Remove the soft requirement that the destination tag must have 50 posts
in order to request an alias. This often gets in the way when trying to
rename a tag to a new name that doesn't already exist.
Remove the edit, update, and approve endpoints for tag aliases and
implications. These have been useless since individual alias and
implication requests were removed. Aliases and implications could only
be edited or approved if they were in the pending state, which is no
longer possible.
Also remove unused new alias/implication request forms.
* Allow approvers to approve a post by tagging it with status:active.
* Allow approvers to ban a post by tagging it with status:banned.
* Allow approvers to unban a post by tagging it with -status:banned.
Refactor how model visibility works in index actions:
* Call `visible` in the controller instead of in model `search`
methods. This decouples model visibility from model searching.
* Explicitly pass CurrentUser when calling `visible`. This reduces
hidden dependencies on the current user inside models.
* Standardize on calling the method `visible`. In some places it was
called `permitted` instead.
* Add a `visible` base method to ApplicationModel.
Remove options for searching for "Artist requested removal" and
"duplicate" flag reasons. These were legacy flag reasons that haven't
been used for a long time.
Remove the creator_id field from artists, notes, and pools. The
creator_id wasn't otherwise used and was inconsistent with the
artist/note/pool history in some cases, especially for old artists.
* Don't show who disapproved the post to other users. Only show the
creator to mods or to the disapprover themselves.
* Let unprivileged users see the /post_disapprovals index.
Remove the post update count estimate from BUR show pages. This was
complex, slow, and usually inaccurate since it assumed that requests in
a BUR had no overlap with each other, which usually wasn't the case.
Refactor to use accepts_nested_attributes_for instead of the notes
attribute to facilitate editing wikis on the artist edit page.
This fixes the notes attribute unintentionally showing up in the API.
This also changes it so that renaming an artist entry doesn't
automatically rename the corresponding wiki page. This had bad behavior
when there was a conflict between wiki pages (the wikis would be
silently merged, which usually isn't what you want). It also didn't warn
about wiki links being broken by renames.
* Replace the .category-N CSS classes on tags with .tag-type-N. Before
we were inconsistent about whether tag colors were indicated with
.category-N or .tag-type-N. Now it's always .tag-type-N.
* Fix various places to not use Tag.category_for. Tag.category_for does
one Redis call per tag lookup, which leads to N Redis calls on many
pages. This was inefficient because usually we either already had the
tags from the database, or we could fetch them easily.
Remove various associated fields that were included by default on
certain endpoints. API users can use the only param to include the
full association if they need these fields.
* /artists.json: urls.
* /artist_urls.json: artist.
* /comments.json: creator_name and updater_name.
* /notes.json: creator_name.
* /pools.json: creator_name.
* /posts.json: uploader_name, children_ids, pixiv_ugoira_frame_data.
* /post_appeals.json: is_resolved.
* /post_versions.json: updater_name.
* /uploads.json: uploader_name.
- The only string works much the same as before with its comma separation
-- Nested includes are indicated with square brackets "[ ]"
-- The nested include is the value immediately preceding the square brackets
-- The only string is the comma separated string inside those brackets
- Default includes are split between format types when necessary
-- This prevents unnecessary includes from being added on page load
- Available includes are those items which are allowed to be accessible to the user
-- Some aren't because they are sensitive, such as the creator of a flag
-- Some aren't because the number of associated items is too large
- The amount of times the same model can be included to prevent recursions
-- One exception is the root model may include the same model once
--- e.g. the user model can include the inviter which is also the user model
-- Another exception is if the include is a has_many association
--- e.g. artist urls can include the artist, and then artist urls again
Remove the list of most-used source domains from artist summaries. This
took up a lot of space and usually wasn't very useful. It was also slow.
We had to calculate this on every artist tag search so we could display
it in the Artist tab, even though usually the user didn't open the tab.
- Added a changes column explicitly listing all of the changes
-- This makes it more in line with the other version views now
- Does a symmetric difference on the array fields to detect changes
- Changed to using the diff-body CSS class
-- Removed unnecessary elements from the CSS style file
- Does a symmetric difference on the array fields to detect differences
- Add more descriptors to the status/changes column
- Specifically add <br> to statuses to cause line breaks
- Changed to using the diff-body CSS class
-- Removed unneeded CSS style file
- Removed trailing whitespace after the >>> link
-- It was causing artifact line-throughs to appear after the link
- Changed the diff link to only render when a text field has changed
-- Because the post changes are already shown on the index view
- Specifically add <br> to statuses to cause line breaks
- All text fields are now shown in their non-rendered form
-- This allows changes to be highlighted with the diff builder
-- The different fields were labeled and separated for easier discernment
-- Fields are only shown if they have text in either the current or previous versions
- Various changes are also verbalized for easier discovery
- The date and the user columns were combined
-- This is more in line with other indexes, plus it saves on space
- The revert listing was changed to use a thumbnail instead of post ID links
-- This makes it more in line with the post versions index
- Body now uses the diff builder to highlight changes
-- A generalized diff-body class was added instead of something specific
- The status changes are now verbalized instead of being shown with styles
- The position and sizes are now split up
-- Changes directly reference the previous version
- The date and user columns were combined
-- This is more in line with other indexes, plus it saves space
Fix exception when trying to get the category_name for the html data
attributes. The wiki title is nil here and Tag.category_for couldn't
handle a nil tag name.
* Automatically generate a mod report when a comment, forum post, or
dmail is detected as spam.
* Automatically ban users that receive too many automatic spam reports
within a short window of time.
* Automatically mark spam dmails as deleted.
* Change ban threshold from 10 spam reports in 24 hours to 10 reports in 1 hour.
* Change ban length from 3 days to forever.
Fix a couple security issues related to dmail permalinks. Dmails have a
permalink that you can give to a Mod to let them read the dmail. This is
done with a key param that grants access when the dmail is opened by
another user. The key param had several problems:
* The key contained a full copy of the message's title and body encoded in
base64. This meant that anyone given a dmail permalink could read the
full dmail just by decoding the key in the link, without even having
to open the link.
* The key was derived from the dmail's title and body. If you knew or
could guess a dmail's title and body you could open the dmail. One
case when this was possible was when sending dmails. You could send
someone a dmail, take the permalink from your sent copy of the dmail,
then increment the dmail id to open the receiver's copy of the dmail.
Since the sent copy and the received copy both had the same title and
body, they both had the same dmail key. This let you check whether a
person had read your dmail, and what time they read it at.
* The key verification was done with an insecure string comparison
rather than a secure constant-time comparison. This was potentially
vulnerable to timing attacks.
* Opening a dmail belonging to another user would mark it as read for them.
The fix to all this is to use the dmail's id as the key instead of the
dmail's title and body. This means that old permalinks no longer work.
This is unavoidable given the issues above.
Other changes:
* The name of the 'Permalink' link is now 'Share'.
* Anyone with the 'Share' link can view the dmail, not just Mods.
