Commit Graph

181 Commits

Author SHA1 Message Date
Julian Lam
087e6020e4 refactor(email): validation checking methods, +tests fix 2021-07-30 13:29:13 -04:00
Julian Lam
a3a3b10fb3 test(emails): fixing broken tests introduced by e5ff68acd 2021-07-30 13:29:13 -04:00
Julian Lam
12b2a979a0 feat: removal of emailExists socket listener 2021-07-30 13:29:13 -04:00
Julian Lam
0960a81468 fix: tests 2021-07-09 12:24:32 -04:00
gasoved
97c8569a79 fix: hide private user data in api/v3/users/[uid] 2021-06-30 17:02:38 -04:00
gasoved
8168c6c407 fix: purge uploaded images accordingly #9606 (#9611)
* fix: purge uploaded images accordingly

* fix: tests

* fix: relative paths
2021-06-18 09:21:23 -04:00
Julian Lam
5c42b3eab0 test: fixed broken tests from #9605, removed token clean on token usage as it is superceded by token clean on generation (+ associated test) 2021-06-11 15:43:03 -04:00
Barış Soner Uşaklı
308252f566 fix: #9503, dont error in markUnread if room doesnt exist
this prevents deleting the user if they are the only person in the chat room
2021-04-23 14:46:54 -04:00
Barış Soner Uşaklı
8ef38cb252 test: add missing test 2021-03-11 10:39:36 -05:00
Barış Soner Uşaklı
0af9d26fe5 feat: change uploadCroppedPicture to use updateProfile as well 2021-03-03 17:14:55 -05:00
Barış Soner Uşaklı
a598abcd8e feat: use updateProfile for picture change
so it triggers action:user:updateProfile
2021-03-03 17:11:13 -05:00
Julian Lam
d3a9e76ae2 test(user): added additional tests for icon background colour 2021-02-19 11:38:48 -05:00
Peter Jaszkowiak
dab3b23575 chore: eslint no-var, vars-on-top 2021-02-08 18:06:44 -05:00
Peter Jaszkowiak
b56d9e12b5 chore: eslint prefer-arrow-callback 2021-02-08 18:06:44 -05:00
Peter Jaszkowiak
707b55b6a5 chore: eslint prefer-template 2021-02-08 18:06:44 -05:00
gasoved
53e0d4d2e0 feat: banned-users group 2021-02-03 15:22:44 -05:00
Barış Soner Uşaklı
647d3ba810 fix: removed methods 2021-01-27 17:36:58 -05:00
Julian Lam
f2a5cd0b67 fix: tests for #9217 2021-01-24 14:05:11 -05:00
Peter Jaszkowiak
2be396ff6e fix: email testing and settings change from ACP
- changing email SMTP settings wouldn't apply the first time
- "Send Test Email" now will report emailer errors in most cases
2020-12-18 16:39:09 -05:00
Barış Soner Uşaklı
80de572aa1 feat: add user.email.confirmByUid for sso plugins 2020-12-10 20:25:48 -05:00
Barış Soner Uşaklı
557f0f5631 feat: use correct code 2020-11-29 22:41:19 -05:00
Barış Soner Uşaklı
f25000cb60 fix: pwd reset test 2020-11-29 22:30:40 -05:00
Barış Soner Uşaklı
5080f35752 fix: #8991, logout on password reset, dont verify email if password expired
dont allow same password on reset
2020-11-29 21:55:07 -05:00
Barış Soner Uşaklı
e32cd31ec6 fix: #8918 2020-11-25 14:33:19 -05:00
gasoved
3ccebf112e feat: invites regardless of registration type, invite privilege, groups to join on acceptance (#8786)
* feat: allow invites in normal registration mode + invite privilege

* feat: select groups to join from an invite

* test: check if groups from invitations have been joined

* fix: remove unused variable

* feat: write API versions of socket calls

* docs: openapi specs for the new routes

* test: iron out mongo redis difference

* refactor: move inviteGroups endpoint into write API

* refactor: use GET /api/v3/users/:uid/invites/groups

Instead of GET /api/v3/users/:uid/inviteGroups

* fix: no need for /api/v3 prefix when using api module

* fix: tests

* refactor: change POST /api/v3/users/invite

To POST /api/v3/users/:uid/invites

* refactor: make helpers.invite awaitable

* fix: restrict invite API to self-use only

* fix: move invite groups controller to write api, +tests

* fix: tests

Co-authored-by: Julian Lam <julian@nodebb.org>
2020-11-16 14:47:23 -05:00
Julian Lam
512f6de6de feat: allow passwords with length > 73 characters (#8818)
* feat: allow passwords longer than 73 characters

Context: A bcrypt/blowfish limitation means that password length is capped at 72 characters. We can get around this without compromising on security
by hashing all incoming passwords with SHA512, and then sending that to bcrypt.

https://dropbox.tech/security/how-dropbox-securely-stores-your-passwords

* feat: add additional test for passwords > 73 chars

* fix: remove 'password-too-long' error message and all invocations

* test: added test to show that a super long password won't bring down NodeBB

* fix: remove debug log

* Revert "fix: remove 'password-too-long' error message and all invocations"

This reverts commit 1e312bf7ef.

* fix: added back password length checks, but at 512 chars

As processing a large string still uses a lot of memory
2020-11-06 08:40:00 -05:00
Barış Soner Uşaklı
a05905f196 performance improvements (#8795)
* perf: nconf/winston/render

cache nconf.get calls
modify middleware.pageView to call next earlier
don't call winston.verbose on every hook see https://github.com/winstonjs/winston/issues/1669
translate header/footer separately and cache results for guests

* fix: copy paste fail

* refactor: style and fire hook only log in dev mode

* fix: cache key, header changes based on template

* perf: change replace

* fix: add missing await

* perf: category

* perf: lodash clone

* perf: remove escapeRegexChars
2020-10-26 10:43:18 -04:00
Julian Lam
e98285dbbb fix: reimplementing isPrivilegedOrSelfAndPasswordMatch 2020-10-15 21:45:57 -04:00
Barış Soner Uşaklı
84a179f48c Merge branch 'master' of https://github.com/NodeBB/NodeBB 2020-10-15 20:51:55 -04:00
Julian Lam
222b4c9533 fix: broken tests from api change 2020-10-15 19:33:20 -04:00
Barış Soner Uşaklı
7d86be2bc2 fix: tests 2020-10-15 17:51:04 -04:00
Barış Soner Uşaklı
872bacf1c4 Admin/users (#8762)
* feat: wip admin/users

* feat: more work

* feat: more fixes

* feat: #8662, verified/unverified user groups

* feat: add filter

* feat: change user search to use filters array

* refactor: remove unused search call

* fix: tests

* fix: cant join system groups

* fix: upgrade script
2020-10-13 22:42:50 -04:00
Barış Soner Uşaklı
1ee9384875 fix: #8757, allow all slashes in category route 2020-10-12 14:18:59 -04:00
Barış Soner Uşaklı
ac43cd8b6f fix: #8665, trim email before checking validity 2020-09-21 20:50:56 -04:00
Barış Soner Uşaklı
38d3982bf1 fix: #8418
allow updating other profile fields when username isnt being changed
2020-09-12 21:48:56 -04:00
Barış Soner Uşaklı
4be693f2e7 feat: fullname search (#8641)
* feat: fullname search

* fix: take last element

* fix: attempt to fix psql like query

* feat: upgrade sript, another fix attempt

* fix: psql test

* fix: psql scan

* feat: add debug for test

* feat: test collate

* feat: cleanup

* fix: upgrade script
2020-09-11 23:20:49 -04:00
Barış Soner Uşaklı
5f10d67db5 Remove sounds (#8617)
* feat: remove sounds

* feat: remove more sounds

* feat: disable sounds plugin

* fix: openapi
2020-09-06 23:45:00 -04:00
Barış Soner Uşaklı
9f9164a9be fix: #8582 2020-08-26 22:04:18 -04:00
Barış Soner Uşaklı
846b7d2430 refactor: change pwd change logic
add one more test
2020-08-12 22:09:22 -04:00
Barış Soner Uşaklı
a333cb6ca4 feat: one more test 2020-08-12 13:46:30 -04:00
Barış Soner Uşaklı
ecda4ad8ad feat: tests for password change 2020-08-12 13:42:55 -04:00
Barış Soner Uşaklı
b9cff5775c fix: edge case in test
if user is created the other one will be renamed
2020-07-23 21:42:23 -04:00
Barış Soner Uşaklı
02ac44cc5a fix: dont allow searching by ip/banned/flagged for regular users 2020-07-04 10:19:05 -04:00
Barış Soner Uşaklı
48b41debe6 fix: vulnerability in cover and admin uploads (#8419)
* fix: vulnerability in cover and admin uploads

* fix: remove old test

* fix: update tests
2020-06-22 12:08:35 -04:00
Barış Soner Uşaklı
bef37e27cb fix: test lock for user create (#8415)
* fix: test lock for user create

* fix: redis hdel with undefined

* feat: add test for undefined key in deleteObjectFields
2020-06-18 23:16:48 -04:00
Barış Soner Uşaklı
18d892398f fix: add timestamp to initial username history 2020-06-13 13:55:48 -04:00
Barış Soner Uşaklı
9d153fd388 fix: #8287, dont readd user after deletion
don't add user uid back to users:* sorted sets if they are deleted
upgrade script to fix users:* sorted sets
2020-05-02 13:27:16 -04:00
Barış Soner Uşaklı
4d0636f847 fix: #8163, prevent account deletion 2020-02-13 11:31:20 -05:00
Barış Soner Uşaklı
66febb8071 feat: add test for isOnline 2020-01-26 21:51:05 -05:00
Barış Soner Uşaklı
e06c1bfcd2 fix: escape config.userLang/acpLang, don't allow invalid language codes 2020-01-13 12:27:50 -05:00