68 Commits (afd2d8dab17b986ebe6075c1575972eaeb72f7a9)

Author SHA1 Message Date
Julian Lam afd2d8dab1 feat(emails): pass req in to filter:registration.interstitial 4 years ago
Julian Lam b4b65ecd98 fix(emails): remove debug log 4 years ago
Julian Lam 69c96dd23c refactor(emails): more work in update email interstitial, interstitial skipping, email change on confirmation, deprecation of requireEmailConfirmation 4 years ago
Julian Lam 7036c3751e feat: internationalize API error messages 4 years ago
Julian Lam a54a3ee1ca fix: return proper API-style response if exception caught by error handler on v3 routes [breaking] 4 years ago
Barış Soner Uşaklı 36f119a96a fix: #9492, keep query params on redirect 4 years ago
Julian Lam 9c52fd2e74 fix: #9450 express session saved even if saveUninitialized explicitly passed in 4 years ago
Julian Lam 166d65a1ba fix: add back middleware.authenticateOrGuest 4 years ago
Julian Lam e3b2c00db1 fix: request authentication called twice in account routes 4 years ago
Julian Lam 7da061f0d7
refactor: automatically authenticate all requests setup through route helpers (#9357)
* refactor: automatically authenticate all requests setup through route helpers

* fix: removed connect-ensure-login dependency

* fix: bug with some middlewares not defined outside route helper methods
4 years ago
Peter Jaszkowiak b56d9e12b5 chore: eslint prefer-arrow-callback 4 years ago
Peter Jaszkowiak 707b55b6a5 chore: eslint prefer-template 4 years ago
Julian Lam f975063b7d fix: #7125, allow list for page route, configurable via plugin hook 4 years ago
Julian Lam 6037f5ee2c chore: add comment for clarification 4 years ago
Julian Lam 6e2da9966e refactor: move plugin hook methods to plugin.hooks.* 4 years ago
Julian Lam 15e0731dd9 fix: deprecate middleware.isAdmin
Also, handle admin logout timer in middleware.admin.checkPrivileges
4 years ago
Julian Lam 57ed6be78b fix: #8805 define our own name for write API v3 4 years ago
Julian Lam 266d7587b2 refactor: remove usage of middlewares
Specifically, middleware.isAdmin|exposePrivilegeSet|exposePrivileges
4 years ago
Julian Lam 1e07886f30 feat: require csrf token if not using bearer token 4 years ago
Julian Lam 549ca11056 fix: bug where middlewares seemingly ran in parallel 4 years ago
Julian Lam fd67355b03 fix(writeapi): authenticate middleware logic to work better with await 4 years ago
Julian Lam f6433ef2c5 fix(refactor): merging write-api auth middlewares with core middlewares 4 years ago
Barış Soner Uşaklı 0cea713691 feat: remove deprecated checkGlobalPrivacySettings 5 years ago
Barış Soner Uşaklı dcb85ee7a1
#8344 (#8346)
* feat: wip

* feat: wrap middlewares

* feat: middleware errors

* feat: more middleware changes

* fix: remove unused async

* fix: prevent version errors from blocking acp render

* feat: wrap more middlewares
5 years ago
Julian Lam 5a1c6ee7ed fix: response hook logic
After some more thought, a response hook should be checking for
whether headers are sent, and executing (or not executing) the
default logic in that case.

Before, we were relying on hooks to call data.next() to continue
execution, but it makes more sense to have the listener either
send a response or not, and handle the behaviour afterwards.
5 years ago
Julian Lam f0db240a1d fix: #8184 global mods unable to revoke other user sessions 5 years ago
Barış Soner Uşaklı a227cbe328 refactor: async/await middleware 5 years ago
Baris Usakli cec0079573 refactor: shorter returns 5 years ago
Baris Usakli efd1e88bbf feat: convert middleware.isAdmin to async/await 5 years ago
Baris Usakli 1eca5b3dae fix: show login fields if user has local password 5 years ago
Opliko b9583ed838 Add privilege for accessing user information (#7859)
* Add view users info global privilege

* Show user ip only to global mods and admins

* fix missing comma

* Hide link for users without correct privilege

* move getting privilege information to getAllData

* Hide the link from Global Moderators as well

* Give Global Moderator view:users:info privilege

* Restrict ip in post menu to view:users:info

* add some trailing commas....

* Add privilege to categories test

* Add group privilege to categories test

* add upgrade script

* fix style for TravisCI

* more styling - change spaces to tabs

* some more styling fixes (hopefully final one)

* fix style for Travis CI

* hide ip in chat messages

* Don't show even hidden ips on user profile page
6 years ago
Baris Usakli 8f55ab1340 fix: #7494 6 years ago
Julian Lam 949b10f132 fix: no relative path needed in req.session.returnTo
re: julianlam/nodebb-plugin-session-sharing#73
6 years ago
Barış Soner Uşaklı c72da5595a fix: #6806
3 new global privileges
view:users
view:tags
view:groups
6 years ago
Julian Lam a23854e3ff feat: new hook type: `response`
Used in authentication middleware. Instead of firing an action
hook, it now fires a response hook.

Response hooks are invoked serially, and if headers are sent from
one of the hook listeners, all subsequent hook methods are not
called.

Response hooks should only be used in situations where res.send
(or other like methods) are invoked. Existing plugin hooks that
pass in res purely for data retrieval purposes have not changed).

fixes nodebb/nodebb-plugin-write-api#101
6 years ago
Barış Soner Uşaklı 60390c01f1 fix: loop 6 years ago
Barış Soner Uşaklı f88db22ca2 feat: give the rest of the middlewares names 6 years ago
Barış Soner Uşaklı 53793e1603 feat: give names to middlewares 6 years ago
Julian Lam 4fba1492c1 feat: added new middleware authenticateOrGuest 6 years ago
Barış Soner Uşaklı e17c4b2766 uid fixes 6 years ago
Barış Soner Uşaklı 69bb3293ee misc fixes
handle spider uids properly
6 years ago
Barış Soner Uşaklı 9c022afae1
Parse int (#6853)
* Store config fields as JSON in the db

Fewer parseInts

* Remove unnecessary parseInts

* remove some dupe code add tests

* remove console.log

* remove more parseInts

* WIP: read meta.configs defaults from defaults.json

remove more parseInts

* more work

* add log for failing test

* update admin pwd

* fix tests, dont require posts/cache before configs are initialized

* handle saves

* Test boolean conditions

* remove more parseInts

* Fix boolean values

* remove lots more parseInts

* removed json parsing

* renamed var to number

* categories dont have timestamp
6 years ago
Julian Lam ebabcc5e3c if authenticate middleware is overridden by plugin, check for req.user and return notAllowed helper otherwise
/cc @LudwikJaniuk
7 years ago
LudwikJaniuk c7f3b76b4e DRY req props that depend on auth (fix #6727) (#6731)
* DRY req props that depend on auth (fix #6727)

authentication leads to req.loggedIn and req.uid being set. However, a
later authentication event might outdate them. Here, I create one
function for setting those properties, and make sure it also is called
on the `action:middleware.authenticate` hook, which would be such an
authentication event. If there are other places, those should be added
as well.

* fix lint errors

* fix lint error

* change exports
7 years ago
Julian Lam 7a53fa9469 Added block and unblock button to profile dropdown menu, #6560 7 years ago
Julian Lam 99f1a5380e closes #6483 7 years ago
Barış Soner Uşaklı beadcd7857 fix tests, remove dupe exposeUid 7 years ago
Julian Lam bfee23adee basic methods and initial integration for #6463 7 years ago
Barış Soner Uşaklı ac1f7eefe5 closes #2304 7 years ago
Baris Usakli c090ec301b fix lint 7 years ago