Dan Brown [Tue, 19 Sep 2023 19:09:33 +0000 (20:09 +0100)]
Search: Added support for escaped exact terms
Also prevented use of empty exact matches.
Prevents issues when attempting to use exact search terms in inputs for
just search terms, and use of single " chars within search terms since
these would get auto-promoted to exacts.
Dan Brown [Tue, 19 Sep 2023 14:53:01 +0000 (15:53 +0100)]
Avatar Commend: Simplified and updated during review
During review of #4560.
- Simplified command to share as much log as possible across different
run options.
- Extracted out user handling to share with MFA command.
- Added specific handling for disabled avatar fetching.
- Added mention of avatar endpoint, to make it clear where these avatars
are coming from (Protect against user expectation of LDAP avatar sync).
- Simplified a range of the testing.
- Tweaked wording and code formatting.
Dan Brown [Sun, 17 Sep 2023 21:02:12 +0000 (22:02 +0100)]
Locales: Removed a lot of existing locale handling
There was a lot of locale handling to get correct/expected date
formatting within the app.
Carbon now has built-in locale content rather than us needing to target
specific system locales.
This also removes setting locale via Carbon directly.
Carbon registers its own Laravel service provider which seems to
accurately pull the correct locale from the app.
Dan Brown [Sun, 17 Sep 2023 12:29:06 +0000 (13:29 +0100)]
Locales: Performed cleanup and alignment of locale handling
- Reduced app settings down to what's required.
- Used new view-shared $locale object instead of using globals via
config.
- Aligned language used to default on "locale" instead of mixing
locale/language.
Dan Brown [Sat, 16 Sep 2023 12:18:35 +0000 (13:18 +0100)]
Guest control: Cleaned methods involved in fetching/handling
- Moves guest user caching from User class to app container for
simplicity.
- Updates test to use simpler $this->users->guest() method for
consistency.
- Streamlined helpers to avoid function overlap for simplicity.
- Extracted user profile dropdown while doing changes.
Dan Brown [Wed, 13 Sep 2023 09:09:33 +0000 (10:09 +0100)]
Reviewed #4533, formatting and tweaks
- Updating formatting.
- Tweaked truncation to roughly match elipsis char to width used.
- Updated testing to use existing helpers, and ran check as admin user
to avoid name conflicts.
Dan Brown [Tue, 12 Sep 2023 11:34:02 +0000 (12:34 +0100)]
Theme: Added handling for functions.php file load error
This adds specific handling for functions.php error loading to re-throw
errors wrapped in a more descriptive message, to make it clear the error
is due to an issue in their functions.php file.
Decided to throw and stop, rather than ignore & continue, to be on the
safe side in the event auth-level (or other security level) customizations
have been made via functions.php.
Dan Brown [Mon, 11 Sep 2023 14:26:04 +0000 (15:26 +0100)]
Slack auth: Switched from community to laravel library
Tested locally before & after change, and looked at code to compare.
Nothing seen or experienced that should affect things, from testing all
is working as expected with no difference from before.
- Update composer requirement of socialite to that which included slack.
- Updated PHP depds while there.
- Updated format of socialite events to align with current documentation
and to use class references instead of strings.
- Changed use of array spread since it was not supported in PHP8.0.
- Updated issue templates based to reduce less valueable fields, update
some details, and try to help bug reports be more focused on bugs.
- Updated readme with peertube link and attribution advistory for
translations PRs.
Dan Brown [Sun, 3 Sep 2023 13:19:43 +0000 (14:19 +0100)]
Watching: Prevent issues when watchable or user is deleted
- Adds filtering to the watched items list in notification preferences
so that deleted (recycle bin) items are removed via query.
- Adds relations and logic to properly remove watches upon user and
entity delete events, to old watches in database do not linger.
- Adds testing to cover the above.
Did not add migration for existing data, since patch will be close to
introduction, and lingering DB entries don't open a security concern,
just some potential confusion in specific potential scenarios.
Probably not work extra migration risk, although could add in future if
concerns/issues are found.
Dan Brown [Sat, 2 Sep 2023 14:39:45 +0000 (15:39 +0100)]
Testing: Added entity decode flag and phpunit env option
- Passed decode flags to provide consistent behaviour across PHP
versions during testing.
- Added env option to prevent local option taking action in PHPunit
tests.
Dan Brown [Sat, 2 Sep 2023 14:11:42 +0000 (15:11 +0100)]
Notifications: Aligned how user language is used
- This ensures content notifications are not translated to receiver
language.
- This adds actual plaintext support for content notifications (Was
previously just HTML as text view).
- Shares same base class across all mail notifications.
- Also cleaned up existing notification classes.
Dan Brown [Sat, 26 Aug 2023 19:13:37 +0000 (20:13 +0100)]
SSR: Updated allow list handling & covered webhook usage
- Covered webhook SSR allow list useage via test.
- Updated allow list handling to use trailing slash, or hash, or end of
line as late anchor for better handling for hosts (prevent .co.uk
passing for .co domain host)
Dan Brown [Sat, 26 Aug 2023 13:07:48 +0000 (14:07 +0100)]
Guests: Prevented access to profile routes
Prevention of action on certain routes for guest user when public access
is enabled. Could not see a way this could be a security issue, beyond a
mild nuisance that'd only be visible if public users can edit, which
would present larger potential nuisance anyway.
Dan Brown [Tue, 22 Aug 2023 18:30:39 +0000 (19:30 +0100)]
Drawio: Started browser drawing backup store system
Adds just the part to store image data, and remove on successfull save.
Alters save events to properly throw upon error.
Adds IDB-Keyval library for local large-size store.
For #4421
Dan Brown [Mon, 21 Aug 2023 14:40:53 +0000 (15:40 +0100)]
API: Reviewed changes for API priority control
Review of #4313
- Made constructor changes while reviewing some classes.
- Updated API examples for consistency.
- Tweaked formatting for some array changes.
- Simplified added tests.
- Tweaked chapter/page repo priority handling to be simpler.
Performed manual API endpoint testing of page/chapter create/update.
Added test and changed logic to properly check the view permissions for
the notification receiver before sending.
Required change to permissions applicator to allow the user to be
manually determined, and a service provider update to provide the class
as a singleton without a specific user, so it checks the current logged
in user on demand.
Dan Brown [Thu, 17 Aug 2023 13:59:28 +0000 (14:59 +0100)]
Notifications: Fixed issues causing failing tests
- Ensured watch options passed in all meta template usage to fix failing
scenarios where watch options did not exist.
- Fixed testing issue caused by guest user permission caching.
Dan Brown [Tue, 15 Aug 2023 13:39:39 +0000 (14:39 +0100)]
Notifications: Cleaned up mails, added debounce for updates
- Updated mail notification design to be a bit prettier, and extracted
text to new lang file for translation.
- Added debounce logic for page update notifications.
- Fixed watch options not being filtered to current user.
Dan Brown [Mon, 14 Aug 2023 16:29:12 +0000 (17:29 +0100)]
Notifications: Added new preferences view and access control
- Added general user preferences view and updated link in profile menu
to suit.
- Made notification permission required for notification preferences
view, added test to cover.
Dan Brown [Mon, 14 Aug 2023 12:11:18 +0000 (13:11 +0100)]
Notifications: User watch list and differnt page watch options
- Adds option filtering and alternative text for page watch options.
- Adds "Watched & Ignored Items" list to user notification preferences
page to show existing watched items.