From d3ad21f81f0f93658b6f905367188ceb7c88a087 Mon Sep 17 00:00:00 2001 From: Ole R Date: Fri, 5 Feb 2016 10:12:07 +0100 Subject: [PATCH 01/34] Fix settings trim cleaning arrays --- src/settings.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/settings.js b/src/settings.js index 3d90dcfa84..6f3e1a0b36 100644 --- a/src/settings.js +++ b/src/settings.js @@ -20,6 +20,7 @@ function expandObjBy(obj1, obj2) { } function trim(obj1, obj2) { + if (obj1 instanceof Array) { return; } var key, val1; for (key in obj1) { if (obj1.hasOwnProperty(key)) { @@ -29,7 +30,7 @@ function trim(obj1, obj2) { } else if (typeof val1 === 'object') { trim(val1, obj2[key]); } - } + } } } From 7484389a4119ba80373c4ba3fbc8f489727e7bd4 Mon Sep 17 00:00:00 2001 From: Ole R Date: Wed, 10 Feb 2016 15:04:55 +0100 Subject: [PATCH 02/34] Update array-check to Array.isArray --- src/settings.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/settings.js b/src/settings.js index 6f3e1a0b36..71e0ea1374 100644 --- a/src/settings.js +++ b/src/settings.js @@ -20,7 +20,7 @@ function expandObjBy(obj1, obj2) { } function trim(obj1, obj2) { - if (obj1 instanceof Array) { return; } + if (Array.isArray(obj1)) { return; } var key, val1; for (key in obj1) { if (obj1.hasOwnProperty(key)) { From f537dfee1622b2040f2ab88219fd82328c822b0b Mon Sep 17 00:00:00 2001 From: Ole R Date: Thu, 25 Feb 2016 11:01:46 +0100 Subject: [PATCH 03/34] Update array-check for settings trim and expand --- src/settings.js | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/settings.js b/src/settings.js index 71e0ea1374..6f6cad2854 100644 --- a/src/settings.js +++ b/src/settings.js @@ -3,16 +3,19 @@ var meta = require('./meta'); function expandObjBy(obj1, obj2) { - var key, val1, val2, changed = false; + var key, val1, val2, xorValIsArray, changed = false; for (key in obj2) { if (obj2.hasOwnProperty(key)) { val2 = obj2[key]; val1 = obj1[key]; - if (!obj1.hasOwnProperty(key) || typeof val2 !== typeof val1) { + xorValIsArray = Array.isArray(val1) ^ Array.isArray(val2); + if (xorValIsArray || !obj1.hasOwnProperty(key) || typeof val2 !== typeof val1) { obj1[key] = val2; changed = true; - } else if (typeof val2 === 'object' && expandObjBy(val1, val2)) { - changed = true; + } else if (typeof val2 === 'object' && !Array.isArray(val2)) { + if (expandObjBy(val1, val2)) { + changed = true; + } } } } @@ -20,14 +23,13 @@ function expandObjBy(obj1, obj2) { } function trim(obj1, obj2) { - if (Array.isArray(obj1)) { return; } var key, val1; for (key in obj1) { if (obj1.hasOwnProperty(key)) { val1 = obj1[key]; if (!obj2.hasOwnProperty(key)) { delete obj1[key]; - } else if (typeof val1 === 'object') { + } else if (typeof val1 === 'object' && !Array.isArray(val1)) { trim(val1, obj2[key]); } } From a402e29f2962cc6d7fc05da0162b07e7b7b75a44 Mon Sep 17 00:00:00 2001 From: barisusakli Date: Sun, 13 Mar 2016 11:05:59 +0200 Subject: [PATCH 04/34] up widget essentials --- package.json | 2 +- src/socket.io/admin/rooms.js | 15 ++++++++------- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index b035c2fbb2..d6599232e5 100644 --- a/package.json +++ b/package.json @@ -54,7 +54,7 @@ "nodebb-theme-lavender": "3.0.9", "nodebb-theme-persona": "4.0.93", "nodebb-theme-vanilla": "5.0.54", - "nodebb-widget-essentials": "2.0.7", + "nodebb-widget-essentials": "2.0.8", "nodemailer": "2.0.0", "nodemailer-sendmail-transport": "1.0.0", "nodemailer-smtp-transport": "^2.4.1", diff --git a/src/socket.io/admin/rooms.js b/src/socket.io/admin/rooms.js index 6d8843b8ca..50ba4661de 100644 --- a/src/socket.io/admin/rooms.js +++ b/src/socket.io/admin/rooms.js @@ -29,15 +29,16 @@ pubsub.on('sync:stats:end', function(data) { stats[data.id] = data.stats; }); +pubsub.on('sync:stats:guests', function() { + var io = require('../index').server; + + var roomClients = io.sockets.adapter.rooms; + var guestCount = roomClients.online_guests ? roomClients.online_guests.length : 0; + pubsub.publish('sync:stats:guests:end', guestCount); +}); + SocketRooms.getTotalGuestCount = function(callback) { var count = 0; - pubsub.once('sync:stats:guests', function() { - var io = require('../index').server; - - var roomClients = io.sockets.adapter.rooms; - var guestCount = roomClients.online_guests ? roomClients.online_guests.length : 0; - pubsub.publish('sync:stats:guests:end', guestCount); - }); pubsub.on('sync:stats:guests:end', function(guestCount) { count += guestCount; From 147e36a7a5e586da1726ab9ae84124a8a4694c2c Mon Sep 17 00:00:00 2001 From: kingjan1999 Date: Mon, 14 Mar 2016 10:27:24 +0100 Subject: [PATCH 05/34] update fontawesome.tpl to FA 4.5 --- src/views/partials/fontawesome.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/views/partials/fontawesome.tpl b/src/views/partials/fontawesome.tpl index 6ede4e70d3..a179bfdd49 100644 --- a/src/views/partials/fontawesome.tpl +++ b/src/views/partials/fontawesome.tpl @@ -4,7 +4,7 @@
- +

For a full list of icons, please consult: From 0f917635c646cae317b71e53d5b22af68319f85d Mon Sep 17 00:00:00 2001 From: accalia Date: Mon, 14 Mar 2016 10:40:24 -0400 Subject: [PATCH 06/34] allow loadMore Calls to fetch page 0 --- src/socket.io/notifications.js | 3 ++- src/socket.io/topics/infinitescroll.js | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/socket.io/notifications.js b/src/socket.io/notifications.js index e2d7cf3084..121ede2a96 100644 --- a/src/socket.io/notifications.js +++ b/src/socket.io/notifications.js @@ -3,6 +3,7 @@ var async = require('async'); var user = require('../user'); var notifications = require('../notifications'); +var utils = require('../../public/src/utils'); var SocketNotifs = {}; @@ -15,7 +16,7 @@ SocketNotifs.get = function(socket, data, callback) { }; SocketNotifs.loadMore = function(socket, data, callback) { - if (!data || !parseInt(data.after, 10)) { + if (!data || !utils.isNumber(data.after) || parseInt(data.after, 10) < 0) { return callback(new Error('[[error:invalid-data]]')); } if (!socket.uid) { diff --git a/src/socket.io/topics/infinitescroll.js b/src/socket.io/topics/infinitescroll.js index 8cb975c15e..3ffe1c65c8 100644 --- a/src/socket.io/topics/infinitescroll.js +++ b/src/socket.io/topics/infinitescroll.js @@ -88,7 +88,7 @@ module.exports = function(SocketTopics) { }; SocketTopics.loadMoreUnreadTopics = function(socket, data, callback) { - if (!data || !data.after) { + if (!data || !utils.isNumber(data.after) || parseInt(data.after, 10) < 0) { return callback(new Error('[[error:invalid-data]]')); } @@ -99,7 +99,7 @@ module.exports = function(SocketTopics) { }; SocketTopics.loadMoreFromSet = function(socket, data, callback) { - if (!data || !data.after || !data.set) { + if (!data || !utils.isNumber(data.after) || parseInt(data.after, 10) < 0 || !data.set) { return callback(new Error('[[error:invalid-data]]')); } From a275aaeaf50a46590e157c183f51333f321b5b7e Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Mon, 14 Mar 2016 12:57:45 -0400 Subject: [PATCH 07/34] fixes #4361 --- public/src/admin/manage/categories.js | 55 ++++++++++++++++++--------- public/src/admin/manage/category.js | 6 +++ src/categories/update.js | 5 ++- 3 files changed, 46 insertions(+), 20 deletions(-) diff --git a/public/src/admin/manage/categories.js b/public/src/admin/manage/categories.js index a57fc06701..b4a5f19601 100644 --- a/public/src/admin/manage/categories.js +++ b/public/src/admin/manage/categories.js @@ -152,28 +152,45 @@ define('admin/manage/categories', ['vendor/jquery/serializeObject/jquery.ba-seri * @param parentId {number} parent category identifier */ function renderList(categories, container, parentId){ - templates.parse('admin/partials/categories/category-rows', { - cid: parentId, - categories: categories - }, function(html) { - container.append(html); + // Translate category names if needed + var count = 0; + categories.forEach(function(category, idx, parent) { + translator.translate(category.name, function(translated) { + if (category.name !== translated) { + category.name = translated; + } + ++count; - // Handle and children categories in this level have - for(var x=0,numCategories=categories.length;x Date: Mon, 14 Mar 2016 13:03:33 -0400 Subject: [PATCH 08/34] Updated topic and category controller to not redirect on incorrect slug if the call is made via API route. Cold load? Anything goes. --- src/controllers/category.js | 2 +- src/controllers/topics.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/controllers/category.js b/src/controllers/category.js index f4b939f60a..e3adde496f 100644 --- a/src/controllers/category.js +++ b/src/controllers/category.js @@ -51,7 +51,7 @@ categoryController.get = function(req, res, callback) { return helpers.notAllowed(req, res); } - if ((!req.params.slug || results.categoryData.slug !== cid + '/' + req.params.slug) && (results.categoryData.slug && results.categoryData.slug !== cid + '/')) { + if (!res.locals.isAPI && (!req.params.slug || results.categoryData.slug !== cid + '/' + req.params.slug) && (results.categoryData.slug && results.categoryData.slug !== cid + '/')) { return helpers.redirect(res, '/category/' + encodeURI(results.categoryData.slug)); } diff --git a/src/controllers/topics.js b/src/controllers/topics.js index 7a222dd09c..68a3b18415 100644 --- a/src/controllers/topics.js +++ b/src/controllers/topics.js @@ -54,7 +54,7 @@ topicsController.get = function(req, res, callback) { return helpers.notAllowed(req, res); } - if ((!req.params.slug || results.topic.slug !== tid + '/' + req.params.slug) && (results.topic.slug && results.topic.slug !== tid + '/')) { + if (!res.locals.isAPI && (!req.params.slug || results.topic.slug !== tid + '/' + req.params.slug) && (results.topic.slug && results.topic.slug !== tid + '/')) { var url = '/topic/' + encodeURI(results.topic.slug); if (req.params.post_index){ url += '/'+req.params.post_index; From 50b0bcca0ca6fdcf2f21b3e7831ef0cd4d7ea1f0 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Mon, 14 Mar 2016 15:30:27 -0400 Subject: [PATCH 09/34] closes #4291 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index d6599232e5..7ee2d14430 100644 --- a/package.json +++ b/package.json @@ -43,7 +43,7 @@ "mongodb": "~2.1.3", "morgan": "^1.3.2", "nconf": "~0.8.2", - "nodebb-plugin-composer-default": "3.0.7", + "nodebb-plugin-composer-default": "3.0.8", "nodebb-plugin-dbsearch": "1.0.0", "nodebb-plugin-emoji-extended": "1.0.3", "nodebb-plugin-markdown": "4.0.17", From 71c697037d7dc41b06cda6a63db97b0cd09acd84 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?= Date: Mon, 14 Mar 2016 22:10:02 +0200 Subject: [PATCH 10/34] return the ips of the account we are looking at --- src/controllers/accounts/settings.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/controllers/accounts/settings.js b/src/controllers/accounts/settings.js index 7028972491..0b180be686 100644 --- a/src/controllers/accounts/settings.js +++ b/src/controllers/accounts/settings.js @@ -42,7 +42,7 @@ settingsController.get = function(req, res, callback) { getHomePageRoutes(next); }, ips: function (next) { - user.getIPs(req.uid, 4, next); + user.getIPs(userData.uid, 4, next); }, sessions: async.apply(user.auth.getSessions, userData.uid, req.sessionID) }, next); From 184a2c4540c95be87ba787aff2dab59a5f7522c0 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Mon, 14 Mar 2016 17:31:36 -0400 Subject: [PATCH 11/34] IP blacklist functionality -- re: #4367 Squashed commit of the following: commit 5c42fd732d091fa66cf5b45a2af5e1697cc1efcd Author: Julian Lam Date: Mon Mar 14 17:29:45 2016 -0400 allowing blacklist.test to be called synchronously commit 979faf2dba5e6f6e2ae1bd07341e63678438daf1 Author: Julian Lam Date: Mon Mar 14 17:01:14 2016 -0400 added plain ipv6 support and finished middleware logic commit d4b72fc1aadff34df3ed7dec52ca8d3c3728a078 Author: Julian Lam Date: Fri Mar 11 16:05:31 2016 -0500 WIP IP Banning logic middleware commit f08b2553890c5522b6a1eaf521fe4e94df40574a Author: Julian Lam Date: Fri Mar 11 15:26:27 2016 -0500 tweaks to ACP, rule validator commit 868abacaa494e6b8a88bd4ea429b1b066a9ecb2e Author: Julian Lam Date: Fri Mar 11 13:50:05 2016 -0500 IP Banning ACP page, styling, save&load functionality --- package.json | 1 + public/language/en_GB/error.json | 1 + public/less/admin/admin.less | 1 + public/less/admin/manage/blacklist.less | 5 + public/src/admin/manage/ip-blacklist.js | 41 +++++++ src/controllers/admin.js | 1 + src/controllers/admin/blacklist.js | 9 ++ src/meta.js | 1 + src/meta/blacklist.js | 106 ++++++++++++++++++ src/middleware/middleware.js | 7 ++ src/routes/admin.js | 2 +- src/routes/authentication.js | 4 +- src/routes/index.js | 11 +- src/socket.io/admin.js | 6 +- src/views/admin/manage/ip-blacklist.tpl | 31 +++++ .../admin/partials/blacklist-validate.tpl | 14 +++ src/views/admin/partials/menu.tpl | 2 + src/webserver.js | 3 +- 18 files changed, 238 insertions(+), 8 deletions(-) create mode 100644 public/less/admin/manage/blacklist.less create mode 100644 public/src/admin/manage/ip-blacklist.js create mode 100644 src/controllers/admin/blacklist.js create mode 100644 src/meta/blacklist.js create mode 100644 src/views/admin/manage/ip-blacklist.tpl create mode 100644 src/views/admin/partials/blacklist-validate.tpl diff --git a/package.json b/package.json index 7ee2d14430..37f7911604 100644 --- a/package.json +++ b/package.json @@ -33,6 +33,7 @@ "express-session": "^1.8.2", "express-useragent": "0.2.4", "html-to-text": "2.0.0", + "ip": "1.1.2", "jimp": "0.2.21", "less": "^2.0.0", "logrotate-stream": "^0.2.3", diff --git a/public/language/en_GB/error.json b/public/language/en_GB/error.json index b60c8a2cde..e9a4cbea7d 100644 --- a/public/language/en_GB/error.json +++ b/public/language/en_GB/error.json @@ -34,6 +34,7 @@ "user-banned": "User banned", "user-too-new": "Sorry, you are required to wait %1 second(s) before making your first post", + "blacklisted-ip": "Sorry, your IP address has been banned from this community. If you feel this is in error, please contact an administrator.", "no-category": "Category does not exist", "no-topic": "Topic does not exist", diff --git a/public/less/admin/admin.less b/public/less/admin/admin.less index 930e518412..182b0afccf 100644 --- a/public/less/admin/admin.less +++ b/public/less/admin/admin.less @@ -12,6 +12,7 @@ @import "./manage/tags"; @import "./manage/groups"; @import "./manage/users"; +@import "./manage/blacklist"; @import "./appearance/customise"; @import "./appearance/themes"; @import "./extend/plugins"; diff --git a/public/less/admin/manage/blacklist.less b/public/less/admin/manage/blacklist.less new file mode 100644 index 0000000000..4e0dcb7c27 --- /dev/null +++ b/public/less/admin/manage/blacklist.less @@ -0,0 +1,5 @@ +#blacklist-rules { + width: 100%; + height: 450px; + display: block; +} \ No newline at end of file diff --git a/public/src/admin/manage/ip-blacklist.js b/public/src/admin/manage/ip-blacklist.js new file mode 100644 index 0000000000..daba34ec3d --- /dev/null +++ b/public/src/admin/manage/ip-blacklist.js @@ -0,0 +1,41 @@ +'use strict'; +/* globals $, app, socket, templates */ + +define('admin/manage/ip-blacklist', ['settings'], function(Settings) { + + var Blacklist = {}; + + Blacklist.init = function() { + var blacklist = ace.edit("blacklist-rules"); + + blacklist.on('change', function(e) { + $('#blacklist-rules-holder').val(blacklist.getValue()); + }); + + Settings.load('blacklist', $('.blacklist-settings'), function(err, settings) { + blacklist.setValue(settings.rules); + }); + + $('[data-action="apply"]').on('click', function() { + Settings.save('blacklist', $('.blacklist-settings'), function() { + app.alert({ + type: 'success', + alert_id: 'blacklist-saved', + title: 'Blacklist Applied', + }); + }); + }); + + $('[data-action="test"]').on('click', function() { + socket.emit('admin.blacklist.validate', { + rules: blacklist.getValue() + }, function(err, data) { + templates.parse('admin/partials/blacklist-validate', data, function(html) { + bootbox.alert(html); + }); + }); + }); + }; + + return Blacklist; +}); \ No newline at end of file diff --git a/src/controllers/admin.js b/src/controllers/admin.js index 8b9b1cafc7..2bba60cae6 100644 --- a/src/controllers/admin.js +++ b/src/controllers/admin.js @@ -5,6 +5,7 @@ var adminController = { categories: require('./admin/categories'), tags: require('./admin/tags'), flags: require('./admin/flags'), + blacklist: require('./admin/blacklist'), groups: require('./admin/groups'), appearance: require('./admin/appearance'), extend: { diff --git a/src/controllers/admin/blacklist.js b/src/controllers/admin/blacklist.js new file mode 100644 index 0000000000..60c3940e44 --- /dev/null +++ b/src/controllers/admin/blacklist.js @@ -0,0 +1,9 @@ +"use strict"; + +var blacklistController = {}; + +blacklistController.get = function(req, res, next) { + res.render('admin/manage/ip-blacklist', {}); +}; + +module.exports = blacklistController; diff --git a/src/meta.js b/src/meta.js index 7a054b1836..716d90e9cb 100644 --- a/src/meta.js +++ b/src/meta.js @@ -26,6 +26,7 @@ var async = require('async'), require('./meta/tags')(Meta); require('./meta/dependencies')(Meta); Meta.templates = require('./meta/templates'); + Meta.blacklist = require('./meta/blacklist'); /* Assorted */ Meta.userOrGroupExists = function(slug, callback) { diff --git a/src/meta/blacklist.js b/src/meta/blacklist.js new file mode 100644 index 0000000000..2029b406f2 --- /dev/null +++ b/src/meta/blacklist.js @@ -0,0 +1,106 @@ +'use strict'; + +var ip = require('ip'), + winston = require('winston'), + async = require('async'); + +var meta = module.parent.exports; + +var Blacklist = { + _rules: [] + }; + +Blacklist.load = function(callback) { + async.waterfall([ + async.apply(meta.settings.getOne, 'blacklist', 'rules'), + async.apply(Blacklist.validate) + ], function(err, rules) { + if (err) { + return callback(err); + } + + winston.verbose('[meta/blacklist] Loading ' + rules.valid.length + ' blacklist rules'); + if (rules.invalid.length) { + winston.warn('[meta/blacklist] ' + rules.invalid.length + ' invalid blacklist rule(s) were ignored.'); + } + + Blacklist._rules = { + ipv4: rules.ipv4, + ipv6: rules.ipv6, + cidr: rules.cidr + }; + + callback(); + }); +}; + +Blacklist.test = function(clientIp, callback) { + if ( + Blacklist._rules.ipv4.indexOf(clientIp) === -1 // not explicitly specified in ipv4 list + && Blacklist._rules.ipv6.indexOf(clientIp) === -1 // not explicitly specified in ipv6 list + && !Blacklist._rules.cidr.some(function(subnet) { + return ip.cidrSubnet(subnet).contains(clientIp); + }) // not in a blacklisted cidr range + ) { + if (typeof callback === 'function') { + callback(); + } else { + return false; + } + } else { + var err = new Error('[[error:blacklisted-ip]]'); + err.code = 'blacklisted-ip'; + + if (typeof callback === 'function') { + callback(err); + } else { + return true; + } + } +}; + +Blacklist.validate = function(rules, callback) { + var rules = (rules || '').split('\n'), + ipv4 = [], + ipv6 = [], + cidr = [], + invalid = []; + + var isCidrSubnet = /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$/; + + // Filter out blank lines and lines starting with the hash character (comments) + rules = rules.map(function(rule) { + rule = rule.trim(); + return rule.length && !rule.startsWith('#') ? rule : null; + }).filter(Boolean); + + // Filter out invalid rules + rules = rules.filter(function(rule) { + if (ip.isV4Format(rule)) { + ipv4.push(rule); + return true; + } else if (ip.isV6Format(rule)) { + ipv6.push(rule); + return true; + } else if (isCidrSubnet.test(rule)) { + cidr.push(rule); + return true; + } else { + invalid.push(rule); + return false; + } + + return true; + }); + + callback(null, { + numRules: rules.length + invalid.length, + ipv4: ipv4, + ipv6: ipv6, + cidr: cidr, + valid: rules, + invalid: invalid + }); +}; + +module.exports = Blacklist; \ No newline at end of file diff --git a/src/middleware/middleware.js b/src/middleware/middleware.js index d5e1d93388..52adf21ab4 100644 --- a/src/middleware/middleware.js +++ b/src/middleware/middleware.js @@ -257,6 +257,13 @@ middleware.busyCheck = function(req, res, next) { } }; +middleware.applyBlacklist = function(req, res, next) { + meta.blacklist.test(req.ip, function(err) { + console.log('blacklist returned:', err); + next(err); + }); +}; + module.exports = function(webserver) { app = webserver; middleware.admin = require('./admin')(webserver); diff --git a/src/routes/admin.js b/src/routes/admin.js index f5d4d039a1..56c97ff1f2 100644 --- a/src/routes/admin.js +++ b/src/routes/admin.js @@ -54,8 +54,8 @@ function addRoutes(router, middleware, controllers) { router.get('/manage/categories/:category_id', middlewares, controllers.admin.categories.get); router.get('/manage/tags', middlewares, controllers.admin.tags.get); - router.get('/manage/flags', middlewares, controllers.admin.flags.get); + router.get('/manage/ip-blacklist', middlewares, controllers.admin.blacklist.get); router.get('/manage/users', middlewares, controllers.admin.users.sortByJoinDate); router.get('/manage/users/search', middlewares, controllers.admin.users.search); diff --git a/src/routes/authentication.js b/src/routes/authentication.js index 37439ba523..8e1824cad6 100644 --- a/src/routes/authentication.js +++ b/src/routes/authentication.js @@ -62,8 +62,8 @@ })); }); - router.post('/register', Auth.middleware.applyCSRF, controllers.authentication.register); - router.post('/login', Auth.middleware.applyCSRF, controllers.authentication.login); + router.post('/register', Auth.middleware.applyCSRF, Auth.middleware.applyBlacklist, controllers.authentication.register); + router.post('/login', Auth.middleware.applyCSRF, Auth.middleware.applyBlacklist, controllers.authentication.login); router.post('/logout', Auth.middleware.applyCSRF, controllers.authentication.logout); hotswap.replace('auth', router); diff --git a/src/routes/index.js b/src/routes/index.js index 7e84f29af1..e49256f933 100644 --- a/src/routes/index.js +++ b/src/routes/index.js @@ -187,9 +187,14 @@ function handle404(app, middleware) { function handleErrors(app, middleware) { app.use(function(err, req, res, next) { - if (err.code === 'EBADCSRFTOKEN') { - winston.error(req.path + '\n', err.message); - return res.sendStatus(403); + switch (err.code) { + case 'EBADCSRFTOKEN': + winston.error(req.path + '\n', err.message); + return res.sendStatus(403); + break; + case 'blacklisted-ip': + return res.status(403).type('text/plain').send(err.message); + break; } if (parseInt(err.status, 10) === 302 && err.path) { diff --git a/src/socket.io/admin.js b/src/socket.io/admin.js index 6dd22134ba..f3504a920d 100644 --- a/src/socket.io/admin.js +++ b/src/socket.io/admin.js @@ -33,7 +33,8 @@ var async = require('async'), settings: {}, email: {}, analytics: {}, - logs: {} + logs: {}, + blacklist: {} }; SocketAdmin.before = function(socket, method, data, next) { @@ -273,5 +274,8 @@ SocketAdmin.deleteAllEvents = function(socket, data, callback) { events.deleteAll(callback); }; +SocketAdmin.blacklist.validate = function(socket, data, callback) { + meta.blacklist.validate(data.rules, callback); +}; module.exports = SocketAdmin; diff --git a/src/views/admin/manage/ip-blacklist.tpl b/src/views/admin/manage/ip-blacklist.tpl new file mode 100644 index 0000000000..13e43a84d7 --- /dev/null +++ b/src/views/admin/manage/ip-blacklist.tpl @@ -0,0 +1,31 @@ +

+
+

+ Configure your IP blacklist here. +

+

+ Occasionally, a user account ban is not enough of a deterrant. Other times, restricting access to the forum to a specific IP or a range of IPs + is the best way to protect a forum. In these scenarios, you can add troublesome IP addresses or entire CIDR blocks to this blacklist, and + they will be prevented from logging in to or registering a new account. +

+ +
+
+
+
+ +
+
+
+
+
Active Rules
+
+ + +
+
+
+
+
+ +
\ No newline at end of file diff --git a/src/views/admin/partials/blacklist-validate.tpl b/src/views/admin/partials/blacklist-validate.tpl new file mode 100644 index 0000000000..4a642a23a3 --- /dev/null +++ b/src/views/admin/partials/blacklist-validate.tpl @@ -0,0 +1,14 @@ +

+ {valid.length} out of {numRules} rule(s) valid. +

+ + +

+ The following {invalid.length} rules are invalid: +

+
    + +
  • @value
    • + +
+ \ No newline at end of file diff --git a/src/views/admin/partials/menu.tpl b/src/views/admin/partials/menu.tpl index a0027c0621..8d0f0f853d 100644 --- a/src/views/admin/partials/menu.tpl +++ b/src/views/admin/partials/menu.tpl @@ -20,6 +20,7 @@
  • Registration Queue
  • Groups
  • Flags
    • +
  • IP Blacklist
    • @@ -173,6 +174,7 @@
  • Registration Queue
  • Groups
  • Flags
    • +
  • IP Blacklist
  • diff --git a/src/webserver.js b/src/webserver.js index 4a46b54520..32ab6c2a59 100644 --- a/src/webserver.js +++ b/src/webserver.js @@ -95,7 +95,8 @@ function initializeNodeBB(callback) { async.apply(!skipJS ? meta.js.minify : meta.js.getFromFile, 'nodebb.min.js'), async.apply(!skipJS ? meta.js.minify : meta.js.getFromFile, 'acp.min.js'), async.apply(!skipLess ? meta.css.minify : meta.css.getFromFile), - async.apply(meta.sounds.init) + async.apply(meta.sounds.init), + async.apply(meta.blacklist.load) ], next); }, function(results, next) { From d52a0ad87a3bd9aaaafe7c6a87f717d751e329c4 Mon Sep 17 00:00:00 2001 From: barisusakli Date: Tue, 15 Mar 2016 10:53:04 +0200 Subject: [PATCH 12/34] closes #4366 --- src/database/mongo/hash.js | 9 +++------ src/search.js | 4 +++- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/src/database/mongo/hash.js b/src/database/mongo/hash.js index fe80afaaf4..dbf294119e 100644 --- a/src/database/mongo/hash.js +++ b/src/database/mongo/hash.js @@ -1,7 +1,5 @@ "use strict"; -var winston = require('winston'); - module.exports = function(db, module) { var helpers = module.helpers.mongo; @@ -121,9 +119,8 @@ module.exports = function(db, module) { } var map = helpers.toMap(items); - var returnData = [], - index = 0, - item; + var returnData = []; + var item; for (var i=0; i Date: Tue, 15 Mar 2016 11:09:06 +0200 Subject: [PATCH 13/34] closes #4368 --- src/database/mongo/sorted.js | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/src/database/mongo/sorted.js b/src/database/mongo/sorted.js index d209f3f491..0baa08b2f6 100644 --- a/src/database/mongo/sorted.js +++ b/src/database/mongo/sorted.js @@ -37,7 +37,7 @@ module.exports = function(db, module) { bulk.find({_key: key, value: values[i]}).upsert().updateOne({$set: {score: parseInt(scores[i], 10)}}); } - bulk.execute(function(err, result) { + bulk.execute(function(err) { callback(err); }); } @@ -55,7 +55,7 @@ module.exports = function(db, module) { bulk.find({_key: keys[i], value: value}).upsert().updateOne({$set: {score: parseInt(score, 10)}}); } - bulk.execute(function(err, result) { + bulk.execute(function(err) { callback(err); }); }; @@ -85,7 +85,7 @@ module.exports = function(db, module) { } value = helpers.valueToString(value); - db.collection('objects').remove({_key: {$in: keys}, value: value}, function(err, res) { + db.collection('objects').remove({_key: {$in: keys}, value: value}, function(err) { callback(err); }); }; @@ -95,16 +95,17 @@ module.exports = function(db, module) { if (!Array.isArray(keys) || !keys.length) { return callback(); } + var query = {_key: {$in: keys}}; - var scoreQuery = {}; if (min !== '-inf') { - scoreQuery.$gte = min; + query.score = {$gte: min}; } if (max !== '+inf') { - scoreQuery.$lte = max; + query.score = query.score || {}; + query.score.$lte = max; } - db.collection('objects').remove({_key: {$in: keys}, score: scoreQuery}, function(err) { + db.collection('objects').remove(query, function(err) { callback(err); }); }; @@ -182,12 +183,14 @@ module.exports = function(db, module) { count = 0; } - var scoreQuery = {}; + var query = {_key: key}; + if (min !== '-inf') { - scoreQuery.$gte = min; + query.score = {$gte: min}; } if (max !== '+inf') { - scoreQuery.$lte = max; + query.score = query.score || {}; + query.score.$lte = max; } var fields = {_id: 0, value: 1}; @@ -195,7 +198,7 @@ module.exports = function(db, module) { fields.score = 1; } - db.collection('objects').find({_key:key, score: scoreQuery}, {fields: fields}) + db.collection('objects').find(query, {fields: fields}) .limit(count) .skip(start) .sort({score: sort}) From b6e22b7723279964fb362a7f6e1f84f29d764d4e Mon Sep 17 00:00:00 2001 From: barisusakli Date: Tue, 15 Mar 2016 12:13:35 +0200 Subject: [PATCH 14/34] closes #4367 --- public/less/admin/admin.less | 4 +-- public/less/{admin/manage => }/blacklist.less | 1 + public/src/admin/manage/ip-blacklist.js | 23 ++++++------- src/controllers/admin/blacklist.js | 9 ++++- src/controllers/globalmods.js | 29 ++++++++++++++++ src/controllers/index.js | 4 +-- src/controllers/posts.js | 19 ----------- src/meta/blacklist.js | 34 +++++++++++++------ src/meta/css.js | 1 + src/routes/index.js | 9 +++-- src/socket.io/admin.js | 6 +--- src/socket.io/blacklist.js | 27 +++++++++++++++ src/socket.io/index.js | 2 +- src/views/admin/manage/ip-blacklist.tpl | 5 +-- 14 files changed, 111 insertions(+), 62 deletions(-) rename public/less/{admin/manage => }/blacklist.less (72%) create mode 100644 src/controllers/globalmods.js delete mode 100644 src/controllers/posts.js create mode 100644 src/socket.io/blacklist.js diff --git a/public/less/admin/admin.less b/public/less/admin/admin.less index 182b0afccf..e733d8d9bd 100644 --- a/public/less/admin/admin.less +++ b/public/less/admin/admin.less @@ -12,7 +12,6 @@ @import "./manage/tags"; @import "./manage/groups"; @import "./manage/users"; -@import "./manage/blacklist"; @import "./appearance/customise"; @import "./appearance/themes"; @import "./extend/plugins"; @@ -22,6 +21,7 @@ @import "./settings"; @import "../flags"; +@import "../blacklist"; @import "./modules/alerts"; @import "./modules/selectable"; @@ -239,5 +239,5 @@ } [class^="col-"] .mdl-switch__label { - padding-right: 15px; + padding-right: 15px; } \ No newline at end of file diff --git a/public/less/admin/manage/blacklist.less b/public/less/blacklist.less similarity index 72% rename from public/less/admin/manage/blacklist.less rename to public/less/blacklist.less index 4e0dcb7c27..5f23cd5698 100644 --- a/public/less/admin/manage/blacklist.less +++ b/public/less/blacklist.less @@ -2,4 +2,5 @@ width: 100%; height: 450px; display: block; + border: 1px solid #eee; } \ No newline at end of file diff --git a/public/src/admin/manage/ip-blacklist.js b/public/src/admin/manage/ip-blacklist.js index daba34ec3d..9769b3e3bb 100644 --- a/public/src/admin/manage/ip-blacklist.js +++ b/public/src/admin/manage/ip-blacklist.js @@ -1,23 +1,22 @@ 'use strict'; -/* globals $, app, socket, templates */ +/* globals $, app, socket, templates, define, bootbox */ -define('admin/manage/ip-blacklist', ['settings'], function(Settings) { +define('admin/manage/ip-blacklist', [], function() { var Blacklist = {}; Blacklist.init = function() { - var blacklist = ace.edit("blacklist-rules"); + var blacklist = $('#blacklist-rules'); - blacklist.on('change', function(e) { - $('#blacklist-rules-holder').val(blacklist.getValue()); - }); - - Settings.load('blacklist', $('.blacklist-settings'), function(err, settings) { - blacklist.setValue(settings.rules); + blacklist.on('keyup', function() { + $('#blacklist-rules-holder').val(blacklist.val()); }); $('[data-action="apply"]').on('click', function() { - Settings.save('blacklist', $('.blacklist-settings'), function() { + socket.emit('blacklist.save', blacklist.val(), function(err) { + if (err) { + return app.alertError(err.message); + } app.alert({ type: 'success', alert_id: 'blacklist-saved', @@ -27,8 +26,8 @@ define('admin/manage/ip-blacklist', ['settings'], function(Settings) { }); $('[data-action="test"]').on('click', function() { - socket.emit('admin.blacklist.validate', { - rules: blacklist.getValue() + socket.emit('blacklist.validate', { + rules: blacklist.val() }, function(err, data) { templates.parse('admin/partials/blacklist-validate', data, function(html) { bootbox.alert(html); diff --git a/src/controllers/admin/blacklist.js b/src/controllers/admin/blacklist.js index 60c3940e44..3561ba0f76 100644 --- a/src/controllers/admin/blacklist.js +++ b/src/controllers/admin/blacklist.js @@ -1,9 +1,16 @@ "use strict"; +var meta = require('../../meta'); + var blacklistController = {}; blacklistController.get = function(req, res, next) { - res.render('admin/manage/ip-blacklist', {}); + meta.blacklist.get(function(err, rules) { + if (err) { + return next(err); + } + res.render('admin/manage/ip-blacklist', {rules: rules}); + }); }; module.exports = blacklistController; diff --git a/src/controllers/globalmods.js b/src/controllers/globalmods.js new file mode 100644 index 0000000000..3275c7929e --- /dev/null +++ b/src/controllers/globalmods.js @@ -0,0 +1,29 @@ +"use strict"; + +var user = require('../user'); +var adminFlagsController = require('./admin/flags'); +var adminBlacklistController = require('./admin/blacklist'); + +var globalModsController = {}; + +globalModsController.flagged = function(req, res, next) { + user.isAdminOrGlobalMod(req.uid, function(err, isAdminOrGlobalMod) { + if (err || !isAdminOrGlobalMod) { + return next(err); + } + + adminFlagsController.get(req, res, next); + }); +}; + +globalModsController.ipBlacklist = function(req, res, next) { + user.isAdminOrGlobalMod(req.uid, function(err, isAdminOrGlobalMod) { + if (err || !isAdminOrGlobalMod) { + return next(err); + } + + adminBlacklistController.get(req, res, next); + }); +}; + +module.exports = globalModsController; diff --git a/src/controllers/index.js b/src/controllers/index.js index 51c5c316ba..fa35523c2b 100644 --- a/src/controllers/index.js +++ b/src/controllers/index.js @@ -12,7 +12,6 @@ var helpers = require('./helpers'); var Controllers = { topics: require('./topics'), - posts: require('./posts'), categories: require('./categories'), category: require('./category'), unread: require('./unread'), @@ -25,7 +24,8 @@ var Controllers = { accounts: require('./accounts'), authentication: require('./authentication'), api: require('./api'), - admin: require('./admin') + admin: require('./admin'), + globalMods: require('./globalmods') }; diff --git a/src/controllers/posts.js b/src/controllers/posts.js deleted file mode 100644 index 5618069b9b..0000000000 --- a/src/controllers/posts.js +++ /dev/null @@ -1,19 +0,0 @@ -"use strict"; - -var user = require('../user'); -var adminFlagsController = require('./admin/flags'); - -var postsController = {}; - -postsController.flagged = function(req, res, next) { - user.isAdminOrGlobalMod(req.uid, function(err, isAdminOrGlobalMod) { - if (err || !isAdminOrGlobalMod) { - return next(err); - } - - adminFlagsController.get(req, res, next); - }); -}; - - -module.exports = postsController; diff --git a/src/meta/blacklist.js b/src/meta/blacklist.js index 2029b406f2..b0269a1f0c 100644 --- a/src/meta/blacklist.js +++ b/src/meta/blacklist.js @@ -1,10 +1,9 @@ 'use strict'; -var ip = require('ip'), - winston = require('winston'), - async = require('async'); - -var meta = module.parent.exports; +var ip = require('ip'); +var winston = require('winston'); +var async = require('async'); +var db = require('../database'); var Blacklist = { _rules: [] @@ -12,7 +11,7 @@ var Blacklist = { Blacklist.load = function(callback) { async.waterfall([ - async.apply(meta.settings.getOne, 'blacklist', 'rules'), + async.apply(db.get, 'ip-blacklist-rules'), async.apply(Blacklist.validate) ], function(err, rules) { if (err) { @@ -34,6 +33,19 @@ Blacklist.load = function(callback) { }); }; +Blacklist.save = function(rules, callback) { + db.set('ip-blacklist-rules', rules, function(err) { + if (err) { + return callback(err); + } + Blacklist.load(callback); + }); +}; + +Blacklist.get = function(callback) { + db.get('ip-blacklist-rules', callback); +}; + Blacklist.test = function(clientIp, callback) { if ( Blacklist._rules.ipv4.indexOf(clientIp) === -1 // not explicitly specified in ipv4 list @@ -60,11 +72,11 @@ Blacklist.test = function(clientIp, callback) { }; Blacklist.validate = function(rules, callback) { - var rules = (rules || '').split('\n'), - ipv4 = [], - ipv6 = [], - cidr = [], - invalid = []; + rules = (rules || '').split('\n'); + var ipv4 = []; + var ipv6 = []; + var cidr = []; + var invalid = []; var isCidrSubnet = /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$/; diff --git a/src/meta/css.js b/src/meta/css.js index effd560526..172c2bf0e6 100644 --- a/src/meta/css.js +++ b/src/meta/css.js @@ -70,6 +70,7 @@ module.exports = function(Meta) { source += '\n@import (inline) "..' + path.sep + '..' + path.sep + 'public/vendor/jquery/textcomplete/jquery.textcomplete.css";'; source += '\n@import (inline) "..' + path.sep + '..' + path.sep + 'public/vendor/colorpicker/colorpicker.css";'; source += '\n@import "..' + path.sep + '..' + path.sep + 'public/less/flags.less";'; + source += '\n@import "..' + path.sep + '..' + path.sep + 'public/less/blacklist.less";'; source += '\n@import "..' + path.sep + '..' + path.sep + 'public/less/generics.less";'; source += '\n@import "..' + path.sep + '..' + path.sep + 'public/less/mixins.less";'; diff --git a/src/routes/index.js b/src/routes/index.js index e49256f933..58754670d5 100644 --- a/src/routes/index.js +++ b/src/routes/index.js @@ -36,8 +36,9 @@ function mainRoutes(app, middleware, controllers) { setupPageRoute(app, '/tos', middleware, [], controllers.termsOfUse); } -function postRoutes(app, middleware, controllers) { - setupPageRoute(app, '/posts/flags', middleware, [], controllers.posts.flagged); +function globalModRoutes(app, middleware, controllers) { + setupPageRoute(app, '/ip-blacklist', middleware, [], controllers.globalMods.ipBlacklist); + setupPageRoute(app, '/posts/flags', middleware, [], controllers.globalMods.flagged); } function topicRoutes(app, middleware, controllers) { @@ -111,7 +112,7 @@ module.exports = function(app, middleware) { mainRoutes(router, middleware, controllers); topicRoutes(router, middleware, controllers); - postRoutes(router, middleware, controllers); + globalModRoutes(router, middleware, controllers); tagRoutes(router, middleware, controllers); categoryRoutes(router, middleware, controllers); accountRoutes(router, middleware, controllers); @@ -191,10 +192,8 @@ function handleErrors(app, middleware) { case 'EBADCSRFTOKEN': winston.error(req.path + '\n', err.message); return res.sendStatus(403); - break; case 'blacklisted-ip': return res.status(403).type('text/plain').send(err.message); - break; } if (parseInt(err.status, 10) === 302 && err.path) { diff --git a/src/socket.io/admin.js b/src/socket.io/admin.js index f3504a920d..6dd22134ba 100644 --- a/src/socket.io/admin.js +++ b/src/socket.io/admin.js @@ -33,8 +33,7 @@ var async = require('async'), settings: {}, email: {}, analytics: {}, - logs: {}, - blacklist: {} + logs: {} }; SocketAdmin.before = function(socket, method, data, next) { @@ -274,8 +273,5 @@ SocketAdmin.deleteAllEvents = function(socket, data, callback) { events.deleteAll(callback); }; -SocketAdmin.blacklist.validate = function(socket, data, callback) { - meta.blacklist.validate(data.rules, callback); -}; module.exports = SocketAdmin; diff --git a/src/socket.io/blacklist.js b/src/socket.io/blacklist.js new file mode 100644 index 0000000000..f4158dc94b --- /dev/null +++ b/src/socket.io/blacklist.js @@ -0,0 +1,27 @@ + +'use strict'; + +var async = require('async'); +var winston = require('winston'); + +var user = require('../user'); +var meta = require('../meta'); + +var SocketBlacklist = {}; + +SocketBlacklist.validate = function(socket, data, callback) { + meta.blacklist.validate(data.rules, callback); +}; + +SocketBlacklist.save = function(socket, rules, callback) { + user.isAdminOrGlobalMod(socket.uid, function(err, isAdminOrGlobalMod) { + if (err || !isAdminOrGlobalMod) { + return callback(err || new Error('[[error:no-privileges]]')); + } + + meta.blacklist.save(rules, callback); + }); +}; + + +module.exports = SocketBlacklist; diff --git a/src/socket.io/index.js b/src/socket.io/index.js index 032c4b9c68..8f6f3c4c5a 100644 --- a/src/socket.io/index.js +++ b/src/socket.io/index.js @@ -121,7 +121,7 @@ function onMessage(socket, payload) { function requireModules() { var modules = ['admin', 'categories', 'groups', 'meta', 'modules', - 'notifications', 'plugins', 'posts', 'topics', 'user' + 'notifications', 'plugins', 'posts', 'topics', 'user', 'blacklist' ]; modules.forEach(function(module) { diff --git a/src/views/admin/manage/ip-blacklist.tpl b/src/views/admin/manage/ip-blacklist.tpl index 13e43a84d7..8ef308f364 100644 --- a/src/views/admin/manage/ip-blacklist.tpl +++ b/src/views/admin/manage/ip-blacklist.tpl @@ -11,10 +11,7 @@
    -
    -
    - -
    +
    From c9cfe5b089c51a7610e48eb9b86cb8394bab6ac9 Mon Sep 17 00:00:00 2001 From: barisusakli Date: Tue, 15 Mar 2016 15:38:16 +0200 Subject: [PATCH 15/34] closes #4355 --- package.json | 2 +- public/src/modules/helpers.js | 2 +- src/categories/create.js | 11 ++++++----- src/categories/update.js | 8 ++++---- 4 files changed, 12 insertions(+), 11 deletions(-) diff --git a/package.json b/package.json index 37f7911604..4fd88722d7 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,7 @@ "nodebb-plugin-spam-be-gone": "0.4.5", "nodebb-rewards-essentials": "0.0.8", "nodebb-theme-lavender": "3.0.9", - "nodebb-theme-persona": "4.0.93", + "nodebb-theme-persona": "4.0.94", "nodebb-theme-vanilla": "5.0.54", "nodebb-widget-essentials": "2.0.8", "nodemailer": "2.0.0", diff --git a/public/src/modules/helpers.js b/public/src/modules/helpers.js index bdc4176d52..8d6b213a1d 100644 --- a/public/src/modules/helpers.js +++ b/public/src/modules/helpers.js @@ -113,7 +113,7 @@ '' + '' + child.name + ' '; }); - html = html ? ('
    ' + html + '') : html; + html = html ? ('' + html + '') : html; return html; }; diff --git a/src/categories/create.js b/src/categories/create.js index fbd448407d..69d1f4dcd8 100644 --- a/src/categories/create.js +++ b/src/categories/create.js @@ -17,15 +17,15 @@ module.exports = function(Categories) { db.incrObjectField('global', 'nextCid', next); }, function(cid, next) { - var slug = cid + '/' + utils.slugify(data.name), - order = data.order || cid, // If no order provided, place it at the end - colours = Categories.assignColours(); + var slug = cid + '/' + utils.slugify(data.name); + var order = data.order || cid; // If no order provided, place it at the end + var colours = Categories.assignColours(); category = { cid: cid, name: data.name, - description: ( data.description ? data.description : '' ), - icon: ( data.icon ? data.icon : '' ), + description: data.description ? data.description : '', + icon: data.icon ? data.icon : '', bgColor: data.bgColor || colours[0], color: data.color || colours[1], slug: slug, @@ -49,6 +49,7 @@ module.exports = function(Categories) { async.series([ async.apply(db.setObject, 'category:' + category.cid, category), + async.apply(Categories.parseDescription, category.cid, category.description), async.apply(db.sortedSetAdd, 'categories:cid', category.order, category.cid), async.apply(db.sortedSetAdd, 'cid:' + parentCid + ':children', category.order, category.cid), async.apply(privileges.categories.give, defaultPrivileges, category.cid, 'administrators'), diff --git a/src/categories/update.js b/src/categories/update.js index ffd9bc5cec..78e97e4076 100644 --- a/src/categories/update.js +++ b/src/categories/update.js @@ -72,7 +72,7 @@ module.exports = function(Categories) { if (key === 'order') { updateOrder(cid, value, callback); } else if (key === 'description') { - parseDescription(cid, value, callback); + Categories.parseDescription(cid, value, callback); } else { callback(); } @@ -100,7 +100,7 @@ module.exports = function(Categories) { function (next) { db.setObjectField('category:' + cid, 'parentCid', newParent, next); } - ], function(err, results) { + ], function(err) { callback(err); }); }); @@ -124,13 +124,13 @@ module.exports = function(Categories) { }); } - function parseDescription(cid, description, callback) { + Categories.parseDescription = function(cid, description, callback) { plugins.fireHook('filter:parse.raw', description, function(err, parsedDescription) { if (err) { return callback(err); } Categories.setCategoryField(cid, 'descriptionParsed', parsedDescription, callback); }); - } + }; }; From b1284f900d5e087c5ba5ccaac158145c6aa3724b Mon Sep 17 00:00:00 2001 From: barisusakli Date: Tue, 15 Mar 2016 15:38:53 +0200 Subject: [PATCH 16/34] up toobusy default --- src/middleware/middleware.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/middleware/middleware.js b/src/middleware/middleware.js index 52adf21ab4..0248af04f4 100644 --- a/src/middleware/middleware.js +++ b/src/middleware/middleware.js @@ -26,7 +26,7 @@ var app, helpers: require('../controllers/helpers') }; -toobusy.maxLag(parseInt(meta.config.eventLoopLagThreshold, 10) || 70); +toobusy.maxLag(parseInt(meta.config.eventLoopLagThreshold, 10) || 100); toobusy.interval(parseInt(meta.config.eventLoopInterval, 10) || 500); middleware.authenticate = function(req, res, next) { From 92b8d661533a5bd3c56c66831c52036974b6a03e Mon Sep 17 00:00:00 2001 From: barisusakli Date: Tue, 15 Mar 2016 16:21:19 +0200 Subject: [PATCH 17/34] up persona --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 4fd88722d7..ceb23a3262 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,7 @@ "nodebb-plugin-spam-be-gone": "0.4.5", "nodebb-rewards-essentials": "0.0.8", "nodebb-theme-lavender": "3.0.9", - "nodebb-theme-persona": "4.0.94", + "nodebb-theme-persona": "4.0.95", "nodebb-theme-vanilla": "5.0.54", "nodebb-widget-essentials": "2.0.8", "nodemailer": "2.0.0", From 13210a91e6428cbda12a89797904347f73f04cb6 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Wed, 16 Mar 2016 10:45:41 -0400 Subject: [PATCH 18/34] Fixed case where plugin upgrade checker crashed ... if no extraneous plugins were installed. Hooray for not testing the null case! --- nodebb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nodebb b/nodebb index 5f6f2a77c5..2c1a722d0a 100755 --- a/nodebb +++ b/nodebb @@ -118,8 +118,11 @@ var getRunningPid = function(callback) { version: async.apply(getCurrentVersion) }), function(payload, next) { - var toCheck = Object.keys(payload.plugins); + if (!payload.plugins.length) { + return next(null, []); // no extraneous plugins installed + } + var toCheck = Object.keys(payload.plugins); request({ method: 'GET', url: 'https://packages.nodebb.org/api/v1/suggest?version=' + payload.version + '&package[]=' + toCheck.join('&package[]='), From bb25c1b8310fd50fe5fe7efd362d1561dcc4ac80 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Wed, 16 Mar 2016 11:36:28 -0400 Subject: [PATCH 19/34] added back the OK on premature success --- nodebb | 1 + 1 file changed, 1 insertion(+) diff --git a/nodebb b/nodebb index 2c1a722d0a..417c6a9d80 100755 --- a/nodebb +++ b/nodebb @@ -119,6 +119,7 @@ var getRunningPid = function(callback) { }), function(payload, next) { if (!payload.plugins.length) { + process.stdout.write('OK'.green + '\n'.reset); return next(null, []); // no extraneous plugins installed } From cf8f1210cd9706d88e6aa29eb0ea5be422d17ad0 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Wed, 16 Mar 2016 12:04:08 -0400 Subject: [PATCH 20/34] added syntax hints to blacklist page --- src/views/admin/manage/ip-blacklist.tpl | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/views/admin/manage/ip-blacklist.tpl b/src/views/admin/manage/ip-blacklist.tpl index 8ef308f364..26170b286e 100644 --- a/src/views/admin/manage/ip-blacklist.tpl +++ b/src/views/admin/manage/ip-blacklist.tpl @@ -21,6 +21,18 @@
    +
    +
    Syntax Hints
    +
    +

    + Define a single IP addresses per line. You can add IP blocks as long as they follow the CIDR format (e.g. + 192.168.100.0/22). +

    +

    + You can add in comments by starting lines with the # symbol. +

    +
    +
    From 86bc7e3eff2c5b58b043ab30b5366f2d6dfb3ea6 Mon Sep 17 00:00:00 2001 From: psychobunny Date: Wed, 16 Mar 2016 12:55:29 -0400 Subject: [PATCH 21/34] up persona --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index ceb23a3262..a8eefa085e 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,7 @@ "nodebb-plugin-spam-be-gone": "0.4.5", "nodebb-rewards-essentials": "0.0.8", "nodebb-theme-lavender": "3.0.9", - "nodebb-theme-persona": "4.0.95", + "nodebb-theme-persona": "4.0.96", "nodebb-theme-vanilla": "5.0.54", "nodebb-widget-essentials": "2.0.8", "nodemailer": "2.0.0", From c8b179e492fdff1dd86cb4ecd815ed1385c52b7c Mon Sep 17 00:00:00 2001 From: psychobunny Date: Wed, 16 Mar 2016 15:39:43 -0400 Subject: [PATCH 22/34] better settings for birthday datepicker --- public/src/client/account/edit.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/public/src/client/account/edit.js b/public/src/client/account/edit.js index 0c22e33d56..de5b01e809 100644 --- a/public/src/client/account/edit.js +++ b/public/src/client/account/edit.js @@ -17,7 +17,8 @@ define('forum/account/edit', ['forum/account/header', 'uploader', 'translator'], $('#inputBirthday').datepicker({ changeMonth: true, changeYear: true, - yearRange: '1900:+0' + yearRange: '1900:-5y', + defaultDate: '-13y' }); }); From 54e36f7c548a47450b069da20deb3d6063f5fa9d Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Wed, 16 Mar 2016 17:47:12 -0400 Subject: [PATCH 23/34] Update ajaxify logic w/ returnPath support If returnPath is defined, and url is null, then ajaxify will execute a replaceState instead of an ajaxification. Used in cases where a separate route is pushed but you'll want to return to the page you were on previously. (see: #4371) --- public/src/ajaxify.js | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/public/src/ajaxify.js b/public/src/ajaxify.js index 608e0a6cda..ecd8276c69 100644 --- a/public/src/ajaxify.js +++ b/public/src/ajaxify.js @@ -22,10 +22,16 @@ $(document).ready(function() { $(window).on('popstate', function (ev) { ev = ev.originalEvent; - if (ev !== null && ev.state && ev.state.url !== undefined) { - ajaxify.go(ev.state.url, function() { - $(window).trigger('action:popstate', {url: ev.state.url}); - }, true); + if (ev !== null && ev.state) { + if (ev.state.url === null && ev.state.returnPath !== undefined) { + window.history.replaceState({ + url: ev.state.returnPath + }, ev.state.returnPath, config.relative_path + '/' + ev.state.returnPath); + } else if (ev.state.url !== undefined) { + ajaxify.go(ev.state.url, function() { + $(window).trigger('action:popstate', {url: ev.state.url}); + }, true); + } } }); From 232cbde8775e721e8c277a7461168bd517008b38 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Wed, 16 Mar 2016 17:53:11 -0400 Subject: [PATCH 24/34] upped composer, #4371 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index a8eefa085e..fb03387329 100644 --- a/package.json +++ b/package.json @@ -44,7 +44,7 @@ "mongodb": "~2.1.3", "morgan": "^1.3.2", "nconf": "~0.8.2", - "nodebb-plugin-composer-default": "3.0.8", + "nodebb-plugin-composer-default": "3.0.9", "nodebb-plugin-dbsearch": "1.0.0", "nodebb-plugin-emoji-extended": "1.0.3", "nodebb-plugin-markdown": "4.0.17", From ceb3b6ebe7cfa3958c74e4a1c1d4b2a4e4e02f8b Mon Sep 17 00:00:00 2001 From: boomzillawtf Date: Wed, 16 Mar 2016 17:55:58 -0400 Subject: [PATCH 25/34] Add setting to avoid showing a post after it is submitted to keep the user's place on the page to address issue #4363 --- public/language/en_GB/user.json | 2 ++ public/src/client/topic/posts.js | 2 +- src/user/settings.js | 4 +++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/public/language/en_GB/user.json b/public/language/en_GB/user.json index 2de2819dad..d76e82b5b3 100644 --- a/public/language/en_GB/user.json +++ b/public/language/en_GB/user.json @@ -103,6 +103,8 @@ "enable_topic_searching": "Enable In-Topic Searching", "topic_search_help": "If enabled, in-topic searching will override the browser's default page search behaviour and allow you to search through the entire topic, instead of what is only shown on screen", + "scroll_to_my_post": "After posting a reply, show the new post", + "follow_topics_you_reply_to": "Follow topics that you reply to", "follow_topics_you_create": "Follow topics you create", diff --git a/public/src/client/topic/posts.js b/public/src/client/topic/posts.js index 8f8bf4ca7d..2eada17c17 100644 --- a/public/src/client/topic/posts.js +++ b/public/src/client/topic/posts.js @@ -79,7 +79,7 @@ define('forum/topic/posts', [ } function scrollToPostIfSelf(post) { - var isSelfPost = parseInt(post.uid, 10) === parseInt(app.user.uid, 10); + var isSelfPost = config.scrollToMyPost && parseInt(post.uid, 10) === parseInt(app.user.uid, 10); if (isSelfPost) { navigator.scrollBottom(post.index); } diff --git a/src/user/settings.js b/src/user/settings.js index f1c4081b50..fc72342bf9 100644 --- a/src/user/settings.js +++ b/src/user/settings.js @@ -76,6 +76,7 @@ module.exports = function(User) { settings.restrictChat = parseInt(getSetting(settings, 'restrictChat', 0), 10) === 1; settings.topicSearchEnabled = parseInt(getSetting(settings, 'topicSearchEnabled', 0), 10) === 1; settings.bootswatchSkin = settings.bootswatchSkin || 'default'; + settings.scrollToMyPost = parseInt(getSetting(settings, 'scrollToMyPost', 1), 10) ===1; callback(null, settings); }); @@ -120,7 +121,8 @@ module.exports = function(User) { restrictChat: data.restrictChat, topicSearchEnabled: data.topicSearchEnabled, groupTitle: data.groupTitle, - homePageRoute: data.homePageCustom || data.homePageRoute + homePageRoute: data.homePageCustom || data.homePageRoute, + scrollToMyPost: data.scrollToMyPost }; if (data.bootswatchSkin) { From eb7c2d5872b12d5b67b26d38cb5585780608c207 Mon Sep 17 00:00:00 2001 From: boomzillawtf Date: Wed, 16 Mar 2016 20:19:02 -0400 Subject: [PATCH 26/34] Use scrollToMyPost setting with both pagination and infinite scroll --- public/src/client/topic/posts.js | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/public/src/client/topic/posts.js b/public/src/client/topic/posts.js index 2eada17c17..3eff5a03b5 100644 --- a/public/src/client/topic/posts.js +++ b/public/src/client/topic/posts.js @@ -33,10 +33,12 @@ define('forum/topic/posts', [ ajaxify.data.postcount ++; postTools.updatePostCount(ajaxify.data.postcount); - if (config.usePagination) { - onNewPostPagination(data); - } else { - onNewPostInfiniteScroll(data); + if (config.scrollToMyPost) { + if (config.usePagination) { + onNewPostPagination(data); + } else { + onNewPostInfiniteScroll(data); + } } }; @@ -79,7 +81,7 @@ define('forum/topic/posts', [ } function scrollToPostIfSelf(post) { - var isSelfPost = config.scrollToMyPost && parseInt(post.uid, 10) === parseInt(app.user.uid, 10); + var isSelfPost = parseInt(post.uid, 10) === parseInt(app.user.uid, 10); if (isSelfPost) { navigator.scrollBottom(post.index); } From 677b97d8bbf7f213bcef567c1111da090a012cfb Mon Sep 17 00:00:00 2001 From: barisusakli Date: Thu, 17 Mar 2016 11:00:01 +0200 Subject: [PATCH 27/34] closes #2873 --- src/views/admin/manage/group.tpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/views/admin/manage/group.tpl b/src/views/admin/manage/group.tpl index 414f51133e..f579065df5 100644 --- a/src/views/admin/manage/group.tpl +++ b/src/views/admin/manage/group.tpl @@ -9,12 +9,12 @@
    -
    +
    -
    +
    From 838023f91e858611bd900e5b42f51a7e47d58ad8 Mon Sep 17 00:00:00 2001 From: barisusakli Date: Thu, 17 Mar 2016 11:03:23 +0200 Subject: [PATCH 28/34] up themes --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index fb03387329..36ebb75f87 100644 --- a/package.json +++ b/package.json @@ -53,8 +53,8 @@ "nodebb-plugin-spam-be-gone": "0.4.5", "nodebb-rewards-essentials": "0.0.8", "nodebb-theme-lavender": "3.0.9", - "nodebb-theme-persona": "4.0.96", - "nodebb-theme-vanilla": "5.0.54", + "nodebb-theme-persona": "4.0.97", + "nodebb-theme-vanilla": "5.0.55", "nodebb-widget-essentials": "2.0.8", "nodemailer": "2.0.0", "nodemailer-sendmail-transport": "1.0.0", From c71ffed69c1efe7ca7a9c329e05f32ebcee59c30 Mon Sep 17 00:00:00 2001 From: barisusakli Date: Thu, 17 Mar 2016 11:38:21 +0200 Subject: [PATCH 29/34] closes #4362 --- public/src/ajaxify.js | 1 + public/src/app.js | 2 ++ public/src/client/topic/events.js | 4 ++-- src/middleware/render.js | 1 + src/posts/parse.js | 3 +++ 5 files changed, 9 insertions(+), 2 deletions(-) diff --git a/public/src/ajaxify.js b/public/src/ajaxify.js index ecd8276c69..8450f1c2ab 100644 --- a/public/src/ajaxify.js +++ b/public/src/ajaxify.js @@ -154,6 +154,7 @@ $(document).ready(function() { templates.parse(tpl_url, data, function(template) { translator.translate(template, function(translatedTemplate) { + translatedTemplate = translator.unescape(translatedTemplate); $('body').addClass(data.bodyClass); $('#content').html(translatedTemplate); diff --git a/public/src/app.js b/public/src/app.js index 4f7b009a30..65276bc798 100644 --- a/public/src/app.js +++ b/public/src/app.js @@ -521,6 +521,7 @@ app.cacheBuster = null; if (typeof blockName === 'string') { templates.parse(template, blockName, data, function(html) { translator.translate(html, function(translatedHTML) { + translatedHTML = translator.unescape(translatedHTML); callback($(translatedHTML)); }); }); @@ -528,6 +529,7 @@ app.cacheBuster = null; callback = data, data = blockName; templates.parse(template, data, function(html) { translator.translate(html, function(translatedHTML) { + translatedHTML = translator.unescape(translatedHTML); callback($(translatedHTML)); }); }); diff --git a/public/src/client/topic/events.js b/public/src/client/topic/events.js index ba8c77598e..d65a1c7c47 100644 --- a/public/src/client/topic/events.js +++ b/public/src/client/topic/events.js @@ -114,7 +114,7 @@ define('forum/topic/events', [ } editedPostEl.fadeOut(250, function() { - editedPostEl.html(data.post.content); + editedPostEl.html(translator.unescape(data.post.content)); editedPostEl.find('img:not(.not-responsive)').addClass('img-responsive'); app.replaceSelfLinks(editedPostEl.find('a')); posts.wrapImagesInLinks(editedPostEl.parent()); @@ -186,7 +186,7 @@ define('forum/topic/events', [ if (isDeleted) { postEl.find('[component="post/content"]').translateHtml('[[topic:post_is_deleted]]'); } else { - postEl.find('[component="post/content"]').html(data.content); + postEl.find('[component="post/content"]').html(translator.unescape(data.content)); } } } diff --git a/src/middleware/render.js b/src/middleware/render.js index 9ae7a50253..2a9d0ba5d2 100644 --- a/src/middleware/render.js +++ b/src/middleware/render.js @@ -72,6 +72,7 @@ module.exports = function(middleware) { var language = res.locals.config ? res.locals.config.userLang || 'en_GB' : 'en_GB'; language = req.query.lang || language; translator.translate(str, language, function(translated) { + translated = translator.unescape(translated); translated = translated + ''; fn(err, translated); }); diff --git a/src/posts/parse.js b/src/posts/parse.js index efa5667ccc..1af374305d 100644 --- a/src/posts/parse.js +++ b/src/posts/parse.js @@ -3,6 +3,7 @@ var cache = require('./cache'); var plugins = require('../plugins'); +var translator = require('../../public/src/modules/translator'); module.exports = function(Posts) { @@ -24,6 +25,8 @@ module.exports = function(Posts) { return callback(err); } + data.postData.content = translator.escape(data.postData.content); + if (global.env === 'production' && data.postData.pid) { cache.set(data.postData.pid, data.postData.content); } From 6076bbbed4263ed0e610e6f9c42134588b280925 Mon Sep 17 00:00:00 2001 From: barisusakli Date: Thu, 17 Mar 2016 11:54:31 +0200 Subject: [PATCH 30/34] added title --- src/controllers/admin/blacklist.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/controllers/admin/blacklist.js b/src/controllers/admin/blacklist.js index 3561ba0f76..2c0104f742 100644 --- a/src/controllers/admin/blacklist.js +++ b/src/controllers/admin/blacklist.js @@ -9,7 +9,7 @@ blacklistController.get = function(req, res, next) { if (err) { return next(err); } - res.render('admin/manage/ip-blacklist', {rules: rules}); + res.render('admin/manage/ip-blacklist', {rules: rules, title: 'IP Blacklist'}); }); }; From 3f9c838c30304fd8e3872e6667fd58db0c43ab30 Mon Sep 17 00:00:00 2001 From: psychobunny Date: Thu, 17 Mar 2016 14:57:41 -0400 Subject: [PATCH 31/34] up persona --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 36ebb75f87..e0e8bf8b71 100644 --- a/package.json +++ b/package.json @@ -53,7 +53,7 @@ "nodebb-plugin-spam-be-gone": "0.4.5", "nodebb-rewards-essentials": "0.0.8", "nodebb-theme-lavender": "3.0.9", - "nodebb-theme-persona": "4.0.97", + "nodebb-theme-persona": "4.0.98", "nodebb-theme-vanilla": "5.0.55", "nodebb-widget-essentials": "2.0.8", "nodemailer": "2.0.0", From 9e44bd3d219849267e4f2b6514fc388cd0f6c286 Mon Sep 17 00:00:00 2001 From: barisusakli Date: Fri, 18 Mar 2016 10:33:10 +0200 Subject: [PATCH 32/34] up themes --- package.json | 4 ++-- public/src/client/topic/posts.js | 14 +++++++------- src/controllers/topics.js | 5 +++-- 3 files changed, 12 insertions(+), 11 deletions(-) diff --git a/package.json b/package.json index e0e8bf8b71..7eb551e233 100644 --- a/package.json +++ b/package.json @@ -53,8 +53,8 @@ "nodebb-plugin-spam-be-gone": "0.4.5", "nodebb-rewards-essentials": "0.0.8", "nodebb-theme-lavender": "3.0.9", - "nodebb-theme-persona": "4.0.98", - "nodebb-theme-vanilla": "5.0.55", + "nodebb-theme-persona": "4.0.99", + "nodebb-theme-vanilla": "5.0.56", "nodebb-widget-essentials": "2.0.8", "nodemailer": "2.0.0", "nodemailer-sendmail-transport": "1.0.0", diff --git a/public/src/client/topic/posts.js b/public/src/client/topic/posts.js index 3eff5a03b5..f534aefad5 100644 --- a/public/src/client/topic/posts.js +++ b/public/src/client/topic/posts.js @@ -33,12 +33,12 @@ define('forum/topic/posts', [ ajaxify.data.postcount ++; postTools.updatePostCount(ajaxify.data.postcount); - if (config.scrollToMyPost) { - if (config.usePagination) { - onNewPostPagination(data); - } else { - onNewPostInfiniteScroll(data); - } + if (ajaxify.data.scrollToMyPost) { + if (config.usePagination) { + onNewPostPagination(data); + } else { + onNewPostInfiniteScroll(data); + } } }; @@ -142,7 +142,7 @@ define('forum/topic/posts', [ } data.slug = ajaxify.data.slug; - + $(window).trigger('action:posts.loading', {posts: data.posts, after: after, before: before}); app.parseAndTranslate('topic', 'posts', data, function(html) { diff --git a/src/controllers/topics.js b/src/controllers/topics.js index 68a3b18415..27c0ed5b81 100644 --- a/src/controllers/topics.js +++ b/src/controllers/topics.js @@ -4,7 +4,6 @@ var async = require('async'); var S = require('string'); var nconf = require('nconf'); -var validator = require('validator'); var user = require('../user'); var meta = require('../meta'); @@ -24,6 +23,7 @@ topicsController.get = function(req, res, callback) { var currentPage = parseInt(req.query.page, 10) || 1; var pageCount = 1; var userPrivileges; + var settings; if ((req.params.post_index && !utils.isNumber(req.params.post_index)) || !utils.isNumber(tid)) { return callback(); @@ -62,7 +62,7 @@ topicsController.get = function(req, res, callback) { return helpers.redirect(res, url); } - var settings = results.settings; + settings = results.settings; var postCount = parseInt(results.topic.postcount, 10); pageCount = Math.max(1, Math.ceil((postCount - 1) / settings.postsPerPage)); @@ -261,6 +261,7 @@ topicsController.get = function(req, res, callback) { data['reputation:disabled'] = parseInt(meta.config['reputation:disabled'], 10) === 1; data['downvote:disabled'] = parseInt(meta.config['downvote:disabled'], 10) === 1; data['feeds:disableRSS'] = parseInt(meta.config['feeds:disableRSS'], 10) === 1; + data.scrollToMyPost = settings.scrollToMyPost; data.rssFeedUrl = nconf.get('relative_path') + '/topic/' + data.tid + '.rss'; data.pagination = pagination.create(currentPage, pageCount); data.pagination.rel.forEach(function(rel) { From 1e651aed3570383ec1492e87af0fa592cbf300f3 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Fri, 18 Mar 2016 12:13:29 -0400 Subject: [PATCH 33/34] #4377 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 7eb551e233..fb4e717bf0 100644 --- a/package.json +++ b/package.json @@ -44,7 +44,7 @@ "mongodb": "~2.1.3", "morgan": "^1.3.2", "nconf": "~0.8.2", - "nodebb-plugin-composer-default": "3.0.9", + "nodebb-plugin-composer-default": "3.0.10", "nodebb-plugin-dbsearch": "1.0.0", "nodebb-plugin-emoji-extended": "1.0.3", "nodebb-plugin-markdown": "4.0.17", From f7e43877482f6efc276ea71e61d7c7524a8f5a44 Mon Sep 17 00:00:00 2001 From: Julian Lam Date: Fri, 18 Mar 2016 12:24:51 -0400 Subject: [PATCH 34/34] closes #4380 --- src/meta/blacklist.js | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/meta/blacklist.js b/src/meta/blacklist.js index b0269a1f0c..47381e487b 100644 --- a/src/meta/blacklist.js +++ b/src/meta/blacklist.js @@ -78,16 +78,24 @@ Blacklist.validate = function(rules, callback) { var cidr = []; var invalid = []; - var isCidrSubnet = /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$/; + var isCidrSubnet = /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$/, + inlineCommentMatch = /#.*$/, + whitelist = ['127.0.0.1', '::1', '::ffff:0:127.0.0.1']; // Filter out blank lines and lines starting with the hash character (comments) + // Also trim inputs and remove inline comments rules = rules.map(function(rule) { - rule = rule.trim(); + rule = rule.replace(inlineCommentMatch, '').trim(); return rule.length && !rule.startsWith('#') ? rule : null; }).filter(Boolean); // Filter out invalid rules rules = rules.filter(function(rule) { + if (whitelist.indexOf(rule) !== -1) { + invalid.push(rule); + return false; + } + if (ip.isV4Format(rule)) { ipv4.push(rule); return true;