Dan Brown [Sat, 16 Sep 2023 12:18:35 +0000 (13:18 +0100)]
Guest control: Cleaned methods involved in fetching/handling
- Moves guest user caching from User class to app container for
simplicity.
- Updates test to use simpler $this->users->guest() method for
consistency.
- Streamlined helpers to avoid function overlap for simplicity.
- Extracted user profile dropdown while doing changes.
Dan Brown [Wed, 13 Sep 2023 09:09:33 +0000 (10:09 +0100)]
Reviewed #4533, formatting and tweaks
- Updating formatting.
- Tweaked truncation to roughly match elipsis char to width used.
- Updated testing to use existing helpers, and ran check as admin user
to avoid name conflicts.
Dan Brown [Tue, 12 Sep 2023 11:34:02 +0000 (12:34 +0100)]
Theme: Added handling for functions.php file load error
This adds specific handling for functions.php error loading to re-throw
errors wrapped in a more descriptive message, to make it clear the error
is due to an issue in their functions.php file.
Decided to throw and stop, rather than ignore & continue, to be on the
safe side in the event auth-level (or other security level) customizations
have been made via functions.php.
Dan Brown [Mon, 11 Sep 2023 14:26:04 +0000 (15:26 +0100)]
Slack auth: Switched from community to laravel library
Tested locally before & after change, and looked at code to compare.
Nothing seen or experienced that should affect things, from testing all
is working as expected with no difference from before.
- Update composer requirement of socialite to that which included slack.
- Updated PHP depds while there.
- Updated format of socialite events to align with current documentation
and to use class references instead of strings.
- Changed use of array spread since it was not supported in PHP8.0.
- Updated issue templates based to reduce less valueable fields, update
some details, and try to help bug reports be more focused on bugs.
- Updated readme with peertube link and attribution advistory for
translations PRs.
Dan Brown [Sun, 3 Sep 2023 13:19:43 +0000 (14:19 +0100)]
Watching: Prevent issues when watchable or user is deleted
- Adds filtering to the watched items list in notification preferences
so that deleted (recycle bin) items are removed via query.
- Adds relations and logic to properly remove watches upon user and
entity delete events, to old watches in database do not linger.
- Adds testing to cover the above.
Did not add migration for existing data, since patch will be close to
introduction, and lingering DB entries don't open a security concern,
just some potential confusion in specific potential scenarios.
Probably not work extra migration risk, although could add in future if
concerns/issues are found.
Dan Brown [Sat, 2 Sep 2023 14:39:45 +0000 (15:39 +0100)]
Testing: Added entity decode flag and phpunit env option
- Passed decode flags to provide consistent behaviour across PHP
versions during testing.
- Added env option to prevent local option taking action in PHPunit
tests.
Dan Brown [Sat, 2 Sep 2023 14:11:42 +0000 (15:11 +0100)]
Notifications: Aligned how user language is used
- This ensures content notifications are not translated to receiver
language.
- This adds actual plaintext support for content notifications (Was
previously just HTML as text view).
- Shares same base class across all mail notifications.
- Also cleaned up existing notification classes.
Dan Brown [Sat, 26 Aug 2023 19:13:37 +0000 (20:13 +0100)]
SSR: Updated allow list handling & covered webhook usage
- Covered webhook SSR allow list useage via test.
- Updated allow list handling to use trailing slash, or hash, or end of
line as late anchor for better handling for hosts (prevent .co.uk
passing for .co domain host)
Dan Brown [Sat, 26 Aug 2023 13:07:48 +0000 (14:07 +0100)]
Guests: Prevented access to profile routes
Prevention of action on certain routes for guest user when public access
is enabled. Could not see a way this could be a security issue, beyond a
mild nuisance that'd only be visible if public users can edit, which
would present larger potential nuisance anyway.
Dan Brown [Tue, 22 Aug 2023 18:30:39 +0000 (19:30 +0100)]
Drawio: Started browser drawing backup store system
Adds just the part to store image data, and remove on successfull save.
Alters save events to properly throw upon error.
Adds IDB-Keyval library for local large-size store.
For #4421
Dan Brown [Mon, 21 Aug 2023 14:40:53 +0000 (15:40 +0100)]
API: Reviewed changes for API priority control
Review of #4313
- Made constructor changes while reviewing some classes.
- Updated API examples for consistency.
- Tweaked formatting for some array changes.
- Simplified added tests.
- Tweaked chapter/page repo priority handling to be simpler.
Performed manual API endpoint testing of page/chapter create/update.
Added test and changed logic to properly check the view permissions for
the notification receiver before sending.
Required change to permissions applicator to allow the user to be
manually determined, and a service provider update to provide the class
as a singleton without a specific user, so it checks the current logged
in user on demand.
Dan Brown [Thu, 17 Aug 2023 13:59:28 +0000 (14:59 +0100)]
Notifications: Fixed issues causing failing tests
- Ensured watch options passed in all meta template usage to fix failing
scenarios where watch options did not exist.
- Fixed testing issue caused by guest user permission caching.
Dan Brown [Tue, 15 Aug 2023 13:39:39 +0000 (14:39 +0100)]
Notifications: Cleaned up mails, added debounce for updates
- Updated mail notification design to be a bit prettier, and extracted
text to new lang file for translation.
- Added debounce logic for page update notifications.
- Fixed watch options not being filtered to current user.
Dan Brown [Mon, 14 Aug 2023 16:29:12 +0000 (17:29 +0100)]
Notifications: Added new preferences view and access control
- Added general user preferences view and updated link in profile menu
to suit.
- Made notification permission required for notification preferences
view, added test to cover.
Dan Brown [Mon, 14 Aug 2023 12:11:18 +0000 (13:11 +0100)]
Notifications: User watch list and differnt page watch options
- Adds option filtering and alternative text for page watch options.
- Adds "Watched & Ignored Items" list to user notification preferences
page to show existing watched items.
Dan Brown [Tue, 18 Jul 2023 14:07:31 +0000 (15:07 +0100)]
Comments: Added extra comment-specific activities
Kept existing "COMMENTED_ON" activity for upgrade compatibility,
specifically for existing webhook usage and for showing comment
activities in activity lists.
Precursor to content notifications.
Currently untested.
Also applied some type updates.
Dan Brown [Wed, 12 Jul 2023 21:04:05 +0000 (22:04 +0100)]
Shelf permissions: reverted create removal
Reverted work in 847a57a49aef525d2f7f429a30e58a34cf69d43f.
Left test in but updated to new expectation.
Left migration in but removed content to prevent new pre-v23.06
upgraders loosing shelf create permission status.
Added note to permission to describe use-case.
Dan Brown [Wed, 12 Jul 2023 15:16:12 +0000 (16:16 +0100)]
Webhooks: Fixed failing delete-based events
Due to queue serialization.
Added a test to check a couple of delete events.
Added ApiTokenFactory to support.
Also made a couple of typing/doc updates while there.