When redirecting to the welcome, challenge and checkin articles,
breakman was complaining about a potential open redirect vulnerability
due to the fact that the redirect URL comes from a string stored in the
database.
This commit silences breakman by explicitly parsing the database article
path (via `URI.parse`) and explicitly stating that only the `path`
portion of the URI is to be used (== in an unlikely event of an absolute
URI pops up from the db record, the user-agent will still be instructed
to be redirected to a page under the app's domain).
* Update mobile version of /new registration view
* Optimize styles for desktop view
* Fix typo
* Fix typo
* Add twemojis in footer area
* Update messaging to fulfill all intents
* cache
* cache
* hr-label fix on mobile
* hr-label fix on mobile
* crayons for checkbox
* crayons for checkbox
* remove old styles
* move signin to appropriate folder
* Remove schema changes
* Fix registraction specs and hide password hint for no SSO enabled
* Disable email hint for password reset page
* Fix specs
* Revert "Disable email hint for password reset page"
This reverts commit b33a6dda4c13534541294281f83f7ad5a4864c0d.
* Transfer User.registered.estimated_count to the controller
* Fix import path
Co-authored-by: ludwiczakpawel <ludwiczakpawel@gmail.com>
Co-authored-by: rhymes <rhymes@hey.com>
* Allow initial user to sign up and configure app
* Fix added value unneeded
* Make siteconfig public in tests
* Remove deprecated method and adjust seed default
* Add new controllers not to redirect for public
* Modify tests
* Edit test defaults
* Fix linting
* Add starter mode to seed file
* Capitalizes Admin on Admin Profile button for better consistency
* Adds reactions and reports partials and adjusts filenames of _notes, _activity, and _credits
* Removes code related to reports to separate this PR and the reports PR
* Adds ability to toggle Recent Reactions and adds #get_related_reactions to controller
- Adds a #get_related_reactions method to the Admin::Users::Controller
- Moves the rendering of the reactions partial below the notes partial in edit
- Styles Recent Reactions in a list format with the ability to toggle
* Modifies #set_related_reactions name, query, and limit and the _reactions view with it
- Adjust #get_related_reactions to read #set_related_reactions
- Sort reactions by descending created_at
- Add a limit of 15 to reactions displayed for any given user
- Add .empty? in place of .nil? to _reactions.html.erb reaction check
* Adjusts the format of how Recent Reactions are displayed and adds Reaction category
* Adds a check for category: vomit in #set_related_reactions
* Renames partial, adds User reactions to #set_related_reactions, and adjusts partial styling
* Rewords message displayed when no negative reactions exist to make it fun
* Adds additional styling changes to recent reactions
* Modify registrations controller
* A bit of progress
* More work
* a bit pf progress on confirmation emails
* Get basic functionality in place
* Remove comments
* First basic test
* Add tests
* Fix code styles
* Remove sessions spec
* Remove sessions spec
* Remove extra markup
* Introduce ProfileFieldGroup model
* Make profile_fields_groups name column unique
* Fix some specs
* feat: allow the page to work again
* Add guard clause to data update script
* Remove unused file
* Fix specs
* Add foreign key
Co-authored-by: Ridhwana <ridhwana.khan16@gmail.com>
* Make confirmation text a required field
* Use strong params to check if confirmation param is present
* Require config confirmation text to match pattern
* Allow greater flexibility for footer mascot image
This change allows admins to set a footer mascot image of any dimension
and manage the forced dimensions in their site config options.
* Update site config copy based on PR feedback
* Replace HEROKU_SLUG_COMMIT with custom footprint (naive)
* Fully set RELEASE_FOOTPRINT with the expectation of setting it before launch
* Change tests
* Fix cache
* Moves badge_achievement-related code from /admin/bagdes to /admin/badge_achievements
- Adds an Admin::BadgeAchievements::Controller
- Moves #award and #award_badges to Admin::BadgeAchievements::Controller
- Removes #award and #award_badges from Admin::Badges::Controller
- Moves award.html.erb from /admin/badges to /admin/badge_achievements
- Removes badge_achievement routes from /admin/badges
- Adds a redirect for /admin/badges/badge_achievements to routes.rb
- Cleans up and refactors code in controllers, views, and routes
* Add more actions to Admin::BadgeAchievements::Controller and matching routes
- Adds an #index and #destory action to the BadgeAchievements::Controller
- Adds destroy to the badge_achievements routes
- Adjusts redirects for badge_achievements in routes.rb
- Removes dead code from the index view for Badges
- Refactors the existing code in the index view for BadgeAchievements
* Adds an /admin/badge_achievements_spec and cleans up the /admin/badges_spec
- Removes the badge_achievement-related tests from badges_spec.rb
- Adds an additional test around deleting badge_achievements
* Add pagination to badge_achievements index view
* Adds badge_achievements to Admin menu items and add comment to routes.rb
-Add badge_achievements to the Admin nav bar
-Add a comment regarding redirects for badge_achievements
* Resolve JS console stacktrace notices and change wording on deletion buttons
* Add a Back to Badge Achievements button to the badge award form
* Adjust styling to fix failing /admin/badges_spec.rb
* Uses SQL paging to optimize scalibility and adds search functionality to index.html.erb
- Use SQL paging in Admin::BadgeAchievements::Controller in #index and #award
- Add a search by user ID to Badge Achievements index view
- Add a limit of 15 badges to be shown on the Badge Achievement index view
- Add a User ID column to the Badge Achievement index view
* Add Award Badge button back to Badge Achievement index.html.erb
* Change @badge to be more explicit and reword warning around badge deletion
* Adds award badge button back, rewords success message, and adjusts SQL paging
* feat: add a select and a new text field
* feat: groups need to be unique and present
* feat: make the ui a little better
* chore: update the label
* chore: just present
* feat: add some js ( still a work in progress)
* feat: update the interface to work better :)
* chore: indent
* feat: make sure the toggles work
* chore: rename more aptly
* refactor: toggling pulled out into two functions
* refactor: move group form to a partial so that we can reuse it
* chore: move the js to the group form
* chore: update alignment and nav element
* chore: update text
* chore: update specs
* Rename method
* Add ProfileFields::Add service
* Add ProfileFields::Remove service
* Use remove_method instead of undef_method
* All hail undef_method
* Move community_copyright_start_year to SiteConfig
* Properly translate year to string
* Change year logic
* Add env default to copyright year
* Fix logic
* Fix codeclimage issue
* Add view element
* Add constants in properly and use dynamic date
* flare tag line height
* .
* dropdown fix + actions bar fix
* actions bar on mob
* fixing typography and improving font handling
* cleanup
* variables naming
* fonts swapping
* Makes user's default font render as SiteConfig.default_font
* Trigger checks
* Fixes missing user model specs
* Fixes storybook CI error import & logged out user font set with default
* Limits default_font config to serif, sans-serif & open-dyslexic
* Default font description text
Co-authored-by: Fernando Valverde <fdov88@gmail.com>
* added created_at to comments in api response
* added test to ensure a date is returned for comment
* fix offenses in test
* updated docs to include addition of created_at to comment api response
* Add gem omniauth-apple
* Integrate omniauth-apple
* Integrate callback
* Add fields
* Add tests, fix bugs and make it all work
* Show only enabled providers for the current user
* Add default profile image for Apple
* Remove localhost patch
* Bring over the changed Apple username if the user changes it
* More specs fixed
* Incorporate feedback from PR
* Fix specs
* Simplify code and fix spec
* Fix Broadcast generators to take into account the new provider
* Fix spec
* Generate a truly unique apple_username
* Fix user specs
* Add omniauth-apple-0.0.2 to vendor cache
* Fix merge conflict and spec
* Update VCR fastly sloan cassette
* Revert "Generate a truly unique apple_username"
This reverts commit 2462875575b0bbd6b3c1d56b25afcd3189671608.
* Fix user specs
* Fix specs
* Fix specs
* Hide Connect Apple button behind a feature flag
* Revert "Hide Connect Apple button behind a feature flag"
This reverts commit 105bde0373389a4eb9b6e948f60734c7e0e99cba.
* Fix line lengths
* Fix spec
* ES tag
* CSRF bypass for Apple callback
* custom user_nickname in Apple provider with small tweaks + omniauth-apple bump
* Fixes username specs
* Makes Apple users default image Users::ProfileImageGenerator
* Fallback to mascot_image_url in test environment to avoid breaking Travis
* Fixes Apple CSRF error + makes default nickname more readable
* Trigger Travis
* Removes CSRF Apple fix from Omniauth callbacks
* Removes Envfile
Co-authored-by: rhymes <rhymesete@gmail.com>
Co-authored-by: rhymes <rhymes@hey.com>
* Replace in Cache-Control header to support Nginx caching
* Add 'X-Accel-Expires' header for Nginx caching
* Remove max-age directive from remaining specs
* Update caching header specs to test against x-accel-expires header
* Add CRUD actions for badge management to Internal::Badges::Controller
* Update sytling of badges index view in index.html.erb
-Uses a table to display all badges
-Links to the badge edit page from the badge title
-Displays a badges slug, title, and badge_image
-Adds an Award Badge button to the index view
* Adds an edit view, edit.html.erb, for badges
-Gives the ability to edit a badge title and/or slug
-Adds an Update Badge button to the left of the view
-Adds a Back to All Badges button to the right of the view
-Displays the badge image in the edit form
* Adjusts the path names in #award_badges in Internal::Badges::Controller
* Adds CRUD actions to the Internal::Badges::Controller and needed routes
* Add a description field to the edit.html.erb for badge management
* Add #award to Internal::Badges::Controller with matching view and routes
-Adds an #award method that sets @badge for #award_badges
-Adds an award.html.erb view for awarding badges
-Adds an award path for awarding badges
-Removes unnecessary code from controller, routes, and views
* Adds image upload functionality to the edit view for badges
* Ensure that usernames are downcased when awarding badges
-Chains downcase to usernames in #award_badges in
Internal::Badges::Controller
* Move badge-related views from old Internal folder to the correct Admin folder
Change routes and paths from /internal to /admin
* Refactor badge_params in Admin::Badges::Controller
* Add additional tests around awarding and updating badges in /admin/badge_achievements
* Add a create view to /admin/badges
-Adds new and create actions to Admin::Badges::Controller
-Adds a create view for creating badges at new.html.erb
-Adds a Create Badge button to the index view
-Moves the Award Badges button to the bottom of the index view
* Add a test around creating badges and clean up existing specs in badges_spec.rb
Adjust path in admin_awards_badges_spec.rb to be correct path
* Adjust routes from /badges/award_badges to /badges/badge_achievements/award_badges
Update paths in admin/badge-related specs
* Adjust paths in badges_spec.rb to be admin_badge_achievements_award_badges_path
* Adjust button styling for Award Badge
* Adjust paths back to /admin/badges in badges_spec.rb
* Add clarification around usernames when awarding badges
* Mark test in black_box_spec.rb as pending due to Travis failure
* Change wording used around usernames and @ symbols in award.html.erb
* Enable new Lint/ cops and run rubocop -a
* Fixing last remaining things with rubocop -a
* Enable and fix Style/ExplicitBlockArgument and Style/GlobalStdStream
* Forgot parenthesis
