Commit Graph

215 Commits

Author SHA1 Message Date
Barış Soner Uşaklı
647d3ba810 fix: removed methods 2021-01-27 17:36:58 -05:00
Julian Lam
f2a5cd0b67 fix: tests for #9217 2021-01-24 14:05:11 -05:00
Peter Jaszkowiak
2be396ff6e fix: email testing and settings change from ACP
- changing email SMTP settings wouldn't apply the first time
- "Send Test Email" now will report emailer errors in most cases
2020-12-18 16:39:09 -05:00
Barış Soner Uşaklı
80de572aa1 feat: add user.email.confirmByUid for sso plugins 2020-12-10 20:25:48 -05:00
Barış Soner Uşaklı
557f0f5631 feat: use correct code 2020-11-29 22:41:19 -05:00
Barış Soner Uşaklı
f25000cb60 fix: pwd reset test 2020-11-29 22:30:40 -05:00
Barış Soner Uşaklı
5080f35752 fix: #8991, logout on password reset, dont verify email if password expired
dont allow same password on reset
2020-11-29 21:55:07 -05:00
Barış Soner Uşaklı
e32cd31ec6 fix: #8918 2020-11-25 14:33:19 -05:00
gasoved
3ccebf112e feat: invites regardless of registration type, invite privilege, groups to join on acceptance (#8786)
* feat: allow invites in normal registration mode + invite privilege

* feat: select groups to join from an invite

* test: check if groups from invitations have been joined

* fix: remove unused variable

* feat: write API versions of socket calls

* docs: openapi specs for the new routes

* test: iron out mongo redis difference

* refactor: move inviteGroups endpoint into write API

* refactor: use GET /api/v3/users/:uid/invites/groups

Instead of GET /api/v3/users/:uid/inviteGroups

* fix: no need for /api/v3 prefix when using api module

* fix: tests

* refactor: change POST /api/v3/users/invite

To POST /api/v3/users/:uid/invites

* refactor: make helpers.invite awaitable

* fix: restrict invite API to self-use only

* fix: move invite groups controller to write api, +tests

* fix: tests

Co-authored-by: Julian Lam <julian@nodebb.org>
2020-11-16 14:47:23 -05:00
Julian Lam
512f6de6de feat: allow passwords with length > 73 characters (#8818)
* feat: allow passwords longer than 73 characters

Context: A bcrypt/blowfish limitation means that password length is capped at 72 characters. We can get around this without compromising on security
by hashing all incoming passwords with SHA512, and then sending that to bcrypt.

https://dropbox.tech/security/how-dropbox-securely-stores-your-passwords

* feat: add additional test for passwords > 73 chars

* fix: remove 'password-too-long' error message and all invocations

* test: added test to show that a super long password won't bring down NodeBB

* fix: remove debug log

* Revert "fix: remove 'password-too-long' error message and all invocations"

This reverts commit 1e312bf7ef.

* fix: added back password length checks, but at 512 chars

As processing a large string still uses a lot of memory
2020-11-06 08:40:00 -05:00
Barış Soner Uşaklı
a05905f196 performance improvements (#8795)
* perf: nconf/winston/render

cache nconf.get calls
modify middleware.pageView to call next earlier
don't call winston.verbose on every hook see https://github.com/winstonjs/winston/issues/1669
translate header/footer separately and cache results for guests

* fix: copy paste fail

* refactor: style and fire hook only log in dev mode

* fix: cache key, header changes based on template

* perf: change replace

* fix: add missing await

* perf: category

* perf: lodash clone

* perf: remove escapeRegexChars
2020-10-26 10:43:18 -04:00
Julian Lam
e98285dbbb fix: reimplementing isPrivilegedOrSelfAndPasswordMatch 2020-10-15 21:45:57 -04:00
Barış Soner Uşaklı
84a179f48c Merge branch 'master' of https://github.com/NodeBB/NodeBB 2020-10-15 20:51:55 -04:00
Julian Lam
222b4c9533 fix: broken tests from api change 2020-10-15 19:33:20 -04:00
Barış Soner Uşaklı
7d86be2bc2 fix: tests 2020-10-15 17:51:04 -04:00
Barış Soner Uşaklı
872bacf1c4 Admin/users (#8762)
* feat: wip admin/users

* feat: more work

* feat: more fixes

* feat: #8662, verified/unverified user groups

* feat: add filter

* feat: change user search to use filters array

* refactor: remove unused search call

* fix: tests

* fix: cant join system groups

* fix: upgrade script
2020-10-13 22:42:50 -04:00
Barış Soner Uşaklı
1ee9384875 fix: #8757, allow all slashes in category route 2020-10-12 14:18:59 -04:00
Barış Soner Uşaklı
ac43cd8b6f fix: #8665, trim email before checking validity 2020-09-21 20:50:56 -04:00
Barış Soner Uşaklı
38d3982bf1 fix: #8418
allow updating other profile fields when username isnt being changed
2020-09-12 21:48:56 -04:00
Barış Soner Uşaklı
4be693f2e7 feat: fullname search (#8641)
* feat: fullname search

* fix: take last element

* fix: attempt to fix psql like query

* feat: upgrade sript, another fix attempt

* fix: psql test

* fix: psql scan

* feat: add debug for test

* feat: test collate

* feat: cleanup

* fix: upgrade script
2020-09-11 23:20:49 -04:00
Barış Soner Uşaklı
5f10d67db5 Remove sounds (#8617)
* feat: remove sounds

* feat: remove more sounds

* feat: disable sounds plugin

* fix: openapi
2020-09-06 23:45:00 -04:00
Barış Soner Uşaklı
9f9164a9be fix: #8582 2020-08-26 22:04:18 -04:00
Barış Soner Uşaklı
846b7d2430 refactor: change pwd change logic
add one more test
2020-08-12 22:09:22 -04:00
Barış Soner Uşaklı
a333cb6ca4 feat: one more test 2020-08-12 13:46:30 -04:00
Barış Soner Uşaklı
ecda4ad8ad feat: tests for password change 2020-08-12 13:42:55 -04:00
Barış Soner Uşaklı
b9cff5775c fix: edge case in test
if user is created the other one will be renamed
2020-07-23 21:42:23 -04:00
Barış Soner Uşaklı
02ac44cc5a fix: dont allow searching by ip/banned/flagged for regular users 2020-07-04 10:19:05 -04:00
Barış Soner Uşaklı
48b41debe6 fix: vulnerability in cover and admin uploads (#8419)
* fix: vulnerability in cover and admin uploads

* fix: remove old test

* fix: update tests
2020-06-22 12:08:35 -04:00
Barış Soner Uşaklı
bef37e27cb fix: test lock for user create (#8415)
* fix: test lock for user create

* fix: redis hdel with undefined

* feat: add test for undefined key in deleteObjectFields
2020-06-18 23:16:48 -04:00
Barış Soner Uşaklı
18d892398f fix: add timestamp to initial username history 2020-06-13 13:55:48 -04:00
Barış Soner Uşaklı
9d153fd388 fix: #8287, dont readd user after deletion
don't add user uid back to users:* sorted sets if they are deleted
upgrade script to fix users:* sorted sets
2020-05-02 13:27:16 -04:00
Barış Soner Uşaklı
4d0636f847 fix: #8163, prevent account deletion 2020-02-13 11:31:20 -05:00
Barış Soner Uşaklı
66febb8071 feat: add test for isOnline 2020-01-26 21:51:05 -05:00
Barış Soner Uşaklı
e06c1bfcd2 fix: escape config.userLang/acpLang, don't allow invalid language codes 2020-01-13 12:27:50 -05:00
Barış Soner Uşaklı
9d074731f4 fix: login with weak password 2019-12-26 20:17:54 -05:00
Barış Soner Uşaklı
75bcb0f484 fix: remove unused data from post/topic/user hashes 2019-10-07 23:13:43 -04:00
Barış Soner Uşaklı
cd80c2638c feat: #7743
user/password
user/picture
2019-07-16 14:17:10 -04:00
Barış Soner Uşaklı
fe4c048198 feat: #7743
user/index.js
user/info.js
user/invite.js
user/jobs.js
2019-07-16 11:42:24 -04:00
Barış Soner Uşaklı
4b843ba16f fix: #7567, allow invite and approval at the same time 2019-06-04 11:10:20 -04:00
Julian Lam
808c4909a4 fix: #6438 only apply whitelist when fields request empty (#7528)
* fix: #6438 only apply whitelist when fields request empty

* feat: explicit password retrieval denied via getUsersFields
2019-04-10 13:55:53 -04:00
Aziz Khoury
3fbb6faf28 feat: update unban logic/invocation and refactor User.bans module
* auto unban when User.getUsersFields is called and the user is banned but has expired

* cleanups and removal of expiry_readable

* expiry_readable make an alias for backward compatibility

* User.bans.func vs User.*ban*Func

* console.log cleanups, plus todo message added

* use code util.deprecate

* fix: remove ununsed winston require
2019-04-05 14:14:48 -04:00
Barış Soner Uşaklı
c6ad8fae2a fix: #7354 2019-02-11 14:29:25 -05:00
Barış Soner Uşaklı
5353960ae7 fix: #7316 2019-01-29 13:11:45 -05:00
Julian Lam
70a87d4399 feat: support for one-click unsubscribe from email clients (#7203)
* feat: sending notifs via ACP creates real notification

re: #7202

* feat: basic integration for one-click unsubscription #7202

* feat: tests for #7202 + bugfix

* feat: added and organized digest unsub tests

closes #7202
2019-01-08 13:56:11 -05:00
Barış Soner Uşaklı
9d28b935fd dont load uid 0, -1 from db 2018-11-22 21:57:56 -05:00
Barış Soner Uşaklı
a6864a8055 add groupTitle test for guests 2018-11-21 23:34:08 -05:00
Baris Usakli
b83e50f286 remove delayImageLoading from api @julianlam 2018-11-20 17:20:07 -05:00
Barış Soner Uşaklı
19e6c61244 add new test for queue 2018-10-27 06:29:12 -04:00
Barış Soner Uşaklı
f3a679e268 remove parseInts 2018-10-25 17:02:59 -04:00
Barış Soner Uşaklı
9c022afae1 Parse int (#6853)
* Store config fields as JSON in the db

Fewer parseInts

* Remove unnecessary parseInts

* remove some dupe code add tests

* remove console.log

* remove more parseInts

* WIP: read meta.configs defaults from defaults.json

remove more parseInts

* more work

* add log for failing test

* update admin pwd

* fix tests, dont require posts/cache before configs are initialized

* handle saves

* Test boolean conditions

* remove more parseInts

* Fix boolean values

* remove lots more parseInts

* removed json parsing

* renamed var to number

* categories dont have timestamp
2018-10-21 16:47:51 -04:00