Commit Graph
8329 Commits
Author SHA1 Message Date
evazion 5bad5c6012 comments: fix visible method conflict.
Fix the `Comment#visible` method conflicting with the base class
`visible` method defined in ApplicationRecord.
2020-08-18 15:34:12 -05:00
evazion 70b82010a7 search: fix info leak when searching nested associations.
Fix an exploit in #4553. It was possible to use nested searches to infer
the contents of private forum posts.

For example:

* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=h*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=he*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=hel*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=hell*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=hello*

The above searches returned the user 'albert', indicating that the
private forum post with id 121683 starts with the word 'hello'.

By guessing the id of a private forum post (which can be done by
searching for gaps in the id sequence), and by guessing text within the
post (which can be done by sequentially guessing characters with
wildcard searches), one could eventually infer the full text of a
private forum post.

The fix is to make nested searches only return records that are visible
to the current user.
2020-08-18 15:21:39 -05:00
evazion 86c376e90d Merge pull request #4590 from nonamethanks/nijie_doujinshi
Nijie: Add doujin support
2020-08-18 14:59:18 -05:00
evazion 0c96c2172c Merge pull request #4577 from nonamethanks/fanbox
Add (partial) fanbox support
2020-08-18 14:13:43 -05:00
evazion e35d130b65 Merge pull request #4594 from BrokenEagle/fix-parameter-hash-check
Fix parameter hash detection
2020-08-18 12:20:43 -05:00
evazion 4c3b4671ef ip addresses: fix exception on ip_addresses/show page. 2020-08-18 11:16:26 -05:00
evazion fee68b6dd9 css: fix input box size in inline forms. 2020-08-18 11:08:02 -05:00
evazion d98dd0bb6d ugoiras: don't initialize notes on ugoiras.
Fixes note font scaling increasing the size of the ugoira playback controls.
2020-08-18 11:06:19 -05:00
BrokenEagle 36fa8efcd5 Fix parameter hash detection
Hash-like objects will respond to each_value, whereas arrays do not.
2020-08-18 05:34:14 +00:00
evazion 937653e519 models: move html_data_attributes to policies.
Move html_data_attributes definitions from models to policies. Which
attributes are permitted as data-* attributes is a view level concern
and should be defined on the policy level, not the model level. Models
should be agnostic about how they're used in views.
2020-08-17 22:33:18 -05:00
evazion 4b18361aaf tumblr: fix uses of $ in regexes. 2020-08-17 15:31:18 -05:00
evazion 160b099445 sources: use http client from base strategy. 2020-08-17 15:30:01 -05:00
evazion 5db11a0b5f Merge branch 'master' into attribute-searching 2020-08-17 14:23:00 -05:00
evazion d9f0a1c5e3 Merge pull request #4585 from nonamethanks/fix_tumblr
Tumblr: support highest res for new image urls
2020-08-17 14:11:48 -05:00
evazion c6a3b11fb6 Merge pull request #4592 from nonamethanks/show_appeals
Users: show appeal link and count to everyone
2020-08-17 13:59:20 -05:00
nonamethanks 04c8a9ebba Users: show appeal link and count to everyone 2020-08-17 13:55:52 +02:00
evazion 366eff4169 posts: show only last successful flag on deleted posts.
In the "This post was deleted" notice, show only the last successful
flag, instead of all previous flags (which may include rejected flags).
2020-08-16 17:19:29 -05:00
evazion 8f1276b013 appeals: crosspost appeals to deletion appeal thread.
Crosspost pending appeals to the deletion appeal thread. We do this once
per hour so we can batch together multiple appeals into one post.
2020-08-16 17:19:04 -05:00
evazion df19cbfd55 modqueue: show appealed posts in sidebar. 2020-08-16 15:41:30 -05:00
evazion d072ef98ba css: don't use monospace font for textareas.
This changes the font in text input boxes (including the tag edit box)
from monospace to Verdana.
2020-08-16 15:17:40 -05:00
evazion 44cbce9855 css: factor out fonts to css variables. 2020-08-16 15:01:28 -05:00
evazion f337902c57 modqueue: fix performance regression from including appeals.
* Add index on posts.is_deleted. The modqueue was slow because we the
 appeal condition wasn't constrained to deleted posts, so it degraded to
 a full table scan.

* Avoid extra queries for calculating the page count and disapproval counts.
2020-08-16 14:31:47 -05:00
evazion 16cfdb8321 bans: don't allow users to be double banned. 2020-08-16 14:31:47 -05:00
evazion 317cfe19b4 flags: only show current flag on flagged posts.
* Only show the current pending flag on flagged posts. Don't show old flags.

* Don't show both the "This post was flagged for review" and the "This
  post was flagged and is pending" notices.
2020-08-16 14:31:47 -05:00
evazion 7eb9f0b75e appeals: only show current appeal on appealed posts.
* Only show the current pending appeal in the "This post was appealed"
  notice. Don't show old appeals.

* Don't show both the "This post was deleted" and the "This post was
  appealed" notice on appealed posts. Only show the "This post was
  appealed" notice.

* Show "no reason" if no appeal reason was given.
2020-08-16 14:31:47 -05:00
evazion d4d1088c30 appeals: make appeal reasons optional. 2020-08-16 14:31:47 -05:00
evazion a1be6d35d1 mod dashboard: don't show appeals.
Don't show appeals in the /moderator/dashboard page. Appeals are already
available in the modqueue.
2020-08-16 14:31:42 -05:00
nonamethanks e3fd3f42cc Nijie: Add doujin support 2020-08-15 09:29:29 +02:00
evazion c002166801 Fix #4584: Disable deleted post filter when searching for status:appealed. 2020-08-14 22:05:19 -05:00
evazion f53fa2adb4 Fix #4587: "Max 5 flags per 3 days" should account for reapproved flags. 2020-08-14 21:57:08 -05:00
nonamethanks 5615719218 Tumblr: support highest res for new image urls 2020-08-14 01:23:27 +02:00
evazion cbadfb3817 post versions: remove dead check_for_retry method. 2020-08-13 02:24:13 -05:00
evazion 70f345fd7b post versions: add back support for changed_tags param.
Fix broken links on various pages:

* The 'History' link in the sidebar on the post index page.
* The 'History' links on the tags index page.
* The 'Tag History' link in the sidebar on the wiki show page.
2020-08-13 02:21:38 -05:00
evazion 06564b25ca autocomplete: add status:appealed to autocomplete. 2020-08-12 22:40:17 -05:00
evazion fbac2cd167 uploads: make early deletions cost more upload slots.
If a pending post is manually deleted before the 3 day moderation period
is up, then make it cost 5 upload slots until the 3 day period is up.
This means that if a new user uploads 3 bad posts that get manually
deleted, then all of their upload slots will be used and they won't be
able to upload again until 3 days have passed.
2020-08-12 21:31:30 -05:00
evazion 78b9613498 Fix #4554: Searches with "-status:active" not showing deleted posts.
Also fixes #4542: Quoted search metatag status:"deleted" yields no results.
2020-08-12 20:53:14 -05:00
evazion d884cb6642 search: fix parsing of quoted metatag values.
* Fix #4552: Multiple quoted search terms not parsed correctly.
* Allow quotes to be escaped in quoted metatags.
* Allow spaces to be escaped in unquoted metatags.
* Allow the empty string to be used in metatags.

Examples:

* `source:""` and `source:''` (same as `source:none`)
* `source:foo\ bar\ baz` (same as `source:"foo bar baz"`)
* `source:"don't say \"lazy\""` (use \" to write a literal ")
* `source:'don\'t say "lazy"'` (use \' to write a literal ')
* `source:"C:\\Windows"` (use \\ to write a literal \)
2020-08-12 18:12:16 -05:00
evazion dd8c3fad2c flags: adjust limit to 5 flags at once. 2020-08-12 13:11:33 -05:00
evazion 5917587fd5 http: add logger for debugging purposes.
Usage: Danbooru::Http.new.use(:logger).get(url).
2020-08-12 13:11:33 -05:00
evazion 0297b631fb moderation: extract 3 day modqueue length to config. 2020-08-12 13:11:22 -05:00
evazion 3d3b5262cc uploads: don't show translated commentary in tag edit dialog. 2020-08-12 11:02:11 -05:00
evazion 4f57d0924f flags: fix deleting unapproved posts.
Don't trigger the "can't be flagged more than once in 3 days" rule when
generating the "Unapproved in three days" flag.
2020-08-12 11:00:17 -05:00
evazion 7d2050428e Merge pull request #4580 from nonamethanks/copy_note_annotations
Copy annotation tags when copying notes
2020-08-12 09:47:15 -05:00
evazion 58179fce00 Merge pull request #4579 from nonamethanks/fix_4564
Upload limit: don't display progress in tooltip when maxed out
2020-08-12 09:46:44 -05:00
evazion a70c4a72e6 Merge pull request #4570 from nonamethanks/fix_4543
Nijie: fix login
2020-08-12 09:46:09 -05:00
nonamethanks 7c03f0d6c9 Copy annotation tags when copying notes 2020-08-12 06:21:50 +02:00
nonamethanks bc8fc1839f Upload limit: don't display progress when maxed out 2020-08-11 04:24:16 +02:00
nonamethanks 9a7a1e20ca Add fanbox support 2020-08-09 00:21:57 +02:00
evazion 0e41fef011 users: mention needing a non-disposable email to verify account. 2020-08-08 15:23:49 -05:00
evazion 3210da1a23 flags: raise flag limits.
The old flag limits were:

* 1 flag per day for regular members.
* 10 flags per day for Gold users.
* Unlimited flags for approvers.

The new flag limits are:

* 10 flags in the modqueue at once for regular users.
* Unlimited flags for approvers.
* Unlimited flags for users with a high enough flag success rate. If you
  have at least 30 flags in the last 3 months, and you have at least a
  70% flag success rate, then you get unlimited flags.

10 flags at once means you can have up to 10 flagged posts in the
modqueue at the same time. Because flags stay in the modqueue for 3
days, this means you can flag on average 10 posts every 3 days, or just
over 3 posts per day.
2020-08-08 15:22:13 -05:00