Commit Graph
8469 Commits
Author SHA1 Message Date
David TaylorandMartin Brennan 07ef1a80a1 SECURITY: Fix invite link email validation (#18817)
See https://github.com/discourse/discourse/security/advisories/GHSA-x8w7-rwmr-w278

Co-authored-by: Martin Brennan <martin@discourse.org>
2022-11-01 16:33:32 +00:00
68b4fe4cf8 SECURITY: Expand and improve SSRF Protections (#18815)
See https://github.com/discourse/discourse/security/advisories/GHSA-rcc5-28r3-23rr

Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com>
Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>
2022-11-01 16:33:17 +00:00
Alan Guo Xiang Tan cfefdf0832 UX: Switch no categories/tags configured text in sidebar to a link (#18787)
Internal Ref: /t/73500
2022-10-31 06:42:55 +08:00
Gaurang Tandon 5ee5031bfa UX: Fix grammar typo in trust_level_unlocked_tip (#18793) 2022-10-31 06:25:37 +08:00
Penar Musaraj 0297c79cbe FIX: simplify display of multiple AJAX errors (#18763)
Our dialog service doesn't accept HTML by default and we shouldn't include HTML in the error message string. And given that the Ajax error handler is called in multiple contexts, it's tricky to properly support line breaks via either HTML or `\n` so we are opting for plain text in AJAX error messages.
2022-10-28 08:37:08 -04:00
Sam d99293d837 FEATURE: reduce suspicious distance logins warning to 100km (#18767)
Suspicious login emails are incredibly rare, we are concerned they are in
fact too rare. Attempt to reduce the distance down to 100km.
2022-10-28 07:01:11 +08:00
Blake Erickson 9b1536fb83 DEV: Update expired reset password copy (#18778) 2022-10-27 12:29:50 -06:00
Penar Musaraj 9ec62091c6 DEV: Update upload mismatch error message (#18759)
Following feedback from translators, it does not look like we need to
refer to an "upload stub" here.
2022-10-26 15:41:50 -04:00
Gerhard Schlager 3fbae5dd03 UX: Use a friendlier educational message (#18760)
See /t/82115/3
2022-10-26 20:53:57 +02:00
Discourse Translator Bot 5f02f11acc Update translations (#18740) 2022-10-25 17:00:49 +02:00
Penar Musaraj a14825836f UX: Show category edit button when in tag intersection (#18679)
Given that the category structure is generally speaking the backbone of most Discourse instances, it makes sense to show the edit button for the category even when the user is in a category/tag intersection route.
2022-10-20 15:04:21 -04:00
Bianca Nenciu 0be0bcfc7d FIX: Do not show a 404 page when visiting messages (#18652)
* DEV: Use list controller and action

It used an empty action handler which just returned the app and it
required another request to get the topic list. By using the correct
controller and action we can preload the topic list.
2022-10-20 16:24:56 +03:00
Bianca Nenciu 66904f2cd2 FEATURE: Add button to reset seen popups (#18586) 2022-10-20 09:06:39 +08:00
maiki 0f7d1f2420 UX: correct capitalization (#18671) 2022-10-19 10:53:09 -07:00
David Taylor 9a4072fe31 DEV: Load plugin CSS in tests (#18668) 2022-10-19 18:10:06 +01:00
Discourse Translator Bot 0af2837b73 Update translations (#18642) 2022-10-19 15:19:28 +02:00
Martin Brennan 7c25597da2 FEATURE: Generic hashtag autocomplete part 1 (#18592)
This commit adds a new `/hashtag/search` endpoint and both
relevant JS and ruby plugin APIs to handle plugins adding their
own data sources and priority orders for types of things to search
when `#` is pressed.

A `context` param is added to `setupHashtagAutocomplete` which
a corresponding chat PR https://github.com/discourse/discourse-chat/pull/1302
will now use.

The UI calls `registerHashtagSearchParam` for each context that will
require a `#` search (e.g. the topic composer), for each type of record that
the context needs to search for, as well as a priority order for that type. Core
uses this call to add the `category` and `tag` data sources to the topic composer.

The `register_hashtag_data_source` ruby plugin API call is for plugins to
add a new data source for the hashtag searching endpoint, e.g. discourse-chat
may add a `channel` data source.

This functionality is hidden behind the `enable_experimental_hashtag_autocomplete`
flag, except for the change to `setupHashtagAutocomplete` since only core and
discourse-chat are using that function. Note this PR does **not** include required
changes for hashtag lookup or new styling.
2022-10-19 14:03:57 +10:00
Keegan George 8791b6d5ee A11Y: Improve group search accessibility (#18651) 2022-10-18 12:55:44 -07:00
Penar Musaraj a2596fb306 A11Y: Add aria labels for posts in group activity (#18601)
This view can show multiple posts from the same topic and the aria labels
will now include the post number to more easily differentiate posts in
screen readers.
2022-10-18 13:58:26 -04:00
David Taylor be3d6a56ce DEV: Introduce minification and source maps for Theme JS (#18646)
Theme javascript is now minified using Terser, just like our core/plugin JS bundles. This reduces the amount of data sent over the network.

This commit also introduces sourcemaps for theme JS. Browser developer tools will now be able show each source file separately when browsing, and also in backtraces.

For theme test JS, the sourcemap is inlined for simplicity. Network load is not a concern for tests.
2022-10-18 18:20:10 +01:00
David Taylor 65a5c84a92 DEV: perform theme extra_js compilation all together
Previously, compiling theme 'extra_js' was done with a number of steps. Each theme_field would be compiled into its own value_baked column, and then the JavascriptCache content would be built by concatenating all of those compiled values.

This commit streamlines things by removing the value_baked step. The raw value of all extra_js theme_fields are passed directly to the ThemeJavascriptCompiler, and then the result is stored in the JavascriptCache.

In itself, this commit should not cause any behavior change. It is designed to open the door to more advanced compilation features which have interdependencies between different source files (e.g. template colocation, sourcemaps).
2022-10-18 10:10:49 +01:00
Martin Brennan 9879cb0e68 FIX: Clarify security key copy (#18636)
In user preferences, we want to make it more obvious
that a security key is a physical device, and also
you can use your phone.
2022-10-18 16:30:48 +10:00
Krzysztof Kotlarek 243efa8931 FEATURE: allow user to set preferred sidebar list destination (#18594)
User can choose between latest or new/unread and that preference will affect behavior of sidebar links.
2022-10-18 13:21:52 +11:00
Alan Guo Xiang Tan fff575ffd2 FEATURE: Add sidebar link for admin to configure default tags (#18593)
Displays a sidebar section link to admin users when
`default_sidebar_tags` site setting has not been configured for the
site.

Internal Ref: /t/73500
2022-10-17 12:08:32 +08:00
Alan Guo Xiang Tan ae6549a6ea FEATURE: Add sidebar link for admin to configure default categories (#18595)
Displays a sidebar section link to admin users when
`default_sidebar_categories` site setting has not been configured for the
site.

Internal Ref: /t/73500
2022-10-17 12:08:15 +08:00
Alan Guo Xiang Tan d1304ecb46 DEV: Move sidebar site settings to the sidebar category (#18596)
Sidebar category is only shown in the admin panel when `enable_experimental_sidebar_hamburger` site setting is enabled
2022-10-17 10:33:15 +08:00
chapoi 7ed87979a2 UX: theme setting highlight update (#18607) 2022-10-15 15:29:37 -05:00
Roman Rizzi 588bb2ccf2 A11Y: Add more information to the "reply to" button label. (#18604)
Includes the post number and poster's username for screen readers.
2022-10-14 17:47:29 -03:00
Tobias Eigen 07a6b6f55c updated copy for Create your Welcome Topic CTA (#18600)
Fixed a typo and added more guidance on info the welcome topic should contain.
2022-10-14 11:46:24 -07:00
Roman Rizzi 2933baa0ce A11Y: Signal the toggle header can reorder table elements. (#18597)
While navigating the table, indicate what the button does and if the user pressed it or not. Also, don't lose focus after reordering elements.
2022-10-14 13:28:20 -03:00
David Taylor e0a6d12c55 Use service account credentials for fetching google hd groups (#18329)
The previous implementation would attempt to fetch groups using the end-user's Google auth token. This only worked for admin accounts, or users with 'delegated' access to the `admin.directory.group.readonly` API.

This commit changes the approach to use a single 'service account' for fetching the groups. This removes the need to add permissions to all regular user accounts. I'll be updating the [meta docs](https://meta.discourse.org/t/226850) with instructions on setting up the service account.

This is technically a breaking change in behavior, but the existing implementation was marked experimental, and is currently unusable in production google workspace environments.
2022-10-13 16:04:42 +01:00
Andrei Prigorshnev 0fe111e492 FEATURE: add user status to user preferences (#18532) 2022-10-12 23:35:25 +04:00
Bianca Nenciu 7611fec0da FEATURE: Implement new onboarding popups (#18362)
This commit introduces a new framework for building user tutorials as
popups using the Tippy JS library. Currently, the new framework is used
to replace the old notification spotlight and tips and show a new one
related to the topic timeline.

All popups follow the same structure and have a title, a description and
two buttons for either dismissing just the current tip or all of them
at once.

The state of all seen popups is stored in a user option. Updating
skip_new_user_tips will automatically update the list of seen popups
accordingly.
2022-10-12 18:38:45 +03:00
Rafael dos Santos Silva 6888eb5c2d Revert "Revert "FEATURE: Preload resources via link header (#18475)" (#18511)" (#18531)
* Revert "Revert "FEATURE: Preload resources via link header (#18475)" (#18511)"

This reverts commit 95a57f7e0c.

* put behind feature flag

* env -> global setting

* declare global setting

* forgot one spot
2022-10-11 20:11:44 -03:00
Jordan Vidrine 356cf358f7 FIX: Change text (#18545) 2022-10-11 11:49:39 -05:00
Osama Sayegh ac9fbb56a4 DEV: Improve UX for user menu tabs when they're empty (#18520)
This commit adds more helpful/education messages that show up in the replies and "other notifications" tabs when they're empty. Internal topic: t/76879.
2022-10-11 18:33:09 +03:00
Rafael dos Santos Silva 4d525a70be DEV: Increase nginx proxy buffer size (#18530)
* DEV: Increase nginx proxy buffer size

This is needed so we can reland the patch to move our asset preloading
from link tags in the response document to response headers.
2022-10-11 11:33:07 -03:00
Discourse Translator Bot f7db4150da Update translations (#18543) 2022-10-11 16:29:04 +02:00
Martin Brennan 472abe532e DEV: Add experimental setting for hashtag-autocomplete changes (#18537)
This initial PR just adds a enable_experimental_hashtag_autocomplete
setting, and related JS & HBR files, replacing direct setup of
the autocomplete within d-editor and instead using the new
lib/hashtag-autocomplete. This is the beginning of preparations
to allow other data sources to be added to this autocomplete,
as well as a redesign of the menu and rendered tags in the composer
preview and posts.
2022-10-11 13:15:16 +10:00
Martin Brennan 086f4775cd FIX: Hide old PM settings (#18535)
Follow up to e62e93f83a.
It's confusing and unexpected that deprecated settings
unconditionally change the new setting's value via the
`SiteSettingsController`, even if `override` was set to `false`,
a follow-up PR will correct the issue in `SiteSettingsController`.
2022-10-11 10:13:53 +10:00
Bianca Nenciu dc89b72d46 FIX: Show error if field is same as password (#18529)
* FIX: Show user fields validation errors

* FIX: Show error if user field is same as password
2022-10-10 20:00:52 +03:00
Bianca Nenciu 08ab09c928 FIX: Remove public topic invite functionality (#18488)
This can no longer be used from the user interface and could be used to
generate useless topic invites notifications. This commit adds site 
setting max_topic_invitations_per_minute to prevent invite spam.
2022-10-10 19:21:51 +03:00
Penar Musaraj a1d67122b1 DEV: Refactor the last few bootbox dialogs (#18416) 2022-10-07 11:38:27 -04:00
Jan Cernik 08476f17ff FEATURE: Add dark mode option for category logos (#18460)
Adds a new upload field for a second dark mode category logo. 
This alternative will be used when the browser is in dark mode (similar to the global site setting for a dark logo).
2022-10-07 11:00:44 -04:00
Discourse Translator Bot e812e10c3b Update translations (#18470) 2022-10-05 15:32:10 +02:00
Alan Guo Xiang Tan 63b7f7c85c UX: More... -> More in Sidebar (#18482)
We already have an icon so `...` is redundant
2022-10-05 12:50:30 +08:00
Bianca Nenciu cf646b2061 FIX: Count resulting bulk invites correctly (#18461)
Skipped invites were not counted at all and some invites could generate
more than one error and resulted in a grand total that was not equal to
the count of bulk invites.
2022-10-04 18:41:06 +03:00
Alan Guo Xiang Tan de071fc1e8 DEV: Convert messages user page nav to experimental redesign (#18456)
No tests are written for now as we're still in a highly iterative stage
2022-10-04 12:05:09 +08:00
Blake Erickson 3b86974367 FEATURE: Make General the default category (#18383)
* FEATURE: Make General the default category

* Set general as the default category in the composer model instead

* use semicolon

* Enable allow_uncategorized_topics in create_post spec helper for now

* Check if general_category_id is set

* Enable allow_uncategorized_topics for test env

* Provide an option to the create_post helper to not set allow_uncategorized_topics

* Add tests to check that category… is not present and that General is selected automatically
2022-09-30 12:20:21 -06:00
Bianca Nenciu 35a90b6a3f FIX: Add better and more strict invite validators (#18399)
* FIX: Add validator for email xor domain

* FIX: Add validator for max_redemptions_allowed

* FIX: Add validator for redemption_count
2022-09-30 13:35:00 +03:00