From 1e651aed3570383ec1492e87af0fa592cbf300f3 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Fri, 18 Mar 2016 12:13:29 -0400 Subject: [PATCH 01/67] #4377 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 7eb551e233..fb4e717bf0 100644 --- a/package.json +++ b/package.json @@ -44,7 +44,7 @@ "mongodb": "~2.1.3", "morgan": "^1.3.2", "nconf": "~0.8.2", - "nodebb-plugin-composer-default": "3.0.9", + "nodebb-plugin-composer-default": "3.0.10", "nodebb-plugin-dbsearch": "1.0.0", "nodebb-plugin-emoji-extended": "1.0.3", "nodebb-plugin-markdown": "4.0.17", From f7e43877482f6efc276ea71e61d7c7524a8f5a44 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Fri, 18 Mar 2016 12:24:51 -0400 Subject: [PATCH 02/67] closes #4380 --- src/meta/blacklist.js | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/meta/blacklist.js b/src/meta/blacklist.js index b0269a1f0c..47381e487b 100644 --- a/src/meta/blacklist.js +++ b/src/meta/blacklist.js @@ -78,16 +78,24 @@ Blacklist.validate = function(rules, callback) { var cidr = []; var invalid = []; - var isCidrSubnet = /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$/; + var isCidrSubnet = /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$/, + inlineCommentMatch = /#.*$/, + whitelist = ['127.0.0.1', '::1', '::ffff:0:127.0.0.1']; // Filter out blank lines and lines starting with the hash character (comments) + // Also trim inputs and remove inline comments rules = rules.map(function(rule) { - rule = rule.trim(); + rule = rule.replace(inlineCommentMatch, '').trim(); return rule.length && !rule.startsWith('#') ? rule : null; }).filter(Boolean); // Filter out invalid rules rules = rules.filter(function(rule) { + if (whitelist.indexOf(rule) !== -1) { + invalid.push(rule); + return false; + } + if (ip.isV4Format(rule)) { ipv4.push(rule); return true; From c9f285a883104cb87802fae8c5d321dea8154680 Mon Sep 17 00:00:00 2001 From: NodeBB Misty Date: Fri, 18 Mar 2016 13:46:58 -0400 Subject: [PATCH 03/67] bumped up version Conflicts: package.json --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index fb4e717bf0..594892df75 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "nodebb", "license": "GPL-3.0", "description": "NodeBB Forum", - "version": "1.0.0", + "version": "1.0.1", "homepage": "http://www.nodebb.org", "repository": { "type": "git", From b9b8f2320fe0ea7d28d6292252fc775180e2292e Mon Sep 17 00:00:00 2001 From: barisusakli Date: Sat, 19 Mar 2016 10:36:39 +0200 Subject: [PATCH 04/67] up composer --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 594892df75..997e4c7399 100644 --- a/package.json +++ b/package.json @@ -44,7 +44,7 @@ "mongodb": "~2.1.3", "morgan": "^1.3.2", "nconf": "~0.8.2", - "nodebb-plugin-composer-default": "3.0.10", + "nodebb-plugin-composer-default": "3.0.11", "nodebb-plugin-dbsearch": "1.0.0", "nodebb-plugin-emoji-extended": "1.0.3", "nodebb-plugin-markdown": "4.0.17", From e556ae93ea04ecd77c0b03c583d54a68c9c7511f Mon Sep 17 00:00:00 2001 From: barisusakli Date: Sat, 19 Mar 2016 10:47:05 +0200 Subject: [PATCH 05/67] up mentions --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 997e4c7399..75fb36119c 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,7 @@ "nodebb-plugin-dbsearch": "1.0.0", "nodebb-plugin-emoji-extended": "1.0.3", "nodebb-plugin-markdown": "4.0.17", - "nodebb-plugin-mentions": "1.0.18", + "nodebb-plugin-mentions": "1.0.19", "nodebb-plugin-soundpack-default": "0.1.6", "nodebb-plugin-spam-be-gone": "0.4.5", "nodebb-rewards-essentials": "0.0.8", From d6549785080a2874c17de5cfc02db063e2b25b5c Mon Sep 17 00:00:00 2001 From: Ben Lubar Date: Sun, 20 Mar 2016 15:07:11 -0500 Subject: [PATCH 06/67] show the crossed-out eye icon for users who want their email private for staff, not just the user --- src/controllers/accounts/helpers.js | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/controllers/accounts/helpers.js b/src/controllers/accounts/helpers.js index 0a35315854..1cb7bb3c77 100644 --- a/src/controllers/accounts/helpers.js +++ b/src/controllers/accounts/helpers.js @@ -64,12 +64,14 @@ helpers.getUserDataByUserSlug = function(userslug, callerUID, callback) { userData.lastonlineISO = utils.toISOString(userData.lastonline || userData.joindate); userData.age = Math.max(0, userData.birthday ? Math.floor((new Date().getTime() - new Date(userData.birthday).getTime()) / 31536000000) : 0); + userData.emailClass = 'hide'; + if (!(isAdmin || isGlobalModerator || self || (userData.email && userSettings.showemail))) { userData.email = ''; + } else if (!userSettings.showemail) { + userData.emailClass = ''; } - userData.emailClass = (self && !userSettings.showemail) ? '' : 'hide'; - if (!isAdmin && !isGlobalModerator && !self && !userSettings.showfullname) { userData.fullname = ''; } @@ -172,4 +174,4 @@ function filterLinks(links, self) { }); } -module.exports = helpers; \ No newline at end of file +module.exports = helpers; From 3c607f2612d66000ae993c60d3f97df63f4d715e Mon Sep 17 00:00:00 2001 From: Ben Lubar Date: Sun, 20 Mar 2016 15:11:32 -0500 Subject: [PATCH 07/67] fix two crashes --- src/controllers/helpers.js | 4 ++-- src/middleware/render.js | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/controllers/helpers.js b/src/controllers/helpers.js index 94dfe022c2..3962e2036b 100644 --- a/src/controllers/helpers.js +++ b/src/controllers/helpers.js @@ -41,7 +41,7 @@ helpers.redirect = function(res, url) { if (res.locals.isAPI) { res.status(308).json(url); } else { - res.redirect(nconf.get('relative_path') + url); + res.redirect(nconf.get('relative_path') + encodeURI(url)); } }; @@ -109,4 +109,4 @@ helpers.buildTitle = function(pageTitle) { return title; }; -module.exports = helpers; \ No newline at end of file +module.exports = helpers; diff --git a/src/middleware/render.js b/src/middleware/render.js index 2a9d0ba5d2..79911f71bd 100644 --- a/src/middleware/render.js +++ b/src/middleware/render.js @@ -13,7 +13,7 @@ module.exports = function(middleware) { req = this.req, defaultFn = function(err, str){ if (err) { - return req.next(err); + return next(err); } self.send(str); @@ -96,4 +96,4 @@ module.exports = function(middleware) { return parts.join(' '); } -}; \ No newline at end of file +}; From bb88c82ffd08c14133be349e085706e80a2d2ed6 Mon Sep 17 00:00:00 2001 From: Ben Lubar Date: Sun, 20 Mar 2016 15:59:38 -0500 Subject: [PATCH 08/67] fix post tools not showing up for other users on new posts (src/topics/posts.js has this condition already) --- public/src/client/topic/posts.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/public/src/client/topic/posts.js b/public/src/client/topic/posts.js index f534aefad5..d479196c24 100644 --- a/public/src/client/topic/posts.js +++ b/public/src/client/topic/posts.js @@ -26,7 +26,7 @@ define('forum/topic/posts', [ post.selfPost = !!app.user.uid && parseInt(post.uid, 10) === parseInt(app.user.uid, 10); post.display_moderator_tools = post.selfPost || ajaxify.data.privileges.isAdminOrMod; post.display_move_tools = ajaxify.data.privileges.isAdminOrMod; - post.display_post_menu = post.selfPost || ajaxify.data.privileges.isAdminOrMod; + post.display_post_menu = post.selfPost || ajaxify.data.privileges.isAdminOrMod || !post.deleted; }); updatePostCounts(data.posts); @@ -262,4 +262,4 @@ define('forum/topic/posts', [ return Posts; -}); \ No newline at end of file +}); From 44431f8410ed6233fc82be5f76b1140d6330a22e Mon Sep 17 00:00:00 2001 From: Ben Lubar Date: Sun, 20 Mar 2016 16:26:13 -0500 Subject: [PATCH 09/67] fix notifications that contain topic titles with commas in them --- src/notifications.js | 7 +++++-- src/socket.io/helpers.js | 13 ++++++++++--- src/socket.io/posts/flag.js | 8 ++++++-- 3 files changed, 21 insertions(+), 7 deletions(-) diff --git a/src/notifications.js b/src/notifications.js index af88fd7b5b..f32ca031d3 100644 --- a/src/notifications.js +++ b/src/notifications.js @@ -450,10 +450,13 @@ var async = require('async'), }); var numUsers = usernames.length; + var title = S(notifications[modifyIndex].topicTitle).decodeHTMLEntities().s; + var titleEscaped = title.replace(/%/g, '%').replace(/,/g, ','); + if (numUsers === 2) { - notifications[modifyIndex].bodyShort = '[[' + mergeId + '_dual, ' + usernames.join(', ') + ', ' + notifications[modifyIndex].topicTitle + ']]'; + notifications[modifyIndex].bodyShort = '[[' + mergeId + '_dual, ' + usernames.join(', ') + ', ' + titleEscaped + ']]'; } else if (numUsers > 2) { - notifications[modifyIndex].bodyShort = '[[' + mergeId + '_multiple, ' + usernames[0] + ', ' + (numUsers-1) + ', ' + notifications[modifyIndex].topicTitle + ']]'; + notifications[modifyIndex].bodyShort = '[[' + mergeId + '_multiple, ' + usernames[0] + ', ' + (numUsers-1) + ', ' + titleEscaped + ']]'; } break; diff --git a/src/socket.io/helpers.js b/src/socket.io/helpers.js index 3aeaaf0bf3..5524faf156 100644 --- a/src/socket.io/helpers.js +++ b/src/socket.io/helpers.js @@ -2,6 +2,7 @@ var async = require('async'); var winston = require('winston'); +var S = require('string'); var nconf = require('nconf'); var websockets = require('./index'); @@ -62,8 +63,11 @@ SocketHelpers.sendNotificationToPostOwner = function(pid, fromuid, notification) return; } + var title = S(results.topicTitle).decodeHTMLEntities().s; + var titleEscaped = title.replace(/%/g, '%').replace(/,/g, ','); + notifications.create({ - bodyShort: '[[' + notification + ', ' + results.username + ', ' + results.topicTitle + ']]', + bodyShort: '[[' + notification + ', ' + results.username + ', ' + titleEscaped + ']]', bodyLong: results.postObj.content, pid: pid, nid: 'post:' + pid + ':uid:' + fromuid, @@ -93,8 +97,11 @@ SocketHelpers.sendNotificationToTopicOwner = function(tid, fromuid, notification return; } + var title = S(results.topicData.title).decodeHTMLEntities().s; + var titleEscaped = title.replace(/%/g, '%').replace(/,/g, ','); + notifications.create({ - bodyShort: '[[' + notification + ', ' + results.username + ', ' + results.topicData.title + ']]', + bodyShort: '[[' + notification + ', ' + results.username + ', ' + titleEscaped + ']]', path: nconf.get('relative_path') + '/topic/' + results.topicData.slug, nid: 'tid:' + tid + ':uid:' + fromuid, from: fromuid @@ -111,4 +118,4 @@ SocketHelpers.emitToTopicAndCategory = function(event, data) { websockets.in('category_' + data.cid).emit(event, data); }; -module.exports = SocketHelpers; \ No newline at end of file +module.exports = SocketHelpers; diff --git a/src/socket.io/posts/flag.js b/src/socket.io/posts/flag.js index eaefcea1e2..bbf7a4721c 100644 --- a/src/socket.io/posts/flag.js +++ b/src/socket.io/posts/flag.js @@ -1,6 +1,7 @@ 'use strict'; var async = require('async'); +var S = require('string'); var user = require('../../user'); var groups = require('../../groups'); @@ -82,8 +83,11 @@ module.exports = function(SocketPosts) { }, next); }, function (results, next) { + var title = S(post.topic.title).decodeHTMLEntities().s; + var titleEscaped = title.replace(/%/g, '%').replace(/,/g, ','); + notifications.create({ - bodyShort: '[[notifications:user_flagged_post_in, ' + flaggingUser.username + ', ' + post.topic.title + ']]', + bodyShort: '[[notifications:user_flagged_post_in, ' + flaggingUser.username + ', ' + titleEscaped + ']]', bodyLong: post.content, pid: data.pid, nid: 'post_flag:' + data.pid + ':uid:' + socket.uid, @@ -163,4 +167,4 @@ module.exports = function(SocketPosts) { }, ], callback); }; -}; \ No newline at end of file +}; From 497592965f64996e902c7dd35f513b79fd2abe66 Mon Sep 17 00:00:00 2001 From: pichalite Date: Sun, 20 Mar 2016 22:09:10 +0000 Subject: [PATCH 10/67] fixes issue-4386 --- public/src/admin/manage/group.js | 2 +- src/views/admin/manage/group.tpl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/public/src/admin/manage/group.js b/public/src/admin/manage/group.js index 58c5017540..5cc5eb2048 100644 --- a/public/src/admin/manage/group.js +++ b/public/src/admin/manage/group.js @@ -98,7 +98,7 @@ define('admin/manage/group', [ templates.parse('partials/groups/memberlist', 'members', {group: {isOwner: ajaxify.data.group.isOwner, members: [member]}}, function(html) { translator.translate(html, function(html) { - $('[component="groups/members"] tr').first().before(html); + $('[component="groups/members"]').prepend(html); }); }); }); diff --git a/src/views/admin/manage/group.tpl b/src/views/admin/manage/group.tpl index f579065df5..a50fdba51b 100644 --- a/src/views/admin/manage/group.tpl +++ b/src/views/admin/manage/group.tpl @@ -63,7 +63,7 @@