Make e.g. hatsune_miku_(cosplay) automatically add hatsune_miku and cosplay.
Perform autotagging after aliasing so that *_(cosplay) aliases (e.g.
hestia_(dungeon)_(cosplay) -> hestia_(danmachi)_(cosplay)) can take
effect first.
Dead code as far as I can tell. According to `git log -p -G "X-Html-Id"`
was added in 2011 and never used. HTML id is passed to javascript in the
JSON response to `POST /notes.json` instead.
Previously only the BUR's approver was set when a BUR was approved. Set
the approver for each alias/implication in the BUR as well.
Additionally:
* Refactor `approve!` to take a user instead of just a user id.
* Be mass-assignment permissions aware when setting approver_id.
* Attribute the "tag alias has conflicting wiki pages" message to the
alias approver, not to the first admin.
* Merge the conflict message and alias approval message into one forum post.
* Fix an error with NewRelic gem not installed in test environment.
`update_attribute` doesn't trigger `before_validation` callbacks, which
is where metatag processing happens. `update` or `update_attributes`
must be used instead.
AFAIK the test suite is the only place where `post.update_attribute(:tag_string => "stuff")`
is used, the actual code doesn't use it.
Move normalize_tags (which processes metatags) from before_save to
before_validation. This is so that it runs as early as possible, before
strip_source / parse_pixiv_ids / updater_can_change_rating, so these
callbacks can handle source/rating changes from metatags.
Fixes a couple bugs:
* Ratings locks were ignored when using rating:s metatag (regression in 0006b76)
* Pixiv ids weren't updated when using source:blah metatag.
Note: this means that `post.update_attribute(:tag_string => "art:bkub)`
is now wrong. This is because update_attribute runs callbacks but not
validations, so it doesn't process metatags from the tag string.
`update` or `update_attributes` must be used instead.
Reorder callbacks into the same order Rails runs them in:
* before_validation
* validate
* before_save
* before_create
* after_create
* after_save
* after_commit
This doesn't change the behavior of anything, it simply rearranges
callbacks so their running order is less confusing.
Exercise a few bugs:
* rating:safe should obey on rating locks.
* source:blah should update the pixiv id.
* source:" foo bar baz " should trim leading/trailing whitespace.
The other tests are for metatags that work but didn't have tests.
Currently rating locks are only obeyed when using the rating: metatag.
They aren't obeyed when:
* Changing the rating via the API.
* Changing the rating via 'Rate Safe' in the mode menu (uses the API).
* Reverting to previous versions.
Also, the current behavior is to ignore the rating: metatag if the post
is locked. This patch instead makes the update fail completely (note that
this could affect trying to mass revert posts that may be rating locked).
Note: the check for `!is_rating_locked_changed?` is so that
PUT /posts/1.json?post[rating]=s&post[is_rating_locked]=true
works (ie., locking and changing the rating at the same time is okay).
Creates a mod action any time an alias or implication is changed. This
includes creations, edits to pending aliases/implications, deletions,
and approvals. Also it logs each status change from pending -> queued
-> processing -> approved.
Call are changed from `update_column` to `update` so that the
create_mod_action callback will run at every point in the lifecycle.
* GET /bans.json
* GET /bans/1.json
* GET /ip_bans.json
* POST /ip_bans.json
* DELETE /ip_bans.json
* GET /mod_actions.json
* GET /posts/1/events.json
* POST /saved_searches.json
* DELETE /saved_searches/1.json
* GET /super_voters.json
There was a regression in 6d6d00b; `before_filter :voter_only` was a
no-op in the post vote controller because it merely returned false,
which does not halt the request. The fix is to arrange for a voter_only
method to be defined that properly redirects to the access denied page.
* Validates that status is active/pending/deleted/etc. Not strictly
necessary, the controller prevents users from setting the status, but
it doesn't hurt.
* Validates that forum_topic_id is a valid topic if it's present.
* Validates that approver_id and creator_id are valid users (not
strictly necessary either, users can't set these values).
vote.destroy sets the score in the database but not on the in-memory
post. So just reload the post from the db to get the updated score,
don't duplicate the logic of setting it again.
Remove start_as_gold? and start_as_contributor? from default config
because they don't actually do anything. `git log -G start_as` indicates
they never have done anything.
Add a more general customize_new_user method for setting the starting
user level, permissions and defaults for any other settings.
* Make illust_id_from_url a public class method instead of a protected
instance method so that Post#parse_pixiv_id can use it.
* Also make illust_id_from_url swallow the exception that
illust_id_from_url! throws so that parse_pixiv_id can use it.
Fix random VCR failures in Pixiv tests.
Sometimes tests randomly fail because the PHPSESSID they use in their
HTTP requests to Pixiv is different than the one that was originally
recorded by VCR. This causes VCR to complain that the requests don't
match.
This is caused by the PHPSESSID being globally cached in Memcache.
Depending on the order the tests run in (which is random), one set of
tests can use a PHPSESSID that was recorded for a /different/ set of
tests.
Improve Pixiv URL matching.
* Allow URLs that are missing the http:// part. These are sometimes seen
in artist entries.
* Ignore URLs from random Pixiv domains such as dic.pixiv.net,
blog.pixiv.net, etc. These are also sometimes in artist entries.
Improve normalize_for_artist_finder! URL matching.
* Normalize www.pixiv.net/stacc/username URLs.
* Correctly normalize URLs that are missing the illust ID part on the end
(i.e. http://i2.pixiv.net/img04/img/syounen_no_uta/). These are common
in artist entries.
Match URLs strictly when normalizing for artist entries.
Only normalize Pixiv URLs that strictly match a known format. Pass any
unrecognized URLs through without attempting to normalize them, just to
be safe.
Normalize URLs when saving artist entries.
In artist entries, there is a Check link next to the name field that
lets you check whether the name is already taken. When the name /is/
taken, you often want to check the other artist entries to see if
you're creating a duplicate. This adds links to the other entries so you
can check them more easily.
* Prevent non-ugoira posts from getting dummy frame data records with
all the columns set to null.
* Make `data` and `content_type` columns NOT NULL, since they should
always be present.
* Remove the timestamps while we're at it, since they don't seem
necessary for anything.
* Change the id of the canvas tag to 'image'. This is what the notes JS
expects. It's also what the shift+e edit shortcut depends on.
* Add data-original-width/height attributes, which are what the notes JS
needs to position notes properly.
* Add all the other data attributes that regular images have, because
why not.
This refactors things such that
* Fetching the ugoira frame data happens at the end of rewrite, not
rewrite_html_pages. This way uploading zip URLs should work.
* The source data is cached in an instance variable in case it
was indeed fetched during rewrite_html_pages. This way it doesn't get
fetched a second time.
1) Put `<script>alert("xss 1")</script>` in the Other Names field in an
artist entry.
2) Put `<script>alert("xss 2")</script>` in the URLs field.
3) Trick someone into the viewing the history page for that artist.
evazion
