Merge branch 'develop' of https://github.com/NodeBB/NodeBB into develop

CHANGELOG.md

@@ -1,3 +1,40 @@
+#### v2.6.1 (2022-11-28)
+
+##### Chores
+
+*  incrementing version number - v2.6.0 (e7fcf482)
+*  update changelog for v2.6.0 (eedd84ae)
+*  incrementing version number - v2.5.8 (dec0e7de)
+*  incrementing version number - v2.5.7 (5836bf4a)
+*  incrementing version number - v2.5.6 (c7bd7dbf)
+*  incrementing version number - v2.5.5 (3509ed94)
+*  incrementing version number - v2.5.4 (e83260ca)
+*  incrementing version number - v2.5.3 (7e922936)
+*  incrementing version number - v2.5.2 (babcd17e)
+*  incrementing version number - v2.5.1 (ce3aa950)
+*  incrementing version number - v2.5.0 (01d276cb)
+*  incrementing version number - v2.4.5 (dd3e1a28)
+*  incrementing version number - v2.4.4 (d5525c87)
+*  incrementing version number - v2.4.3 (9c647c6c)
+*  incrementing version number - v2.4.2 (3aa7b855)
+*  incrementing version number - v2.4.1 (60cbd148)
+*  incrementing version number - v2.4.0 (4834cde3)
+*  incrementing version number - v2.3.1 (d2425942)
+*  incrementing version number - v2.3.0 (046ea120)
+
+##### Documentation Changes
+
+*  remote extraneous lines from changelog (8a15e58d)
+
+##### Bug Fixes
+
+*  prototype vulnerability in socket.io onMessage (48d14392)
+*  #11066, fix custom privilege/path in routePrefixMap (0e495f9e)
+
+##### Refactors
+
+*  not deprecated on 2.x (91c2e5ac)
+
 #### v2.6.0 (2022-11-23)
 
 ##### Chores

install/package.json

@@ -2,7 +2,7 @@
     "name": "nodebb",
     "license": "GPL-3.0",
     "description": "NodeBB Forum",
-    "version": "2.6.0",
+    "version": "2.6.1",
     "homepage": "http://www.nodebb.org",
     "repository": {
         "type": "git",

public/language/hy/_DO_NOT_EDIT_FILES_HERE.md

@@ -0,0 +1,3 @@
+# The files here are not meant to be edited directly
+
+Please see the → [Internalization README](../README.md).

src/privileges/admin.js

@@ -56,6 +56,14 @@ privsAdmin.routeMap = {
 	'extend/plugins': 'admin:settings',
 	'extend/widgets': 'admin:settings',
 	'extend/rewards': 'admin:settings',
+	// uploads
+	'category/uploadpicture': 'admin:categories',
+	uploadfavicon: 'admin:settings',
+	uploadTouchIcon: 'admin:settings',
+	uploadMaskableIcon: 'admin:settings',
+	uploadlogo: 'admin:settings',
+	uploadOgImage: 'admin:settings',
+	uploadDefaultAvatar: 'admin:settings',
 };
 privsAdmin.routePrefixMap = {
 	'manage/categories/': 'admin:categories',

src/privileges/categories.js

@@ -47,6 +47,7 @@ privsCategories.getPrivilegeList = async () => {
 };
 
 privsCategories.init = async () => {
+	privsCategories._coreSize = _privilegeMap.size;
 	await plugins.hooks.fire('static:privileges.categories.init', {
 		privileges: _privilegeMap,
 	});
@@ -72,8 +73,8 @@ privsCategories.list = async function (cid) {
 	});
 	payload.keys = keys;
 
-	payload.columnCountUserOther = payload.labels.users.length - labels.users.length;
-	payload.columnCountGroupOther = payload.labels.groups.length - labels.groups.length;
+	payload.columnCountUserOther = payload.labels.users.length - privsCategories._coreSize;
+	payload.columnCountGroupOther = payload.labels.groups.length - privsCategories._coreSize;
 
 	return payload;
 };

test/controllers-admin.js

@@ -832,7 +832,18 @@ describe('Admin Controllers', () => {
 						});
 					});
 				}
-				for (const route of Object.keys(privileges.admin.routeMap)) {
+				const uploadRoutes = [
+					'category/uploadpicture',
+					'uploadfavicon',
+					'uploadTouchIcon',
+					'uploadMaskableIcon',
+					'uploadlogo',
+					'uploadOgImage',
+					'uploadDefaultAvatar',
+				];
+				const adminRoutes = Object.keys(privileges.admin.routeMap)
+					.filter(route => !uploadRoutes.includes(route));
+				for (const route of adminRoutes) {
 					/* eslint-disable no-await-in-loop */
 					await privileges.admin.rescind([privileges.admin.routeMap[route]], uid);
 					let res = await makeRequest(`${nconf.get('url')}/api/admin/${route}`);
@@ -845,7 +856,7 @@ describe('Admin Controllers', () => {
 					await privileges.admin.rescind([privileges.admin.routeMap[route]], uid);
 				}
 
-				for (const route of Object.keys(privileges.admin.routeMap)) {
+				for (const route of adminRoutes) {
 					/* eslint-disable no-await-in-loop */
 					await privileges.admin.rescind([privileges.admin.routeMap[route]], uid);
 					let res = await makeRequest(`${nconf.get('url')}/api/admin`);