Commit Graph
100 Commits
Author SHA1 Message Date
evazion ef3f390bba Fix #2813: /posts/random.json does not redirect nicely. 2017-01-01 04:04:46 -06:00
evazion c292587edb Add missing :platinum role to user/tag/dmail_filter attr_accessible lists. 2016-12-29 16:19:36 -06:00
evazion 6645847857 Simplify User#role. 2016-12-29 15:56:48 -06:00
evazion d2e9ff363b Fix bug preventing Platinum users from commenting.
Bug:

Platinum users get this error when commenting:

    No route matches {:action=>"show", :controller=>"posts", :id=>nil}
    missing required keys: [:id]

Fix:

The issue was that `CurrentUser.role` was nil for Platinum users, which
caused `Comment.create(create_params, :as => CurrentUser.role)` to
silently ignore the create_params because the nil role wasn't in the
attr_accessible whitelist.

Despite this, things worked accidentally for other models because they
had `attr_accessible ..., :as => [:default]` in their whitelists where
the comment model didn't.
2016-12-29 15:45:23 -06:00
evazion 8d714820a4 Fix undefined method is_deleted?' for nil` on /post_appeals.
Fix this exception:

    undefined method `is_deleted?' for nil:NilClass
    app/models/post_appeal.rb:72:in `resolved?'
    app/views/post_appeals/index.html.erb:23:in `block in _app_views_post_appeals_index_html_erb__2678117644687662585_70170674603580'
    app/views/post_appeals/index.html.erb:17:in `_app_views_post_appeals_index_html_erb__2678117644687662585_70170674603580'
    app/controllers/post_appeals_controller.rb:13:in `index'

that occurs on these pages:

    http://danbooru.donmai.us/post_appeals?limit=1&page=a2928
    http://danbooru.donmai.us/post_appeals?limit=1&page=a2929
    http://danbooru.donmai.us/post_appeals?limit=1&page=a2930
    http://danbooru.donmai.us/post_appeals?limit=1&page=a2931
    http://danbooru.donmai.us/post_appeals?limit=1&page=a2934
    http://danbooru.donmai.us/post_appeals?limit=1&page=a2936
    http://danbooru.donmai.us/post_appeals?limit=1&page=a2937
    http://danbooru.donmai.us/post_appeals?limit=1&page=a2945
    http://danbooru.donmai.us/post_appeals?limit=1&page=a2949
2016-12-27 21:33:44 -06:00
evazion 68744bc24a Add controls for copying commentary from source or another post. 2016-12-27 06:01:23 +00:00
evazion be379cc4a2 Return artist commentary in /sources.json?url=<url>. 2016-12-27 06:01:23 +00:00
evazion cc215f6a41 Add more artist commentary API endpoints.
* GET /posts/1/artist_commentary.json
* GET /artist_commentaries/1.json
2016-12-27 06:01:22 +00:00
evazion 254efd9ca2 Rearrange /artist_commentaries/search form. 2016-12-27 06:01:22 +00:00
evazion 7734e53169 Add "Help" link in /artist_commentaries subnav. 2016-12-27 06:01:22 +00:00
evazion 0af7e84c78 Fix subnav quick search bar on /artist_commentaries. 2016-12-27 06:01:21 +00:00
evazion 0e73f3c8a9 Add tests for stickying comments. 2016-12-26 23:52:46 -06:00
evazion 82e93b3c12 Allow downvoting admin comments. 2016-12-26 23:52:45 -06:00
evazion 91e368f08a Highlight stickied comments; don't dim downvoted stickies.
The highlight color uses the same color as the subnav bar background
color. Make it a tad brighter so it's more visible.
2016-12-26 23:52:45 -06:00
evazion 1257639109 Add 'post as moderator' option for comments.
* Add 'post as moderator' option to comment form. This creates a so-called sticky comment.
* Downvotes have no effect on stickied comments; they're always visible, regardless of comment thresholds.
* Only mods may sticky comments.
* Mods may sticky comments by other users.
2016-12-26 23:52:45 -06:00
evazion 390524c7f5 Remove obsolete IE8 opacity hacks; remove unused transparency mixin. 2016-12-26 23:52:27 -06:00
evazion 1b05d5068a Simplify Comment.for_creator_name. 2016-12-26 23:52:27 -06:00
evazion 9347f27059 /comments.json: add id param; allow id and post_id to take lists of ids. 2016-12-26 23:52:27 -06:00
evazion 69c50290a8 Include updater_name in /comments/1.json. 2016-12-26 23:52:27 -06:00
evazion c165b38a91 Prevent anon users from attempting to undelete/unvote comments.
The :undelete and :unvote actions weren't covered.
2016-12-26 23:52:27 -06:00
evazion 7c838f8525 Delete unused /comments/index_all route and unused _threshold.html.erb template. 2016-12-26 23:52:27 -06:00
evazion 85011c9192 Fix "'archive_development' database is not configured." exception. 2016-12-26 23:52:27 -06:00
evazion df22bae2be Fix "'archive_development' database is not configured." exception. 2016-12-26 15:09:43 -06:00
evazion f0591f3f5b Fix #2792: pull appeal text from wiki page. 2016-12-22 21:53:10 -06:00
evazion 00ddd2f5d4 Fix #2795: "check_availability" bug with saved searches. 2016-12-22 21:44:35 -06:00
evazion d79f1aac96 Move stupidtable.js into application.js.
Fixes this javascript error:

    Uncaught TypeError: $(...).stupidtable is not a function

on these pages:

* http://safebooru.donmai.us/reports/user_promotions
* http://safebooru.donmai.us/reports/contributors
* http://safebooru.donmai.us/reports/janitor_trials

...due to stupidtable.js not loading.
2016-12-20 02:31:05 -06:00
evazion 780fe07976 Move ugoira_player.js into application.js.
Fixes an issue with the ugoira player not working on Safebooru due to
this error:

    Asset filtered out and will not be served: add
    `Rails.application.config.assets.precompile += %w( ugoira_player.js)`
    to `config/initializers/assets.rb` and restart your server
2016-12-20 02:26:13 -06:00
evazion 78ca92c981 Fix upload image resizer. (fixes #1375, #2471)
Polling the image height isn't reliable. Wait for the image to be fully
downloaded before resizing it instead.
2016-12-18 20:42:24 -06:00
evazion b7246d335f Prevent double uploading when mashing enter key in tag edit box. 2016-12-18 18:45:02 -06:00
evazion a92120e873 Fix #2785: Allow changing API key; require password to view or change key. 2016-12-18 06:30:48 -06:00
evazion 5d0e950cdb Prevent video_with_sound posts from autoplaying when blacklisted. 2016-12-17 18:33:03 -06:00
evazion 838d6f6eea Fix #2460: Uploading pixiv user's background image throws error.
Fix exception when uploading these types of URLs:

* http://img12.pixiv.net/profile/rapattu/119950.jpg
* http://i2.pixiv.net/img130/profile/minono_aki/8733472.jpg
* http://i2.pixiv.net/img20/img/a-park/novel/3607898.jpg
* http://i1.pixiv.net/novel-cover-original/img/2016/11/03/20/10/58/7436075_f75af69f3eacd1656d3733c72aa959cf.jpg
* http://i1.pixiv.net/background/img/2016/05/17/12/05/48/2074388_d4ac52034f7ca0af3e083d59fde7e97f.jpg

Skip rewriting sources that don't have illust IDs to avoid this
exception. Also fix `tags` so that it doesn't blow up when fetching
source data for these types of sources.
2016-12-04 02:04:44 -06:00
evazion e7bc3048ed Test downloading pixiv profile/background/novel images. 2016-12-04 02:04:44 -06:00
evazion 5302b804f1 Fix #2779: Erroneous pixiv_id parsed for novel/background/profile images 2016-12-04 02:04:44 -06:00
evazion 96a38f8d1b Test pixiv id parsing for novel/background/profile images. 2016-12-04 02:04:44 -06:00
evazion db9cb20faf Remove coinbase from Gemfile.lock. 2016-12-03 20:22:53 -06:00
evazion f8d5add0cc Silence git messages to stdout during app boot.
Caused this to be printed every time tests were run:

    git is /usr/bin/git
    /home/user/src/danbooru
2016-12-03 20:09:58 -06:00
evazion 01afc46f74 Fix failures in commenting tests.
Restricting users from upvoting their own comments broke some tests.
Switch these tests to downvoting instead.
2016-12-03 20:06:50 -06:00
evazion 1cce721114 Fix #2772: Topics set as mod+ can't be reverted to public ones. 2016-11-28 05:50:46 -06:00
evazion f9aeb875db Normalize yande.re sources from image URL -> html page URL. 2016-11-28 05:04:02 -06:00
evazion fa74c71b6d Prevent mods from editing/deleting feedbacks given to themselves. 2016-11-28 03:57:24 -06:00
evazion bba080a4c5 Test mod deletion of user feedbacks. 2016-11-28 03:57:23 -06:00
evazion 0697af6d23 Fix #2771: Approving deleted image doesn't create mod action. 2016-11-28 02:50:07 -06:00
evazion daf1324ab2 Refactor available_min_user_levels to view helper. 2016-11-28 01:36:59 -06:00
evazion 1d3ec05348 Fix nil exception on if help:upload_notice doesn't exist. 2016-11-21 01:40:37 -06:00
evazion 961fb94adf Pull flag notice from help:flag_notice wiki page (fix #2767). 2016-11-21 01:30:01 -06:00
evazion 5909e8501c Pull upload notice, bookmarklet notice from help:upload_notice wiki page. 2016-11-21 01:17:15 -06:00
evazion 12dd0f3a48 Pool/favgroup orders: include post id in hidden post placeholder.
This is so hidden posts are distinguishable from one another.
2016-11-20 06:21:51 +00:00
evazion f073e14574 Don't display hidden posts on pool/favgroups order pages (fix #2762). 2016-11-20 06:06:29 +00:00
evazion b2a6cf070c Use raw note body instead of sanitized body for note edit box. 2016-11-19 21:33:26 -06:00
evazion 3eafc5ae6a Don't clobber image board sources. 2016-11-19 02:29:33 -06:00
evazion 47f663e002 Don't filter dmails from moderators (fix #2757). 2016-11-12 01:11:40 -06:00
evazion b0a0a32173 API: support PUT /maintenance/user/dmail_filter.json. 2016-11-12 01:10:14 -06:00
evazion a16b91e2bf Fix exploit allowing dmail filters to be set on other users.
Exploit:

    curl \
      -u $USERNAME:$API_KEY \
      -X PUT "http://danbooru.donmai.us/maintenance/user/dmail_filter.json?dmail_id=1" \
      -d "dmail_filter[words]=owned&dmail_filter[user_id]=2"

...where dmail_id is any dmail you own (doesn't matter which) and user_id is the victim.
2016-11-12 01:10:14 -06:00
evazion 2dadad395b Add test for setting dmail filters on other people. 2016-11-12 01:10:14 -06:00
evazion 1047d7c96b Prevent users from upvoting their own comments. 2016-11-06 01:32:54 -06:00
evazion f02a31a447 Autotag character_(cosplay) -> character, cosplay.
Make e.g. hatsune_miku_(cosplay) automatically add hatsune_miku and cosplay.

Perform autotagging after aliasing so that *_(cosplay) aliases (e.g.
hestia_(dungeon)_(cosplay) -> hestia_(danmachi)_(cosplay)) can take
effect first.
2016-11-04 23:37:28 -05:00
evazion c2e026e55b Fix BURs posting approval message for every implication. 2016-11-02 16:12:53 -05:00
evazion f46d055218 Fix AmbiguousColumn exception in /forum_posts?search[creator_id]=1 2016-10-31 17:11:52 -05:00
evazion 6a9b68022a Test /forum_posts?search[creator_id]=1. 2016-10-31 17:11:52 -05:00
evazion 00da01ea3e Remove unused NotesController#pass_html_id.
Dead code as far as I can tell. According to `git log -p -G "X-Html-Id"`
was added in 2011 and never used. HTML id is passed to javascript in the
JSON response to `POST /notes.json` instead.
2016-10-31 01:37:49 +00:00
evazion 9c188ff0cb Fix notes appearing unsaved after saving them.
Bug: creating a note then saving it doesn't remove the red border
indicating it's unsaved.

Broken by 8df1496 / PR #2729.

Ref: http://danbooru.donmai.us/forum_topics/13348.
2016-10-31 01:25:09 +00:00
evazion 18d2d0b6b8 Fix private forum topic bumping for users below min level. 2016-10-30 18:00:26 -05:00
evazion 5d54ba5096 Fix listing private topics in /forum_posts.
Fix an exploit allowing viewing of private topics with

  http://danbooru.donmai.us/forum_posts
2016-10-30 18:00:26 -05:00
evazion 4e9f7391e6 Test private topics don't bump forum. 2016-10-30 18:00:26 -05:00
evazion 88a8c02f4c Test /forum_posts doesn't list private forum topics. 2016-10-30 18:00:26 -05:00
evazion 8672604ee7 Add upvote:/downvote: editing metatags. 2016-10-26 23:23:47 -05:00
evazion 8b5aac7808 Add locked:{notes,status,rating} editing metatags (fix #1716). 2016-10-26 23:23:09 -05:00
evazion 0dcd7e82be Test forum posts generated by tag alias approval. 2016-10-26 21:52:19 -05:00
evazion e67194c19d Set approver when creating banned_artist implication. 2016-10-26 21:52:19 -05:00
evazion 1e9bcf75de Test banning artist sets approver of banned_artist implication. 2016-10-26 21:52:19 -05:00
evazion 6dd8ec909d Set approver of aliases/implications in BURs.
Previously only the BUR's approver was set when a BUR was approved. Set
the approver for each alias/implication in the BUR as well.

Additionally:

* Refactor `approve!` to take a user instead of just a user id.
* Be mass-assignment permissions aware when setting approver_id.
2016-10-26 21:52:19 -05:00
evazion 1e8a68a56b Test that approving BUR sets approver of aliases/implications. 2016-10-26 21:52:18 -05:00
evazion abbf834256 Merge wiki conflict and tag alias approval forum posts (#2715).
* Attribute the "tag alias has conflicting wiki pages" message to the
  alias approver, not to the first admin.
* Merge the conflict message and alias approval message into one forum post.
* Fix an error with NewRelic gem not installed in test environment.
2016-10-26 21:52:15 -05:00
evazion fd4eb8fa08 Replace references to Danbooru with Danbooru.config.app_name.
* Also replace references to github with a configurable repo.
* Plus link commit ref in footer to the commit in the repo.
2016-10-24 19:07:19 -05:00
evazion 58ef469a76 Link current commit if running inside a git repo.
Useful when running `rails server` straight from a dev repo.
2016-10-24 19:07:08 -05:00
evazion 5e3393817f Link to howto:flag in flag notice. 2016-10-24 18:52:01 -05:00
evazion 13d4474818 Add self-uploading disclaimer to uploads page. 2016-10-24 18:52:01 -05:00
evazion f94dfbf17e Fix bookmarklet for whitecube URLs.
Make the bookmarklet work for URLs like this:

* http://www.pixiv.net/whitecube/user/607414/illust/59510800
* http://www.pixiv.net/whitecube/user/772090/illust/59595705
2016-10-22 16:11:44 -05:00
evazion c6294d5dfd Resolve aliases when removing negated tags (fix #2730). 2016-10-21 23:39:35 -05:00
evazion 52491f4486 Fix @artist.ban! test case.
Must use an admin in this test now because admin privileges are needed
to create the `banned_artist` tag implication.

(fixes regression in 7e3284c)
2016-10-21 19:59:02 -05:00
evazion 8b46726166 Fix tests for before_validation :normalize_tags.
`update_attribute` doesn't trigger `before_validation` callbacks, which
is where metatag processing happens. `update` or `update_attributes`
must be used instead.

AFAIK the test suite is the only place where `post.update_attribute(:tag_string => "stuff")`
is used, the actual code doesn't use it.
2016-10-21 19:59:02 -05:00
evazion 07921d2c88 Make rating:s obey rate locks; make source:blah update pixiv id.
Move normalize_tags (which processes metatags) from before_save to
before_validation. This is so that it runs as early as possible, before
strip_source / parse_pixiv_ids / updater_can_change_rating, so these
callbacks can handle source/rating changes from metatags.

Fixes a couple bugs:

* Ratings locks were ignored when using rating:s metatag (regression in 0006b76)
* Pixiv ids weren't updated when using source:blah metatag.

Note: this means that `post.update_attribute(:tag_string => "art:bkub)`
is now wrong. This is because update_attribute runs callbacks but not
validations, so it doesn't process metatags from the tag string.
`update` or `update_attributes` must be used instead.
2016-10-21 19:59:02 -05:00
evazion 899f008c1d Reorganize Post callbacks into calling order.
Reorder callbacks into the same order Rails runs them in:

* before_validation
* validate
* before_save
* before_create
* after_create
* after_save
* after_commit

This doesn't change the behavior of anything, it simply rearranges
callbacks so their running order is less confusing.
2016-10-21 19:59:01 -05:00
evazion 0b7cd71d42 Add some tests for tagging posts with metatags.
Exercise a few bugs:

* rating:safe should obey on rating locks.
* source:blah should update the pixiv id.
* source:"  foo bar baz  " should trim leading/trailing whitespace.

The other tests are for metatags that work but didn't have tests.
2016-10-21 19:59:01 -05:00
evazion 8df1496d28 Fix vuln allowing users to move notes between posts.
Prevents this from working:

    PUT /notes/1.json?note[post_id]=23
    PUT /notes/1.json?note[post_id]=42
2016-10-19 22:54:47 -05:00
evazion d2f3027294 Add test for moving notes between posts. 2016-10-19 22:54:39 -05:00
evazion 0006b76c4d Always obey rating locks; make rerating locked posts an error.
Currently rating locks are only obeyed when using the rating: metatag.
They aren't obeyed when:

* Changing the rating via the API.
* Changing the rating via 'Rate Safe' in the mode menu (uses the API).
* Reverting to previous versions.

Also, the current behavior is to ignore the rating: metatag if the post
is locked. This patch instead makes the update fail completely (note that
this could affect trying to mass revert posts that may be rating locked).

Note: the check for `!is_rating_locked_changed?` is so that

  PUT /posts/1.json?post[rating]=s&post[is_rating_locked]=true

works (ie., locking and changing the rating at the same time is okay).
2016-10-19 20:06:43 -05:00
evazion 88248e7ec7 Add tests for reverting rating-locked posts. 2016-10-19 20:06:43 -05:00
evazion c01e03b193 Validate post ratings.
Prevent ratings from being set to invalid values via the API:

    PUT /posts/1.json?post[rating]=Z
2016-10-19 20:06:43 -05:00
evazion d2a0b089f4 Add test for setting invalid ratings. 2016-10-19 20:06:43 -05:00
evazion 29f3aef6b6 Log all tag alias/implication changes.
Creates a mod action any time an alias or implication is changed. This
includes creations, edits to pending aliases/implications, deletions,
and approvals. Also it logs each status change from pending -> queued
-> processing -> approved.

Call are changed from `update_column` to `update` so that the
create_mod_action callback will run at every point in the lifecycle.
2016-10-18 05:23:27 -05:00
evazion 5743166e25 Add a test case for implication requests. 2016-10-18 05:22:44 -05:00
evazion 7c8557dbac Make more pages publicly accessible to logged out users.
* /artist_commentaries
* /note_versions
* /post_appeals
* /post_flags
* /posts/1/events
* /super_voters
2016-10-17 05:57:05 -05:00
evazion 7c6ba6a7c0 Add /delayed_jobs.json.
Leave out `handler` because it's sensitive.
2016-10-17 05:57:05 -05:00
evazion af7abc2b38 Add missing JSON/XML responses.
* GET    /bans.json
* GET    /bans/1.json
* GET    /ip_bans.json
* POST   /ip_bans.json
* DELETE /ip_bans.json
* GET    /mod_actions.json
* GET    /posts/1/events.json
* POST   /saved_searches.json
* DELETE /saved_searches/1.json
* GET    /super_voters.json
2016-10-17 05:57:05 -05:00
evazion bd6ebceda3 Refactor post_approvers_only to approver_only.
Don't duplicate code with post_approvers_only; use the approver_only?
method dynamically defined in `User::Roles.each do ... end`.
2016-10-14 05:04:40 +00:00
evazion d84184b5f1 Prevent anon/banned/member users from voting (fix #2719).
There was a regression in 6d6d00b; `before_filter :voter_only` was a
no-op in the post vote controller because it merely returned false,
which does not halt the request. The fix is to arrange for a voter_only
method to be defined that properly redirects to the access denied page.
2016-10-14 04:47:51 +00:00
evazion 5e75dcecea Add test cases for anon/banned/member voting. 2016-10-14 04:47:51 +00:00
evazion 7e3284c87f Fix mass assignment vuln to tag alias/implication status (2704). 2016-10-11 08:20:28 +00:00