Tim Düsterhus [Fri, 8 Jan 2021 15:58:12 +0000 (16:58 +0100)]
Register reauthentication after authenticating in LoginForm and MFAuthenticationForm
Tim Düsterhus [Fri, 8 Jan 2021 15:54:26 +0000 (16:54 +0100)]
Require a reauthentication in WCFACP::initAuth()
Tim Düsterhus [Fri, 8 Jan 2021 14:59:12 +0000 (15:59 +0100)]
Remove the userID from the session cookie
It was only added to support the username suggestion in the ACP login.
Tim Düsterhus [Fri, 8 Jan 2021 14:55:45 +0000 (15:55 +0100)]
Make SessionHandler::getParsedCookieData() private
This method was newly introced in 5.4 to support the username suggestion during ACP login.
Tim Düsterhus [Fri, 8 Jan 2021 14:54:37 +0000 (15:54 +0100)]
Remove logic to set the preferred username in ACP's login
By the removal of the session separation this will always be empty (otherwise
the user would already be logged in).
Tim Düsterhus [Fri, 8 Jan 2021 15:47:02 +0000 (16:47 +0100)]
Drop wcf1_acp_session when upgrading from 5.3
Tim Düsterhus [Fri, 8 Jan 2021 15:14:21 +0000 (16:14 +0100)]
Remove wcf1_acp_session from install.sql
Tim Düsterhus [Fri, 8 Jan 2021 15:05:02 +0000 (16:05 +0100)]
Remove ACP sessions from GDPR export
They'll always be empty anyway.
Tim Düsterhus [Wed, 20 Jan 2021 16:10:30 +0000 (17:10 +0100)]
Remove SessionHandler::ACP_SESSION_LIFETIME
This constant is unused as of the previous commit.
Tim Düsterhus [Wed, 20 Jan 2021 16:08:50 +0000 (17:08 +0100)]
Remove pruning of ACP sessions
The table always is empty since the previous commits, so the pruning is no longer required.
Tim Düsterhus [Wed, 20 Jan 2021 15:35:46 +0000 (16:35 +0100)]
Remove the `isAcpSession` property from \wcf\system\session\Session
This property always was `false` since the removal of the distinction between
frontend and ACP sessions.
Tim Düsterhus [Fri, 8 Jan 2021 14:52:10 +0000 (15:52 +0100)]
Remove SessionHandler methods to delete ACP sessions
They were both introduced and deprecated in 5.4.
Tim Düsterhus [Fri, 8 Jan 2021 14:51:38 +0000 (15:51 +0100)]
Remove calls to SessionHandler::deleteAcpSessionsExcept()
This method was deprecated in the previous commit.
Tim Düsterhus [Fri, 8 Jan 2021 14:50:45 +0000 (15:50 +0100)]
Remove SessionHandler::$isACP
Since the previous commit this is always `false`.
Tim Düsterhus [Fri, 8 Jan 2021 14:35:28 +0000 (15:35 +0100)]
Force SessionHandler::$isACP to be false
This causes the ACP to reuse the frontend session. This improves the user
experience for enabled multi-factor authentication, because the ACP will no
longer require both the password *and* an additional MFA code when the user's
web browser is already authenticated in the frontend.
Additionally it will allow to simplify the whole session handling logic, due to
the future removal of several code branches.
This removal of the branches is not yet done to keep this commit simple.
As of right now the ACP will have reduced security compared to the situation in
5.3, because no passwords will be asked either. This will also be fixed in a
future commit by using the reauthentication framework.
Tim Düsterhus [Thu, 21 Jan 2021 08:39:15 +0000 (09:39 +0100)]
Merge branch '5.3'
Tim Düsterhus [Thu, 21 Jan 2021 08:33:22 +0000 (09:33 +0100)]
Set 'stream' to `true` for Guzzle in `HTTPRequest`
This is required to properly support the 'maxLength' option on endless streams
(such as a web radio). Without setting 'stream' to `true`, Guzzle attempts to
download the entire response body before returning from `->send()`.
Tim Düsterhus [Wed, 20 Jan 2021 16:05:15 +0000 (17:05 +0100)]
Fix disabling of session ACP expiration in debug + dev mode
While this was properly accounted for in SessionHandler::prune() it was not
when loading the session.
Tim Düsterhus [Wed, 20 Jan 2021 16:03:14 +0000 (17:03 +0100)]
Fix pruning of ACP sessions
This fixes a copy and paste mistake in
6096fe159bbcae95b54abe0cfdb8eba0774dffc5.
This mistake did not introduce a security issue, because the session timeout is
also checked when loading the session, instead of just relying on the cronjob
pruning the session.
Tim Düsterhus [Wed, 20 Jan 2021 15:22:33 +0000 (16:22 +0100)]
Add missing PHPDoc tags for new SessionHandler methods
- Add missing `@since` tags.
- Add useful `@see` tags.
Tim Düsterhus [Wed, 20 Jan 2021 15:15:54 +0000 (16:15 +0100)]
Merge pull request #3883 from WoltLab/access-log-clean
Clean up ACP session log processing
Tim Düsterhus [Fri, 8 Jan 2021 15:11:59 +0000 (16:11 +0100)]
Consider an ACP session to be expired after 15 minutes in SessionAccessLogListener
Tim Düsterhus [Fri, 8 Jan 2021 15:08:56 +0000 (16:08 +0100)]
Stop accessing wcf1_acp_session in ACP session log
This access was only used to full the `active` property which is unused.
Joshua Rüsweg [Wed, 20 Jan 2021 14:46:44 +0000 (15:46 +0100)]
Merge pull request #3873 from WoltLab/user-online-performance
Fix performance of user online list
joshuaruesweg [Tue, 12 Jan 2021 13:45:33 +0000 (14:45 +0100)]
Fix performance of user online list
If the UserStorageHandler has to load all users that are online, this is quite resource intensive in larger communities and the query is very slow. The UserStorageHandler must actually be loaded so that the permissions of the users can be checked to see if they can make themselves invisible. We switch off this check with this commit and assume that users who cannot change this setting are always online.
WoltLab [Wed, 20 Jan 2021 12:15:24 +0000 (12:15 +0000)]
Updating minified JavaScript files
Alexander Ebert [Wed, 20 Jan 2021 12:13:58 +0000 (13:13 +0100)]
Merge branch '5.2' into 5.3
WoltLab [Wed, 20 Jan 2021 12:12:17 +0000 (12:12 +0000)]
Updating minified JavaScript files
Tim Düsterhus [Wed, 20 Jan 2021 09:06:43 +0000 (10:06 +0100)]
Fix the ACP session cookie value after WCFSetup
WCFSetup was not adjusted when making the changes to the cookie format.
see
3b07fad7445f10555cc367eadedb9543565e4943
Tim Düsterhus [Tue, 19 Jan 2021 13:55:52 +0000 (14:55 +0100)]
Fix typo in de.xml
Tim Düsterhus [Tue, 19 Jan 2021 13:25:22 +0000 (14:25 +0100)]
Mark multi-factor methods as final
There is no good reason why anyone should be allowed to inherit from these
classes, especially since all the methods are either public or private (and not
protected).
Tim Düsterhus [Tue, 19 Jan 2021 10:16:35 +0000 (11:16 +0100)]
Move permission checks for Multifactor forms into checkPermissions()
This avoids issues with requestReauthentication() being called for guests.
I verified that none of the actual processing happens before the
checkPermissions() check.
Tim Düsterhus [Tue, 19 Jan 2021 09:32:59 +0000 (10:32 +0100)]
Remove call to deprecated HeaderUtil::exceptionDisableGzip();
This method is a no-op.
see
91b46ad444a1c0d90ae0c309b1386fbd5919f30b
see #3634
see #3881
Matthias Schmidt [Tue, 19 Jan 2021 08:10:43 +0000 (09:10 +0100)]
Use `jslang` in templates instead of `lang`
Matthias Schmidt [Tue, 19 Jan 2021 07:49:50 +0000 (08:49 +0100)]
Replace `boolean` with `bool` in PHP documentation
Matthias Schmidt [Tue, 19 Jan 2021 07:20:23 +0000 (08:20 +0100)]
Replace `integer` with `int` in PHP documentation
Matthias Schmidt [Mon, 18 Jan 2021 16:09:08 +0000 (17:09 +0100)]
Remove `@noinspection PhpUnusedParameterInspection` comments
Matthias Schmidt [Mon, 18 Jan 2021 16:04:16 +0000 (17:04 +0100)]
Remove `@noinspection PhpMissingParentCallCommonInspection` comments
Matthias Schmidt [Mon, 18 Jan 2021 16:03:13 +0000 (17:03 +0100)]
Replace usage of `WCF.System.PageNavigation` with `Ui/Page/JumpTo` (#3877)
See #3876
Matthias Schmidt [Mon, 18 Jan 2021 16:02:54 +0000 (17:02 +0100)]
Deprecate `WCF.System.Dependency.Manager` (#3879)
It has not been actively used for a very long time, see
d1d6845c77fd7cde7558d0defd71ab7947643fe7.
joshuaruesweg [Mon, 18 Jan 2021 15:25:23 +0000 (16:25 +0100)]
Unify reaction count button style with notification style
Marcel Werk [Mon, 18 Jan 2021 15:21:23 +0000 (16:21 +0100)]
Merge branch '5.3'
Marcel Werk [Mon, 18 Jan 2021 15:20:15 +0000 (16:20 +0100)]
Merge branch '5.2' into 5.3
Marcel Werk [Mon, 18 Jan 2021 15:19:54 +0000 (16:19 +0100)]
Merge branch '3.1' into 5.2
Marcel Werk [Mon, 18 Jan 2021 15:19:25 +0000 (16:19 +0100)]
Permissions for media were not saved correctly
joshuaruesweg [Mon, 18 Jan 2021 14:58:43 +0000 (15:58 +0100)]
Add spacing beetween reaction icon in notifications
joshuaruesweg [Mon, 18 Jan 2021 12:54:21 +0000 (13:54 +0100)]
Fix double html encoding in trophy activity events
Matthias Schmidt [Sun, 17 Jan 2021 16:10:36 +0000 (17:10 +0100)]
Fix content removal clipboard JavaScript on ACP user list page
Close #3878
Matthias Schmidt [Sun, 17 Jan 2021 12:41:08 +0000 (13:41 +0100)]
Fix hiding suggestion dropdown when no suggestion are available
See
0a9081c855bf8b9ab0ffbd5ab98679a11f23849c
Matthias Schmidt [Sun, 17 Jan 2021 12:31:09 +0000 (13:31 +0100)]
Fix `Ui/ItemList` for textareas
`parentElement` is no longer `element.parentNode` as `element` has been repositioned.
Alexander Ebert [Sat, 16 Jan 2021 13:29:59 +0000 (14:29 +0100)]
Missing `tsc` update
Alexander Ebert [Sat, 16 Jan 2021 12:21:32 +0000 (13:21 +0100)]
Hint the return type based on the provided parameters
Matthias Schmidt [Sat, 16 Jan 2021 09:57:15 +0000 (10:57 +0100)]
Remove unused imports
Matthias Schmidt [Sat, 16 Jan 2021 09:35:59 +0000 (10:35 +0100)]
Use `WoltLabSuite/Core/Acp/Ui/Worker` instead of `WCF.ACP.Worker` (#3686)
Additionally, the mail worker dialogs now use titles.
Matthias Schmidt [Sat, 16 Jan 2021 08:30:44 +0000 (09:30 +0100)]
Remove unused import
Alexander Ebert [Fri, 15 Jan 2021 18:16:43 +0000 (19:16 +0100)]
Move data structures for the inline editor into a spearate module
Alexander Ebert [Fri, 15 Jan 2021 17:40:22 +0000 (18:40 +0100)]
Move data structures for the inline editor into a spearate module
Matthias Schmidt [Fri, 15 Jan 2021 15:02:15 +0000 (16:02 +0100)]
Fix fields selector in `Form/Builder/Field/Checkboxes`
Tim Düsterhus [Fri, 15 Jan 2021 14:08:10 +0000 (15:08 +0100)]
Merge pull request #3875 from WoltLab/typescript-tree
Move TypeScript sources into ts/ from wcfsetup/install/files/ts/
Tim Düsterhus [Fri, 15 Jan 2021 14:04:19 +0000 (15:04 +0100)]
Merge branch 'master' into typescript-tree
joshuaruesweg [Fri, 15 Jan 2021 12:47:25 +0000 (13:47 +0100)]
Merge branch '5.3'
joshuaruesweg [Fri, 15 Jan 2021 12:47:06 +0000 (13:47 +0100)]
Merge branch '5.2' into 5.3
joshuaruesweg [Fri, 15 Jan 2021 12:46:45 +0000 (13:46 +0100)]
Merge branch '3.1' into 5.2
joshuaruesweg [Fri, 15 Jan 2021 12:45:59 +0000 (13:45 +0100)]
Set explicit value for invalid select options
Matthias Schmidt [Fri, 15 Jan 2021 10:53:10 +0000 (11:53 +0100)]
Fix import of incorrect module in `Form/Builder/Field/User`
Matthias Schmidt [Fri, 15 Jan 2021 10:29:38 +0000 (11:29 +0100)]
Merge branch '5.3'
Matthias Schmidt [Fri, 15 Jan 2021 10:29:29 +0000 (11:29 +0100)]
Merge branch '5.2' into 5.3
Titus Kirch [Wed, 30 Dec 2020 01:11:55 +0000 (02:11 +0100)]
Support WysiwygFormContainer as children of ITabMenuFormContainer
Matthias Schmidt [Fri, 15 Jan 2021 10:14:35 +0000 (11:14 +0100)]
Make `options` parameter of `Form/Builder/Dialog` a `Partial`
Matthias Schmidt [Fri, 15 Jan 2021 10:08:04 +0000 (11:08 +0100)]
Use monospace font for template listener code field in devtools
Matthias Schmidt [Fri, 15 Jan 2021 10:04:33 +0000 (11:04 +0100)]
Add missing calls to parent constructors in subclasses of `TextFormField`
Matthias Schmidt [Fri, 15 Jan 2021 08:54:04 +0000 (09:54 +0100)]
Merge branch '5.3'
Matthias Schmidt [Fri, 15 Jan 2021 08:53:55 +0000 (09:53 +0100)]
Merge branch '5.2' into 5.3
Matthias Schmidt [Fri, 15 Jan 2021 08:53:37 +0000 (09:53 +0100)]
Fix displaying error messages for devtool projects' instructions
Matthias Schmidt [Fri, 15 Jan 2021 08:50:00 +0000 (09:50 +0100)]
Remove incorrect devtools form field description
Tim Düsterhus [Fri, 15 Jan 2021 08:46:42 +0000 (09:46 +0100)]
Move TypeScript sources into ts/ from wcfsetup/install/files/ts/
Matthias Schmidt [Fri, 15 Jan 2021 08:37:54 +0000 (09:37 +0100)]
Improve variable name
Matthias Schmidt [Fri, 15 Jan 2021 08:35:36 +0000 (09:35 +0100)]
Merge pull request #3871 from WoltLab/devtools_project_typescript
Convert devtools project JavaScript code to TypeScript
Matthias Schmidt [Fri, 15 Jan 2021 08:33:00 +0000 (09:33 +0100)]
Fix required packages' `file` value when editing devtools project
Alexander Ebert [Thu, 14 Jan 2021 18:36:21 +0000 (19:36 +0100)]
Missing signature for `$.ui.messageTabMenu`
Tim Düsterhus [Wed, 13 Jan 2021 10:30:15 +0000 (11:30 +0100)]
Do not take X locks in read-only methods of the MFA Setup class
This was a fun one. Apparently even a query locking exactly a single row by
leveraging an UNIQUE KEY outside of a transaction can deadlock with another
transaction.
Sending two requests to regenerate MFA backup codes at the same time caused the
following to happen within the database:
T1: Within a transaction locks the Setup by using Setup::lock(), putting an X
onto the PRIMARY KEY.
T2: Outside of a transaction reads a Setup using Setup::find(), hitting exactly
a single entry within the `userID` UNIQUE KEY (i.e. a specific
`(userID, objectTypeID)` tuple).
-> This puts an X onto the `userID` UNIQUE KEY.
-> This wants to also put an X onto the corresponding PRIMARY KEY.
-> The PRIMARY KEY is already locked by T1.
-> This query (and thus this transaction) waits within this specific query
for the lock to be granted.
T1: Within the transaction calls Setup::find() with the same parameters as T2.
-> This needs to put the X onto the same row in the `userID` UNIQUE KEY.
-> This row is locked by T2.
-> This transaction needs to wait for that lock to be granted.
Now T1 needs to wait for T2 which already waits for T1 and we're experiencing a
deadlock.
Fix this issue by not taking an X within Setup::find() (i.e. removing the `FOR
UPDATE`). I've verified that nothing calls Setup::find() within a transaction
(without locking the Setup by a different means). Thus this change does not
result in a difference with regard to lock safety. Everything that needs to
modify a Setup already calls Setup::lock() which locks the PRIMARY KEY only.
Fixes #3874
Tim Düsterhus [Wed, 13 Jan 2021 08:20:19 +0000 (09:20 +0100)]
Merge remote-tracking branch 'origin/master'
Tim Düsterhus [Wed, 13 Jan 2021 08:19:25 +0000 (09:19 +0100)]
Merge branch '5.3'
- Dropped update_com.woltlab.wcf_5.3.3_style.php
Tim Düsterhus [Wed, 13 Jan 2021 08:13:00 +0000 (09:13 +0100)]
Merge pull request #3865 from WoltLab/fix-style-preview
Fix the style preview images
Tim Düsterhus [Wed, 13 Jan 2021 08:12:57 +0000 (09:12 +0100)]
Merge pull request #3872 from WoltLab/codemirror-media
Convert `Acp/Ui/CodeMirror/Media` to TypeScript
Alexander Ebert [Tue, 12 Jan 2021 11:53:31 +0000 (12:53 +0100)]
Unified the exception type for GD and Imagick
Tim Düsterhus [Tue, 12 Jan 2021 11:03:00 +0000 (12:03 +0100)]
Use an `enum` for the InsertType
Tim Düsterhus [Tue, 12 Jan 2021 10:59:20 +0000 (11:59 +0100)]
Convert `Acp/Ui/CodeMirror/Media` to TypeScript
Matthias Schmidt [Tue, 12 Jan 2021 10:25:52 +0000 (11:25 +0100)]
Apply suggestions from code review
Matthias Schmidt [Tue, 12 Jan 2021 09:59:37 +0000 (10:59 +0100)]
Convert `Acp/Form/Builder/Field/Devtools/Project/Instructions` to TypeScript
Matthias Schmidt [Tue, 12 Jan 2021 09:58:15 +0000 (10:58 +0100)]
Convert `Acp/Form/Builder/Field/Devtools/Project/RequiredPackages` to TypeScript
Matthias Schmidt [Tue, 12 Jan 2021 09:57:50 +0000 (10:57 +0100)]
Convert `Acp/Form/Builder/Field/Devtools/Project/OptionalPackages` to TypeScript
Matthias Schmidt [Tue, 12 Jan 2021 09:57:26 +0000 (10:57 +0100)]
Convert `Acp/Form/Builder/Field/Devtools/Project/ExcludedPackages` to TypeScript
Matthias Schmidt [Tue, 12 Jan 2021 09:57:15 +0000 (10:57 +0100)]
Convert `Acp/Form/Builder/Field/Devtools/Project/AbstractPackageList` to TypeScript
Matthias Schmidt [Tue, 12 Jan 2021 09:56:50 +0000 (10:56 +0100)]
Add devtools form builder-related TypeScript interfaces
Matthias Schmidt [Tue, 12 Jan 2021 09:35:40 +0000 (10:35 +0100)]
Use DomUtil for element visibility in form builder modules
Alexander Ebert [Mon, 11 Jan 2021 19:10:50 +0000 (20:10 +0100)]
Convert `WCF.Message.Quote.Handler` to TypeScript (#3860)
* Convert `WCF.Message.Quote.Handler` to TypeScript
* Export the class separately
Alexander Ebert [Mon, 11 Jan 2021 17:33:56 +0000 (18:33 +0100)]
Image adapters now support saving to GIF/JPG/PNG/WebP (#3869)
* Image adapters now support saving to GIF/JPG/PNG/WebP
* Adjusted the usage of exception
* Missing remark on the version support
Tim Düsterhus [Mon, 11 Jan 2021 15:59:48 +0000 (16:59 +0100)]
Merge branch '5.3'
Tim Düsterhus [Mon, 11 Jan 2021 15:59:19 +0000 (16:59 +0100)]
Fix check for deleted notifications in NotificationEmailDeliveryBackgroundJob