Merge remote-tracking branch 'refs/remotes/origin/master' into develop

src/categories/recentreplies.js

@@ -91,11 +91,8 @@ module.exports = function (Categories) {
 				db.getSortedSetsMembers(keys, next);
 			},
 			function (results, next) {
-				var tids = _.flatten(results);
+				var tids = _.uniq(_.flatten(results).filter(Boolean));
 
-				tids = tids.filter(function (tid, index, array) {
-					return !!tid && array.indexOf(tid) === index;
-				});
 				privileges.topics.filterTids('read', tids, uid, next);
 			},
 			function (tids, next) {

src/controllers/helpers.js

@@ -179,6 +179,9 @@ helpers.buildTitle = function (pageTitle) {
 };
 
 helpers.getWatchedCategories = function (uid, selectedCid, callback) {
+	if (selectedCid && !Array.isArray(selectedCid)) {
+		selectedCid = [selectedCid];
+	}
 	async.waterfall([
 		function (next) {
 			user.getWatchedCategories(uid, next);
@@ -193,14 +196,30 @@ helpers.getWatchedCategories = function (uid, selectedCid, callback) {
 			categoryData = categoryData.filter(function (category) {
 				return category && !category.link;
 			});
-
-			var selectedCategory;
+			var selectedCategory = [];
+			var selectedCids = [];
 			categoryData.forEach(function (category) {
-				category.selected = parseInt(category.cid, 10) === parseInt(selectedCid, 10);
+				category.selected = selectedCid ? selectedCid.indexOf(String(category.cid)) !== -1 : false;
 				if (category.selected) {
-					selectedCategory = category;
+					selectedCategory.push(category);
+					selectedCids.push(parseInt(category.cid, 10));
 				}
 			});
+			selectedCids.sort(function (a, b) {
+				return a - b;
+			});
+
+			if (selectedCategory.length > 1) {
+				selectedCategory = {
+					icon: 'fa-plus',
+					name: '[[unread:multiple-categories-selected]]',
+					bgColor: '#ddd',
+				};
+			} else if (selectedCategory.length === 1) {
+				selectedCategory = selectedCategory[0];
+			} else {
+				selectedCategory = undefined;
+			}
 
 			var categoriesData = [];
 			var tree = categories.getTree(categoryData, 0);
@@ -209,7 +228,7 @@ helpers.getWatchedCategories = function (uid, selectedCid, callback) {
 				recursive(category, categoriesData, '');
 			});
 
-			next(null, { categories: categoriesData, selectedCategory: selectedCategory });
+			next(null, { categories: categoriesData, selectedCategory: selectedCategory, selectedCids: selectedCids });
 		},
 	], callback);
 };

src/controllers/recent.js

@@ -3,7 +3,7 @@
 
 var async = require('async');
 var nconf = require('nconf');
-var validator = require('validator');
+var querystring = require('querystring');
 
 var user = require('../user');
 var topics = require('../topics');
@@ -53,6 +53,7 @@ recentController.get = function (req, res, next) {
 		function (data) {
 			data.categories = categoryData.categories;
 			data.selectedCategory = categoryData.selectedCategory;
+			data.selectedCids = categoryData.selectedCids;
 			data.nextStart = stop + 1;
 			data.set = 'topics:recent';
 			data['feeds:disableRSS'] = parseInt(meta.config['feeds:disableRSS'], 10) === 1;
@@ -74,7 +75,8 @@ recentController.get = function (req, res, next) {
 				data.breadcrumbs = helpers.buildBreadcrumbs([{ text: '[[recent:title]]' }]);
 			}
 
-			data.querystring = cid ? ('?cid=' + validator.escape(String(cid))) : '';
+			data.querystring = cid ? '?' + querystring.stringify({ cid: cid }) : '';
+
 			res.render('recent', data);
 		},
 	], next);

src/controllers/unread.js

@@ -3,7 +3,6 @@
 
 var async = require('async');
 var querystring = require('querystring');
-var validator = require('validator');
 
 var pagination = require('../pagination');
 var user = require('../user');
@@ -64,6 +63,7 @@ unreadController.get = function (req, res, next) {
 
 			data.categories = results.watchedCategories.categories;
 			data.selectedCategory = results.watchedCategories.selectedCategory;
+			data.selectedCids = results.watchedCategories.selectedCids;
 
 			if (req.path.startsWith('/api/unread') || req.path.startsWith('/unread')) {
 				data.breadcrumbs = helpers.buildBreadcrumbs([{ text: '[[unread:title]]' }]);
@@ -76,8 +76,7 @@ unreadController.get = function (req, res, next) {
 				return filter && filter.selected;
 			});
 
-			data.querystring = cid ? ('?cid=' + validator.escape(String(cid))) : '';
-
+			data.querystring = cid ? '?' + querystring.stringify({ cid: cid }) : '';
 			res.render('unread', data);
 		},
 	], next);

src/messaging.js

@@ -72,11 +72,15 @@ function canGet(hook, callerUid, uid, callback) {
 }
 
 Messaging.parse = function (message, fromuid, uid, roomId, isNew, callback) {
+	message = S(message).stripTags().decodeHTMLEntities().s;
+	message = validator.escape(String(message));
+
 	plugins.fireHook('filter:parse.raw', message, function (err, parsed) {
 		if (err) {
 			return callback(err);
 		}
 
+
 		var messageData = {
 			message: message,
 			parsed: parsed,

src/meta/blacklist.js

@@ -65,6 +65,9 @@ Blacklist.test = function (clientIp, callback) {
 	// Some handy test addresses
 	// clientIp = '2001:db8:85a3:0:0:8a2e:370:7334';	// IPv6
 	// clientIp = '127.0.15.1';	// IPv4
+	// clientIp = '127.0.15.1:3443'; // IPv4 with port strip port to not fail
+	clientIp = clientIp.split(':').length === 2 ? clientIp.split(':')[0] : clientIp;
+
 	var addr = ipaddr.parse(clientIp);
 
 	if (

src/middleware/admin.js

@@ -5,6 +5,7 @@ var winston = require('winston');
 var user = require('../user');
 var meta = require('../meta');
 var plugins = require('../plugins');
+var jsesc = require('jsesc');
 
 var controllers = {
 	api: require('../controllers/api'),
@@ -73,11 +74,11 @@ module.exports = function (middleware) {
 
 				var templateValues = {
 					config: results.config,
-					configJSON: JSON.stringify(results.config),
+					configJSON: jsesc(JSON.stringify(results.config), { isScriptContext: true }),
 					relative_path: results.config.relative_path,
 					adminConfigJSON: encodeURIComponent(JSON.stringify(results.configs)),
 					user: userData,
-					userJSON: JSON.stringify(userData).replace(/'/g, "\\'"),
+					userJSON: jsesc(JSON.stringify(userData), { isScriptContext: true }),
 					plugins: results.custom_header.plugins,
 					authentication: results.custom_header.authentication,
 					scripts: results.scripts,

src/posts/queue.js

@@ -8,6 +8,7 @@ var meta = require('../meta');
 var topics = require('../topics');
 var notifications = require('../notifications');
 var privileges = require('../privileges');
+var plugins = require('../plugins');
 var socketHelpers = require('../socket.io/helpers');
 
 module.exports = function (Posts) {
@@ -18,7 +19,14 @@ module.exports = function (Posts) {
 			},
 			function (userData, next) {
 				var shouldQueue = parseInt(meta.config.postQueue, 10) === 1 && (!parseInt(uid, 10) || (parseInt(userData.reputation, 10) <= 0 && parseInt(userData.postcount, 10) <= 0));
-				next(null, shouldQueue);
+				plugins.fireHook('filter:post.shouldQueue', {
+					shouldQueue: shouldQueue,
+					uid: uid,
+					data: data,
+				}, next);
+			},
+			function (result, next) {
+				next(null, result.shouldQueue);
 			},
 		], callback);
 	};

src/topics/recent.js

@@ -3,11 +3,11 @@
 'use strict';
 
 var async = require('async');
+
 var db = require('../database');
 var plugins = require('../plugins');
 var privileges = require('../privileges');
 var user = require('../user');
-var categories = require('../categories');
 var meta = require('../meta');
 
 module.exports = function (Topics) {
@@ -23,22 +23,15 @@ module.exports = function (Topics) {
 			nextStart: 0,
 			topics: [],
 		};
-
+		if (cid && !Array.isArray(cid)) {
+			cid = [cid];
+		}
 		async.waterfall([
 			function (next) {
-				if (cid) {
-					categories.getTopicIds({
-						cid: cid,
-						start: 0,
-						stop: 199,
-						sort: 'newest_to_oldest',
-					}, next);
-				} else {
-					db.getSortedSetRevRange('topics:recent', 0, 199, next);
-				}
+				db.getSortedSetRevRange('topics:recent', 0, 199, next);
 			},
 			function (tids, next) {
-				filterTids(tids, uid, filter, next);
+				filterTids(tids, uid, filter, cid, next);
 			},
 			function (tids, next) {
 				recentTopics.topicCount = tids.length;
@@ -53,8 +46,7 @@ module.exports = function (Topics) {
 		], callback);
 	};
 
-
-	function filterTids(tids, uid, filter, callback) {
+	function filterTids(tids, uid, filter, cid, callback) {
 		async.waterfall([
 			function (next) {
 				if (filter === 'watched') {
@@ -84,9 +76,10 @@ module.exports = function (Topics) {
 				}, next);
 			},
 			function (results, next) {
+				cid = cid && cid.map(String);
 				tids = results.topicData.filter(function (topic) {
 					if (topic && topic.cid) {
-						return results.ignoredCids.indexOf(topic.cid.toString()) === -1;
+						return results.ignoredCids.indexOf(topic.cid.toString()) === -1 && (!cid || (cid.length && cid.indexOf(topic.cid.toString()) !== -1));
 					}
 					return false;
 				}).map(function (topic) {

src/topics/unread.js

@@ -75,6 +75,10 @@ module.exports = function (Topics) {
 
 		var cutoff = params.cutoff || Topics.unreadCutoff();
 
+		if (params.cid && !Array.isArray(params.cid)) {
+			params.cid = [params.cid];
+		}
+
 		async.waterfall([
 			function (next) {
 				async.parallel({
@@ -181,10 +185,11 @@ module.exports = function (Topics) {
 			},
 			function (results, next) {
 				var topics = results.topics;
+				cid = cid && cid.map(String);
 				tids = topics.filter(function (topic, index) {
 					return topic && topic.cid &&
 						(!!results.isTopicsFollowed[index] || results.ignoredCids.indexOf(topic.cid.toString()) === -1) &&
-						(!cid || parseInt(cid, 10) === parseInt(topic.cid, 10));
+						(!cid || (cid.length && cid.indexOf(String(topic.cid)) !== -1));
 				}).map(function (topic) {
 					return topic.tid;
 				});

src/widgets/index.js

@@ -218,34 +218,31 @@ widgets.reset = function (callback) {
 };
 
 widgets.resetTemplate = function (template, callback) {
-	db.getObject('widgets:' + template + '.tpl', function (err, area) {
-		if (err) {
-			return callback();
-		}
-
-		var toBeDrafted = [];
-		for (var location in area) {
-			if (area.hasOwnProperty(location)) {
-				toBeDrafted = toBeDrafted.concat(JSON.parse(area[location]));
+	var toBeDrafted = [];
+	async.waterfall([
+		function (next) {
+			db.getObject('widgets:' + template + '.tpl', next);
+		},
+		function (area, next) {
+			for (var location in area) {
+				if (area.hasOwnProperty(location)) {
+					toBeDrafted = toBeDrafted.concat(JSON.parse(area[location]));
+				}
 			}
-		}
-
-		db.delete('widgets:' + template + '.tpl');
-		db.getObjectField('widgets:global', 'drafts', function (err, draftWidgets) {
-			if (err) {
-				return callback();
-			}
-
+			db.delete('widgets:' + template + '.tpl', next);
+		},
+		function (next) {
+			db.getObjectField('widgets:global', 'drafts', next);
+		},
+		function (draftWidgets, next) {
 			draftWidgets = JSON.parse(draftWidgets).concat(toBeDrafted);
-			db.setObjectField('widgets:global', 'drafts', JSON.stringify(draftWidgets), callback);
-		});
-	});
+			db.setObjectField('widgets:global', 'drafts', JSON.stringify(draftWidgets), next);
+		},
+	], callback);
 };
 
 widgets.resetTemplates = function (templates, callback) {
-	async.eachSeries(templates, function (template, next) {
-		widgets.resetTemplate(template, next);
-	}, callback);
+	async.eachSeries(templates, widgets.resetTemplate, callback);
 };
 
 module.exports = widgets;