1
0
mirror of https://github.com/flarum/core.git synced 2025-07-24 10:11:43 +02:00
Commit Graph

267 Commits

Author SHA1 Message Date
Daniël Klabbers
79abf87e8c Dw/huntr fix path traversal (#2931)
* Fix Huntr vuln with possible directory traversal
* Use `active_url` in Laravel validator
2021-06-21 10:14:15 +02:00
Alexander Skvortsov
0bd3dcec39 Typehint event in console scheduling test case 2021-05-11 23:55:34 -04:00
Alexander Skvortsov
bd33954a57 Rename viewDiscussions => viewForum, viewUserList => searchUsers (#2854)
This naming is clearer as to the intended effect. Changes include:

- A migration to rename all permissions
- Updating the seed migration to use the original naming from the start
- Replacing usage of the old names with new names in code
- Throwing warnings when the old names are used.
2021-05-11 15:15:27 -04:00
Alexander Skvortsov
d5c2a997b1 Run API Client requests through middleware (#2783)
- Add integration tests for login and registration
- Use URL instead of controller
- Add fluent API
- Allow setting parent request, user, session
2021-05-10 17:41:38 -04:00
Matt Kilgore
b6a811bbcc Harden Headers (#2721)
* Basic security headers

* Remove XSS Header (not relevent)

* Fix config name

* Use Arr::get()

* Add tests

* Re-fix the StoreConfig step for fresh installs

Co-authored-by: luceos <luceos@users.noreply.github.com>
Co-authored-by: Alexander Skvortsov <askvortsov1@users.noreply.github.com>
2021-05-03 12:42:06 -04:00
Alexander Skvortsov
87024fc8b7 Apply fixes from StyleCI
[ci skip] [skip ci]
2021-05-03 05:36:06 +00:00
Alexander Skvortsov
a22fed10a7 Use latest version of settings package
This allows us to get rid of hacks for configuring settings and config
2021-05-03 01:35:46 -04:00
Alexander Skvortsov
b5ee8a034b Switch to ICU MessageFormat (#2759) 2021-04-30 12:44:39 -04:00
Alexander Skvortsov
401672aac4 Combine search tests
#b4738febaa2e9a34cea181b621016b50a145115d and #0fb3548f46719090579a5ef4e8cda26234d24943
 both added/improved searching tests, but did so in separate files. As a result, the tests did not consider each other, and when both were merged, started failing. This commit combines the tests into one file that tests both order and search in titles.
2021-04-20 19:16:59 -04:00
Alexander Skvortsov
04115e28c1 Fix searching titles in discussions (#2698)
* Fix searching titles in discussions

* Apply fixes from StyleCI

* Fix tests

* Distinct by discussion ID

* Replace distinct with groupBy

Co-authored-by: Alexander Skvortsov <askvortsov1@users.noreply.github.com>
2021-04-20 18:52:14 -04:00
Alexander Skvortsov
42a9de5a11 Fix registering custom searchers, allow searchers without fulltext (#2755) 2021-04-19 16:59:53 -04:00
Alexander Skvortsov
4fea0ebdee Filesystem Extender and Tests (#2732) 2021-04-19 16:25:08 -04:00
Alexander Skvortsov
3e173afa24 Use Laravel filesystem interface for assets and avatars (#2729)
* WIP: Use Laravel filesystem interface where possible
* Drop vendorFilesystem
* Support getting URL of cloud-based logo and favicon
* FilesystemAdapter should always be cloud
* Get base avatar URL from filesystem adapter
* Restore deleted getAsset method

Co-authored-by: Alexander Skvortsov <askvortsov1@users.noreply.github.com>
2021-04-19 21:11:03 +02:00
Sami Mazouz
72e29a24b7 Add unparse to Formatter extender (#2780) 2021-04-14 11:34:49 +01:00
Alexander Skvortsov
0fb3548f46 Fix relevance sort (#2773)
- Adds a field to QueryCriteria that determines whether the sort provided is the controller's default sort
- Set this field to true iff sort not in query params. Default it to false
- Override $sort if a new default sort has been set on search state, and the param is true.
- Add tests!
2021-04-11 22:21:56 -04:00
Sami Mazouz
598bb94657 Require unique route names (#2771) 2021-04-10 20:38:25 +01:00
Alexander Skvortsov
afa89aa05d Preloaded API document Improvements (#2754)
* Invalidate preloadedApiDocument if URL has changed
* Revert to using `getRouteData()[0]`
2021-04-07 23:25:01 +01:00
Sami Mazouz
e60bf67c61 Eager loading extender (#2724)
* Eager loading extender
* Add tests for the eager loading extender
2021-03-25 15:36:39 +01:00
Sami Mazouz
4cc9aeeb28 Improve ApiSerializer tests (#2733)
The ApiSerializerTest was added before the ApiController extender, so I used a workaround at the time to check for the existence of the relationships on the serializer.
2021-03-23 17:33:51 -04:00
Alexander Skvortsov
512b756804 Include task scheduler in core 2021-03-19 18:01:38 -04:00
Alexander Skvortsov
897e778800 Remove deprecated code from beta 16 (#2705) 2021-03-19 19:13:50 +01:00
Alexander Skvortsov
99311188a2 Make filter mutator API consistent with search mutator API.
This is inline with the docblock for the Filter extender, and is much more sensible.
2021-03-11 23:12:49 -05:00
Alexander Skvortsov
97d1a42ad2 Add deprecated "user" filter for posts
In the filterer refactor for ListPostsController, the filter key was changed to `author` for consistency with the AuthorFilterGambit used in discussions. This commit adds a deprecated `user` filter back in for a release to allow for a graceful transition
2021-03-08 16:20:26 -05:00
Alexander Skvortsov
9cd94c5d78 Use flarum/testing for test infrastructure (#2545) 2021-03-07 16:32:41 -05:00
Daniël Klabbers
242593daf6 Laravel components v8 (#2576)
- update actions ci
- include json for 4 spaces tab
- provide output int for process code exit
- adhere to parent type hint of builder
- mailer instance now needs a name, multiple can be instantiated
- getOriginal now uses mutators in the model
- Temporarily loosen MailableInterface requirements. This avoids an immediate BC break for classes in extensions that implement this interface.
- Temporarily provide (and autoload) old symfony translator interface
- make queue exception handler compatible with the contract of L8
- Update phpunit schema for newer version
- Update phpunit assert calls for newer version
2021-03-05 09:43:35 -05:00
Clark Winkelmann
965b713a27 Refactor Access Tokens (#2651)
- Make session token-based instead of user-based
- Clear current session access tokens on logout
- Introduce increment ID so we can show tokens to moderators in the future without exposing secrets
- Switch to type classes to manage the different token types. New implementation fixes #2075
- Drop ability to customize lifetime per-token
- Add developer access keys that don't expire. These must be created from the database for now
- Add title in preparation for the developer token UI
- Add IP and user agent logging
- Delete all non-remember tokens in migration
2021-03-04 16:50:38 -05:00
Blake Payne
9c47ccd1fd Updated GroupFilterGambit to prevent hidden groups being visible wher… (#2657)
Updated GroupFilterGambit to prevent hidden groups being visible where they shouldn't be and to ensure that only the selected groups are returned on a search. Fixes #2559
2021-03-04 10:08:12 -05:00
Clark Winkelmann
8eb57ec990 Restrict who can use the lastSeenAt user sort (#2634) 2021-03-02 09:59:14 -05:00
Alexander Skvortsov
5813f2522c Query Namespace (#2645)
Move shared classes in search and filter namespaces to a new query namespace
2021-03-02 09:57:40 -05:00
Matt Kilgore
b5adb6e843 User edit permission tightening (#2620)
- Split user edit permision into edit attributes, edit credentials, and edit groups
- Only Admins can edit Admin Credentials
- Only Admins can Promote/Demote to/from Admin
2021-03-01 15:52:29 -05:00
Alexander Skvortsov
9157efe426 Use filterer for ListPostsController (#2479) 2021-02-28 14:06:07 -05:00
Sami Mazouz
e9abcd59db Allow overriding routes (#2577) 2021-02-28 14:01:30 -05:00
Alexander Skvortsov
87e58f390a Search Filter Split, Use Same Controller (#2454) 2021-02-24 11:17:40 -05:00
Alexander Skvortsov
0d81f248f8 Refactor password checker, add extender (#2176) 2021-02-22 17:08:36 -05:00
Alexander Skvortsov
c4ffa73d31 Optional Dependencies (#2579)
* Add and calculate optional dependencies
* Add extension dependency resolver (Kahn's algorithm), plus unit tests
* Resolve extension dependency on enable/disable
2021-02-21 13:49:33 -05:00
Robert Korulczyk
b234d37332 Move locale files from language pack to core (#2408) 2021-02-17 16:23:13 -05:00
Alexander Skvortsov
7e3b83b4f6 Broader support for callables in ContainerUtil (#2596)
It can be very annoying if we want to use something like boolval, but have to define an entire anonymous function to pass it in. This PR adds support for tpassing it in directly as a string, like is posible with User::registerPreference.
2021-02-10 14:51:31 -05:00
Alexander Skvortsov
4661de4ddc Simple Flarum Search Extender and tests (#2483) 2021-02-10 09:59:23 -05:00
Sami Mazouz
b1efe7b133 Rename ApiSerializer's mutate to attributes (#2578) 2021-02-05 13:21:36 -05:00
Alexander Skvortsov
2a2abfb3fa Deprecate GetModelIsPrivate, replace with extender (#2587) 2021-02-04 10:56:10 -05:00
Daniël Klabbers
8fdddf91a2 PHP 8 support, cookie unit tests (#2507) 2021-01-26 17:53:28 -05:00
Alexander Skvortsov
1ae7dbe464 Remove deprecated API events 2021-01-23 16:48:22 -05:00
Alexander Skvortsov
54fd02e839 Remove deprecated policy and visibility scoping events 2021-01-20 15:21:30 -05:00
Alexander Skvortsov
c887093e67 Remove deprecated CSRF wildcard path match 2021-01-20 12:01:52 -05:00
Alexander Skvortsov
60eb89e152 NotificationTest: Rely on adminUser from installation 2021-01-19 17:05:53 -05:00
Sami Mazouz
88ef99b13c Add Notification extender beforeSending method (#2533) 2021-01-19 14:40:19 -05:00
Alexander Skvortsov
c12bf937f5 Policies: treat true as allow, and false as deny (#2534) 2021-01-18 18:28:48 -05:00
Alexander Skvortsov
877296d194 Add subscribe method to event extender (#2535)
Historically, extensions using subscribers has caused problems because subscribers were constructed/applied at extension boot. This caused some classes (e.g. UrlGenerator) to be resolved early, breaking parts of Flarum. For this reason, subscriber support wasn't included in the initial version of the Event extender.

However, updating extensions has shown that there is a legitimate use case for subscribers in organizing clean code; for instance, core's own `DiscussionMetadataUpdater`.

This commit introduces support for subscribers, but only applies them after the app has booted, which avoids the early resolution issues. Since event listeners/subscribers are only intended to be used with domain events, which would never be dispatched during app boot, the late activation of subscribers should not cause issue.
2021-01-15 20:33:29 -05:00
Alexander Skvortsov
a5a8b075dd Apply fixes from StyleCI
[ci skip] [skip ci]
2021-01-09 00:36:07 -05:00
Alexander Skvortsov
54e0d1b7da Fix fulltext search tests
Under InnoDB, database entries created in transactions are not processed by fulltext indexes until the transaction is committed. To work around this, cases that test fulltext search have been split off into a separate class that adds and removes seed discussions/posts outside of transactions during setUp/tearDown.
2021-01-09 00:35:55 -05:00