807 Commits (1d1639d46f15c5a9c84d3ccfc7a334244c28039a)

Author SHA1 Message Date
Barış Soner Uşaklı 67f44a3212 feat: add back support for req.body._csrf
used in login.tpl etc for noscript login
2 years ago
Barış Soner Uşaklı 51096ad234 poc: use csrf_token in ws handshake (#11573) 2 years ago
Julian Lam 686ecea123 fix: #11589, regression where a user could not confirm their email if requireEmailAddress was enabled 2 years ago
Barış Soner Uşaklı e1473bcc2d fix: strip html tags from browser title 2 years ago
Julian Lam 84313712a2 fix: add an additional check on page load to enforce `requireEmailAddress` setting
The old behaviour would require that an email be entered, but did not block access to the forum (nor did it ensure that the email was verified).

The new behaviour (if the setting is enabled) will ensure that only those users with a confirmed email can continue through.

The only exceptions are super admins (so they don't get locked out).
2 years ago
Julian Lam d814e281a0 feat: write API shorthand to query post routes by their topic index (requires tid in either query string or request body)
middleware.checkRequired is also updated to check for matches in req.query as well.
2 years ago
Barış Soner Uşaklı af7ab9b468 Merge branch 'master' into develop 2 years ago
Veronikya c931183287
fix: NodeBB#11482 thumbs Post Can not upload a thumbnail, only multip… (#11483)
* fix: NodeBB#11482 thumbs Post Can not upload a thumbnail, only multiple uploads

* Modify upload thumbnail test

* Modify upload thumbnail test +,

* Get rid of v2 uploads test

* edit times

* Modify amount of files associated post test

* edit post file amount
2 years ago
Julian Lam 2615c1e584 fix: #11426, proper v3 style error on maintenance mode [breaking]
The v3-style error only applies to v3 routes. Existing Read API and page routes are unaffected.
2 years ago
Julian Lam efa64032dd feat: log the last time a valid api token was seen, have v3 ping route go through setupApiRoute helper 2 years ago
Barış Soner Uşaklı 7ba70d1561
Bootstrap5 (#10894)
* chore: up deps

* chore: up composer

* fix(deps): bump 2factor to v7

* chore: up harmony

* chore: up harmony

* fix: missing await

* feat: allow middlewares to pass in template values via res.locals

* feat: buildAccountData middleware automatically added ot all account routes

* fix: properly allow values in res.locals.templateValues to be added to the template data

* refactor: user/blocks

* refactor(accounts): categories and consent

* feat: automatically 404 if exposeUid or exposeGroupName come up empty

* refactor: remove calls to getUserDataByUserSlug for most account routes, since it is populated via middleware now

* fix: allow exposeUid and exposeGroupName to work with slugs with mixed capitalization

* fix: move reputation removal check to accountHelpers method

* test: skip i18n tests if ref branch when present is not develop

* fix(deps): bump theme versions

* fix(deps): bump ntfy and 2factor

* chore: up harmony

* fix: add missing return

* fix: #11191, only focus on search input on md environments and up

* feat: allow file uploads on mobile chat

closes https://github.com/NodeBB/NodeBB/issues/11217

* chore: up themes

* chore: add lang string

* fix(deps): bump ntfy to 1.0.15

* refactor: use new if/each syntax

* chore: up composer

* fix: regression from user helper refactor

* chore: up harmony

* chore: up composer

* chore: up harmony

* chore: up harmony

* chore: up harmony

* chore: fix composer version

* feat: add increment helper

* chore: up harmony

* fix: #11228 no timestamps in future 

* chore: up harmony

* check config.theme as well

fire action:posts.loaded after processing dom

* chore: up harmony

* chore: up harmony

* chore: up harmony

* chore: up themes

* chore: up harmony

* remove extra class

* refactor: move these to core from harmony

* chore: up widgets

* chore: up widgets

* height auto

* fix: closes #11238

* dont focus inputs, annoying on mobile

* fix: dont focus twice, only focus on chat input on desktop

dont wrap widget footer in row

* chore: up harmony

* chore: up harmony

* update chat window

* chore: up themes

* fix cache buster for skins

* chat fixes

* chore: up harmony

* chore: up composer

* refactor: change hook logs to debug

* fix: scroll to post right after adding to dom

* fix: hash scrolling and highlighting correct post

* test: re-enable read API schema tests

* fix: add back schema changes for 179faa2270f2ad955dcc4a7b04755acce59e6ffd and c3920ccb10d8ead2dcd9914bb1784bed3f6adfd4

* fix: schema changes from 488f0978a4

* fix: schema changes for f4cf482a87

* fix: schema update for be6bbabd0e

* fix: schema changes for 69c96078ea

* fix: schema changes for d1364c3130

* fix: schema changes for 84ff1152f7

* fix: schema changes for b860c2605c

* fix: schema changes for 23cb67a112

* fix: schema changes for b916e42f40

* fix: schema change for a9bbb586fc

* fix: schema changes for 4b738c8cd3

* fix: schema changes for 58b5781cea

* fix: schema changes for 794bf01b21

* fix: schema changes for 80ea12c1c1, e368feef51, and 52ead114bec961c62fa2eb0786540e229f6e4873

* fix: composer-default object in config?

* fix: schema changes for 9acdc6808c and 093093420027999df3c67bf0ea6024f6dbf81d2d

* fix: schema changes for c0a52924f1

* fix: schema change for aba420a3f3, move loggedInUser to optional props

* fix: schema changes for 8c67031609

* fix: schema changes for 27e53b42f3

* fix: schema changes for 2835966518

* fix: breaking test for email confirmation API call

* fix: schema changes for refactored search page

* fix: schema changes for user object

* fix: schema changes for 9f531f957e

* fix: schema changes for c4042c70de and 23175110a2

* fix: schema changes for 9b3616b10392e247974eb0c1e6225a1582bf6c69

* fix: schema changes for 5afd5de07d

* fix: schema change for 1d7baf12171cffbd3af8914bef4e6297d1160d49

* fix: schema changes for 57bfb37c55a839662144e684875003ab52315ecc and be6bbabd0e

* fix: schema changes for 6e86b4afa20d662af8b9f1c07518df2d8c258105 and 3efad2e13b7319eb9a1f4fda7af047be43ebc11f and 68f66223e73a72f378f193c83a9b5546bede2cda

* fix: allowing optional qs prop in pagination keys (not sure why this didn't break before)

* fix: re-login on email change

* fix: schema changes for c926358d73

* fix: schema changes for 388a8270c9882892bad5c8141f65da8d59eac0fd

* fix: schema change for 2658bcc821c22e137a6eeb9bb74098856a642eaf

* fix: no need to call account middlewares for chats routes

* fix: schema changes for 71743affc3e58dc85d4ffa15ce043d4d9ddd3d67

* fix: final schema changes

* test: support for anyOf and oneOf

* fix: check thumb

* dont scroll to top on back press

* remove group log

* fix: add top margin to merged and deleted alerts

* chore: up widgets

* fix: improve fix-lists mixin

* chore: up harmony/composer

* feat: allow hiding quicksearch results during search

* dont record searches made by composer

* chore: up 54

* chore: up spam be gone

* feat: add prev/next page and page count into mobile paginator

* chore: up harmony

* chore: up harmony

* use old style for IS

* fix: hide entire toolbar row if no posts or not singlePost

* fix: updated messaging for post-queue template, #11206

* fix: btn-sm on post queue back button

* fix: bump harmony, closes #11206

* fix: remove unused alert module import

* fix: bump harmony

* fix: bump harmony

* chore: up harmony

* refactor: IS scrolltop

* fix: update users:search-user-for-chat source string

* feat: support for mark-read toggle on chats dropdown and recent chats list

* feat: api v3 calls to mark chat read/unread

* feat: send event:chats.mark socket event on mark read or unread

* refactor: allow frontend to mark chats as unread, use new API v3 routes instead of socket calls, better frontend event handling

* docs: openapi schema updates for chat marking

* fix: allow unread state toggling in chats dropdown too

* fix: issue where repeated openings of the chats dropdown would continually add events for mark-read/unread

* fix: debug log

* refactor: move userSearch filter to a module

* feat(routes): allow remounting /categories (#11230)

* feat: send flags count to frontend on flags list page

* refactor: filter form client-side js to extract out some logic

* fix: applyFilters to not take any arguments, update selectedCids in updateButton instead of onHidden

* fix: use userFilter module for assignee, reporterId, targetUid

* fix(openapi): schema changes for updated flags page

* fix: dont allow adding duplicates to userFilter

* use same var

* remove log

* fix: closes #11282

* feat: lang key for x-topics

* chore: up harmony

* chore: up emoji

* chore: up harmony

* fix: update userFilter to allow new option `selectedBlock`

* fix: wrong block name passed to userFilter

* fix: https://github.com/NodeBB/NodeBB/issues/11283

* fix: chats, allow multiple dropdowns like in harmony

* chore: up harmony

* refactor: flag note adding/editing, closes #11285

* fix: remove old prepareEdit logic

* chore: add caveat about hacky code block in userFilter module

* fix: placeholders for userFilter module

* refactor: navigator so it works with multiple thumbs/navigators

* chore: up harmony

* fix: closes #11287, destroy quick reply autocomplete

on navigation

* fix: filter disabled categories on user categories page count

* chore: up harmony

* docs: update openapi spec to include info about passing in timestamps for topic creation, removing timestamp as valid request param for topic replying

* fix: send back null values on ACP search dashboard for startDate and endDate if not expicitly passed in, fix tests

* fix: tweak table order in ACP dash searches

* fix: only invoke navigator click drag on left mouse button

* feat: add back unread indicator to navigator

* clear bookmark on mark unread

* fix: navigator crash on ajaxify

* better thumb top calculation

* fix: reset user bookmark when topic is marked unread

* Revert "fix: reset user bookmark when topic is marked unread"

This reverts commit 9bcd85c2c6848c3d325d32027261809da6e11c9e.

* fix: update unread indicator on scroll, add unread count

* chore: bump harmony

* fix: crash on navigator unread update when backing out of a topic

* fix: closes #11183

* fix: update topics:recent zset when rescheduling a topic

* fix: dupe quote button, increase delay, hide immediately on empty selection

* fix: navigator not showing up on first load

* refactor: remove glance

assorted fixes to navigator
dont reduce remaning count if user scrolls down and up quickly
only call topic.navigatorCallback when index changes

* more sanity checks for bookmark

dont allow setting bookmark higher than topic postcount

* closes #11218, 🚋

* Revert "fix: update topics:recent zset when rescheduling a topic"

This reverts commit 737973cca9e94b6cb3867492a09e1e0b1af391d5.

* fix: #11306, show proper error if queued post doesn't exist

was showing no-privileges if someone else accepted the post

* https://github.com/NodeBB/NodeBB/issues/11307

dont use li

* chore: up harmony

* chore: bump version string

* fix: copy paste fail

* feat: closes #7382, tag filtering

add client side support for filtering by tags on /category, /recent and /unread

* chore: up harmony

* chore: up harmony

* Revert "fix: add back req.query fallback for backwards compatibility" [breaking]

This reverts commit cf6cc2c454dc35c330393c62ee8ce67b42d8eefb.
This commit is no longer required as passing in a CSRF token via query parameter is no longer supported as of NodeBB v3.x

This is a breaking change.

* fix: pass csrf token in form data, re: NodeBB/NodeBB#11309

* chore: up deps

* fix: tests, use x-csrf-token query param removed

* test: fix csrf_token

* lint: remove unused

* feat: add itemprop="image" to avatar helper

* fix: get chat upload button in chat modal

* breaking: remove deprecated socket.io methods

* test: update messaging tests to not use sockets

* fix: parent post links

* fix: prevent post tooltip if mouse leaves before data/tpl is loaded

* chore: up harmony

* chore: up harmony

* chore: up harmony

* chore: up harmony

* fix: nested replies indices

* fix(deps): bump 2factor

* feat: add loggedIn user to all api routes

* chore: up themes

* refactor: audit admin v3 write api routes as per #11321

* refactor: audit category v3 write api routes as per #11321 [breaking]

docs: fix open api spec for #11321

* refactor: audit chat v3 write api routes as per #11321

* refactor: audit files v3 write api routes as per #11321

* refactor: audit flags v3 write api routes as per #11321

* refactor: audit posts v3 write api routes as per #11321

* refactor: audit topics v3 write api routes as per #11321

* refactor: audit users v3 write api routes as per #11321

* fix: lang string

* remove min height

* fix: empty topic/labels taking up space

* fix: tag filtering when changing filter to watched topics

or changing popular time limit to month

* chore: up harmony

* fix: closes #11354, show no post error if queued post already accepted/rejected

* test: #11354

* test: #11354

* fix(deps): bump 2factor

* fix: #11357 clear cache on thumb remove

* fix: thumb remove on windows, closes #11357

* test: openapi for thumbs

* test: fix openapi

---------

Co-authored-by: Julian Lam <julian@nodebb.org>
Co-authored-by: Opliko <opliko.reg@protonmail.com>
2 years ago
Julian Lam 83d3633626 fix: add back req.query fallback for backwards compatibility 2 years ago
psibean ea95668a76 fix: update csrf parser to accept csrf_token form value if present 2 years ago
psibean f553da48e1 Update csrf-sync to fallback to _csrf query param 2 years ago
Julian Lam bb0397cbc8 lint: satisfy lint errors 2 years ago
psibean 5a994290f2 Replace csurf with csrf-sync 2 years ago
Julian Lam a382e6e2e5 Merge branch 'master' into develop 2 years ago
Barış Soner Uşaklı 1d3c0e5a2b fix: https://github.com/NodeBB/NodeBB/issues/11239
parseInt uid received from req.body._uid or req.query._uid
2 years ago
Julian Lam a69bc2cf7f fix: remove unneeded assignment, as req and locals will not likely ever be completely reassigned 2 years ago
Julian Lam 25ae58e8a0 fix: move call to `filter:middleware.buildHeader` out of parallel so that req can be overridden by plugins prior to loading config 2 years ago
Julian Lam 0a691e6744 fix: move call to `filter:middleware.buildHeader` out of parallel so that req can be overridden by plugins prior to loading config 2 years ago
Barış Soner Uşaklı 864fe0f971 feat: add permissions-policy header 2 years ago
Barış Soner Uşaklı 3c85b944e3 feat: allow groups to be exempt from maintenance mode
closes #11030
2 years ago
Barış Soner Uşaklı 6f673f806f fix: #10993, apply autoLocale middleware to guests only 2 years ago
Julian Lam cf4f5447bb fix: #10906, allow `middleware.checkAccountPermissions` to be called with either uid or userslug in params
Previously, the middleware only worked with userslug params
3 years ago
Julian Lam 4dc7fa050f fix: #10845, disallow inline viewing of uploaded html files 3 years ago
Barış Soner Uşaklı 6b2a6f9006
test: passport0.6 (#10638)
* test: passport0.6

* test: make logout async, fix lint

* test: keepSessionInfo flag

* revert: csrf load
3 years ago
Julian Lam 9b753d6d57
TTL Cache (#10816)
* refactor: move src/cacheCreate.js to src/cache/lru.js

* fix: call new library location for lru cache creator

* feat: add ttl cache

* fix: update upload throttler to use ttl cache instead of lru cache

* chore: add missing dependency

* fix: avoid pubsub conflicts

* fix: use get instead of peek, which is not available in ttl-cache
3 years ago
Julian Lam c07d595662
Update to lru-cache@^7 (#10815)
* chore(deps): bump lru-cache from 6.0.0 to 7.13.1 in /install

Bumps [lru-cache](https://github.com/isaacs/node-lru-cache) from 6.0.0 to 7.13.1.
- [Release notes](https://github.com/isaacs/node-lru-cache/releases)
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-lru-cache/compare/v6.0.0...v7.13.1)

---
updated-dependencies:
- dependency-name: lru-cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(lru-cache): remove unneeded `length` params for cache creation, as `maxSize` was not used in those init calls, also renamed some methods to match new method names in lru-cache [breaking]

Added deprecation notices for old params

* fix: replace three direct calls to lru-cache with call to cacheCreate, moved cache creation call in uploads to run on first init as config is not populated at lib init

* test: move configs init above cache reset calls in databasemock

* move some more code above cache clear

* refactor: remove unused

* test: lru

* test: more debug

* test: on more test

* use await helpers.uploadFile

* fix: tests remove logs

* fix: acp cache page

* fix: add in one more guard again cache instantiation with `length` prop but no `maxSize` prop

* fix(deps): bump markdown

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Barış Soner Uşaklı <barisusakli@gmail.com>
3 years ago
Barış Soner Uşaklı d20b07cfea
Webpack5 (#10311)
* feat: webpack 5 part 1

* fix: gruntfile fixes

* fix: fix taskbar warning

add app.importScript
copy public/src/modules to build folder

* refactor: remove commented old code

* feat: reenable admin

* fix: acp settings pages, fix sortable on manage categories

embedded require in html not allowed

* fix: bundle serialize/deserizeli so plugins dont break

* test: fixe util tests

* test: fix require path

* test: more test fixes

* test: require correct utils module

* test: require correct utils

* test: log stack

* test: fix db require blowing up tests

* test: move and disable bundle test

* refactor: add aliases

* test: disable testing route

* fix: move webpack modules necessary for build, into `dependencies`

* test: fix one more test

remove 500-embed.tpl

* fix: restore use of assets/nodebb.min.js, at least for now

* fix: remove unnecessary line break

* fix: point to proper ACP bundle

* test: maybe fix build test

* test: composer

* refactor: dont need dist

* refactor: more cleanup

use everything from build/public folder

* get rid of conditional import in app.js

* fix: ace

* refactor: cropper alias

* test: lint and test fixes

* lint: fix

* refactor: rename function to app.require

* refactor: go back to using app.require

* chore: use github branch

* chore: use webpack branch

* feat: webpack webinstaller

* feat: add chunkFile name with contenthash

* refactor: move hooks to top

* refactor: get rid of template500Function

* fix(deps): use webpack5 branch of 2factor plugin

* chore: tagging v2.0.0-beta.0 pre-release version 💥 :shipit: 🎉 🚀

* refactor: disable cache on templates

loadTemplate is called once by benchpress and the result is cache internally

* refactor: add server side helpers.js

* feat: deprecate /plugins shorthand route, closes #10343

* refactor: use build/public for webpack

* test: fix filename

* fix: more specific selector

* lint: ignore

* refactor: fix comments

* test: add debug for random failing test

* refactor: cleanup

remove test page, remove dupe functions in utils.common

* lint: use relative path  for now

* chore: bump prerelease version

* feat: add translateKeys

* fix: optional params

* fix: get rid of extra timeago files

* refactor: cleanup, require timeago locale earlier

remove translator.prepareDOM, it is in header.tpl html tag

* refactor: privileges system to use a Map in the backend instead of separate objects for keys and labels (#10378)

* refactor: privileges system to use a Map in the backend instead of separate objects for keys and labels

- Existing hooks are preserved (to be deprecated at a later date, possibly)
- New init hooks are called on NodeBB start, and provide a one-stop shop to add new privileges, instead of having to add to four different hooks

* docs: fix typo in comment

* test: spec changes

* refactor: privileges system to use a Map in the backend instead of separate objects for keys and labels (#10378)

* refactor: privileges system to use a Map in the backend instead of separate objects for keys and labels

- Existing hooks are preserved (to be deprecated at a later date, possibly)
- New init hooks are called on NodeBB start, and provide a one-stop shop to add new privileges, instead of having to add to four different hooks

* docs: fix typo in comment

* test: spec changes

* feat: allow app.require('bootbox'/'benchpressjs')

* refactor: require server side utils

* test: jquery ready

* change istaller to use build/public

* test: use document.addEventListener

* refactor: closes #10301

* refactor: generateTopicClass

* fix: column counts for other privileges

* fix: #10443, regression where sorted-list items did not render into the DOM in the predicted order [breaking]

* fix: typo in hook name

* refactor: introduce a generic autocomplete.init() method that can be called to add nodebb-style autocompletion but using different data sources (e.g. not user/groups/tags)

* fix: crash if `delay` not passed in (as it cannot be destructured)

* refactor: replace substr

* feat: set --panel-offset style in html element based on stored value in localStorage

* refactor: addDropupHandler() logic to be less naive

- Take into account height of the menu
- Don't apply dropUp logic if there's nothing in the dropdown
- Remove 'hidden' class (added by default in Persona for post tools) when menu items are added

closes #10423

* refactor: simplify utils.params [breaking]

Retrospective analysis of the usage of this method suggests that the options passed in are superfluous, and that only `url` is required. Using a browser built-in makes more sense to accomplish what this method sets out to do.

* feat: add support for returning full URLSearchParams for utils.params

* fix: utils.params() fallback handling

* fix: default empty obj for params()

* fix: remove \'loggedin\' and \'register\' qs parameters once they have been used, delay invocation of messages until ajaxify.end

* fix: utils.params() not allowing relative paths to be passed in

* refactor(DRY): new assertPasswordValidity utils method

* fix: incorrect error message returned on insufficient privilege on flag edit

* fix: read/update/delete access to flags API should be limited for moderators to only post flags in categories they moderate

- added failing tests and patched up middleware.assert.flags to fix

* refactor: flag api v3 tests to create new post and flags on every round

* fix: missing error:no-flag language key

* refactor: flags.canView to check flag existence, simplify middleware.assert.flag

* feat: flag deletion API endpoint, #10426

* feat: UI for flag deletion, closes #10426

* chore: update plugin versions

* chore: up emoji

* chore: update markdown

* chore: up emoji-android

* fix: regression caused by utils.params() refactor, supports arrays and pipes all values through utils.toType, adjusts tests to type check

Co-authored-by: Julian Lam <julian@nodebb.org>
3 years ago
Barış Soner Uşaklı ac125538d0 refactor: show invalid uri 3 years ago
Julian Lam 38ca73c493 fix(security): explicitly declare cache-control header instead of using middleware
This commit reverts 1f6f389ff2
3 years ago
Julian Lam 1f6f389ff2 fix(security): cache-control on all pages using setupPageRoute or setupApiRoute, and 404 controllers.
This commit also reverts e39cdd490b
3 years ago
Julian Lam e39cdd490b fix(security): explicitly set cache-control 'private' on any page where a header is built 3 years ago
Barış Soner Uşaklı dcb201dfa8 fix: https://github.com/NodeBB/NodeBB/issues/10242 3 years ago
Julian Lam e1e1d5223e feat: push the theme name into body class 3 years ago
Barış Soner Uşaklı 10949184ca
test: add failing guest csrf test (#10169)
* test: add failing guest csrf test

* test: use correct var

* fix: use applyCsrf for guests as well
3 years ago
Julian Lam e9ee843b27
fix: CSRF handler to go back to saving in session (#10159) 3 years ago
Julian Lam d89fc44c03 fix: move authenticateRequest before interstitial and maintenance mode middlewares, allowed plugins to disable authentication on certain routes
fixes #10112
3 years ago
Julian Lam d95b4ee29a fix: assertion check to ensure messages are in the room when editing/deleting, etc 3 years ago
Julian Lam 90fcbe4416 feat: middleware.assert.message 3 years ago
Julian Lam 140f9d2481 fix: isFinite check for room assertion, more test migrating 3 years ago
Julian Lam 74f1905ea8 feat: allow API checkRequired middleware error to be internationalized 3 years ago
Julian Lam 02e878be72 feat: stub code for v3 chats api 3 years ago
Barış Soner Uşaklı c4042c70de feat: #9506, allow seeing and editing your queued posts
allow regular users access to post queue
allow regular users to edit their queued post/topic title
allow regular users to remove their post from post queue
ability to send a notification to user without removing from post queue
allow accessing single post queue items from notifications
3 years ago
Barış Soner Uşaklı 41db9436e8 perf: only add middleware if relativePath is set 3 years ago
Julian Lam a3bdb70617 feat: ensure that all requests handled by NodeBB fall under the relative_path as configured 3 years ago
Barış Soner Uşaklı 324262cbb5 refactor: DRY 3 years ago
Barış Soner Uşaklı 1a7fffc7e9 breaking: remove deprecated user middlewares 3 years ago
Barış Soner Uşaklı 941ecaf899 fix: keep query params on /me redirects 3 years ago