Commit Graph

9621 Commits

Author SHA1 Message Date
Barış Soner Uşaklı
446b125c83 escape post content 2018-09-04 10:59:52 -04:00
LudwikJaniuk
c7f3b76b4e DRY req props that depend on auth (fix #6727) (#6731)
* DRY req props that depend on auth (fix #6727)

authentication leads to req.loggedIn and req.uid being set. However, a
later authentication event might outdate them. Here, I create one
function for setting those properties, and make sure it also is called
on the `action:middleware.authenticate` hook, which would be such an
authentication event. If there are other places, those should be added
as well.

* fix lint errors

* fix lint error

* change exports
2018-09-04 09:43:33 -04:00
Barış Soner Uşaklı
3e1b007f9f escape title in post queue 2018-09-04 09:39:08 -04:00
Ben Lubar
97a3079bc0 Optimize PostgreSQL session store.
- Sets session ID to be a constant-sized character field inline in the
  table instead of a variable-length character field compressed outside
  of the row.
- Changes the session data from "json" to "jsonb" which is faster and
  smaller on disk with the drawback of not maintaining key order and
  whitespace (which we don't care about at all)
- Adds a clustered index on the session expiration timestamp, which will
  make periodic session purging much faster.

(For an example, WTDWTF currently has 482355 sessions in the table, and
 because there is no index on the expiration timestamp, PostgreSQL must
 check all the rows in the table every time.)

This upgrade script can run concurrently with a live NodeBB instance,
but any action that touches sessions will wait until the upgrade script
is done.

Does not touch the database if the database driver is not set to
PostgreSQL or if there is a Redis database configured.
2018-09-02 00:32:55 -04:00
Julian Lam
c2c925cacd closes #6678 2018-08-31 15:34:36 -04:00
Julian Lam
29836aaad9 rename session account middleware to sessions, plural, prep for fixing #6678 2018-08-31 15:34:36 -04:00
Baris Usakli
5b45b2f72c closes #6729 2018-08-31 11:48:13 -04:00
Barış Soner Uşaklı
0519f84734 Promisify modules (#6723)
* WIP promisify

* promisify psql

* ability to skip some keys

* dont promisify client object

* remove async

* clone entire module so it has all properties

* add shim for node 6

* ignore sessionStore as well

* ignore pool on psql
2018-08-31 11:04:42 -04:00
Julian Lam
c1725442ea added progress bar to username_email_history upgrade script 2018-08-30 17:03:42 -04:00
Julian Lam
545e678e8a fixes #6726 2018-08-30 15:08:01 -04:00
Julian Lam
5c04ec2d63 removed client-side chat message length check in favour of server-side check, firing new hook on messaging.checkContent for hooks to intercept 2018-08-29 14:31:53 -04:00
Julian Lam
1e3cdc99ac fixes #6702 2018-08-28 14:29:51 -04:00
Andrew Rodrigues
a06b33a713 fix html characters when cloning children categories 2018-08-27 18:40:56 -04:00
Julian Lam
aaa9561b7f Revert "moved filter:post.getPostSummaryByPids to before parsePosts call"
This reverts commit cf82407a8f.
2018-08-26 00:08:06 -04:00
Julian Lam
cf82407a8f moved filter:post.getPostSummaryByPids to before parsePosts call
/@pitaj
2018-08-24 14:54:11 -04:00
Barış Soner Uşaklı
ae4016d9e0 add getCateries to helpers 2018-08-17 16:39:56 -04:00
Andrew Rodrigues
12940b577b closes #6703 2018-08-15 20:42:59 -04:00
Julian Lam
2ce6a85756 properly closes #6698 2018-08-13 14:17:51 -04:00
Julian Lam
f751d21d1e removed debug line 2018-08-13 12:06:56 -04:00
Julian Lam
f9d3484ec6 fixes #6543 2018-08-10 16:07:25 -04:00
Julian Lam
ed9dc113b0 sanitizing notes in flags details page, fixes #6698 2018-08-10 15:01:49 -04:00
Julian Lam
a77630c6be closes #6697 2018-08-10 14:22:33 -04:00
Ben Lubar
33228bb7fe PostgreSQL database driver (#5861)
* [test/database/list] Fix test list 4 being used in two different tests

* [database/postgres] PostgreSQL database driver

* [database/postgres] Make transactions work based on continuation scope.

* [database/postgres] Implement nested transactions

* eslint --fix

* Add database changes from earlier this week to the PostgreSQL driver.

* Fix typo

* Fix postgres.incrObjectFieldBy returning undefined instead of null when given NaN

* [database/postgres] Fix sortedSetsCard returning an array of strings.

* Update socket.io postgres adapter

* Fix PostgreSQL erroring when multiple updates are made to the same sorted set entry in a single operation.

Add a test case to catch this error.

* Fix lint errors.

* Only prune sessions on one instance in a cluster to avoid deadlocks.

They're caught and handled by the database server, but they spam the logs.

* Fix arguments.slice.
2018-08-08 15:13:48 -04:00
Jimb Esser
3cccbbc1f2 Add option to enable/disable HSTS
Also fix HSTS middleware being added twice.
2018-08-07 10:33:55 -04:00
Barış Soner Uşaklı
1c286e4536 not even used 2018-08-03 18:50:45 -04:00
Barış Soner Uşaklı
fa499aef18 closes #6680 2018-07-31 14:26:17 -04:00
Baris Usakli
e7bd0cea74 fix lint 2018-07-27 14:27:23 -04:00
Baris Usakli
bcef32c5af closes #6645 2018-07-27 13:38:37 -04:00
Baris Usakli
546b13b897 fix lint and tests 2018-07-27 13:10:52 -04:00
Baris Usakli
79ffae608e closes #6675 2018-07-27 12:58:01 -04:00
Baris Usakli
4200cff47c closes #6662 2018-07-27 12:48:15 -04:00
Julian Lam
3c6c0ed7a1 restoring passwordExpiry for use in continueLogin, fixed tests, hopefully 2018-07-27 12:34:51 -04:00
Julian Lam
786af5fbb3 derp 2018-07-27 11:57:41 -04:00
Julian Lam
b6a5419ca1 closes #6674 2018-07-27 11:54:32 -04:00
Julian Lam
4f8815eb78 closes #6646 2018-07-26 16:38:40 -04:00
Julian Lam
ea2bd33bfa fixes #6608, restored template values in widget containers 2018-07-26 15:00:49 -04:00
Julian Lam
7dfe953526 closes #6672 2018-07-26 14:36:25 -04:00
Julian Lam
48197e2d25 this upgrade script was written in 2018, not 2017, heh 2018-07-26 11:02:43 -04:00
Barış Soner Uşaklı
c7d6cacd98 closes #6658 2018-07-26 10:52:06 -04:00
Ben Lubar
44373afc52 Fix socket.io not working properly in single-host clusters. (#6669)
This is because we don't use the cluster module, so the master nodejs process doesn't know about any of the clients through the socket API.
2018-07-25 11:04:18 -04:00
Julian Lam
3522ad0e05 Revert "closes #6664"
This reverts commit f27a0d252c.
2018-07-24 16:05:05 -04:00
Julian Lam
f27a0d252c closes #6664 2018-07-24 15:43:54 -04:00
Julian Lam
506467ad6f closes #6663 2018-07-24 10:30:47 -04:00
Ben Lubar
c1e98eefa7 Allow single-host clusters to not send pubsub and socket.io messages through the database. (#6659)
* Allow single-host clusters to not send pubsub and socket.io messages through the database.

* Fix lint errors.
2018-07-23 12:21:36 -04:00
Barış Soner Uşaklı
87b6808c4e refactor to use getCidsByPrivilege
switch to .includes
2018-07-20 14:34:53 -04:00
Ben Lubar
f1a6537fc2 Add notification frequencies from nodebb-plugin-upvote-notifications. (#6640)
* Add notification frequencies from nodebb-plugin-upvote-notifications.

https://github.com/boomzillawtf/nodebb-plugin-upvote-notifications

* Fix editing settings clearing upvote notification preferences.
2018-07-20 10:29:51 -04:00
Sebastian G. Marinescu
e35d4a7d85 closes #6283 2018-07-17 15:55:41 -04:00
Peter Jaszkowiak
04d31fe1d4 Precompile all templates
- Benchpress compilation is 33x faster now
- Native module with JS fallback and pre-built binaries
- Dev template build is <1sec now
- Minified template build is ~5sec (uglify accounts for almost all)
2018-07-15 00:12:37 -06:00
Julian Lam
7558046e75 add brute-force protection for change password and email actions 2018-07-11 16:28:40 -04:00
Barış Soner Uşaklı
91f9c60660 closes #6643 2018-07-10 12:14:12 -04:00