Commit Graph

560 Commits

Author SHA1 Message Date
evazion
7f90bc4216 BURs: remove ability to skip secondary validations.
Remove the ability to skip secondary validations when creating a BUR.
The only skippable validation that still existed was the requirement
that both tags in an implication must have wiki pages. It's now
mandatory to write wiki pages for tags before you can request an
implication. This doesn't apply to empty tags.
2020-11-12 20:15:14 -06:00
evazion
cc64f8b7ee tests: fix broken source tests.
Fix various tests broken by source files changing or being deleted.
2020-11-10 14:52:54 -06:00
evazion
1ddcc661e1 BURs: clean up parsing and error handling.
* Don't raise exceptions when a BUR is invalid. Instead, use Rails
  validations to return errors. Fixes invalid BURs potentially raising
  exceptions in views. Also makes it so that each error in a BUR is
  reported, not just the first one.

* Revalidate the BUR whenever the script is edited, not just when the
  BUR is created. Ensures the BUR can't be broken by editing. Fixes a bug
  where forum threads could be broken by someone editing a BUR and
  breaking the syntax, thereby causing the BUR to raise an unparseable
  script error when the forum thread was viewed.

* Validate that removed aliases and implication actually exist.

* Validate that the tag actually exists when changing a tag's category.

* Combine bulk update request processor unit tests with main bulk update
  request unit tests.
2020-08-24 17:10:48 -05:00
evazion
1d2a8a7898 fanbox: don't raise error on age-restricted posts.
Prevent age-restricted fanbox posts from raising errors when source data
is fetched. This prevents error messages from being shown to users when
switching to the edit tab on a post.

This will cause uploads of age-restricted posts to fail with an
unrelated error because we either can't find the image url (if we were
given only the html page) or we can't download the image (because we're
not logged in to Fanbox).
2020-08-18 15:34:12 -05:00
evazion
70b82010a7 search: fix info leak when searching nested associations.
Fix an exploit in #4553. It was possible to use nested searches to infer
the contents of private forum posts.

For example:

* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=h*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=he*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=hel*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=hell*
* https://danbooru.donmai.us/users?search[forum_posts][id]=121683&search[forum_posts][body_matches]=hello*

The above searches returned the user 'albert', indicating that the
private forum post with id 121683 starts with the word 'hello'.

By guessing the id of a private forum post (which can be done by
searching for gaps in the id sequence), and by guessing text within the
post (which can be done by sequentially guessing characters with
wildcard searches), one could eventually infer the full text of a
private forum post.

The fix is to make nested searches only return records that are visible
to the current user.
2020-08-18 15:21:39 -05:00
evazion
4c3b4671ef ip addresses: fix exception on ip_addresses/show page. 2020-08-18 11:16:26 -05:00
evazion
e196514de8 tests: fix test failures in #4553. 2020-08-17 15:19:34 -05:00
evazion
5db11a0b5f Merge branch 'master' into attribute-searching 2020-08-17 14:23:00 -05:00
evazion
366eff4169 posts: show only last successful flag on deleted posts.
In the "This post was deleted" notice, show only the last successful
flag, instead of all previous flags (which may include rejected flags).
2020-08-16 17:19:29 -05:00
evazion
16cfdb8321 bans: don't allow users to be double banned. 2020-08-16 14:31:47 -05:00
evazion
c002166801 Fix #4584: Disable deleted post filter when searching for status:appealed. 2020-08-14 22:05:19 -05:00
evazion
78b9613498 Fix #4554: Searches with "-status:active" not showing deleted posts.
Also fixes #4542: Quoted search metatag status:"deleted" yields no results.
2020-08-12 20:53:14 -05:00
evazion
3a17b5a13e flags/appeals: replace is_resolved flag with statuses.
Replace references to the `is_resolved` field with the `status` field.
Post flags were marked as resolved when a post was approved (but not
when the post was deleted because it went unapproved). The status field
supercedes the resolved field.
2020-08-07 19:24:57 -05:00
evazion
2b0cd3c90b searchable: add support for searching enum fields.
Allow searching enum fields by string, by id, or by array of
comma-separated values. The category field in modactions is an example
of an enum field that can be searched this way.
2020-08-07 19:24:57 -05:00
evazion
0a0a85ee70 Fix #4568: Send appealed posts back to the mod queue
* Include appealed posts in the modqueue.

* Add `status` field to appeals. Appeals start out as `pending`, then
  become `rejected` if the post isn't approved within three days. If the
  post is approved, the appeal's status becomes `succeeded`.

* Add `status` field to flags. Flags start out as `pending` then become
  `rejected` if the post is approved within three days. If the post
  isn't approved, the flag's status becomes `succeeded`.

* Leave behind a "Unapproved in three days" dummy flag when an appeal
  goes unapproved, just like when a pending post is unapproved.

* Only allow deleted posts to be appealed. Don't allow flagged posts to be appealed.

* Add `status:appealed` metatag. `status:appealed` is separate from `status:pending`.

* Include appealed posts in `status:modqueue`. Search `status:modqueue order:modqueue`
  to view the modqueue as a normal search.

* Retroactively set old flags and appeals as succeeded or rejected. This
  may not be correct for posts that were appealed or flagged multiple
  times. This is difficult to set correctly because we don't have
  approval records for old posts, so we can't tell the actual outcome of
  old flags and appeals.

* Deprecate the `is_resolved` field on post flags. A resolved flag is a
  flag that isn't pending.

* Known bug: appealed posts have a black border instead of a blue
  border. Checking whether a post has been appealed would require either
  an extra query on the posts/index page, or an is_appealed flag on
  posts, neither of which are very desirable.

* Known bug: you can't use `status:appealed` in blacklists, for the same
  reason as above.
2020-08-06 20:55:45 -05:00
evazion
e31afd0827 tests: fix broken tests. 2020-08-05 12:41:48 -05:00
evazion
bca1f122d0 posts: rework post deletion to use dialog box.
Rework post deletion from using a separate page to using a dialog box,
like flagging.

* Add `DELETE /posts/:id` endpoint.
* Remove `POST /moderator/post/posts/:id/delete` endpoint.
2020-08-03 20:21:28 -05:00
evazion
baf0cf87af Fix #4571: Show banner when email verification is required.
* Show a banner if the user is restricted because they signed up from a
  proxy or VPN.

* Add an option to resend the confirmation email if your account has an
  unverified email address.
2020-08-02 16:48:45 -05:00
BrokenEagle
7291de42f4 Fix issue with test since Mod topics aren't visible to anonymous 2020-07-27 19:29:22 +00:00
BrokenEagle
396e9c6ef4 fixup-add-tests 2020-07-27 19:29:22 +00:00
BrokenEagle
a903bd95f9 Add tests for all models with includes searches 2020-07-27 19:29:22 +00:00
evazion
7f2eaeb02b Fix #4541: Possible to create new user while logged in. 2020-07-13 19:25:30 -05:00
evazion
88bbd1e3f0 users: add username tooltips. 2020-07-13 17:09:03 -05:00
evazion
42f0112c38 seo: increase sitemap coverage.
Rework sitemaps to provide more coverage of the site. We want every
important page on the site - including every post, tag, and wiki page -
to be indexed by Google. We do this by generating sitemaps and sitemap
indexes that contain links to every important page on the site.
2020-07-10 00:18:30 -05:00
evazion
40a114c99c posts: restrict banned paid rewards for non-approvers. 2020-07-06 13:52:57 -05:00
evazion
0c7d48d890 posts: autoban uploads tagged paid_reward. 2020-07-06 13:52:46 -05:00
evazion
b5fc8fff6e Add privacy policy (#4415). 2020-07-06 02:53:01 -05:00
evazion
f0a573e1e5 /comments.atom: fix restricted posts being leaked.
Fix thumbnail URLs of loli/shota/banned posts being leaked in
/comments.atom. Restricted posts are now entirely hidden in
/comments.atom.

Example: https://danbooru.donmai.us/comments.atom?search[post_id]=2.
2020-07-06 02:51:30 -05:00
evazion
9a03582513 Add OpenSearch suggestion support.
Add autocomplete support when searching Danbooru from the Chrome address
bar. If you type "danb<tab>" in the address bar then search for a tag,
then autocomplete results from Danbooru will appear as search
suggestions in Chrome.

Note that the "Autocomplete searches and URLs" Chrome setting must be
enabled for this to work.

Ref:

* http://dev.chromium.org/tab-to-search
* https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Supporting_search_suggestions_in_search_plugins
* https://github.com/dewitt/opensearch/blob/master/mediawiki/Specifications/OpenSearch/Extensions/Suggestions/1.1/Draft%201.wiki
2020-07-04 17:52:53 -05:00
evazion
aa1a21aece Add OpenSearch support (/opensearch.xml).
Add https://danbooru.donmai.us/opensearch.xml. This file tells browsers
how to perform searches on Danbooru.

In Chrome, this lets you type "danb<tab>" in the address bar to perform
a search on Danbooru.

In Firefox, you have to click the "..." icon next to the address bar,
then choose "Add Search Engine". After that, you can search Danbooru
from the address bar.

Ref:

* http://dev.chromium.org/tab-to-search
* https://developer.mozilla.org/en-US/docs/Web/OpenSearch
* https://github.com/dewitt/opensearch/blob/master/opensearch-1-1-draft-6.md
* https://en.wikipedia.org/wiki/OpenSearch
2020-07-04 17:52:49 -05:00
evazion
f97c62c71d search: fix search timeout error page not appearing.
Bug: when a search timed out we got the generic failbooru page instead
of the search timeout error page.

Cause: when rendering the <link rel="next"> / <link rel="prev"> tags in
the header, we may need to evaluate the search to determine the next or
previous page, but if the searches times out then this fails, which
caused Rails to throw a ActionView::Template::Error because an exception
was thrown while rendering the template.

Likewise, rendering the attributes for the <body> tag could fail with an
ActionView::Template::Error because the call to `current_item.present?`
forced evaluation of the search.
2020-07-03 13:08:49 -05:00
evazion
ad02b26f3d pagination: fix exception on empty pages in seq. pagination.
Fix exception when the page is empty during sequential pagination.
Caused because the paginator can't figure out the next or previous page
when the current page is empty.

* https://danbooru.donmai.us/posts?page=b0
* https://danbooru.donmai.us/posts?page=a10000000
2020-06-28 02:57:48 -05:00
evazion
580211ee64 seo: fix canonical tags on post index and show page.
* Fix incorrect canonical tags. Before we were using
  `<meta name="canonical" content="...">`. This is wrong, it should have been
  `<link rel="canonical" href="...">`.

* Add a default canonical tag on all pages. Fixes Google treating the
  same content on different subdomains (safebooru, shima, kagamihara, etc)
  as duplicate content. Also fixes Google sometimes treating similar but
  distinct content on the same domain as duplicate content.
2020-06-27 19:54:11 -05:00
evazion
ff096b8adc Fix #4508: Specific tag not showing a wiki.
Fix the wiki excerpt not appearing when searching for a tag that doesn't
exist in the tag list. This could happen if someone created a wiki for a
tag that has never been used on a post.
2020-06-27 02:01:34 -05:00
evazion
f06e322dc0 Fix #4507: Clicking "View wiki" on Artists with no wiki redirects to the posts page. 2020-06-27 01:20:05 -05:00
evazion
b09350c0dc tests: add more Tag.search tests.
Improve tag model test coverage.
2020-06-24 18:39:55 -05:00
evazion
85f58bf2f6 newgrounds: fix style nitpicks. 2020-06-24 00:25:45 -05:00
evazion
5f3c41416e tests: add more wiki page controller search tests. 2020-06-23 23:36:16 -05:00
evazion
83a8468ee9 tests: remove unnecessary rescueing of Net::OpenTimeout errors.
These exceptions are no longer thrown now that we've switched from
HTTParty to http.rb. Swallowing unexpected exceptions during testing was
a bad practice anyway.
2020-06-23 03:12:44 -05:00
evazion
be4bdfc136 artists: add test for hiding deleted wikis on artist pages (#4526). 2020-06-23 03:01:32 -05:00
evazion
d1e0542eb5 Merge pull request #4534 from BrokenEagle/fix-4533
Fix the tag matches option
2020-06-23 03:00:32 -05:00
evazion
0276792b35 BURs: add test for users voting on their own BURs (#4527) 2020-06-23 02:43:12 -05:00
evazion
73506bac33 twitter: add tests for uploading profile banners (#4520). 2020-06-23 02:37:21 -05:00
BrokenEagle
1a87935764 Fix the tag matches option
The split function was mistakenly used instead of the match function.
2020-06-23 06:58:03 +00:00
evazion
8c6759bbd7 nicoseiga: fix login endpoint.
* Update the login endpoint. The old endpoint returns 404 now.

  POST https://account.nicovideo.jp/api/v1/login ->
  POST https://account.nicovideo.jp/login/redirector?site=seiga

* Let Danbooru::Http cache the login request instead of caching it manually.

* Let Danbooru::Http automatically follow redirects instead of dealing
  with the Location header manually.
2020-06-22 18:46:47 -05:00
evazion
db3407caa3 uploads: fix uploading from source not working.
ref: 26ad844bbe (r40077579).
2020-06-22 15:32:48 -05:00
evazion
5c7843bd3d scripts: refactor mocked services.
Replace the mocked services in scripts/mocked_services with Rails-level
mocked services.

The scripts in scripts/mocked_services were a set of stub Sinatra
servers used to mock the Reportbooru, Recommender, and IQDBs services
during development. They return fake data so you can test pages that use
these services.

Implementing these services in Rails makes it easier to run them. It
also lets us drop a dependency on Sinatra and drop a use of HTTParty.

To use these services, set the following configuration in danbooru_local_config.rb
or .env.local:

* reportbooru_server: http://localhost:3000/mock/reportbooru
* recommender_server: http://localhost:3000/mock/recommender
* iqdbs_server: http://localhost:3000/mock/iqdb

where `http://localhost:300` is the url for your local Danbooru server
(may need to be changed depending on your configuration).
2020-06-21 15:11:56 -05:00
evazion
29a5f7dfc8 image proxy: replace HTTParty with Danbooru::Http. 2020-06-21 15:11:56 -05:00
evazion
a572a6614d popular/missed searches: fix blank views.
Fix missing call to `.each`.
2020-06-16 13:09:05 -05:00
evazion
ec5aa6c662 tests: fix saved search index action test.
This passed in development but failed in CI because SavedSearch.redis
used the live Redis server, which worked by accident as long as you had
a Redis server running.
2020-06-15 16:45:37 -05:00