* Disable ActionController auto params wrapping
Rails by default accepts wrapped and unwrapped parameters in JSON requests (with or without a root object), regardless of the fact that the contract with the client requests wrapped parameters or not. This results in unforeseeable bugs when the client sends unwrapped parameters in lieu of wrapped ones.
As undeterministic bugs are a PITA and this is the classic grey area in Rails apps and as the customer facing API is fully documented and the internal can be manually adjusted, we disable this and be done with this odd feature.
https://github.com/forem/forem/issues/11645https://github.com/forem/forem/pull/11638
* Remove accidentally committed file
The CustomText converter was monkey patched to fix a bug related to
preserve_tags. Somewhere in that process, remove_inner_newlines was
changed to strip newlines completely, instead of replacing them with a
single space. This restores that functionality.
In development mode, files are not eager loaded. That means that the
converters were not being required, so it was not possible to reproduce
that issue in development mode (since it was falling back to the
original converter, which does not have the bug). This commit also adds
an initializer that requires every converter.
* Makes Omniauth rely on Proc instead of initializer value for redirect uri
* Adds SiteConfig.app_domain test for OAuth providers callback_url generation
* Fixes protocol mismatch in test
* Fixes URL encoding problem with query params in test
* Sets Omniauth full_host config to match the environment
* Fixes tests by passing missing params in omniauth env to mocks
* Default param as nil in omniauth mock helpers
* Optimization:Move Initilization CacheBust to Background Worker
* lower cache bust to 5 min and then bust shell version last
* moving back to 10 min after looking at recent deploy data
* Initial secure header functionality
* Add unsafe-inline to csp
* Secure cookies
* Add connect-src
* Only run secure header config in prod (for now)
* Change prod check to within default
* Change from secure_headers to rails config
* Wrap behind production check
* Replace HEROKU_SLUG_COMMIT with custom footprint (naive)
* Fully set RELEASE_FOOTPRINT with the expectation of setting it before launch
* Change tests
* Fix cache
* Mess with ssl
* Add redirect false
* Remove redirect config
* Redirect back to false
* Mess with validrequest
* Add validrequest back in
* Secure sessions
* Add domain to session_store
* Fiddle with ssl options
* Fiddle with secure
* Same site lax
* Remove force_ssl
* Remove domain from session_store
* Add domain back
* Secure session cookie
* Set secure with var
* Revert default_url_options change
* Set session store to secure
* revert secure force
* Revert unintended change
* The cookie domain property should not be set on localhost
* Switch to no domain unless in production
Co-authored-by: rhymes <rhymes@hey.com>
* Refactor:Remove ENVied Gem in Favor of Default application.yml
* Copy sample_application.yml for Travis
* Create .env_sample file, Warn of missing ENV variables, ignore .env file
* Use dotenv For ENV variables and create Rake Task to Populate
* Update docs to copy .env_sample file
* make application config a bit more resilient
* update more documentation and only initialize dotenv in dev and test
* Update doc code snippet types and refactor rake task and app config
* remove push defaults
* Make initializers more resilient, remove unused ENV from travis
* Exit new rake task if application.yml does not exist, include dotenv in docs
* Enable new Lint/ cops and run rubocop -a
* Fixing last remaining things with rubocop -a
* Enable and fix Style/ExplicitBlockArgument and Style/GlobalStdStream
* Forgot parenthesis
* First draft - all the big changes
* Changing some more references to 'internal'
* Relocate internal request tests to admin
* Relocate internal system tests to admin
* Fix trailing space
* Test fix
* Move queries from internal to admin
* Docs updates
* Rename internal stimuls controllers to admin (plus docs)
* Rename admin layout
* Fix routing after rebase
* Fixes for latest added admin interfaces
* Serviceworker ignore paths
