Commit Graph

4923 Commits

Author SHA1 Message Date
evazion
58ef469a76 Link current commit if running inside a git repo.
Useful when running `rails server` straight from a dev repo.
2016-10-24 19:07:08 -05:00
Albert Yi
0757f201a0 Merge pull request #2735 from evazion/fix-whitecube-bookmarklet
Fix upload bookmarklet for Pixiv whitecube URLs.
2016-10-24 12:21:36 -07:00
Albert Yi
f158e10c37 Merge pull request #2734 from evazion/fix-negated-aliases
Resolve aliases when removing negated tags (fix #2730)
2016-10-24 12:21:21 -07:00
Albert Yi
95c3f5342a Merge pull request #2733 from evazion/fix-tag-normalization
Fix metatag editing so that rating:s obeys rate locks, source:blah updates pixiv id
2016-10-24 12:18:41 -07:00
Albert Yi
e8336afd81 fixes #2718: Twitter artist finding should not be case sensitive 2016-10-24 12:18:44 -07:00
evazion
f94dfbf17e Fix bookmarklet for whitecube URLs.
Make the bookmarklet work for URLs like this:

* http://www.pixiv.net/whitecube/user/607414/illust/59510800
* http://www.pixiv.net/whitecube/user/772090/illust/59595705
2016-10-22 16:11:44 -05:00
evazion
c6294d5dfd Resolve aliases when removing negated tags (fix #2730). 2016-10-21 23:39:35 -05:00
evazion
52491f4486 Fix @artist.ban! test case.
Must use an admin in this test now because admin privileges are needed
to create the `banned_artist` tag implication.

(fixes regression in 7e3284c)
2016-10-21 19:59:02 -05:00
evazion
8b46726166 Fix tests for before_validation :normalize_tags.
`update_attribute` doesn't trigger `before_validation` callbacks, which
is where metatag processing happens. `update` or `update_attributes`
must be used instead.

AFAIK the test suite is the only place where `post.update_attribute(:tag_string => "stuff")`
is used, the actual code doesn't use it.
2016-10-21 19:59:02 -05:00
evazion
07921d2c88 Make rating:s obey rate locks; make source:blah update pixiv id.
Move normalize_tags (which processes metatags) from before_save to
before_validation. This is so that it runs as early as possible, before
strip_source / parse_pixiv_ids / updater_can_change_rating, so these
callbacks can handle source/rating changes from metatags.

Fixes a couple bugs:

* Ratings locks were ignored when using rating:s metatag (regression in 0006b76)
* Pixiv ids weren't updated when using source:blah metatag.

Note: this means that `post.update_attribute(:tag_string => "art:bkub)`
is now wrong. This is because update_attribute runs callbacks but not
validations, so it doesn't process metatags from the tag string.
`update` or `update_attributes` must be used instead.
2016-10-21 19:59:02 -05:00
evazion
899f008c1d Reorganize Post callbacks into calling order.
Reorder callbacks into the same order Rails runs them in:

* before_validation
* validate
* before_save
* before_create
* after_create
* after_save
* after_commit

This doesn't change the behavior of anything, it simply rearranges
callbacks so their running order is less confusing.
2016-10-21 19:59:01 -05:00
evazion
0b7cd71d42 Add some tests for tagging posts with metatags.
Exercise a few bugs:

* rating:safe should obey on rating locks.
* source:blah should update the pixiv id.
* source:"  foo bar baz  " should trim leading/trailing whitespace.

The other tests are for metatags that work but didn't have tests.
2016-10-21 19:59:01 -05:00
Albert Yi
080eecb6b9 Merge pull request #2729 from evazion/fix-notes-mass-assignment
Fix vuln allowing users to move notes between posts.
2016-10-20 16:22:43 -07:00
Albert Yi
8d2b1cf2b5 Merge pull request #2727 from evazion/fix-post-ratings
Validate post ratings and fix ratings locks
2016-10-20 10:32:40 -07:00
evazion
8df1496d28 Fix vuln allowing users to move notes between posts.
Prevents this from working:

    PUT /notes/1.json?note[post_id]=23
    PUT /notes/1.json?note[post_id]=42
2016-10-19 22:54:47 -05:00
evazion
d2f3027294 Add test for moving notes between posts. 2016-10-19 22:54:39 -05:00
evazion
0006b76c4d Always obey rating locks; make rerating locked posts an error.
Currently rating locks are only obeyed when using the rating: metatag.
They aren't obeyed when:

* Changing the rating via the API.
* Changing the rating via 'Rate Safe' in the mode menu (uses the API).
* Reverting to previous versions.

Also, the current behavior is to ignore the rating: metatag if the post
is locked. This patch instead makes the update fail completely (note that
this could affect trying to mass revert posts that may be rating locked).

Note: the check for `!is_rating_locked_changed?` is so that

  PUT /posts/1.json?post[rating]=s&post[is_rating_locked]=true

works (ie., locking and changing the rating at the same time is okay).
2016-10-19 20:06:43 -05:00
evazion
88248e7ec7 Add tests for reverting rating-locked posts. 2016-10-19 20:06:43 -05:00
evazion
c01e03b193 Validate post ratings.
Prevent ratings from being set to invalid values via the API:

    PUT /posts/1.json?post[rating]=Z
2016-10-19 20:06:43 -05:00
evazion
d2a0b089f4 Add test for setting invalid ratings. 2016-10-19 20:06:43 -05:00
Albert Yi
4c1949f1c8 add PATCH 2016-10-19 14:41:59 -07:00
Albert Yi
25028f0c7f increase api limit for platinum 2016-10-19 13:00:36 -07:00
Albert Yi
af55e6cf8a fix api limit display 2016-10-19 10:39:01 -07:00
Albert Yi
fb1cf5edbc Merge pull request #2726 from evazion/feat-log-tag-aliases+implications
Log tag aliases+implications
2016-10-19 10:07:08 -07:00
Albert Yi
4b8d014b2f fixes #2718: Twitter artist finding should not be case sensitive 2016-10-18 16:51:59 -07:00
Albert Yi
7cad4a3f68 normalized artist urls are always downcased 2016-10-18 16:32:35 -07:00
Albert Yi
e78b7d2a8c fixes #2716: Wiki pages should be undeletable 2016-10-18 15:45:50 -07:00
Albert Yi
2a5343b8cf add more intelligent js for artist forms 2016-10-18 14:56:40 -07:00
Albert Yi
2424f24fcd return 429 for too many requests instead of 421 2016-10-18 13:33:04 -07:00
Albert Yi
b17cd5bffc fix for sessionless api limits 2016-10-18 13:04:50 -07:00
evazion
29f3aef6b6 Log all tag alias/implication changes.
Creates a mod action any time an alias or implication is changed. This
includes creations, edits to pending aliases/implications, deletions,
and approvals. Also it logs each status change from pending -> queued
-> processing -> approved.

Call are changed from `update_column` to `update` so that the
create_mod_action callback will run at every point in the lifecycle.
2016-10-18 05:23:27 -05:00
evazion
5743166e25 Add a test case for implication requests. 2016-10-18 05:22:44 -05:00
r888888888
afa0dcae20 potential fix for alias/implication status bug 2016-10-18 00:25:55 -07:00
Albert Yi
87447a51c3 work on #2693 Separate API Limits by Writes/Reads 2016-10-17 16:37:11 -07:00
Albert Yi
ced7a34afa additional fixes for install script 2016-10-17 16:15:12 -07:00
Albert Yi
86af580445 increase random post mod queue length to 12 2016-10-17 15:53:51 -07:00
Albert Yi
c36d58f5f5 Merge pull request #2722 from evazion/fix-2721
Fix missing JSON/XML templates, make more pages public (#2721)
2016-10-17 14:47:01 -07:00
evazion
7c8557dbac Make more pages publicly accessible to logged out users.
* /artist_commentaries
* /note_versions
* /post_appeals
* /post_flags
* /posts/1/events
* /super_voters
2016-10-17 05:57:05 -05:00
evazion
7c6ba6a7c0 Add /delayed_jobs.json.
Leave out `handler` because it's sensitive.
2016-10-17 05:57:05 -05:00
evazion
af7abc2b38 Add missing JSON/XML responses.
* GET    /bans.json
* GET    /bans/1.json
* GET    /ip_bans.json
* POST   /ip_bans.json
* DELETE /ip_bans.json
* GET    /mod_actions.json
* GET    /posts/1/events.json
* POST   /saved_searches.json
* DELETE /saved_searches/1.json
* GET    /super_voters.json
2016-10-17 05:57:05 -05:00
Albert Yi
1d8341e1ac Merge pull request #2720 from evazion/fix-member-voting
Prevent anon/banned/member users from voting (fix #2719)
2016-10-13 22:13:08 -07:00
evazion
bd6ebceda3 Refactor post_approvers_only to approver_only.
Don't duplicate code with post_approvers_only; use the approver_only?
method dynamically defined in `User::Roles.each do ... end`.
2016-10-14 05:04:40 +00:00
evazion
d84184b5f1 Prevent anon/banned/member users from voting (fix #2719).
There was a regression in 6d6d00b; `before_filter :voter_only` was a
no-op in the post vote controller because it merely returned false,
which does not halt the request. The fix is to arrange for a voter_only
method to be defined that properly redirects to the access denied page.
2016-10-14 04:47:51 +00:00
evazion
5e75dcecea Add test cases for anon/banned/member voting. 2016-10-14 04:47:51 +00:00
Albert Yi
903eff5c24 update rails gem 2016-10-12 17:06:50 -07:00
Albert Yi
8d8511dc08 update rbenv ruby version 2016-10-12 16:46:29 -07:00
Albert Yi
11f911fd32 remove gctools dependency 2016-10-12 16:45:14 -07:00
Albert Yi
eaa0426c36 Merge pull request #2714 from evazion/fix-2704
Fix mass assignment vuln to tag alias/implication status (partial fix for #2704).
2016-10-11 17:48:26 -07:00
Albert Yi
3479ad89c6 readd postgresql-contrib package; add conditional check for postgresql version before compiling test_parser extension #2707 2016-10-11 17:46:37 -07:00
Albert Yi
2aae95623d Merge pull request #2713 from evazion/fix-2711
Prevent reverting to foreign versions (fixes #2711).
2016-10-11 17:28:44 -07:00