Commit graph

420 commits

Author SHA1 Message Date
Tom Hughes
39e66c69b7 Stop parameter hashes comparing equal to normal hashes 2023-10-27 17:31:23 +01:00
Tom Hughes
3588e955c5 Drop X-Download-Options from default headers 2023-10-27 17:26:25 +01:00
Tom Hughes
7ba8ac2b61 Stop adding autoloaded paths to $LOAD_PATH 2023-10-27 17:25:50 +01:00
Tom Hughes
b89fd03403 Enable rails 7.1 changes to model callbacks 2023-10-26 22:51:55 +01:00
Tom Hughes
60d3448cef Enable precompilation of filter_parameters 2023-10-26 22:44:02 +01:00
Tom Hughes
e331266687 Enable rails 7.1 defaults that relate to rolling upgrades 2023-10-26 22:43:29 +01:00
Tom Hughes
1bb8d9caf6 Enable rails 7.1 defaults for features we don't use 2023-10-26 22:43:28 +01:00
Tom Hughes
6e1613f73e Disable deprecated singular association names 2023-10-26 22:19:02 +01:00
Tom Hughes
f37ea2fae3 Update to rails 7.1.1 2023-10-18 18:26:13 +01:00
Tom Hughes
132bb9ad59 Improve support for primary keys in migrations 2023-10-08 12:33:54 +01:00
Tom Hughes
c8fc2218e5 Merge remote-tracking branch 'upstream/pull/4226' 2023-10-03 19:39:41 +01:00
Milan Cvetkovic
64bcf7652b Add openid connect support using doorkeeper-openid_connect gem
... as discussed in [Issue 507](https://github.com/openstreetmap/operations/issues/507)
and described by @mmd-osm.

To activate, set the value of `doorkeeper_signing_key` to RSA private key.

Allows using openstreetmap as an identity provider.

Adds `openid` scope to OAuth2 authorizations, required to login to OSM.

Currently, the only claims returned are:
 - "openid" scope: "sub" and "preferred_username"
 - "read_email" scope: "email"
2023-10-03 18:53:47 +01:00
Milan Cvetkovic
8a22bfb222 Add unconfigured doorkeeper-openid_connect
After executing:
rails generate doorkeeper:openid_connect:install
rails generate doorkeeper:openid_connect:install

Split migration script to 2 to avoid deadlock.
2023-10-03 18:53:09 +01:00
Andy Allan
0a046673d6
Merge pull request #4201 from AntonKhorev/issues-limit-settings
Move max value of issues counter to settings
2023-09-27 15:47:44 +01:00
Paul Norman
00d085ed5d
Add Tracestrack Topo as featured layer 2023-09-19 22:16:42 -07:00
Anton Khorev
fff98f2afb Move max value of issues counter to settings 2023-09-01 07:14:45 +03:00
Tom Hughes
8e3af42fe1 Bump facebook API version 2023-08-30 20:31:24 +01:00
Tom Hughes
3422bb541d Merge remote-tracking branch 'upstream/pull/4198' 2023-08-27 09:46:10 +01:00
Tom Hughes
0913f286fe Make the TOTP cookie httponly 2023-08-22 21:18:45 +01:00
Tom Hughes
63bf18a3c3 Add support for rate limiting signup requests 2023-08-22 18:45:17 +01:00
Milan Cvetkovic
ad164d384e Change provider name to "microsoft" 2023-08-20 10:19:30 +01:00
Milan Cvetkovic
568bf4939d Replace references to windowslive with microsoft_graph 2023-08-17 13:01:15 +00:00
Milan Cvetkovic
7428da74c2 Use omniauth-microsoft_graph instead of omniauth-windowslive
Omniauth-microsoft_graph correctly populates 'email' and 'name' fields used by OpenStreetMap.
It also  uses updated endpoints for Microsoft identity provider.

Use email address returned by microsoft_graph provider as a verified address.

Upgrading exisiting users from windowslive to microsoft_graph:
 - upon next login existing `windowslive` users will have to authorizei
   OpenStreetMap application to "Read Your Profile," required for proper reading
   of display name field.

The name of the identity provider in OSM is kept to 'windowslive':
 - the entries in users table with `provider == 'windowslive'`
   can be reused for microsoft_graph provider, since
   the uid field is preserved. Users will not need to repeat the sign up process.
 - OAuth2 callback is still `/auth/windowslive`, no updates to Microsoft Identity Provider portal
   App registration are necessary.
2023-08-17 13:01:15 +00:00
Tom Hughes
f42a7a2d8d Make sanitize convert text alignment styles to bootstrap classes
The kramdown converter for markdown uses inline styles for table
column alignment which gets lost when we strip the styles so add
bootstrap classes to replace it.
2023-01-09 11:10:11 +00:00
Tom Hughes
6033359bd0 Preserve rel=me on links in rich text
Fixes #3859
2022-12-29 18:02:23 +00:00
Tom Hughes
23f73d0be0 Avoid duplicate initialisation warnings 2022-12-10 15:33:49 +00:00
Tom Hughes
8cef62cd2c Merge remote-tracking branch 'upstream/pull/3301' 2022-11-22 18:47:24 +00:00
Andy Allan
aab33eee87 Use rails 7.0 configuration defaults
All the entries in the new framework defaults were enabled a while
ago, apart from the cookies serializer which is already defined in
config/initializers/cookies_serializer.rb
2022-11-16 15:29:30 +00:00
Tom Hughes
5a28ff2901 Require multi_json for windowslive logins
The windowslive omniauth plugin needs multi_json but doesn't require
it and the omniauth core is no longer doing so.
2022-10-16 19:28:37 +01:00
Tom Hughes
00112700d7 Update doorkeeper to 5.6.0 2022-09-12 19:27:33 +01:00
Adam Hoyle
7e5cbe87ed Merge branch 'master' into feature/add-communities-page
# Conflicts:
#	Gemfile.lock
#	package.json
#	yarn.lock
2022-09-10 16:13:17 +01:00
Tom Hughes
9cd96bd452 Fix new rubocop warnings 2022-09-09 22:45:58 +01:00
Tom Hughes
fb362ef0d8 Enable brotli compression for assets 2022-08-03 19:01:24 +01:00
Andy Allan
83a0ea14f1 Refactor i18n so that all community information is available
This makes it easier to use non-chapter communities on the site in future.
2022-08-03 10:11:30 +01:00
Tom Hughes
e9f62a8c30 Rename piwik to matomo and merge configuration into settings 2022-08-01 22:42:04 +01:00
Tom Hughes
21d52f2d3f Monkey patch MailDeliveryJob to work with delayed_job under ruby 3
The delayed_job gem does not currently perserve keyword arguments
properly leading to errors when running under ruby 3 and try to run
a job that requires them.

This affects our deferred mail deliveries so we monkey patch the
mail delivery job to unpack the hash from the normal arguments and
use it to provide the expected keyword arguments.

https://github.com/collectiveidea/delayed_job/issues/1134
2022-07-23 12:12:29 +01:00
Tom Hughes
6ef6ddc14d Make database_offline mode work
Fixes #3529
2022-04-11 20:28:11 +01:00
Tom Hughes
ddb140f387 Switch to using vips for image processing 2022-03-02 19:44:56 +00:00
Andy Allan
e530d4f54d Move the i18n loading to an initializer
Use after_initialize to avoid rails resetting the translations
2022-03-02 16:24:02 +00:00
Tom Hughes
304eb3b75c Enable open redirect protection 2022-03-01 18:39:08 +00:00
Tom Hughes
172a71e3f2 Disable partial inserts 2022-02-22 19:16:10 +00:00
Tom Hughes
5b3edb8075 Switch to rails 7 default headers
These are basically all the same as what secure_headers
was already setting for us anyway.
2022-02-22 19:13:02 +00:00
Tom Hughes
a5508cfba1 Enable automatic scope inversing 2022-02-21 19:11:58 +00:00
Tom Hughes
b86390d303 Use a button element for button_to 2022-02-21 19:11:58 +00:00
Tom Hughes
999ebb1bf2 Default to not specifying media restrictions on stylesheet tags 2022-02-21 19:11:58 +00:00
Tom Hughes
04cb32b140 Enable verification of foreign keys in tests 2022-02-21 19:11:58 +00:00
Tom Hughes
fbd45a2ea0 Wrap test execution for better isolation 2022-02-17 19:30:19 +00:00
Tom Hughes
890569fba7 Enable some rails 7.x defaults 2022-02-17 19:18:03 +00:00
Tom Hughes
28900676f3 Default to allowing TLS for SMTP but without peer verification 2022-02-17 00:54:11 +00:00
Tom Hughes
aec7af87d7 Disable peer host name validation when sending email 2022-02-16 22:48:26 +00:00