Commit Graph

95 Commits

Author SHA1 Message Date
Cinder
4883912e93
[Security] Implement read only mode (#821) 2024-12-08 19:28:31 -08:00
Earlopain
fc7d84affd
[RuboCop] Enable Style/FrozenStringLiteralComment
This reduces allocations on the posts page by about 5%, from basic testing
2024-02-25 18:15:55 +01:00
Donovan Daniels
b89fc1428e
[Comments] Add "Post Uploader" to search options (#598)
* [Comments] Add "Post Uploader" to search options

* Use block with where_user
2024-02-14 16:10:45 +01:00
Earlopain
2c832dc633
[Comments] Show hidden sticky comments to Janitors 2024-01-22 19:26:00 +01:00
Earlopain
23fcee2356
[Comments] Allow janitor to sticky 2024-01-22 17:52:48 +01:00
Earlopain
6bb4c272cc
[Gems] Bump rubocop 2023-12-03 15:36:37 +01:00
Earlopain
2624a0f706
[Comments] Fix "Show all" for anon users 2023-10-15 18:09:54 +02:00
Earlopain
4f3be1955e
[Notes] Add back ability to search by post note updater 2023-08-31 17:38:09 +02:00
Earlopain
580776ca81
[Comments] Remove quoted response 2023-04-03 00:10:28 +02:00
Earlopain
1a94acb6f6
[Users] Moderator permission tweaks 2022-12-23 16:35:37 +01:00
Earlopain
665f432e17
[Users] Allow moderators to handle tickets 2022-11-28 16:21:40 +01:00
Kira
963b67d0b9 [Rails 7] Fix bad response format on show all comments. 2022-11-24 16:58:55 -08:00
Earlopain
361b90a79a
[Warnable] Replace html after warning 2022-09-27 21:01:41 +02:00
Earlopain
5139aaf4db
[Cleanup] Refactor user warnable code 2022-09-26 20:15:35 +02:00
Earlopain
dd194122a0
[Comments] Refactor showing the reply button 2022-05-16 13:34:25 +02:00
Earlopain
a9b6970956
[Controllers] Always allow search[id] parameter
It works for controllers which allow every parameter, but they need to be
explicitly set when permitting

Noticed because of e397a10e0d
2022-02-06 15:19:08 +01:00
Earlopain
a8276c4775
[Comments] Prevent moving comments to other posts 2022-01-09 17:53:17 +01:00
Earlopain
609c1b4b8f
[IpSearch] Add ip searching capabilities and link to them 2021-11-17 18:09:45 +01:00
Earlopain
d9f7bec1ee
[Comments] Remove atom feed 2021-10-02 12:13:27 +02:00
Kira
1feee5e9a5 [Admin] Allow marking content as having earned a user a warning/ban 2021-04-16 15:39:32 -07:00
Kira
ffe7fca18a [Comments] Prevent leaking thumbnails of non-visible posts 2020-07-08 02:40:27 -07:00
Kira
b47e837ee5 [Comments] Prevent hidden comment leak in API 2020-05-20 18:32:31 -07:00
Kira
2c40167c39 [Comments] Prevent searching for deleted comments unless mod+ 2020-05-20 18:20:41 -07:00
Kira
38aaa8cbe2 Fix show all comments link 2020-02-21 21:40:37 -08:00
Kira
c072f8090d Remove comment remote: true actions 2020-02-21 21:40:37 -08:00
Kira
04fd83c59a Fix empty comment page because of bad search 2020-02-01 07:45:17 -08:00
Kira
d1750f938a Remove xml render special casing 2020-01-02 10:16:54 -08:00
Kira
cc71812fda Remove xml respond_to 2020-01-02 10:16:54 -08:00
Kira
6127ea6d25 Initial comment hide vs delete distinction 2019-09-06 07:01:37 -07:00
Kira
9dceee4648 Move comment vote loading to controllers
This avoids using a very hacking preloading scheme that involved
a singleton value that could change at runtime and chaining model
associations together.
2019-04-10 17:21:27 -07:00
Kira
e62099af44 A whole boatload of elasticsearch changes
Makes index job unique to account for changes to update triggering.
Fixes instances of mixed SQL and ES searches with tag_matches.
Adds utility methods for exists? and count_only ES searches.
Adds comment_bumped_at for comments page usage.
Adds random seeding capability.
Fixes random searches not working correctly.
Fixes status:active.
2019-03-28 14:04:01 -07:00
evazion
dfb7cf6994 comments: add standalone new comment form.
Add standalone /comments/new page to allow commenting if javascript is
disabled.
2018-09-29 20:42:38 -05:00
evazion
9ac59aeadd comments.js: clean up comment quoting.
Replace Comment.quote with a remote new.js.erb call.
2018-09-29 20:42:38 -05:00
evazion
130570aa33 comments.js: fix thresholded comments.
* Restore behavior of thresholded comments being greyed out (lost in 6fa0ae2cf).

* Set the `below-threshold` class for thresholded comments in the html instead of in javascript.

* Remove `include_below_threshold` param; it was always true when clicking "Show all comments".
2018-08-09 14:45:26 -05:00
evazion
83b96b4f3f Fix #3652: URL addons stripped when comments are created/edited. 2018-04-18 23:58:35 -05:00
Albert Yi
5546d9e98b fixes #3627 2018-04-12 14:20:02 -07:00
r888888888
abce4d2551 Raise error on unpermitted params.
Fail loudly if we forget to whitelist a param instead of silently
ignoring it.

misc models: convert to strong params.

artist commentaries: convert to strong params.

* Disallow changing or setting post_id to a nonexistent post.

artists: convert to strong params.

* Disallow setting `is_banned` in create/update actions. Changing it
  this way instead of with the ban/unban actions would leave the artist in
  a partially banned state.

bans: convert to strong params.

* Disallow changing the user_id after the ban has been created.

comments: convert to strong params.

favorite groups: convert to strong params.

news updates: convert to strong params.

post appeals: convert to strong params.

post flags: convert to strong params.

* Disallow users from setting the `is_deleted` / `is_resolved` flags.

ip bans: convert to strong params.

user feedbacks: convert to strong params.

* Disallow users from setting `disable_dmail_notification` when creating feedbacks.
* Disallow changing the user_id after the feedback has been created.

notes: convert to strong params.

wiki pages: convert to strong params.

* Also fix non-Builders being able to delete wiki pages.

saved searches: convert to strong params.

pools: convert to strong params.

* Disallow setting `post_count` or `is_deleted` in create/update actions.

janitor trials: convert to strong params.

post disapprovals: convert to strong params.

* Factor out quick-mod bar to shared partial.
* Fix quick-mod bar to use `Post#is_approvable?` to determine visibility
  of Approve button.

dmail filters: convert to strong params.

password resets: convert to strong params.

user name change requests: convert to strong params.

posts: convert to strong params.

users: convert to strong params.

* Disallow setting password_hash, last_logged_in_at, last_forum_read_at,
  has_mail, and dmail_filter_attributes[user_id].

* Remove initialize_default_image_size (dead code).

uploads: convert to strong params.

* Remove `initialize_status` because status already defaults to pending
  in the database.

tag aliases/implications: convert to strong params.

tags: convert to strong params.

forum posts: convert to strong params.

* Disallow changing the topic_id after creating the post.
* Disallow setting is_deleted (destroy/undelete actions should be used instead).
* Remove is_sticky / is_locked (nonexistent attributes).

forum topics: convert to strong params.

* merges https://github.com/evazion/danbooru/tree/wip-rails-5.1
* lock pg gem to 0.21 (1.0.0 is incompatible with rails 5.1.4)
* switch to factorybot and change all references

Co-authored-by: r888888888 <r888888888@gmail.com>
Co-authored-by: evazion <noizave@gmail.com>

add diffs
2018-04-06 18:09:57 -07:00
evazion
87da9ec873 /comments: break out index_by_post/index_by_comment into partials. 2017-06-18 22:32:51 -05:00
evazion
fad4d48b1c search: fix order:note, order:comment_bumped to use indexes. 2017-05-19 18:19:05 -05:00
evazion
e68946e95d /comments.atom: add atom feed for comments. 2017-05-13 10:37:58 -05:00
evazion
869f1610fc comments: use server-side quote-stripping instead of reimplementing in js. 2017-04-24 21:15:47 -05:00
evazion
40092f21ba Remove redundant rescue_from calls.
These are redundant because ApplicationController rescues these exceptions already.
2017-02-25 02:18:16 -06:00
evazion
caaff24112 /comments?group_by=comment: add is_sticky/is_deleted/do_not_bump_post/order params. 2017-01-23 22:13:00 -06:00
Albert Yi
bdac591266 fixes #2838 2017-01-16 12:57:43 -08:00
Albert Yi
8db970f9f3 skip api check for forum and comment endpoints 2017-01-10 15:06:34 -08:00
evazion
1257639109 Add 'post as moderator' option for comments.
* Add 'post as moderator' option to comment form. This creates a so-called sticky comment.
* Downvotes have no effect on stickied comments; they're always visible, regardless of comment thresholds.
* Only mods may sticky comments.
* Mods may sticky comments by other users.
2016-12-26 23:52:45 -06:00
evazion
69c50290a8 Include updater_name in /comments/1.json. 2016-12-26 23:52:27 -06:00
evazion
c165b38a91 Prevent anon users from attempting to undelete/unvote comments.
The :undelete and :unvote actions weren't covered.
2016-12-26 23:52:27 -06:00
evazion
8c8f4a6a8f Fix mass assignment vuln in comment update action (#2704).
Prevents mass assignment of `post_id`, `do_not_bump_post`, and
`is_deleted`.
2016-10-06 09:39:57 +00:00
Toks
a4440514ff Allow undeleting comments 2015-07-11 13:26:55 -04:00