required the logging,
This feature is not going to be shipped for a while so disabling this
for now.
2018-09-04 17:05:17 +10:00
Sam e4498d2a8a FIX: keep db and job correctly in multisite logs
This ensures we report job and db correctly, previously we were
only reporting this on default
2018-09-04 16:05:44 +10:00
Sam ad70502ab8 FIX: ignore invalid usernames in incoming link tracker
If an incoming link username has NULL in it simply ignore it
2018-09-04 12:28:32 +10:00
Sam 2f5c21e28c FIX: return a 400 error instead of 500 for null injections
Many security scanners like to inject NULL in inputs causing application
to exception out and return a 500

We now handle this exception and render a 400 status back
2018-09-04 12:11:52 +10:00
Sam fcae21c4fc remove test that is no longer relevant 2018-09-04 10:52:12 +10:00
Sam 3748d3e281 UX: hide associate accounts if second factor is enabled
Once second factor is enabled all login via associated accounts is banned
showing this section just leads to confusion
2018-09-04 10:42:39 +10:00
Sam 155eb02c7e UX: remove auth token log from user page
This feature is not quite ready so we are deferring on it for a few more weeks
2018-09-04 10:28:33 +10:00
Sam b3aab1770f FIX: set old last modified date for invalid avatars
In some cases Akami was holding tight to these invalid avatars,
to avoid this happening we explain the avatar image is ancient
then when a new upload is added it automatically is older than
this.
2018-08-31 17:07:31 +10:00
Sam 1866a8e8da correct invalid spec 2018-08-31 15:06:30 +10:00
Sam e1975e293f FIX: when uploads are destroyed clear up avatar refs in user table
This also auto corrects twice daily when we ensure consistency
2018-08-31 14:46:42 +10:00
Sam 9b7cab589a FIX: revert diacritic stripping
See more details in test case and at: https://meta.discourse.org/t/discourse-should-ignore-if-a-character-is-accented-when-doing-a-search/90198/16?u=sam
2018-08-31 11:46:55 +10:00
Sam e6970151a6 FEATURE: allow specifying locale via SSO
Use:

locale
locale_force_update

To force user locale on users where SiteSetting.allow_user_locale is enabled

Note: If an invalid locale is specified no action will occur
2018-08-30 09:58:03 +10:00
Sam 44cf3cf975 FIX: queue heartbeats in readonly modes
If sidekiq is paused or Discourse is in readonly continue to queue
heartbeats

If we do not do that then a master process can end up reaping sidekiq
workers and causing various badness

This also impacts restore which can do weird stuff TM in cases like this
2018-08-29 12:36:59 +10:00
Sam 740308675b FEATURE: erode bounce score every time an email is sent
Introduces a hidden setting (default is 0.1) that erodes bounce score
every time we send an email. This means that erratic failures are less
painful cause system auto corrects
2018-08-28 17:02:12 +10:00
Sam 9ab1fb7dfc FEATURE: correctly store width and height on uploads
Previously we used width and height for thumbnails, new code ensures

1. We auto correct width and height
2. We added extra columns for thumbnail_width and height, this is determined
 by actual upload and no longer passed in as a side effect
3. Optimized Image now stores filesize which can be used for analysis, decisions

Also

- fixes Android image manifest as a side effect
- fixes issue where a thumbnail generated that is smaller than the upload is no longer used
2018-08-28 12:59:22 +10:00
Sam dc17ae3b2f correct specs 2018-08-27 14:50:56 +10:00
Sam 4205c528d0 FEATURE: hide enable_personal_email_messages and min_trust_to_send_email_messages
These site settings are very hard to explain and only applicable for very
specific Discourse setups.

If an admin "enables staged users" which is used in support scenarios then
all staff can send "messages" directly to an "email".

The setting allows you to extend this to TL4 or any trust level.

Actual use case would be a support type setup with restricted staff. It is
quite rare so hiding this for now and re-evaluate keeping the setting in
2019
2018-08-27 11:38:22 +10:00
Sam b760f66523 Upgrade PG gem to latest
This unlocks some performance improvements
2018-08-27 10:58:19 +10:00
Sam 47e6b8b318 discourse etiquette is an official plugin 2018-08-27 10:03:49 +10:00
Sam ac11f8df52 correct regression searching with diacritics 2018-08-24 10:00:51 +10:00
Sam 29315b73c2 FIX: improve last_modified date returned for avatars
instead of hard coding a date:

1. For optimized images use the upload date when on s3
2. For not-found use 10 minutes ago to match the expiry
2018-08-24 09:36:11 +10:00
Sam 6ee352510a Correctly handle exception 2018-08-23 16:27:00 +10:00
Sam cbd9045c6b FIX: avoid race condition creating posts
in some cases the distributed mutex was not protecting us
and transactions would fail
2018-08-23 15:11:06 +10:00
Sam 5a6d1ee257 FIX: defer actions in a static method
This avoids capturing a huge closure and passing to defer
2018-08-22 14:36:56 +10:00
Sam d3b4f24ced DEV: correct watcher for controller specs 2018-08-22 14:35:57 +10:00
Sam 272de95175 FIX: client duplicate registration should be cleaned up
If for any reason we are unable to correct client id on a user api key
invalidate old keys for client/user
2018-08-22 12:56:49 +10:00
Sam 5d96809abd FIX: improve support for subfolder S3 CDN 2018-08-22 12:31:13 +10:00
Sam f5142861e5 Revert "Revert "FIX: upload URLs from S3 on subfolder installs""
This reverts commit 26c96e97e5.

We have no choice but to run this code
2018-08-22 11:31:33 +10:00
Sam 26c96e97e5 Revert "FIX: upload URLs from S3 on subfolder installs"
This reverts commit 357df2ff4f.
2018-08-22 10:51:40 +10:00
Sam 2d96160192 FEATURE: improve API error reporting for invalid records 2018-08-21 11:54:34 +10:00
Sam f939bdbf44 FIX: if user is logged off return 404 instead of 500
Return correct error when attempting to publish presence for
a logged out user.
2018-08-21 11:22:40 +10:00
Sam 57d04200a1 Add Rails 6 note here 2018-08-21 11:09:10 +10:00
Sam ca5a6f0a9d FIX: handle concurrently creating post reply keys
In some very rare conditions this would be called concurrently and fail
2018-08-21 10:59:18 +10:00
Sam 8fa5dd4a1f FEATURE: discourse-checklist is now an official plugin 2018-08-21 10:44:40 +10:00
Sam f5fe58384f correct regression around file renaming 2018-08-20 16:08:05 +10:00
Sam ce4b12ae59 FIX: if we have not target available do not redirect 2018-08-20 13:10:59 +10:00