fix: Escape like strings

Fixes https://github.com/flarum/core/issues/3025, title says it all.

js/src/admin/components/AdminPage.tsx

@@ -106,7 +106,7 @@ export type SettingsComponentOptions = HTMLInputSettingsComponentOptions | Switc
 export type AdminHeaderAttrs = AdminHeaderOptions & Partial<Omit<Mithril.Attributes, 'class'>>;
 
 export default abstract class AdminPage<CustomAttrs extends IPageAttrs = IPageAttrs> extends Page<CustomAttrs> {
-  settings!: Record<string, Stream<string>>;
+  settings: Record<string, Stream<string>> = {};
   loading: boolean = false;
 
   view(vnode: Mithril.Vnode<CustomAttrs, this>): Mithril.Children {

js/src/common/states/PaginatedListState.ts

@@ -92,7 +92,10 @@ export default abstract class PaginatedListState<T extends Model> {
    */
   protected loadPage(page = 1): Promise<T[]> {
     const params = this.requestParams();
-    params.page = { offset: this.pageSize * (page - 1) };
+    params.page = {
+      offset: this.pageSize * (page - 1),
+      ...params.page,
+    };
 
     if (Array.isArray(params.include)) {
       params.include = params.include.join(',');

src/Api/Controller/AbstractSerializeController.php

@@ -148,13 +148,9 @@ abstract class AbstractSerializeController implements RequestHandlerInterface
     abstract protected function createElement($data, SerializerInterface $serializer);
 
     /**
-     * Eager loads the required relationships.
-     *
-     * @param Collection $models
-     * @param array $relations
-     * @return void
+     * Returns the relations to load added by extenders.
      */
-    protected function loadRelations(Collection $models, array $relations): void
+    protected function getRelationsToLoad(): array
     {
         $addedRelations = [];
 
@@ -164,6 +160,20 @@ abstract class AbstractSerializeController implements RequestHandlerInterface
             }
         }
 
+        return $addedRelations;
+    }
+
+    /**
+     * Eager loads the required relationships.
+     *
+     * @param Collection $models
+     * @param array $relations
+     * @return void
+     */
+    protected function loadRelations(Collection $models, array $relations): void
+    {
+        $addedRelations = $this->getRelationsToLoad();
+
         if (! empty($addedRelations)) {
             usort($addedRelations, function ($a, $b) {
                 return substr_count($a, '.') - substr_count($b, '.');

src/Api/Controller/ShowDiscussionController.php

@@ -187,12 +187,21 @@ class ShowDiscussionController extends AbstractShowController
 
         $query->orderBy('created_at')->skip($offset)->take($limit)->with($include);
 
-        $posts = $query->get()->all();
+        $posts = $query->get();
 
         foreach ($posts as $post) {
             $post->discussion = $discussion;
         }
 
-        return $posts;
+        $this->loadRelations($posts, $include);
+
+        return $posts->all();
+    }
+
+    protected function getRelationsToLoad(): array
+    {
+        $addedRelations = parent::getRelationsToLoad();
+
+        return $this->getPostRelationships($addedRelations);
     }
 }

src/Api/Controller/UploadFaviconController.php

@@ -9,9 +9,13 @@
 
 namespace Flarum\Api\Controller;
 
+use Flarum\Foundation\ValidationException;
+use Flarum\Settings\SettingsRepositoryInterface;
+use Illuminate\Contracts\Filesystem\Factory;
 use Intervention\Image\Image;
 use Intervention\Image\ImageManager;
 use Psr\Http\Message\UploadedFileInterface;
+use Symfony\Contracts\Translation\TranslatorInterface;
 
 class UploadFaviconController extends UploadImageController
 {
@@ -19,6 +23,22 @@ class UploadFaviconController extends UploadImageController
 
     protected $filenamePrefix = 'favicon';
 
+    /**
+     * @var TranslatorInterface
+     */
+    protected $translator;
+
+    /**
+     * @param SettingsRepositoryInterface $settings
+     * @param Factory $filesystemFactory
+     */
+    public function __construct(SettingsRepositoryInterface $settings, Factory $filesystemFactory, TranslatorInterface $translator)
+    {
+        parent::__construct($settings, $filesystemFactory);
+
+        $this->translator = $translator;
+    }
+
     /**
      * {@inheritdoc}
      */
@@ -27,18 +47,24 @@ class UploadFaviconController extends UploadImageController
         $this->fileExtension = pathinfo($file->getClientFilename(), PATHINFO_EXTENSION);
 
         if ($this->fileExtension === 'ico') {
-            $encodedImage = $file->getStream();
-        } else {
-            $manager = new ImageManager();
-
-            $encodedImage = $manager->make($file->getStream())->resize(64, 64, function ($constraint) {
-                $constraint->aspectRatio();
-                $constraint->upsize();
-            })->encode('png');
-
-            $this->fileExtension = 'png';
+            // @todo remove in 2.0
+            throw new ValidationException([
+                'message' => strtr($this->translator->trans('validation.mimes'), [
+                    ':attribute' => 'favicon',
+                    ':values' => 'jpeg,png,gif,webp',
+                ])
+            ]);
         }
 
+        $manager = new ImageManager();
+
+        $encodedImage = $manager->make($file->getStream())->resize(64, 64, function ($constraint) {
+            $constraint->aspectRatio();
+            $constraint->upsize();
+        })->encode('png');
+
+        $this->fileExtension = 'png';
+
         return $encodedImage;
     }
 }

src/Forum/Content/Index.php

@@ -68,12 +68,13 @@ class Index
         $sort = Arr::pull($queryParams, 'sort');
         $q = Arr::pull($queryParams, 'q');
         $page = max(1, intval(Arr::pull($queryParams, 'page')));
+        $filters = Arr::pull($queryParams, 'filter', []);
 
         $sortMap = $this->getSortMap();
 
         $params = [
             'sort' => $sort && isset($sortMap[$sort]) ? $sortMap[$sort] : '',
-            'filter' => [],
+            'filter' => $filters,
             'page' => ['offset' => ($page - 1) * 20, 'limit' => 20]
         ];
 

src/Http/Middleware/AuthenticateWithHeader.php

@@ -47,6 +47,8 @@ class AuthenticateWithHeader implements Middleware
             }
 
             if (isset($actor)) {
+                $actor->updateLastSeen()->save();
+
                 $request = RequestUtil::withActor($request, $actor);
                 $request = $request->withAttribute('bypassCsrfToken', true);
                 $request = $request->withoutAttribute('session');

src/User/Search/Gambit/FulltextGambit.php

@@ -34,6 +34,8 @@ class FulltextGambit implements GambitInterface
      */
     private function getUserSearchSubQuery($searchValue)
     {
+        $searchValue = $this->users->escapeLikeString($searchValue);
+
         return $this->users
             ->query()
             ->select('id')

src/User/UserRepository.php

@@ -102,6 +102,8 @@ class UserRepository
      * @param string $string
      * @param User|null $actor
      * @return array
+     *
+     * @deprecated remove in 2.0 (no longer used since https://github.com/flarum/core/pull/1878)
      */
     public function getIdsForUsername($string, User $actor = null)
     {
@@ -135,8 +137,10 @@ class UserRepository
      *
      * @param string $string
      * @return string
+     *
+     * @internal
      */
-    private function escapeLikeString($string)
+    public function escapeLikeString($string)
     {
         return str_replace(['\\', '%', '_'], ['\\\\', '\%', '\_'], $string);
     }