Commit Graph

11114 Commits

Author SHA1 Message Date
evazion
eb032d54c1 uploads: set upload_media_asset.status to active.
Fix the status being set to pending instead of active for new upload
media assets.
2022-02-14 00:40:40 -06:00
evazion
26da728a07 deviant art: fix new image URLs not being recognized.
Partial fix for #5008. DeviantArt now returns https://wixmp-ed30a86b8c4ca887773594c2.wixmp.com
URLs instead of https://images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com for images in the
API. Fix these URLs not being recognized by the DeviantArt strategy.
2022-02-14 00:33:50 -06:00
evazion
d7ac57f1e5 artists: sort URLs in edit form. 2022-02-14 00:33:50 -06:00
evazion
d6f7725a1e nijie: fix exception in login process.
Fix an exception when we can't find the 'url' field in the login form
because we're rate limited by Nijie and couldn't scrape the login page.
2022-02-12 17:26:25 -06:00
evazion
5bb64596cb uploads: include media assets in API response.
Include media assets in /uploads.json and /uploads/:id.json API responses, like this:

    {
      "id": 4983629,
      "source": "https://www.pixiv.net/en/artworks/96198438",
      "uploader_id": 52664,
      "status": "completed",
      "created_at": "2022-02-12T16:26:04.680-06:00",
      "updated_at": "2022-02-12T16:26:08.071-06:00",
      "referer_url": "",
      "error": null,
      "media_asset_count": 1,
      "upload_media_assets": [
        {
          "id": 9370,
          "created_at": "2022-02-12T16:26:08.068-06:00",
          "updated_at": "2022-02-12T16:26:08.068-06:00",
          "upload_id": 4983629,
          "media_asset_id": 5206552,
          "status": "pending",
          "source_url": "https://i.pximg.net/img-original/img/2022/02/13/01/20/19/96198438_p0.jpg",
          "error": null,
          "page_url": "https://www.pixiv.net/artworks/96198438",
          "media_asset": {
            "id": 5206552,
            "created_at": "2022-02-12T16:26:07.980-06:00",
            "updated_at": "2022-02-12T16:26:08.061-06:00",
            "md5": "90a85a5fae5f0e86bdb2501229af05b7",
            "file_ext": "jpg",
            "file_size": 1055775,
            "image_width": 1052,
            "image_height": 1545,
            "duration": null,
            "status": "active"
          }
        }
      ]
    }

This is needed so you can check for upload errors in the API, since in a multi-file
upload, each asset can have a separate error message. This is a stopgap solution until
something like /uploads.json?include=upload_media_assets.media_asset works.
2022-02-12 16:48:34 -06:00
evazion
04d242c60c uploads: save filename, image URL, page URL for uploads.
* Save the filename for files uploaded from disk. This could be used in
  the future to extract source data if the filename is from a known site.

* Save both the image URL and the page URL for files uploaded from
  source. This is needed for multi-file uploads. The image URL is the
  URL of the file actually downloaded from the source. This can be
  different from the URL given by the user, if the user tried to upload
  a sample URL and we automatically changed it to the original URL. The
  page URL is the URL of the page containing the image. We don't always
  know this, for example if someone uploads a Twitter image without the
  bookmarklet, then we can't find the page URL.

* Add a fix script to backfill URLs for existing uploads. For file
  uploads, the filename will be set to "unknown.jpg". For source
  uploads, we fetch the source data again to get the image and page
  URLs. This may fail for uploads that have been deleted from the
  source since uploading.
2022-02-12 15:22:41 -06:00
evazion
9a23970ab1 uploads: fix media_asset_count. 2022-02-12 15:22:24 -06:00
evazion
117d31e633 Fix undefined method readpartial' for \"\":String` error.
This exception was thrown by app/logical/pixiv_ajax_client.rb:406 when a
Pixiv API call failed with a network error. In this case we tried to log
the response body, but this failed because we returned a faked HTTP
response with an empty string for the body, which the http.rb library
didn't like because it was expecting an IO-like object for the body.
2022-02-12 15:22:24 -06:00
evazion
b5b5cc77bd artists: fix exception in /artists/show_or_new?name=does_not_exist
Fix exception in /artists/show_or_new?name=does_not_exist when the tag
doesn't exist.
2022-02-11 17:43:30 -06:00
evazion
d7649dbd70 Update Ruby gems and Yarn packages.
Upgrade Rails to 7.0.2.2 and Puma to 5.6.2 to fix this CVE:

* https://rubyonrails.org/2022/2/11/Rails-7-0-2-2-6-1-4-6-6-0-4-6-and-5-2-6-2-have-been-released
* https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9
* https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016

This fixes a bug in Puma <5.6.2 that caused ActiveSupport::CurrentAttributes
to not be reset between requests in certain cases, which could allow
state to be leaked between requests.
2022-02-11 17:30:40 -06:00
evazion
44c9c7f1ac uploads: removed unused /uploads/preprocess route. 2022-02-11 03:15:12 -06:00
evazion
44ca178d7a uploads: add upload_media_assets.page_url.
This is needed for multi-file uploads. We need to know both the image
url and the page url to set the post's source correctly when converting
an upload media asset into a post.
2022-02-11 02:51:20 -06:00
evazion
c2ed5c2841 uploads: make upload_media_assets.media_asset_id nullable.
Make upload_media_assets.media_asset_id nullable in order to support
multi-file uploads. The media asset will be null while the image is
still being downloaded from the source.
2022-02-11 02:49:52 -06:00
evazion
70d38d9e0b uploads: add columns needed for multi-file uploads.
* uploads.media_asset_count - the number of media assets attached to this upload.
* upload_media_assets.status - the status of each media asset attached to this upload (processing, active, failed)
* upload_media_assets.source_url - the source of each media asset attached to this upload
* upload_media_assets.error - the error message if uploading the media asset failed
2022-02-10 12:06:57 -06:00
evazion
76d2ee3220 Fix #5005: Export time attributes as HTML attributes
* `float` is used for MediaAsset durations.
* `interval` is used for Ban durations.
* `uuid` is used for GoodJob IDs.
* `datetime` is used for created_at/updated_at timestamps. The format is
  `2022-02-04 08:33:36 -0800`.
2022-02-10 11:07:05 -06:00
evazion
9117ce9225 Merge pull request #5003 from GiantFrog/master
Fix initial upload points bug
2022-02-09 23:43:11 -06:00
evazion
eadf985266 Merge pull request #5004 from NamelessContributor/patch-1
Tag script field: use full available width
2022-02-09 23:43:03 -06:00
evazion
58fc00e549 uploads: allow uploading iso5 .mp4 files.
This is an MP4 ftyp sometimes used by Twitter.
2022-02-09 16:48:11 -06:00
evazion
26d54c1e37 artists: show "Artist" tab in searches for artists without artist entry.
On the post index page, show the "Artist" tab instead of the "Wiki" tab when searching for
an artist tag that doesn't have an artist entry. This way the user is prompted to create a
new artist entry instead of a new wiki.
2022-02-09 01:16:05 -06:00
NamelessContributor
55dd4d24a9 Tag script field: use full available width
When unset the width is inconsistent across browsers. 
In Firefox I measured 203px while in Chrome it is only 162px.
2022-02-09 08:07:01 +01:00
evazion
d4b251a079 css: fix site name flickering black on page load.
Fix regression in 7bbe6e9d. Caused by CSS specificity conflict.
2022-02-09 01:04:11 -06:00
evazion
c207f34dbb artists: unify show and show_or_new templates. 2022-02-08 23:11:56 -06:00
evazion
7bbe6e9d22 artists: make artist pages less shit.
* Group URLs by site.
* List most important URLs first and dead URLs last.
* Add site icons next to URLs.
* Put other names and group name beneath the artist name, instead of beneath the wiki.
2022-02-08 22:20:01 -06:00
evazion
51ba56e8a3 Fix #5001: Media assets not searchable through upload records.
Fix this:

  https://danbooru.donmai.us/uploads.json?search[media_assets][md5]=b83daa7f1ae7e4127b1befd32f71ba10

failing with an ActiveRecord::StatementInvalid error.

The bug was that for a `has_many through: ...` association, like
`has_many :media_assets, through: :upload_media_assets`, we weren't
joining on the associated table properly so we ended up generating
invalid SQL.
2022-02-08 19:18:11 -06:00
evazion
a02d409068 Fix #4730: Trying to change email to already taken email returns "Email address normalized address has already been taken"
Fix the error message to return "Email address has already been taken".
2022-02-08 19:18:11 -06:00
evazion
21c0d55aa4 Fix #5002: "Urls url has already been taken" when submitting duplicate urls with different capitalization
Fix URLs being normalized after checking for duplicates rather than
before, which meant that URLs that differed in capitalization weren't
detected as duplicates.
2022-02-08 19:15:55 -06:00
evazion
67d834775d js: add symlinks for component .js files.
Followup to ef0d8151d. Add symlinks from app/components/**/*.js to
app/javascript/src/javascripts/*.js so you can still see a component's
Javascript inside the component.
2022-02-08 14:21:32 -06:00
evazion
ef0d8151d8 js: reorganize Javascript file structure.
Move Javascript files from app/components/**/*.js back to app/javascript/src/javascripts/*.js.
This way Javascript files are in one place, which simplifies import paths and makes it
easier to see all Javascript at once.
2022-02-08 14:15:35 -06:00
evazion
37ad6f5a71 Fix non-existent .js requests raising DoubleRenderError.
Fix requests for non-existent .js pages, for example https://danbooru.donmai.us/oaisfj.js,
raising AbstractController::DoubleRenderError when trying to render the 404 response.
2022-02-08 00:14:38 -06:00
evazion
5ba03ba359 replacements: fix submit button not working in Chrome.
Fix the submit button in the post replacement dialog doing nothing in Chrome.

When the submit button in a dialog box is clicked, we tried to fire a 'submit' event on
the form to submit it. Apparently this no longer works in Chrome. `requestSubmit` is the
modern way to programmatically submit a form, but it's not supported by Safari, or by
versions of Firefox or Chrome released before 2019-2020.

https://developer.mozilla.org/en-US/docs/Web/API/HTMLFormElement/requestSubmit
https://caniuse.com/mdn-api_htmlformelement_requestsubmit
2022-02-07 22:24:54 -06:00
evazion
345a222163 Fix #4999: Unexpected error: ActiveRecord::RecordNotUnique sometimes appears when uploading posts
Fix two issues that could lead to duplicate errors when creating posts:

* Fix the submit button on the upload form to disable itself on submit, to prevent
  accidental double submit errors.

* Fix a race condition when checking for MD5 duplicates. MD5 uniqueness is checked on both
  the Rails level, with a uniqueness validation, and on the database level, with a unique
  index on the md5 column. Creating a post could fail with an ActiveRecord::RecordNotUnique
  error if the uniqueness validation in Rails passed, but the uniqueness constraint in the
  database failed. In this case, we catch the RecordNotUnique error and convert it to a
  Rails validation error so we can treat it like a normal validation failure.
2022-02-07 21:02:30 -06:00
evazion
a5b92dc9e6 css: fix disabled buttons appearing clickable.
Fix buttons appearing to be clickable when in the disabled state.

Submit buttons are normally disabled after a form is submitted. Before
these buttons would still look clickable. Now disabled buttons are greyed
out instead of looking the same as normal buttons.
2022-02-07 21:02:30 -06:00
evazion
3f64808432 Merge pull request #5000 from NamelessContributor/patch-1
Show file extension next to file size in post preview
2022-02-07 16:21:17 -06:00
evazion
1a61e329ba uploads: add column for error messages.
Change it so uploads store errors in an `error` column instead of in the
`status` field.
2022-02-07 15:44:39 -06:00
evazion
19a9cf3d2f uploads: delete old upload records from before the rework.
Delete all old upload records from before the upload rework in abdab7a0a
/ f11c46b4f. Uploads from before the rework don't have any attached
media assets, so they're not valid under the new system because we can't
find which files they were for.

Before the rework, completed uploads were only saved for 1 hour, and
failed uploads were only saved for 3 days, so deleting this data
doesn't really lose anything that wouldn't have been deleted before.
2022-02-07 15:11:09 -06:00
NamelessContributor
49f71122fc Show file extension next to file size in post preview 2022-02-07 10:47:13 +01:00
evazion
572878fb0d uploads: allow uploading .m4v format videos.
Fix not being able to upload .m4v format videos as reported here:

* https://danbooru.donmai.us/forum_posts/205248
* https://github.com/danbooru/danbooru/issues/3615#issuecomment-1030950924

From https://en.wikipedia.org/wiki/M4V:

  The M4V file format is a video container format developed by Apple and
  is very similar to the MP4 format. The primary difference is that M4V
  files may optionally be protected by DRM copy protection.

This could be a problem if it allows uploading videos that are
unplayable because of DRM.
2022-02-06 21:41:35 -06:00
evazion
7bed81812d Don't show error messages that could contain private information.
Fix a potential exploit where private information could be leaked if
it was contained in the error message of an unexpected exception.

For example, NoMethodError contains a raw dump of the object in the
error message, which could leak private user data if you could force a
User object to raise a NoMethodError.

Fix the error page to only show known-safe error messages from expected
exceptions, not unknown error messages from unexpected exceptions.

API changes:

* JSON errors now have a `message` param. The message will be blank for unknown exceptions.
* XML errors have a new format. This is a breaking change. They now look like this:

    <result>
      <success type="boolean">false</success>
      <error>PaginationExtension::PaginationError</error>
      <message>You cannot go beyond page 5000.</message>
      <backtrace type="array">
        <backtrace>app/logical/pagination_extension.rb:54:in `paginate'</backtrace>
        <backtrace>app/models/application_record.rb:17:in `paginate'</backtrace>
        <backtrace>app/logical/post_query_builder.rb:529:in `paginated_posts'</backtrace>
        <backtrace>app/logical/post_sets/post.rb:95:in `posts'</backtrace>
        <backtrace>app/controllers/posts_controller.rb:22:in `index'</backtrace>
      </backtrace>
    </result>

  instead of like this:

    <result success="false">You cannot go beyond page 5000.</result>
2022-02-06 18:09:54 -06:00
evazion
8b5d687b7a rails: add more attributes to filtered params list.
Add more sensitive attributes to the filtered parameters list so that
they aren't shown in exception messages, and aren't logged in log files
or to NewRelic.

Only do this in production so that in testing and development, you can
still see these things when inspecting objects on the console.
2022-02-06 18:09:54 -06:00
evazion
b695c4ccb1 modreports: fix private user information leak in new modreport action.
Fix this:

    https://danbooru.donmai.us/moderation_reports/new.json?moderation_report[model_id]=52664&moderation_report[model_type]=User

raising an `undefined method `reportable?' for #<UserPolicy ...>`
exception, which contained the full user object in the error message,
which leaked private user information.
2022-02-06 14:39:08 -06:00
evazion
00d2b70670 uploads: fix back button behavior when not using bookmarklet.
Better fix for 8173c73aa. When not using the bookmarklet, make the back
button on the upload tagging page take you back to the new upload page.
When using the bookmarklet, make it take you back to the source.
2022-02-05 23:52:55 -06:00
evazion
d0f3e5526d tests: fix broken tests.
Fix regression in e7744cb6e.
2022-02-05 23:14:14 -06:00
evazion
9dd1afbedd posts: fix exception in expunge method.
Fix regression in 7c63ac8db. Posts no longer have an association with
uploads, so expunge failed when it tried to destroy the associated upload.
2022-02-05 22:47:53 -06:00
evazion
1032a60d4b Update Ruby gems and Yarn packages. 2022-02-05 22:29:50 -06:00
evazion
6ff5ae1ce8 Remove uses of string.mb_chars.downcase.
`string.mb_chars.downcase` was used to correctly downcase Unicode
characters when downcasing strings in Ruby <2.4. This hasn't been needed
since Ruby 2.4.
2022-02-05 22:12:09 -06:00
evazion
a3ef7bf573 Merge pull request #4996 from nonamethanks/fix-lofter-iqdb
Fix lofter not working with iqdb
2022-02-05 22:11:17 -06:00
nonamethanks
1c9014a5bb Fix lofter not working with iqdb 2022-02-05 09:43:17 +01:00
evazion
e7744cb6e3 uploads: generate thumbnails in parallel.
Make uploads faster by generating and saving thumbnails in parallel.

We generate each thumbnail in parallel, then send each thumbnail to the
backend image servers in parallel.

Most images have 5 variants: 'preview' (150x150), 180x180, 360x360,
720x720, and 'sample' (850px width). Plus the original file, that's 6
files we have to save. In production we have 2 image servers, so we have
to save each file twice, to 2 remote servers. Doing all this in parallel
should make uploads significantly faster.
2022-02-04 16:20:50 -06:00
evazion
fd25cd6868 Fix #4993: IQDB broken on upload page. 2022-02-04 11:12:16 -06:00
evazion
7c63ac8dbd uploads: drop unused columns. 2022-02-04 02:19:30 -06:00