Commit Graph
100 Commits
Author SHA1 Message Date
evazion d79f1aac96 Move stupidtable.js into application.js.
Fixes this javascript error:

    Uncaught TypeError: $(...).stupidtable is not a function

on these pages:

* http://safebooru.donmai.us/reports/user_promotions
* http://safebooru.donmai.us/reports/contributors
* http://safebooru.donmai.us/reports/janitor_trials

...due to stupidtable.js not loading.
2016-12-20 02:31:05 -06:00
evazion 780fe07976 Move ugoira_player.js into application.js.
Fixes an issue with the ugoira player not working on Safebooru due to
this error:

    Asset filtered out and will not be served: add
    `Rails.application.config.assets.precompile += %w( ugoira_player.js)`
    to `config/initializers/assets.rb` and restart your server
2016-12-20 02:26:13 -06:00
evazion 78ca92c981 Fix upload image resizer. (fixes #1375, #2471)
Polling the image height isn't reliable. Wait for the image to be fully
downloaded before resizing it instead.
2016-12-18 20:42:24 -06:00
evazion b7246d335f Prevent double uploading when mashing enter key in tag edit box. 2016-12-18 18:45:02 -06:00
evazion a92120e873 Fix #2785: Allow changing API key; require password to view or change key. 2016-12-18 06:30:48 -06:00
evazion 5d0e950cdb Prevent video_with_sound posts from autoplaying when blacklisted. 2016-12-17 18:33:03 -06:00
evazion 838d6f6eea Fix #2460: Uploading pixiv user's background image throws error.
Fix exception when uploading these types of URLs:

* http://img12.pixiv.net/profile/rapattu/119950.jpg
* http://i2.pixiv.net/img130/profile/minono_aki/8733472.jpg
* http://i2.pixiv.net/img20/img/a-park/novel/3607898.jpg
* http://i1.pixiv.net/novel-cover-original/img/2016/11/03/20/10/58/7436075_f75af69f3eacd1656d3733c72aa959cf.jpg
* http://i1.pixiv.net/background/img/2016/05/17/12/05/48/2074388_d4ac52034f7ca0af3e083d59fde7e97f.jpg

Skip rewriting sources that don't have illust IDs to avoid this
exception. Also fix `tags` so that it doesn't blow up when fetching
source data for these types of sources.
2016-12-04 02:04:44 -06:00
evazion e7bc3048ed Test downloading pixiv profile/background/novel images. 2016-12-04 02:04:44 -06:00
evazion 5302b804f1 Fix #2779: Erroneous pixiv_id parsed for novel/background/profile images 2016-12-04 02:04:44 -06:00
evazion 96a38f8d1b Test pixiv id parsing for novel/background/profile images. 2016-12-04 02:04:44 -06:00
evazion db9cb20faf Remove coinbase from Gemfile.lock. 2016-12-03 20:22:53 -06:00
evazion f8d5add0cc Silence git messages to stdout during app boot.
Caused this to be printed every time tests were run:

    git is /usr/bin/git
    /home/user/src/danbooru
2016-12-03 20:09:58 -06:00
evazion 01afc46f74 Fix failures in commenting tests.
Restricting users from upvoting their own comments broke some tests.
Switch these tests to downvoting instead.
2016-12-03 20:06:50 -06:00
evazion 1cce721114 Fix #2772: Topics set as mod+ can't be reverted to public ones. 2016-11-28 05:50:46 -06:00
evazion f9aeb875db Normalize yande.re sources from image URL -> html page URL. 2016-11-28 05:04:02 -06:00
evazion fa74c71b6d Prevent mods from editing/deleting feedbacks given to themselves. 2016-11-28 03:57:24 -06:00
evazion bba080a4c5 Test mod deletion of user feedbacks. 2016-11-28 03:57:23 -06:00
evazion 0697af6d23 Fix #2771: Approving deleted image doesn't create mod action. 2016-11-28 02:50:07 -06:00
evazion daf1324ab2 Refactor available_min_user_levels to view helper. 2016-11-28 01:36:59 -06:00
evazion 1d3ec05348 Fix nil exception on if help:upload_notice doesn't exist. 2016-11-21 01:40:37 -06:00
evazion 961fb94adf Pull flag notice from help:flag_notice wiki page (fix #2767). 2016-11-21 01:30:01 -06:00
evazion 5909e8501c Pull upload notice, bookmarklet notice from help:upload_notice wiki page. 2016-11-21 01:17:15 -06:00
evazion 12dd0f3a48 Pool/favgroup orders: include post id in hidden post placeholder.
This is so hidden posts are distinguishable from one another.
2016-11-20 06:21:51 +00:00
evazion f073e14574 Don't display hidden posts on pool/favgroups order pages (fix #2762). 2016-11-20 06:06:29 +00:00
evazion b2a6cf070c Use raw note body instead of sanitized body for note edit box. 2016-11-19 21:33:26 -06:00
evazion 3eafc5ae6a Don't clobber image board sources. 2016-11-19 02:29:33 -06:00
evazion 47f663e002 Don't filter dmails from moderators (fix #2757). 2016-11-12 01:11:40 -06:00
evazion b0a0a32173 API: support PUT /maintenance/user/dmail_filter.json. 2016-11-12 01:10:14 -06:00
evazion a16b91e2bf Fix exploit allowing dmail filters to be set on other users.
Exploit:

    curl \
      -u $USERNAME:$API_KEY \
      -X PUT "http://danbooru.donmai.us/maintenance/user/dmail_filter.json?dmail_id=1" \
      -d "dmail_filter[words]=owned&dmail_filter[user_id]=2"

...where dmail_id is any dmail you own (doesn't matter which) and user_id is the victim.
2016-11-12 01:10:14 -06:00
evazion 2dadad395b Add test for setting dmail filters on other people. 2016-11-12 01:10:14 -06:00
evazion 1047d7c96b Prevent users from upvoting their own comments. 2016-11-06 01:32:54 -06:00
evazion f02a31a447 Autotag character_(cosplay) -> character, cosplay.
Make e.g. hatsune_miku_(cosplay) automatically add hatsune_miku and cosplay.

Perform autotagging after aliasing so that *_(cosplay) aliases (e.g.
hestia_(dungeon)_(cosplay) -> hestia_(danmachi)_(cosplay)) can take
effect first.
2016-11-04 23:37:28 -05:00
evazion c2e026e55b Fix BURs posting approval message for every implication. 2016-11-02 16:12:53 -05:00
evazion f46d055218 Fix AmbiguousColumn exception in /forum_posts?search[creator_id]=1 2016-10-31 17:11:52 -05:00
evazion 6a9b68022a Test /forum_posts?search[creator_id]=1. 2016-10-31 17:11:52 -05:00
evazion 00da01ea3e Remove unused NotesController#pass_html_id.
Dead code as far as I can tell. According to `git log -p -G "X-Html-Id"`
was added in 2011 and never used. HTML id is passed to javascript in the
JSON response to `POST /notes.json` instead.
2016-10-31 01:37:49 +00:00
evazion 9c188ff0cb Fix notes appearing unsaved after saving them.
Bug: creating a note then saving it doesn't remove the red border
indicating it's unsaved.

Broken by 8df1496 / PR #2729.

Ref: http://danbooru.donmai.us/forum_topics/13348.
2016-10-31 01:25:09 +00:00
evazion 18d2d0b6b8 Fix private forum topic bumping for users below min level. 2016-10-30 18:00:26 -05:00
evazion 5d54ba5096 Fix listing private topics in /forum_posts.
Fix an exploit allowing viewing of private topics with

  http://danbooru.donmai.us/forum_posts
2016-10-30 18:00:26 -05:00
evazion 4e9f7391e6 Test private topics don't bump forum. 2016-10-30 18:00:26 -05:00
evazion 88a8c02f4c Test /forum_posts doesn't list private forum topics. 2016-10-30 18:00:26 -05:00
evazion 8672604ee7 Add upvote:/downvote: editing metatags. 2016-10-26 23:23:47 -05:00
evazion 8b5aac7808 Add locked:{notes,status,rating} editing metatags (fix #1716). 2016-10-26 23:23:09 -05:00
evazion 0dcd7e82be Test forum posts generated by tag alias approval. 2016-10-26 21:52:19 -05:00
evazion e67194c19d Set approver when creating banned_artist implication. 2016-10-26 21:52:19 -05:00
evazion 1e9bcf75de Test banning artist sets approver of banned_artist implication. 2016-10-26 21:52:19 -05:00
evazion 6dd8ec909d Set approver of aliases/implications in BURs.
Previously only the BUR's approver was set when a BUR was approved. Set
the approver for each alias/implication in the BUR as well.

Additionally:

* Refactor `approve!` to take a user instead of just a user id.
* Be mass-assignment permissions aware when setting approver_id.
2016-10-26 21:52:19 -05:00
evazion 1e8a68a56b Test that approving BUR sets approver of aliases/implications. 2016-10-26 21:52:18 -05:00
evazion abbf834256 Merge wiki conflict and tag alias approval forum posts (#2715).
* Attribute the "tag alias has conflicting wiki pages" message to the
  alias approver, not to the first admin.
* Merge the conflict message and alias approval message into one forum post.
* Fix an error with NewRelic gem not installed in test environment.
2016-10-26 21:52:15 -05:00
evazion fd4eb8fa08 Replace references to Danbooru with Danbooru.config.app_name.
* Also replace references to github with a configurable repo.
* Plus link commit ref in footer to the commit in the repo.
2016-10-24 19:07:19 -05:00
evazion 58ef469a76 Link current commit if running inside a git repo.
Useful when running `rails server` straight from a dev repo.
2016-10-24 19:07:08 -05:00
evazion 5e3393817f Link to howto:flag in flag notice. 2016-10-24 18:52:01 -05:00
evazion 13d4474818 Add self-uploading disclaimer to uploads page. 2016-10-24 18:52:01 -05:00
evazion f94dfbf17e Fix bookmarklet for whitecube URLs.
Make the bookmarklet work for URLs like this:

* http://www.pixiv.net/whitecube/user/607414/illust/59510800
* http://www.pixiv.net/whitecube/user/772090/illust/59595705
2016-10-22 16:11:44 -05:00
evazion c6294d5dfd Resolve aliases when removing negated tags (fix #2730). 2016-10-21 23:39:35 -05:00
evazion 52491f4486 Fix @artist.ban! test case.
Must use an admin in this test now because admin privileges are needed
to create the `banned_artist` tag implication.

(fixes regression in 7e3284c)
2016-10-21 19:59:02 -05:00
evazion 8b46726166 Fix tests for before_validation :normalize_tags.
`update_attribute` doesn't trigger `before_validation` callbacks, which
is where metatag processing happens. `update` or `update_attributes`
must be used instead.

AFAIK the test suite is the only place where `post.update_attribute(:tag_string => "stuff")`
is used, the actual code doesn't use it.
2016-10-21 19:59:02 -05:00
evazion 07921d2c88 Make rating:s obey rate locks; make source:blah update pixiv id.
Move normalize_tags (which processes metatags) from before_save to
before_validation. This is so that it runs as early as possible, before
strip_source / parse_pixiv_ids / updater_can_change_rating, so these
callbacks can handle source/rating changes from metatags.

Fixes a couple bugs:

* Ratings locks were ignored when using rating:s metatag (regression in 0006b76)
* Pixiv ids weren't updated when using source:blah metatag.

Note: this means that `post.update_attribute(:tag_string => "art:bkub)`
is now wrong. This is because update_attribute runs callbacks but not
validations, so it doesn't process metatags from the tag string.
`update` or `update_attributes` must be used instead.
2016-10-21 19:59:02 -05:00
evazion 899f008c1d Reorganize Post callbacks into calling order.
Reorder callbacks into the same order Rails runs them in:

* before_validation
* validate
* before_save
* before_create
* after_create
* after_save
* after_commit

This doesn't change the behavior of anything, it simply rearranges
callbacks so their running order is less confusing.
2016-10-21 19:59:01 -05:00
evazion 0b7cd71d42 Add some tests for tagging posts with metatags.
Exercise a few bugs:

* rating:safe should obey on rating locks.
* source:blah should update the pixiv id.
* source:"  foo bar baz  " should trim leading/trailing whitespace.

The other tests are for metatags that work but didn't have tests.
2016-10-21 19:59:01 -05:00
evazion 8df1496d28 Fix vuln allowing users to move notes between posts.
Prevents this from working:

    PUT /notes/1.json?note[post_id]=23
    PUT /notes/1.json?note[post_id]=42
2016-10-19 22:54:47 -05:00
evazion d2f3027294 Add test for moving notes between posts. 2016-10-19 22:54:39 -05:00
evazion 0006b76c4d Always obey rating locks; make rerating locked posts an error.
Currently rating locks are only obeyed when using the rating: metatag.
They aren't obeyed when:

* Changing the rating via the API.
* Changing the rating via 'Rate Safe' in the mode menu (uses the API).
* Reverting to previous versions.

Also, the current behavior is to ignore the rating: metatag if the post
is locked. This patch instead makes the update fail completely (note that
this could affect trying to mass revert posts that may be rating locked).

Note: the check for `!is_rating_locked_changed?` is so that

  PUT /posts/1.json?post[rating]=s&post[is_rating_locked]=true

works (ie., locking and changing the rating at the same time is okay).
2016-10-19 20:06:43 -05:00
evazion 88248e7ec7 Add tests for reverting rating-locked posts. 2016-10-19 20:06:43 -05:00
evazion c01e03b193 Validate post ratings.
Prevent ratings from being set to invalid values via the API:

    PUT /posts/1.json?post[rating]=Z
2016-10-19 20:06:43 -05:00
evazion d2a0b089f4 Add test for setting invalid ratings. 2016-10-19 20:06:43 -05:00
evazion 29f3aef6b6 Log all tag alias/implication changes.
Creates a mod action any time an alias or implication is changed. This
includes creations, edits to pending aliases/implications, deletions,
and approvals. Also it logs each status change from pending -> queued
-> processing -> approved.

Call are changed from `update_column` to `update` so that the
create_mod_action callback will run at every point in the lifecycle.
2016-10-18 05:23:27 -05:00
evazion 5743166e25 Add a test case for implication requests. 2016-10-18 05:22:44 -05:00
evazion 7c8557dbac Make more pages publicly accessible to logged out users.
* /artist_commentaries
* /note_versions
* /post_appeals
* /post_flags
* /posts/1/events
* /super_voters
2016-10-17 05:57:05 -05:00
evazion 7c6ba6a7c0 Add /delayed_jobs.json.
Leave out `handler` because it's sensitive.
2016-10-17 05:57:05 -05:00
evazion af7abc2b38 Add missing JSON/XML responses.
* GET    /bans.json
* GET    /bans/1.json
* GET    /ip_bans.json
* POST   /ip_bans.json
* DELETE /ip_bans.json
* GET    /mod_actions.json
* GET    /posts/1/events.json
* POST   /saved_searches.json
* DELETE /saved_searches/1.json
* GET    /super_voters.json
2016-10-17 05:57:05 -05:00
evazion bd6ebceda3 Refactor post_approvers_only to approver_only.
Don't duplicate code with post_approvers_only; use the approver_only?
method dynamically defined in `User::Roles.each do ... end`.
2016-10-14 05:04:40 +00:00
evazion d84184b5f1 Prevent anon/banned/member users from voting (fix #2719).
There was a regression in 6d6d00b; `before_filter :voter_only` was a
no-op in the post vote controller because it merely returned false,
which does not halt the request. The fix is to arrange for a voter_only
method to be defined that properly redirects to the access denied page.
2016-10-14 04:47:51 +00:00
evazion 5e75dcecea Add test cases for anon/banned/member voting. 2016-10-14 04:47:51 +00:00
evazion 7e3284c87f Fix mass assignment vuln to tag alias/implication status (2704). 2016-10-11 08:20:28 +00:00
evazion 789dede893 Tag aliases/implications: validate status and forum_topic_id.
* Validates that status is active/pending/deleted/etc. Not strictly
  necessary, the controller prevents users from setting the status, but
  it doesn't hurt.
* Validates that forum_topic_id is a valid topic if it's present.
* Validates that approver_id and creator_id are valid users (not
  strictly necessary either, users can't set these values).
2016-10-11 08:20:28 +00:00
evazion 101771adb8 Aliases/implications: Add tests for status and foreign keys. 2016-10-11 08:19:52 +00:00
evazion c46b31aa9c Prevent reverting to foreign versions (fixes #2711). 2016-10-11 06:57:46 +00:00
evazion 80895ef46e Add tests for reverting to foreign versions. 2016-10-11 06:57:05 +00:00
evazion 3838167dc0 Post#unvote!: Return correct score (fixes #2709).
vote.destroy sets the score in the database but not on the in-memory
post. So just reload the post from the db to get the updated score,
don't duplicate the logic of setting it again.
2016-10-08 09:07:41 +00:00
evazion cb1e1d3a94 Prevent commenting on nonexistent posts (#2704). 2016-10-06 09:39:57 +00:00
evazion 8c8f4a6a8f Fix mass assignment vuln in comment update action (#2704).
Prevents mass assignment of `post_id`, `do_not_bump_post`, and
`is_deleted`.
2016-10-06 09:39:57 +00:00
evazion ab5fd48280 Prevent mass assignment to Post#last_noted_at (#2704). 2016-10-06 09:39:57 +00:00
evazion 98f16b7105 Artist finder: Don't return bogus results for non-matching twitter artists. 2016-10-05 08:13:27 +00:00
evazion b6af41e0f8 Add test cases for twitter artist finder. 2016-10-05 08:13:27 +00:00
evazion e86a7ae957 Give approve/upload/supervoter permissions to first admin. 2016-10-05 02:15:04 +00:00
evazion c3b55e80c5 Make default user level and settings configurable.
Remove start_as_gold? and start_as_contributor? from default config
because they don't actually do anything. `git log -G start_as` indicates
they never have done anything.

Add a more general customize_new_user method for setting the starting
user level, permissions and defaults for any other settings.
2016-10-05 01:39:08 +00:00
evazion d38e83cd00 Refactor Post#parse_pixiv_id to use illust_id_from_url (fix #2695).
* Make illust_id_from_url a public class method instead of a protected
  instance method so that Post#parse_pixiv_id can use it.
* Also make illust_id_from_url swallow the exception that
  illust_id_from_url! throws so that parse_pixiv_id can use it.
2016-10-03 02:29:45 +00:00
evazion f4f85bd0d8 Add tests for setting pixiv_id on posts. 2016-10-03 02:29:41 +00:00
evazion 57bb51621e Add debugger gem.
Fix random VCR failures in Pixiv tests.

Sometimes tests randomly fail because the PHPSESSID they use in their
HTTP requests to Pixiv is different than the one that was originally
recorded by VCR. This causes VCR to complain that the requests don't
match.

This is caused by the PHPSESSID being globally cached in Memcache.
Depending on the order the tests run in (which is random), one set of
tests can use a PHPSESSID that was recorded for a /different/ set of
tests.

Improve Pixiv URL matching.

* Allow URLs that are missing the http:// part. These are sometimes seen
  in artist entries.
* Ignore URLs from random Pixiv domains such as dic.pixiv.net,
  blog.pixiv.net, etc. These are also sometimes in artist entries.

Improve normalize_for_artist_finder! URL matching.

* Normalize www.pixiv.net/stacc/username URLs.
* Correctly normalize URLs that are missing the illust ID part on the end
  (i.e. http://i2.pixiv.net/img04/img/syounen_no_uta/). These are common
  in artist entries.

Match URLs strictly when normalizing for artist entries.

Only normalize Pixiv URLs that strictly match a known format. Pass any
unrecognized URLs through without attempting to normalize them, just to
be safe.

Normalize URLs when saving artist entries.
2014-12-03 13:16:05 -08:00
evazion ffc7a7bb39 Save normalized source with post instead of original source.
Fixes #2294.
2014-10-28 22:57:00 -05:00
evazion 9f96965bb4 Add test case for rewriting ugoira URLs. 2014-10-28 22:57:00 -05:00
evazion 5bdb3e72ac Link to artist entries for taken artist names.
In artist entries, there is a Check link next to the name field that
lets you check whether the name is already taken. When the name /is/
taken, you often want to check the other artist entries to see if
you're creating a duplicate. This adds links to the other entries so you
can check them more easily.
2014-10-28 21:35:52 -05:00
evazion 19b62c5f4b Fix XSS in fetch source data javascript. 2014-10-28 20:58:58 -05:00
evazion 6a965db911 Add debugger gem. 2014-10-28 16:05:38 -05:00
evazion bcef22aefe Add source redirection support for ugoira URLs. 2014-10-27 19:01:07 -05:00
evazion 24dcf0090a Add a few more tests for Pixiv source redirection. 2014-10-27 19:00:57 -05:00
evazion 79395a8b2a Include ugoira data in post JSON API. 2014-10-26 13:15:59 -05:00
evazion cb57d3550d Include ugoira frames in post data attributes. 2014-10-26 13:15:54 -05:00
evazion 8844220c48 Ensure JSON API returns boolean for Post#has_large.
Currently the JSON API returns null for false and 0 for true for this
attribute. Cast it to a boolean instead.
2014-10-26 12:36:57 -05:00