Build(deps): Bump actions/stale from 9 to 10 - #495
Open
dependabot[bot] wants to merge 1277 commits into
Open
Conversation
Previously, theme fields from components would be cached for each of their parent themes.
Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
The hidden site setting max_drafts_per_user defaults to 10_000 drafts per user. The longest key should be "topic_<MAX_BIG_INT>" which is 25 characters.
This commit adds limits to themes and theme components on the: - file size of about.json and .discourse-compatibility - file size of theme assets - number of files in a theme
…course#23346) Why this change? As part of our ongoing efforts to security harden the Discourse application, we are adding the `cross_origin_opener_policy_header` site setting which allows the `Cross-Origin-Opener-Policy` response header to be set on requests that preloads the Discourse application. In more technical terms, only GET requests that are not json or xhr will have the response header set. The `cross_origin_opener_policy_header` site setting is hidden for now for testing purposes and will either be released as a public site setting or be remove if we decide to be opinionated and ship a default for the `Cross-Origin-Opener-Policy` response header.
Add spec compact
User profiles, including the summary, should be private to anonymous users if hide_user_profiles_from_public is enabled.
Why this change? The `PostsController#create` action allows arbitrary topic custom fields to be set by any user that can create a topic. Without any restrictions, this opens us up to potential security issues where plugins may be using topic custom fields in security sensitive areas. What does this change do? 1. This change introduces the `register_editable_topic_custom_field` plugin API which allows plugins to register topic custom fields that are editable either by staff users only or all users. The registered editable topic custom fields are stored in `DiscoursePluginRegistry` and is called by a new method `Topic#editable_custom_fields` which is then used in the `PostsController#create` controller action. When an unpermitted custom fields is present in the `meta_data` params, a 400 response code is returned. 2. Removes all reference to `meta_data` on a topic as it is confusing since we actually mean topic custom fields instead.
This adds access controls for the `/polls/grouped_poll_results` endpoint, such that only users with appropriate permissions can read the grouped results of a given poll.
Why this change? This ensures that malicious requests cannot end up causing the logs to quickly fill up. The default chosen is sufficient for most legitimate requests to the Discourse application. When truncation happens, parsing of logs in supported format like lograge may break down.
Ensure we escape the display names before passing it to the regexp used to update quotes whenever a user change their display name.
Block redirects when making the final request in TopicEmbed to prevent Server Side Request Forgery (SSRF)
The use of triple-curlies on Mustache templates opens the possibility for HTML injections.
There is an edge case where the following occurs: 1. The user sets a bookmark reminder on a post/topic 2. The post/topic is changed to a PM before or after the reminder fires, and the notification remains unread by the user 3. The user opens their bookmark reminder notification list and they can still see the notification even though they cannot access the topic anymore There is a very low chance for information leaking here, since the only thing that could be exposed is the topic title if it changes to something sensitive. This commit filters the bookmark unread notifications by using the bookmarkable can_see? methods and also prevents sending reminder notifications for bookmarks the user can no longer see.
Ensures posts cannot have SVG or PRE elements that are too tall.
- Add these params directly to stable since main refactored the template
- Move the change added in [this commit ](discourse@df412608c8fa1ff396b02751590025ad7015484e)to stable
…iscourse#32411) The `--disable-system-tests` CLI arg does nothing
```
Selenium::WebDriver::Error::WebDriverError:
Could not find a valid devtools version; use a more recent version of selenium-devtools gem
```
…iscourse#32413) This commit adds a new `--exclude-pattern` CLI option which supports excluding files using unix style pattern matching. This is to simplify a couple of situations: 1. Running `bin/turbo_rspec plugin/spec` but we want to exclude all tests in the `plugin/spec/system` folder. Example: `bin/turbo_rspec --exclude-pattern="*spec/system*" plugin/spec` 2. Running `bin/turbo_rspec plugin/*/spec/system` but we want to exclude tests for a particular plugin. Example: `bin/turbo_rspec --exclude-pattern="plugins/chat/*" plugin/*/spec/system`
When adding people to a DM, the ones already in the channel weren’t taken into account when checking whether the maximum limit was reached.
This patch adds a new shared example to be used as a smoke test in plugins and themes. A `skip_examples` argument is available to easily opt-out from a category of tests. Example: ```rb RSpec.describe "Testing core features", type: :system do it_behaves_like "having working core features", skip_examples: %i[search login] end ```
Some plugins are always enabled and don’t have a related site setting. This patch takes this into account.
Bumps [actions/stale](https://github.com/actions/stale) from 9 to 10. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@v9...v10) --- updated-dependencies: - dependency-name: actions/stale dependency-version: '10' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
PR body updated to plaintext for easier squash-merging. Original body content below: Bumps actions/stale from 9 to 10. Release notesSourced from actions/stale's releases.
ChangelogSourced from actions/stale's changelog.
... (truncated) Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting Dependabot commands and optionsYou can trigger Dependabot actions by commenting on this PR:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/stale from 9 to 10.