788 Commits (894f392bfc97b27f51843567ac4749960f4bb29f)

Author SHA1 Message Date
Barış Soner Uşaklı 1d3c0e5a2b fix: https://github.com/NodeBB/NodeBB/issues/11239
parseInt uid received from req.body._uid or req.query._uid
2 years ago
Julian Lam 25ae58e8a0 fix: move call to `filter:middleware.buildHeader` out of parallel so that req can be overridden by plugins prior to loading config 2 years ago
Barış Soner Uşaklı 864fe0f971 feat: add permissions-policy header 2 years ago
Barış Soner Uşaklı 3c85b944e3 feat: allow groups to be exempt from maintenance mode
closes #11030
2 years ago
Barış Soner Uşaklı 6f673f806f fix: #10993, apply autoLocale middleware to guests only 2 years ago
Julian Lam cf4f5447bb fix: #10906, allow `middleware.checkAccountPermissions` to be called with either uid or userslug in params
Previously, the middleware only worked with userslug params
2 years ago
Julian Lam 4dc7fa050f fix: #10845, disallow inline viewing of uploaded html files 3 years ago
Barış Soner Uşaklı 6b2a6f9006
test: passport0.6 (#10638)
* test: passport0.6

* test: make logout async, fix lint

* test: keepSessionInfo flag

* revert: csrf load
3 years ago
Julian Lam 9b753d6d57
TTL Cache (#10816)
* refactor: move src/cacheCreate.js to src/cache/lru.js

* fix: call new library location for lru cache creator

* feat: add ttl cache

* fix: update upload throttler to use ttl cache instead of lru cache

* chore: add missing dependency

* fix: avoid pubsub conflicts

* fix: use get instead of peek, which is not available in ttl-cache
3 years ago
Julian Lam c07d595662
Update to lru-cache@^7 (#10815)
* chore(deps): bump lru-cache from 6.0.0 to 7.13.1 in /install

Bumps [lru-cache](https://github.com/isaacs/node-lru-cache) from 6.0.0 to 7.13.1.
- [Release notes](https://github.com/isaacs/node-lru-cache/releases)
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-lru-cache/compare/v6.0.0...v7.13.1)

---
updated-dependencies:
- dependency-name: lru-cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(lru-cache): remove unneeded `length` params for cache creation, as `maxSize` was not used in those init calls, also renamed some methods to match new method names in lru-cache [breaking]

Added deprecation notices for old params

* fix: replace three direct calls to lru-cache with call to cacheCreate, moved cache creation call in uploads to run on first init as config is not populated at lib init

* test: move configs init above cache reset calls in databasemock

* move some more code above cache clear

* refactor: remove unused

* test: lru

* test: more debug

* test: on more test

* use await helpers.uploadFile

* fix: tests remove logs

* fix: acp cache page

* fix: add in one more guard again cache instantiation with `length` prop but no `maxSize` prop

* fix(deps): bump markdown

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Barış Soner Uşaklı <barisusakli@gmail.com>
3 years ago
Barış Soner Uşaklı d20b07cfea
Webpack5 (#10311)
* feat: webpack 5 part 1

* fix: gruntfile fixes

* fix: fix taskbar warning

add app.importScript
copy public/src/modules to build folder

* refactor: remove commented old code

* feat: reenable admin

* fix: acp settings pages, fix sortable on manage categories

embedded require in html not allowed

* fix: bundle serialize/deserizeli so plugins dont break

* test: fixe util tests

* test: fix require path

* test: more test fixes

* test: require correct utils module

* test: require correct utils

* test: log stack

* test: fix db require blowing up tests

* test: move and disable bundle test

* refactor: add aliases

* test: disable testing route

* fix: move webpack modules necessary for build, into `dependencies`

* test: fix one more test

remove 500-embed.tpl

* fix: restore use of assets/nodebb.min.js, at least for now

* fix: remove unnecessary line break

* fix: point to proper ACP bundle

* test: maybe fix build test

* test: composer

* refactor: dont need dist

* refactor: more cleanup

use everything from build/public folder

* get rid of conditional import in app.js

* fix: ace

* refactor: cropper alias

* test: lint and test fixes

* lint: fix

* refactor: rename function to app.require

* refactor: go back to using app.require

* chore: use github branch

* chore: use webpack branch

* feat: webpack webinstaller

* feat: add chunkFile name with contenthash

* refactor: move hooks to top

* refactor: get rid of template500Function

* fix(deps): use webpack5 branch of 2factor plugin

* chore: tagging v2.0.0-beta.0 pre-release version 💥 :shipit: 🎉 🚀

* refactor: disable cache on templates

loadTemplate is called once by benchpress and the result is cache internally

* refactor: add server side helpers.js

* feat: deprecate /plugins shorthand route, closes #10343

* refactor: use build/public for webpack

* test: fix filename

* fix: more specific selector

* lint: ignore

* refactor: fix comments

* test: add debug for random failing test

* refactor: cleanup

remove test page, remove dupe functions in utils.common

* lint: use relative path  for now

* chore: bump prerelease version

* feat: add translateKeys

* fix: optional params

* fix: get rid of extra timeago files

* refactor: cleanup, require timeago locale earlier

remove translator.prepareDOM, it is in header.tpl html tag

* refactor: privileges system to use a Map in the backend instead of separate objects for keys and labels (#10378)

* refactor: privileges system to use a Map in the backend instead of separate objects for keys and labels

- Existing hooks are preserved (to be deprecated at a later date, possibly)
- New init hooks are called on NodeBB start, and provide a one-stop shop to add new privileges, instead of having to add to four different hooks

* docs: fix typo in comment

* test: spec changes

* refactor: privileges system to use a Map in the backend instead of separate objects for keys and labels (#10378)

* refactor: privileges system to use a Map in the backend instead of separate objects for keys and labels

- Existing hooks are preserved (to be deprecated at a later date, possibly)
- New init hooks are called on NodeBB start, and provide a one-stop shop to add new privileges, instead of having to add to four different hooks

* docs: fix typo in comment

* test: spec changes

* feat: allow app.require('bootbox'/'benchpressjs')

* refactor: require server side utils

* test: jquery ready

* change istaller to use build/public

* test: use document.addEventListener

* refactor: closes #10301

* refactor: generateTopicClass

* fix: column counts for other privileges

* fix: #10443, regression where sorted-list items did not render into the DOM in the predicted order [breaking]

* fix: typo in hook name

* refactor: introduce a generic autocomplete.init() method that can be called to add nodebb-style autocompletion but using different data sources (e.g. not user/groups/tags)

* fix: crash if `delay` not passed in (as it cannot be destructured)

* refactor: replace substr

* feat: set --panel-offset style in html element based on stored value in localStorage

* refactor: addDropupHandler() logic to be less naive

- Take into account height of the menu
- Don't apply dropUp logic if there's nothing in the dropdown
- Remove 'hidden' class (added by default in Persona for post tools) when menu items are added

closes #10423

* refactor: simplify utils.params [breaking]

Retrospective analysis of the usage of this method suggests that the options passed in are superfluous, and that only `url` is required. Using a browser built-in makes more sense to accomplish what this method sets out to do.

* feat: add support for returning full URLSearchParams for utils.params

* fix: utils.params() fallback handling

* fix: default empty obj for params()

* fix: remove \'loggedin\' and \'register\' qs parameters once they have been used, delay invocation of messages until ajaxify.end

* fix: utils.params() not allowing relative paths to be passed in

* refactor(DRY): new assertPasswordValidity utils method

* fix: incorrect error message returned on insufficient privilege on flag edit

* fix: read/update/delete access to flags API should be limited for moderators to only post flags in categories they moderate

- added failing tests and patched up middleware.assert.flags to fix

* refactor: flag api v3 tests to create new post and flags on every round

* fix: missing error:no-flag language key

* refactor: flags.canView to check flag existence, simplify middleware.assert.flag

* feat: flag deletion API endpoint, #10426

* feat: UI for flag deletion, closes #10426

* chore: update plugin versions

* chore: up emoji

* chore: update markdown

* chore: up emoji-android

* fix: regression caused by utils.params() refactor, supports arrays and pipes all values through utils.toType, adjusts tests to type check

Co-authored-by: Julian Lam <julian@nodebb.org>
3 years ago
Barış Soner Uşaklı ac125538d0 refactor: show invalid uri 3 years ago
Julian Lam 38ca73c493 fix(security): explicitly declare cache-control header instead of using middleware
This commit reverts 1f6f389ff2
3 years ago
Julian Lam 1f6f389ff2 fix(security): cache-control on all pages using setupPageRoute or setupApiRoute, and 404 controllers.
This commit also reverts e39cdd490b
3 years ago
Julian Lam e39cdd490b fix(security): explicitly set cache-control 'private' on any page where a header is built 3 years ago
Barış Soner Uşaklı dcb201dfa8 fix: https://github.com/NodeBB/NodeBB/issues/10242 3 years ago
Julian Lam e1e1d5223e feat: push the theme name into body class 3 years ago
Barış Soner Uşaklı 10949184ca
test: add failing guest csrf test (#10169)
* test: add failing guest csrf test

* test: use correct var

* fix: use applyCsrf for guests as well
3 years ago
Julian Lam e9ee843b27
fix: CSRF handler to go back to saving in session (#10159) 3 years ago
Julian Lam d89fc44c03 fix: move authenticateRequest before interstitial and maintenance mode middlewares, allowed plugins to disable authentication on certain routes
fixes #10112
3 years ago
Julian Lam d95b4ee29a fix: assertion check to ensure messages are in the room when editing/deleting, etc 3 years ago
Julian Lam 90fcbe4416 feat: middleware.assert.message 3 years ago
Julian Lam 140f9d2481 fix: isFinite check for room assertion, more test migrating 3 years ago
Julian Lam 74f1905ea8 feat: allow API checkRequired middleware error to be internationalized 3 years ago
Julian Lam 02e878be72 feat: stub code for v3 chats api 3 years ago
Barış Soner Uşaklı c4042c70de feat: #9506, allow seeing and editing your queued posts
allow regular users access to post queue
allow regular users to edit their queued post/topic title
allow regular users to remove their post from post queue
ability to send a notification to user without removing from post queue
allow accessing single post queue items from notifications
3 years ago
Barış Soner Uşaklı 41db9436e8 perf: only add middleware if relativePath is set 3 years ago
Julian Lam a3bdb70617 feat: ensure that all requests handled by NodeBB fall under the relative_path as configured 3 years ago
Barış Soner Uşaklı 324262cbb5 refactor: DRY 3 years ago
Barış Soner Uşaklı 1a7fffc7e9 breaking: remove deprecated user middlewares 3 years ago
Barış Soner Uşaklı 941ecaf899 fix: keep query params on /me redirects 3 years ago
Barış Soner Uşaklı 65c5504193 fix: 403/400/500 page not generating csrf_token 3 years ago
Barış Soner Uşaklı 7434cbf66f test: add api token tests 3 years ago
Julian Lam 6c07433dea
refactor: use routePrefixMap instead of routeRegexpMap, +tests (#10035)
* refactor: use routePrefixMap instead of routeRegexpMap, +tests

Currently tests fail because privilege pages resolve if passed garbage... hmm

* fix: priv check paths

remove /v3 from path as well

Co-authored-by: Barış Soner Uşaklı <barisusakli@gmail.com>
3 years ago
Barış Soner Uşaklı 29b3587d91 test: middleware/expose.js 3 years ago
Barış Soner Uşaklı fb363957d1 refactor: tab rules 3 years ago
Barış Soner Uşaklı e368feef51 refactor: dont expost entire res._locals to client side 3 years ago
Julian Lam 1719bff89c feat: use auto-generated meta and link tags in ACP, closes #9991 3 years ago
Julian Lam dd4e66e22c fix: push back some deprecations, remove deprecated stuff scheduled for v1.18.0 4 years ago
gasoved 3df79683f5
feat: create folders in ACP uploads #9638 (#9750)
* feat: create folders in ACP uploads #9638

* fix: openapi

* test: missing tests

* fix: eslint

* fix: tests
4 years ago
Barış Soner Uşaklı a288f51f42 fix: allow smaller than 5mins for admin relogin duration
setting the value to 1min in ACP wasn't working
4 years ago
Opliko d509a307f0
Remove some deprecated/unnecessary code (#9688)
* refactor: remove mkdirp promisify

* refactor: remove old session deletion API route

* refactor: remove middleware.isAdmin

* refactor: remove templateValues.config.bootswatchSkin

* fix: unused dependencies
4 years ago
Julian Lam afd2d8dab1 feat(emails): pass req in to filter:registration.interstitial 4 years ago
Julian Lam b4b65ecd98 fix(emails): remove debug log 4 years ago
Julian Lam 087e6020e4 refactor(email): validation checking methods, +tests fix 4 years ago
Julian Lam 69c96dd23c refactor(emails): more work in update email interstitial, interstitial skipping, email change on confirmation, deprecation of requireEmailConfirmation 4 years ago
Barış Soner Uşaklı 04b1f702cd feat: add loggedin/guest class to body 4 years ago
Julian Lam cc6cbfcdc4
Flags API (#9666)
* feat: new routes for flags API

+ flag get
+ flag creation, migration from socket method
+ flag update, migration from socket method
* fixed bug where you could not unassign someone from a flag

* feat: tests for new flags API

added missing files for schema update

* fix: flag tests to use Write API instead of sockets

* feat: flag notes API + tests

* chore: remove debug line

* test: fix breaking test on mongo
4 years ago
Julian Lam 7036c3751e feat: internationalize API error messages 4 years ago
Julian Lam a54a3ee1ca fix: return proper API-style response if exception caught by error handler on v3 routes [breaking] 4 years ago