* WIP: release footprint in the admin UI
* feat: show the commit ID and the date
* chore: change env optional to empty string
* fix: change the FOREM_BUILD_DATE to RELEASE_FOOTPRINT
* feat: add Not Available as a last option
* test: last deployed time and latest commit id
* feat: update the way we change the env variable!
* fix: we need to set the RELEASE FOOTPRINT so that this clause is not hit - `return path if release_footprint.blank?`
* feat: add a Forem Instance Model
* chore: rename variable
* feat: use the new model that we created
* feat: Update the Forem Instance model to remove Not available from the model method and add it to the view layer
* test: Forem Instance model to return the correct values when present
* feat: use Forem.deployed_at instead of the Application config directly
* chore: remove the initializer
* feat: rename the data keys to reflect what it does
* fix: oops evaluate the var
* refactor: static values that can never change during the lifetime of the app should be constants
* chore: setup the test to have a release footprint before the test gets executed
* chore: remove the methods
* revert to method + cache
* revert to using method
* reset the instance variable
* Add script to remove feature flag
* Remove :feeds_import feature flag and RssReader and related classes
* Change Feeds::ImportArticlesWorker signature to support Sidekiq Cron serialization
* Replace RssReader::Assembler with Feeds::AssembleArticleMarkdown
* Removing Assembler
* Add gem omniauth-apple
* Integrate omniauth-apple
* Integrate callback
* Add fields
* Add tests, fix bugs and make it all work
* Show only enabled providers for the current user
* Add default profile image for Apple
* Remove localhost patch
* Bring over the changed Apple username if the user changes it
* More specs fixed
* Incorporate feedback from PR
* Fix specs
* Simplify code and fix spec
* Fix Broadcast generators to take into account the new provider
* Fix spec
* Generate a truly unique apple_username
* Fix user specs
* Add omniauth-apple-0.0.2 to vendor cache
* Fix merge conflict and spec
* Update VCR fastly sloan cassette
* Revert "Generate a truly unique apple_username"
This reverts commit 2462875575b0bbd6b3c1d56b25afcd3189671608.
* Fix user specs
* Fix specs
* Fix specs
* Hide Connect Apple button behind a feature flag
* Revert "Hide Connect Apple button behind a feature flag"
This reverts commit 105bde0373389a4eb9b6e948f60734c7e0e99cba.
* Fix line lengths
* Fix spec
* ES tag
* CSRF bypass for Apple callback
* custom user_nickname in Apple provider with small tweaks + omniauth-apple bump
* Fixes username specs
* Makes Apple users default image Users::ProfileImageGenerator
* Fallback to mascot_image_url in test environment to avoid breaking Travis
* Fixes Apple CSRF error + makes default nickname more readable
* Trigger Travis
* Better devise config
* Apple SiteConfig entires in /admin/config
* Fixing specs
* Adds beta_access? to Authentication::Providers::Provider
* Fixes specs
* Codeclimate double quote fix in Gemfile
* Fixes /admin/config allowed params & adds feature flag for provider beta_access?
* Remove Enfile & adds temporary docs
* Adds custom apple auth provider settings
* Fix authenticator spec
* Fix configs spec (use last instead of first to avoid apple special case)
* Remove dangling fields from /admin/config
* updates feature flag
* More test fixes
* Hide config behind feature flag too
* omniauth-apple bump
* Takes care of edge case fallback
* Reverse apple_username update
* Adds auth_time to info hash in apple omniauth mock
* Switch to next instead of nesting for feature flag
* Fixes CVE-2015-9284
* Fixes specs after auth providers initiatior refactor from GET to POST
* Spec fixes
* More spec fixes
* Fix Rails codebase reference link
Co-authored-by: rhymes <rhymesete@gmail.com>
Co-authored-by: rhymes <rhymes@hey.com>
* Disable ActionController auto params wrapping
Rails by default accepts wrapped and unwrapped parameters in JSON requests (with or without a root object), regardless of the fact that the contract with the client requests wrapped parameters or not. This results in unforeseeable bugs when the client sends unwrapped parameters in lieu of wrapped ones.
As undeterministic bugs are a PITA and this is the classic grey area in Rails apps and as the customer facing API is fully documented and the internal can be manually adjusted, we disable this and be done with this odd feature.
https://github.com/forem/forem/issues/11645https://github.com/forem/forem/pull/11638
* Remove accidentally committed file
The CustomText converter was monkey patched to fix a bug related to
preserve_tags. Somewhere in that process, remove_inner_newlines was
changed to strip newlines completely, instead of replacing them with a
single space. This restores that functionality.
In development mode, files are not eager loaded. That means that the
converters were not being required, so it was not possible to reproduce
that issue in development mode (since it was falling back to the
original converter, which does not have the bug). This commit also adds
an initializer that requires every converter.
* Makes Omniauth rely on Proc instead of initializer value for redirect uri
* Adds SiteConfig.app_domain test for OAuth providers callback_url generation
* Fixes protocol mismatch in test
* Fixes URL encoding problem with query params in test
* Sets Omniauth full_host config to match the environment
* Fixes tests by passing missing params in omniauth env to mocks
* Default param as nil in omniauth mock helpers
* Optimization:Move Initilization CacheBust to Background Worker
* lower cache bust to 5 min and then bust shell version last
* moving back to 10 min after looking at recent deploy data
* Initial secure header functionality
* Add unsafe-inline to csp
* Secure cookies
* Add connect-src
* Only run secure header config in prod (for now)
* Change prod check to within default
* Change from secure_headers to rails config
* Wrap behind production check
* Replace HEROKU_SLUG_COMMIT with custom footprint (naive)
* Fully set RELEASE_FOOTPRINT with the expectation of setting it before launch
* Change tests
* Fix cache
* Mess with ssl
* Add redirect false
* Remove redirect config
* Redirect back to false
* Mess with validrequest
* Add validrequest back in
* Secure sessions
* Add domain to session_store
* Fiddle with ssl options
* Fiddle with secure
* Same site lax
* Remove force_ssl
* Remove domain from session_store
* Add domain back
* Secure session cookie
* Set secure with var
* Revert default_url_options change
* Set session store to secure
* revert secure force
* Revert unintended change
* The cookie domain property should not be set on localhost
* Switch to no domain unless in production
Co-authored-by: rhymes <rhymes@hey.com>
