Add <link rel="prev"> and <link rel="next"> elements to most pages with
pagination. This should work on all index pages, but it won't work for
things like pool or forum topic show pages.
Also remove the <link rel="top"> element (wasn't useful, was just a link
back to the root url).
* Convert notices from helpers to partials.
* Eliminate PostSets::PostRelationship class in favor of post_sets/posts template.
* Eliminate COUNT(*) queries when calculating the number of child posts.
* Eliminate redundant parent load and parent exists queries.
Re-enable post view counts, post search counts, and missed search
counts. These were disabled in 89adf88d5 because of a bug caused by the
upgrade to rack-2.0.8 in a58dd83ad.
The bug was that rack-2.0.8 changed `session.id` to return a value of a
new wrapper type that doesn't respond to `to_s`. Previously it just
returned a string. Now we have to call `session[:session_id]` or
`session.id.public_id` to get a plain string. This was an undocumented
breaking change in rack-2.0.8 to fix CVE-2019-16782.
* Fix inconsistencies in how wiki pages were linked.
* Link directly to the wiki instead of to a title search that is expected
to redirect to the wiki.
* Don't truncate long sources in the sidebar on the post show page. Word
wrap them instead.
* Word wrap long external links in general (mainly links in dtext).
* Turn sources into links on modqueue page.
Tells browsers not to send the Referer header when following external
links. Among other things, this bypasses Pixiv's anti-hotlinking
protection when opening direct image sources from Pixiv.
* On the posts show page, make the "»" link next to the source visible
to all users, not just builders.
* Make "»" link to the raw unnormalized source, instead of a `source:` search.
* Remove the special case for displaying old pixiv sources as `pixiv/moniker`.
This vulnerability allows someone to create a source link that appears
to lead to Pixiv like normal, but that actually executes Javascript code
when clicked.
1) Set the source of a post to javascript:"http://img1.pixiv.net/img/xss/";alert("xss");
2) Wait for someone to click the source link in the Information sidebar.
3) Profit.
The cause is that the regexes for detecting Pixiv URLs aren't anchored
to the front of the string using \A. This allows non-http:// links to be
created.
Use the "\A" metacharacter for the beginning of a string, instead of "^"
for the beginning of any line within that string, and check for "://" as
well. Fixes#1947.
Additionally:
* Rename methods and variables related to the parent/child previews for
consistency.
* Split off siblings into a separate post set.
* Increase limit of children/siblings displayed to max of 200.
