Tim Düsterhus [Wed, 9 Mar 2022 09:46:52 +0000 (10:46 +0100)]
Merge branch '5.3' into 5.4
Tim Düsterhus [Wed, 9 Mar 2022 09:40:02 +0000 (10:40 +0100)]
Simplify condition in UserTrophyAction::validateGetGroupedUserTrophyList()
Tim Düsterhus [Wed, 9 Mar 2022 09:39:36 +0000 (10:39 +0100)]
Validate that the userID matches a user in UserTrophyAction::validateGetGroupedUserTrophyList()
Tim Düsterhus [Wed, 9 Mar 2022 09:38:04 +0000 (10:38 +0100)]
Validate that the userID matches a user in UserProfileVisitorAction::validateGetGroupedUserList()
Tim Düsterhus [Wed, 9 Mar 2022 09:33:51 +0000 (10:33 +0100)]
Fix typing of RuntimeCache's getObject() method
Alexander Ebert [Tue, 8 Mar 2022 18:12:26 +0000 (19:12 +0100)]
Disabled `input[type="date"]` were not initialized
See https://www.woltlab.com/community/thread/294503-ansicht-bei-einem-datumsfeld-fehlerhaft-plus-konsolenfehler-disabled/
Alexander Ebert [Tue, 8 Mar 2022 13:43:23 +0000 (14:43 +0100)]
`Escape` key now triggers `onBeforeClose`
See https://www.woltlab.com/community/thread/294772-closeconfirmmessage-onbeforeclose-bei-esc-taste/
Tim Düsterhus [Tue, 8 Mar 2022 09:07:32 +0000 (10:07 +0100)]
Fix PHP 8.1 compatibility when editing groups with NULL description
This can happen for the groups that are created during initial installation.
see #4694
Tim Düsterhus [Tue, 8 Mar 2022 09:05:27 +0000 (10:05 +0100)]
Create the initial user groups with explicit descriptions
Tim Düsterhus [Tue, 8 Mar 2022 08:59:46 +0000 (09:59 +0100)]
Correctly handle missing requirements without minversion in dev tools
Marcel Werk [Mon, 7 Mar 2022 17:51:02 +0000 (18:51 +0100)]
Indentation in label group availability was too large
Marcel Werk [Mon, 7 Mar 2022 17:45:39 +0000 (18:45 +0100)]
Label group availability could not be configured for deeper categories
Tim Düsterhus [Mon, 7 Mar 2022 09:37:35 +0000 (10:37 +0100)]
Fix PHP 8.1 compatibility in SignatureCache
> Message: preg_replace_callback(): Passing null to parameter #3 ($subject) of
> type array|string is deprecated
Alexander Ebert [Thu, 3 Mar 2022 18:38:04 +0000 (19:38 +0100)]
Restoring the selection immediately discarded it
See https://www.woltlab.com/community/thread/294654-links-werden-vom-editor-aus-dem-text-direkt-nach-ganz-oben-verschoben/
joshuaruesweg [Thu, 3 Mar 2022 12:59:02 +0000 (13:59 +0100)]
Merge branch '5.3'
joshuaruesweg [Thu, 3 Mar 2022 12:56:27 +0000 (13:56 +0100)]
Fix detection of ipv4 adresses for stopforumspam integration
joshuaruesweg [Thu, 3 Mar 2022 08:05:44 +0000 (09:05 +0100)]
Surpress output of empty labeled url user option fields
Tim Düsterhus [Mon, 28 Feb 2022 12:12:10 +0000 (13:12 +0100)]
Merge branch '5.3' into 5.4
Tim Düsterhus [Mon, 28 Feb 2022 12:10:16 +0000 (13:10 +0100)]
Validate the messageObjectType in MessagePreviewAction::validateGetMessagePreview()
Tim Düsterhus [Mon, 28 Feb 2022 12:03:52 +0000 (13:03 +0100)]
Merge branch '5.3' into 5.4
Tim Düsterhus [Mon, 28 Feb 2022 12:02:17 +0000 (13:02 +0100)]
Validate the object type definition in CommentAction::validateObjectType()
Tim Düsterhus [Mon, 28 Feb 2022 10:20:35 +0000 (11:20 +0100)]
Fix success message in ApplicationManagementForm
Fixes #4679
Tim Düsterhus [Thu, 24 Feb 2022 10:35:41 +0000 (11:35 +0100)]
Ignore non-HTTP schemes for URL unfurling
Tim Düsterhus [Mon, 21 Feb 2022 14:14:17 +0000 (15:14 +0100)]
Merge branch 'mysql-search-query-parser' into 5.4
Tim Düsterhus [Mon, 21 Feb 2022 14:12:38 +0000 (15:12 +0100)]
Fix handling of queries ending in a lone quote in MysqlSearchEngine::splitIntoTerms()
Tim Düsterhus [Mon, 21 Feb 2022 14:08:02 +0000 (15:08 +0100)]
Fix handling of quoted parentheses in MysqlSearchEngine::splitIntoTerms()
Tim Düsterhus [Mon, 21 Feb 2022 13:51:55 +0000 (14:51 +0100)]
Fix typo in comment in MysqlSearchEngine::splitIntoTerms()
Tim Düsterhus [Mon, 21 Feb 2022 09:05:12 +0000 (10:05 +0100)]
Alexander Ebert [Fri, 18 Feb 2022 15:17:28 +0000 (16:17 +0100)]
Reverted the implicit expansion of blocked content
This reverts
936edda0bd3537095d1bd01e96682c40796b1b2f which implicitly expanded a message when it is being accessed through an URL anchor.
However, these URLs are also generated when accessing the last post of a thread which is merely a jump to the end.
Tim Düsterhus [Fri, 18 Feb 2022 13:32:34 +0000 (14:32 +0100)]
Throw UserInputException for invalid className in AJAXInvokeAction/AJAXProxyAction
As the `className` is a user-provided value, we must throw a UserInputException
for proper error handling.
Tim Düsterhus [Wed, 16 Feb 2022 15:25:06 +0000 (16:25 +0100)]
Add trailing comma to maxItems in __userFormField
Alexander Ebert [Tue, 15 Feb 2022 20:16:40 +0000 (21:16 +0100)]
Superfluous whitespace
Alexander Ebert [Tue, 15 Feb 2022 20:15:53 +0000 (21:15 +0100)]
Improper comparison of user groups containing non-ASCII characters
Alexander Ebert [Tue, 15 Feb 2022 13:58:30 +0000 (14:58 +0100)]
Merge branch '5.3' into 5.4
Alexander Ebert [Tue, 15 Feb 2022 13:54:23 +0000 (14:54 +0100)]
Release 5.3.20
Alexander Ebert [Tue, 15 Feb 2022 13:28:07 +0000 (14:28 +0100)]
Release 5.4.14
Tim Düsterhus [Tue, 15 Feb 2022 12:05:10 +0000 (13:05 +0100)]
Add `trophyPoints` to User's `@property-read`
Resolves #4669
Alexander Ebert [Mon, 14 Feb 2022 16:29:12 +0000 (17:29 +0100)]
Release 5.4.14 dev 2
WoltLab [Mon, 14 Feb 2022 16:28:21 +0000 (16:28 +0000)]
Updating minified JavaScript files
Alexander Ebert [Mon, 14 Feb 2022 16:14:00 +0000 (17:14 +0100)]
Work-around for the inconsistent selection handling in iOS 15
See https://www.woltlab.com/community/thread/294136-ios-text-markieren-link-einf%C3%BCgen-geht-nicht/
Alexander Ebert [Mon, 14 Feb 2022 14:50:30 +0000 (15:50 +0100)]
Clamp the date value if it exceeds the `maxDate`
See https://www.woltlab.com/community/thread/294169-min-max-datepicker-falscher-monat/
Tim Düsterhus [Mon, 14 Feb 2022 13:39:57 +0000 (14:39 +0100)]
Fix PHP 8.0/8.1 compatibility of phpline.phar
Alexander Ebert [Sun, 13 Feb 2022 15:57:31 +0000 (16:57 +0100)]
Implicitly expand messages from blocked users when following a permalink
See https://www.woltlab.com/community/thread/294218-verlinkung-zu-beitr%C3%A4gen-von-blockierten-nutzern/
Marcel Werk [Sun, 13 Feb 2022 15:39:12 +0000 (16:39 +0100)]
Individual settings for boxes were unintentionally overwritten during update
Alexander Ebert [Thu, 10 Feb 2022 17:00:41 +0000 (18:00 +0100)]
Release 5.4.14 dev 1
WoltLab [Thu, 10 Feb 2022 16:58:27 +0000 (16:58 +0000)]
Updating minified JavaScript files
Tim Düsterhus [Tue, 8 Feb 2022 15:45:26 +0000 (16:45 +0100)]
Merge pull request #4664 from WoltLab/formbuilder-checkbox-ajax
Add `CheckedVoid` form builder data handler for CheckboxFormField
Tim Düsterhus [Tue, 8 Feb 2022 14:54:22 +0000 (15:54 +0100)]
Add `CheckedVoid` form builder data handler for CheckboxFormField
The `Checked` data handler is not usable for the CheckboxFormField, because its
behavior differs from the non-AJAX behavior by always sending a value whereas
checkboxes that are not checked will not send anything within a regular form.
It was considered to simply reuse the `readValue()` implementation in
BooleanFormField, because it appears to do the right thing at a glance. However
this would effectively revert
7d36c55726af2b5b9d9ab1706a05ccf5e52e84b8 which is
a fix to allow unchecking checkboxes that are checked by default.
Also matching the behavior of AJAX and non-AJAX forms 100% is considered a good
thing, so a new JavaScript module to handle this, is the best solution.
Tim Düsterhus [Tue, 8 Feb 2022 09:12:31 +0000 (10:12 +0100)]
Merge branch '5.3' into 5.4
Tim Düsterhus [Tue, 8 Feb 2022 09:07:00 +0000 (10:07 +0100)]
Ignore `length` when diffing YearDatabaseTableColumn
Similarly to INT columns MySQL 8 ignores the length of YEAR columns:
https://dev.mysql.com/doc/refman/8.0/en/year.html
> As of MySQL 8.0.19, the YEAR(4) data type with an explicit display width is
> deprecated and you should expect support for it to be removed in a future
> version of MySQL. Instead, use YEAR without a display width, which has the
> same meaning.
Tim Düsterhus [Mon, 7 Feb 2022 13:00:48 +0000 (14:00 +0100)]
Fix template syntax error in wcf.user.notification.articleComment.response(Owner)?.mail.html
see
cc5632977059ae88aa5cfe1c27407f0e00fa68c1
Tim Düsterhus [Mon, 7 Feb 2022 08:16:08 +0000 (09:16 +0100)]
Whitelist `array_key_exists` in enterprise mode
Marcel Werk [Sat, 5 Feb 2022 12:59:32 +0000 (13:59 +0100)]
Permission 'canOnlyAccessOwnMedia' did not work as expected
It was still possible to find files from other users through the search function.
Marcel Werk [Sat, 5 Feb 2022 12:56:59 +0000 (13:56 +0100)]
File size was displayed twice when uploading media
Marcel Werk [Thu, 3 Feb 2022 13:44:19 +0000 (14:44 +0100)]
Email column in notification settings was too small
Alexander Ebert [Wed, 2 Feb 2022 18:29:42 +0000 (19:29 +0100)]
`saveInstant()` yields an incorrect selection after formatting
Consider the example `Hello World` where the word `World` is selected. Marking the selection as bold did not mark the button as active.
This was caused by the way the selection is created, causing it to be `Hello |<strong>World|</strong>` when using `saveInstant()` (the pipe denotes the selection boundary).
Tim Düsterhus [Wed, 2 Feb 2022 11:05:19 +0000 (12:05 +0100)]
Merge pull request #4656 from WoltLab/dialog-alert
Fix rendering of alert boxes at the top of a dialog
Tim Düsterhus [Wed, 2 Feb 2022 11:01:43 +0000 (12:01 +0100)]
Remove obsolete inline CSS in removeUserContentDialog.tpl
see
0d0aecf7b629619de450304945989074522dbca2
Tim Düsterhus [Wed, 2 Feb 2022 10:50:13 +0000 (11:50 +0100)]
Fix rendering of alert boxes at the top of a dialog
Alexander Ebert [Mon, 31 Jan 2022 16:33:14 +0000 (17:33 +0100)]
Release 5.4.13
Alexander Ebert [Mon, 31 Jan 2022 16:32:20 +0000 (17:32 +0100)]
Merge branch '5.3' into 5.4
Alexander Ebert [Mon, 31 Jan 2022 16:30:49 +0000 (17:30 +0100)]
Release 5.3.19
Alexander Ebert [Mon, 31 Jan 2022 16:30:10 +0000 (17:30 +0100)]
Merge branch '5.2' into 5.3
Alexander Ebert [Mon, 31 Jan 2022 16:28:38 +0000 (17:28 +0100)]
Release 5.2.19
Alexander Ebert [Mon, 31 Jan 2022 16:27:54 +0000 (17:27 +0100)]
Merge branch '3.1' into 5.2
Alexander Ebert [Mon, 31 Jan 2022 16:24:44 +0000 (17:24 +0100)]
Release 3.1.27
Tim Düsterhus [Mon, 31 Jan 2022 16:21:49 +0000 (17:21 +0100)]
Merge branch '5.3' into 5.4
Tim Düsterhus [Mon, 31 Jan 2022 16:18:38 +0000 (17:18 +0100)]
Merge branch '5.2' into 5.3
Tim Düsterhus [Mon, 31 Jan 2022 16:18:14 +0000 (17:18 +0100)]
Merge branch '3.1' into 5.2
Tim Düsterhus [Mon, 31 Jan 2022 16:17:54 +0000 (17:17 +0100)]
Merge branch 'unknown-bbcode-xss' into 3.1
Tim Düsterhus [Mon, 31 Jan 2022 13:18:17 +0000 (14:18 +0100)]
Fix XSS vulnerability in HtmlBBCodeParser::buildBBCodeTag()
Thanks to @methosiea for responsibly reporting this issue.
Resolves #4653
Tim Düsterhus [Mon, 31 Jan 2022 13:40:44 +0000 (14:40 +0100)]
Fix PHP 8.1.2 compatibility in DatabaseException
> Cannot access protected property PDOException::$code
Tim Düsterhus [Thu, 27 Jan 2022 13:09:56 +0000 (14:09 +0100)]
Merge branch '5.3' into 5.4
Tim Düsterhus [Thu, 27 Jan 2022 13:01:33 +0000 (14:01 +0100)]
Fix regular expression for the `atext` production in EmailGrammar
Due to the missing escaping of the hyphen with a backslash the allowed
characters were not just:
- The plus sign (`+`, 0x2B),
- the dash (`-`, 0x2D), and
- the slash (`/`, 0x2F).
But all ASCII characters between 0x2B and 0x2F, namely:
- The plus sign (`+`, 0x2B),
- the comma (`,`, 0x2C),
- the dash (`-`, 0x2D),
- the dot (`.`, 0x2E), and
- the slash (`/`, 0x2F).
i.e. the comma and dot in addition to the actually allowed characters.
This error caused an incorrect encoding of headers in `::encodeHeader()`.
Specifically the real name of a mailbox was affected by this issue. As a result
a real name that included a dot, but otherwise matched the `atom` grammar was
improperly encoded, possibly causing email parsing failures for MUAs.
joshuaruesweg [Tue, 25 Jan 2022 09:33:41 +0000 (10:33 +0100)]
Fix poll management within the form builder
Fixes #4648
Joshua Rüsweg [Mon, 24 Jan 2022 15:02:06 +0000 (16:02 +0100)]
Merge pull request #4647 from WoltLab/5.4-devtools-requirewcfvalidator
Validates whether the WCF was created as a requirement when saving a …
joshuaruesweg [Mon, 24 Jan 2022 12:45:42 +0000 (13:45 +0100)]
Validates whether the WCF was created as a requirement when saving a project
Tim Düsterhus [Mon, 24 Jan 2022 14:10:11 +0000 (15:10 +0100)]
Fix typo in de.xml
Tim Düsterhus [Fri, 21 Jan 2022 13:03:14 +0000 (14:03 +0100)]
Merge branch '5.3' into 5.4
Alexander Ebert [Fri, 21 Jan 2022 13:00:08 +0000 (14:00 +0100)]
Release 5.4.12
Alexander Ebert [Fri, 21 Jan 2022 12:58:37 +0000 (13:58 +0100)]
Merge branch '5.3' into 5.4
Tim Düsterhus [Fri, 21 Jan 2022 12:53:33 +0000 (13:53 +0100)]
Merge branch '5.2' into 5.3
Tim Düsterhus [Fri, 21 Jan 2022 12:50:28 +0000 (13:50 +0100)]
Remove codestyle workflow for non-PSR-12 branches
The recent backport of the `|json` template modifier from 5.5 to 3.1+ in
58bc4b693415079127dd11d8210d2564a443010d fails the code style, because the
branches 5.3 and earlier expect tabs instead of spaces for indentation.
It's not really work fixing the code style for the file, just to revert it once
again when merging upwards.
Remove the check for these older branches. They are only touched for bug fixes
and the style will need to be adapted when merging into 5.4.
Alexander Ebert [Fri, 21 Jan 2022 12:48:46 +0000 (13:48 +0100)]
Release 5.3.18
Alexander Ebert [Fri, 21 Jan 2022 12:47:22 +0000 (13:47 +0100)]
Merge branch '5.2' into 5.3
Alexander Ebert [Fri, 21 Jan 2022 12:30:34 +0000 (13:30 +0100)]
Release 5.2.18
Tim Düsterhus [Thu, 20 Jan 2022 10:50:19 +0000 (11:50 +0100)]
Stop using `|encodeJSON`
(cherry picked from commit
ab1e34de9ca94dc44b20d0b4d58eca2bad80d9d3)
Alexander Ebert [Fri, 21 Jan 2022 12:27:41 +0000 (13:27 +0100)]
Merge branch '3.1' into 5.2
Alexander Ebert [Fri, 21 Jan 2022 12:06:52 +0000 (13:06 +0100)]
Release 3.1.26
Tim Düsterhus [Thu, 20 Jan 2022 10:50:47 +0000 (11:50 +0100)]
Add missing JSON encoding of the PAGE_TITLE in `ampArticle.tpl`
This does not need to be fixed in any current branch, because the broken-ness
of `|encodeJSON` will result in broken metadata one way or another.
(cherry picked from commit
bba7f1706e30761e55954a5a4be569e5bb55a6c4)
Tim Düsterhus [Thu, 20 Jan 2022 10:50:19 +0000 (11:50 +0100)]
Stop using `|encodeJSON`
(cherry picked from commit
ab1e34de9ca94dc44b20d0b4d58eca2bad80d9d3)
Tim Düsterhus [Thu, 20 Jan 2022 10:48:16 +0000 (11:48 +0100)]
Add `|json` template modifier
(cherry picked from commit
e178fa84dc06861c5aba3d14e03161c5396fe9a7)
Tim Düsterhus [Fri, 21 Jan 2022 08:28:01 +0000 (09:28 +0100)]
Move `@types/*` npm dependencies into the non-dev section
This is required for them to be detected in downstream consumers.
Alexander Ebert [Thu, 20 Jan 2022 18:06:46 +0000 (19:06 +0100)]
Release 5.4.12 dev 1
Tim Düsterhus [Thu, 20 Jan 2022 10:50:47 +0000 (11:50 +0100)]
Add missing JSON encoding of the PAGE_TITLE in `ampArticle.tpl`
This does not need to be fixed in any current branch, because the broken-ness
of `|encodeJSON` will result in broken metadata one way or another.
(cherry picked from commit
bba7f1706e30761e55954a5a4be569e5bb55a6c4)
Tim Düsterhus [Thu, 20 Jan 2022 10:50:19 +0000 (11:50 +0100)]
Stop using `|encodeJSON`
(cherry picked from commit
ab1e34de9ca94dc44b20d0b4d58eca2bad80d9d3)
Tim Düsterhus [Thu, 20 Jan 2022 10:48:16 +0000 (11:48 +0100)]
Add `|json` template modifier
(cherry picked from commit
e178fa84dc06861c5aba3d14e03161c5396fe9a7)
Alexander Ebert [Wed, 19 Jan 2022 13:26:02 +0000 (14:26 +0100)]
Release 5.4.11
Alexander Ebert [Wed, 19 Jan 2022 13:18:27 +0000 (14:18 +0100)]
Merge branch '5.3' into 5.4
Alexander Ebert [Wed, 19 Jan 2022 13:10:10 +0000 (14:10 +0100)]
Release 5.3.17