Граф коммитов

11119 Коммитов

Автор SHA1 Сообщение Дата
Jesse Hallam
15f8656088 explicitly configure DisableLegacyMFA for TestCheckUserMfa (#10401) 2019-03-04 12:32:55 -05:00
Jesús Espino
43e6e261d6 MM-14357: Remove store call that can provoke dead locks (#10393)
* MM-14357: Remove store call that can provoke dead locks

* Simplify query

* Adding unit test
2019-03-04 17:52:26 +01:00
Jesse Hallam
46a035df79 skip TestUserLoginMFAFlow/WithCorrectMFA as it fails at random (#10390) 2019-03-04 07:38:55 -08:00
Jesse Hallam
55103b0a78 fix vettool; run vet on all available packages (#10389)
#### Summary
Unfortunately, `which shadow` didn't resolve to the shadow binary, so hard-code the expected path in `$GOPATH/bin`. At the same time, run `go vet` across both the server and enterprise (if present), reducing the number of required invocations.

This is accompanied by an enterprise change to fix shadowing issues there.

#### Ticket Link
N/A (tooling upgrade)

#### Checklist
- [x] Has enterprise changes: https://github.com/mattermost/enterprise/pull/403
2019-03-04 15:27:59 +01:00
Dan Maas
6903980152 Update NOTICE.txt (#10400)
- add new dependency (sqlx)
2019-03-04 14:08:27 +01:00
Lev
3ad901b50b MM-10516: Added support for PostActions in ephemeral posts (#10258)
* Added support for PostActions in ephemeral posts

The general approach is that we take all the metadata that DoPostAction
needs to process client DoPostActionRequests, and store it in a
serialized, encrypted Cookie field, in the PostAction struct.

The client then must send it back, and it is then used to process
PostActions as a fallback top the metadata in the database.

This PR adds a new config setting, `ServiceSettings.ActionCookieSecret`.
In a cluster environment it must be the same for all instances.

- Added type PostActionCookie, and a Cookie string to PostAction.
- Added App.AddActionCookiesToPost.
- Use App.AddActionCookiesToPost in api4.createEphemeralPost,
  App.SendEphemeralPost, App.UpdateEphemeralPost.
- Added App.DoPostActionWithCookie to process incoming requests with
  cookies. For backward compatibility, it prefers the metadata in the
  database; falls back to cookie.
- Added plugin.API.UpdateEphemeralPost and plugin.API.DeleteEphemeralPost.
- Added App.encryptActionCookie/App.decryptActionCookie.

* Style

* Fixed an unfortunate typo, tested with matterpoll

* minor PR feedback

* Fixed uninitialized Context

* Fixed another test failure

* Fixed permission check

* Added api test for DoPostActionWithCookie

* Replaced config.ActionCookieSecret with Server.PostActionCookieSecret

Modeled after AsymetricSigningKey

* style

* Set DeleteAt in DeleteEphemeralPost

* PR feedback

* Removed deadwood comment

* Added EXPERIMENTAL comment to the 2 APIs in question
2019-03-01 10:15:31 -08:00
Daniel Schalla
dcf611b735 [MM-14081] Disable checkMFA Endpoint by default and add tests for MFA login (#10356) 2019-03-01 18:56:11 +01:00
Carlos Tadeu Panato Junior
6a3fdbd489 update go to 1.12 (#10382)
* update go to 1.12

* update per feedback

* fix test

* revert test changes

* remove zap.AddCallerSkip(1)
2019-03-01 12:55:35 -05:00
Sandeep Sukhani
7f9e1273d7 [MM-12667] Allow including deactivated users in bulk import and export (#10353)
* [MM-12667] Allow including deactivated users in bulk import and export

1. Added `deleteAt` for user type import line
2. Adding deactivated users data in bulk export
3. Importing deactivated users data in bulk import

Added/Updated relevant test cases

* Fixed export of replies to posts by deleted users.
Updated tests for same
2019-03-01 15:50:24 +00:00
Daniel Schalla
7ac5715a02 [MM-14333] Stricten external HTTP Calls to require that own IPs need to be explicitly whitelisted (#10375)
* Stricten external HTTP Calls to require that own IPs need to be explicitly whitelisted

* gofmt

* Documentation; Style fixes for IsOwnIP function
2019-03-01 16:22:24 +01:00
Saturnino Abril
d85dff81a8 skip tutorial steps for sysadmin, user-1 and user-2 from generated sample data (#10387) 2019-03-01 20:11:38 +08:00
Daniel Schalla
a3ee3ac193 [MM-14313] Use LogAudit for Active/Deactive Action (#10357) 2019-02-28 23:30:26 +01:00
Christopher Poile
476a66099f [MM-11142] Console logging should be human readable during developmen… (#10352)
* MM-11142: Console logging should be human readable during dev #10349

* MM-11142: Console logging should be human readable during dev #10349
2019-02-28 11:42:56 -05:00
Christopher Poile
8bd182c38f MM-14145: The config store Set will now Save automatically (#10377)
* MM-14145: The config store Set will now Save automatically

When UpdateConfig (and configStore.Set) is called in admin.go and
config.go, commonStore.Set now takes a store-specific persist function.
It uses that persist function to save the configuration automatically.

Removed: Now callers do not have to call configStore.Save or
app.PersistConfig, and those functions have been removed.

Possible downside: this means a "failed to persist config" error can now
be thrown during a app.UpdateConfig or commonStore.Set call. But
considering application code never really sets a config without saving
it (except in the test cases, which were testing that -- see below), it
seems fine to group these responsibilities.

Also removed: tests for 'set without save'. Since that can not happen
anymore, the tests are not needed.

* Removed Save completely, cleaned up formatting, joined save test with
set tests.

* fixed shadowed variable error
2019-02-28 10:51:42 -05:00
Harrison Healey
06261d32ba MM-14082 Don't print warnings when saving duplicate metadata (#10376)
* MM-14082 Don't print warnings when saving duplicate metadata

* Fix order of arguments passed to assert.Equal
2019-02-28 10:32:52 -05:00
jfrerich
bbfcac84c9 [MM-13721] Fix the etag function GetEtagForProfilesNotInTeam (#10360)
* Initial solution for Draft PR

* Reformat tabs to spaces for readability

* Remove my comments and debugging lines for Core Commiter to see changes
more easily

* Remove all comments and show only code changes

* Match indentation spacing of new query to old query to make diff reading
easier for core committer

* Remove everything except what want to show core commiter

* Restrucure query and resulting etag value.
get number of users not in team from SELECT subquery.
etag return values is now of the form
<model.CurrenVersion>.<UpdateAt>.<number_profiles_not_int_team>

* Remove skipped test for solution to https://mattermost.atlassian.net/browse/MM-13721.
Remove comment for failing description of test
store u4 with prepended "u4".  Similar to u1, u2, u3.  This is easier
for debugging when looking in the database
Added skipped test:
  check that etag does not change when a user, not in team 1, is added
  to different team.  UpdateAt will change, but users in the set does
  not

* Remove skipped test for solution to https://mattermost.atlassian.net/browse/MM-13721.
Remove comment for failing description of test
store u4 with prepended "u4".  Similar to u1, u2, u3.  This is easier
for debugging when looking in the database
Added skipped test:
  check that etag does not change when a user, not in team 1, is added
  to different team.  UpdateAt will change, but users in the set does
  not

* remove commented out tests

* Restructure and simplify the SQL query for GetEtagForProfilesNotInTeam.
- Build the query to get all profiles not in a specified team
- select latest UpdateAt Value by getting Max value from UpdateAt field.
- select Number of profiles not in Team from count of the returned Ids

The previous query required building a complex query with multiple
joins and repeated code in a select subquery, and derived table

* Format SQL styling indentation, spaces around equal signs, and new lines

* Add description for skipped test
2019-02-27 18:51:06 -08:00
Jesse Hallam
4f259970e6 MM-14194: fix subpath csp directive until server restart (#10365)
* MM-14194: fix subpath csp directive until server restart

The SiteURL organically doesn't take effect until server restart, but in v5.8, the required CSP directive would change immediately. If changing from one subpath to another, the webapp would effectively be bricked until a server restart.

Avoid this by determining the CSP directive when the static handler is created.

* simplify access to config
2019-02-27 14:53:53 -05:00
Dean Whillier
df6b8ff768 [MM-13158] Initial attempt at extracting SVG dimensions (#10332)
* initial attempt at extracting svg dimensions

* rafactor SVG dimensions extraction

* pass SVG parsing errors to calling context

* tweaks to svg parsing placement

- also stopped trying to pre/post process SVG’s as images

* add svg parsing tests

* updates for PR change requests

* code review updates

* correct a conditional typo
2019-02-27 14:06:56 -05:00
Miguel de la Cruz
4013e77e3e [MM-13810] Modifies invalid parameter error message for update post and team (#10361) 2019-02-27 14:02:21 +00:00
Jesús Espino
9052d81790 MM-13817: Increase the time limit of tokens existency from 24h to 48h (#10318) 2019-02-27 12:44:46 +01:00
Jesse Hallam
e1ed46605a use hard-coded names for saml certificates (#10341)
This preserves the ability to use custom file names -- required for backwards compatibility -- but forces names upon all newly uploaded certificates, avoiding clashes with other configuration files and skipping the need for file safety checks.
2019-02-26 12:17:49 -05:00
Jesse Hallam
72448d12a9 deprecate timezones.json (#10311) 2019-02-25 12:07:45 -04:00
κουκουλοφόρος
5b24c44e19 Add missing transaction rollbacks for SQL store (#9964)
* Add missing transaction rollbacks for SQL store

* Add `defer transaction.Rollback()` in SQL stores.

* abstract finalizeTransaction
2019-02-23 11:44:52 -08:00
Shobhit Gupta
b4d645f121 [MM-13746] Add GetTeamMembersForUser and GetChannelMembersForUser apis (#10269)
* Add GetTeamMembersForUser and GetChannelMembersForUser apis

* Address comments

* Fix tests

* Fix test

* Fix comment

* Fix minimum server version

* Change to []*model.ChannelMember

* Fix panic, add more tests

* Remove print statement
2019-02-23 11:41:19 -08:00
Daniel Schalla
0e50ec6a35 Use LogAudit instead of LogAuditWithUser for role/auth provider modification (#10312) 2019-02-22 16:20:59 +01:00
Jesse Hallam
7150b9aada einterfaces: simply saml.ConfigureSP error handling (#10306) 2019-02-21 09:51:25 -08:00
Katie Wiersgalla
659af08ee4 Update PRIVACY_POLICY.md (#10287) 2019-02-21 10:30:35 -05:00
Angela Chang
1018ead619 [MM-8421] Fix tiff preview - backend (#10170) 2019-02-21 09:06:59 +01:00
Daniel Schalla
26d3362eca Invalidate password recovery tokens on eMail change (#10302) 2019-02-21 00:48:28 +01:00
Daniel Schalla
ab812207ab [MM-13610] Fix Login Hooks for SAML (#10288)
* Fix Login Hooks for SAML

* Update unit tests

* Delete extra whitespace

Co-Authored-By: DSchalla <daniel@schalla.me>
2019-02-20 18:04:50 +01:00
Daniel Schalla
166ab15f38 Check whether self-deactivation is enabled in delete handler (#10300) 2019-02-20 16:56:26 +01:00
Daniel Schalla
f046163a12 [MM-13840] Change eMail as a post-verification action (#10253)
* Change eMail as a post-verification action

* Fix broken test

* comment for special behavior, tests

* govet

* Check for already existent eMails when require email verification is turned on before accepting update
2019-02-20 15:50:52 +01:00
Daniel Schalla
1218e774ba Make CSRF Logging less verbose if not enforced (#10279) 2019-02-20 15:21:19 +01:00
Hanzei
b057e9feef Let stale bot ignore pr further in the lifecycle (#10294)
* Let stale bot ignore pr further in the lifecycle

* Update per feedback
2019-02-19 09:21:33 -05:00
Carlos Tadeu Panato Junior
4646c38295 Dbups (#10297)
* upgrade db to 5.9

* Prepare db upgrade to 5.10
2019-02-19 09:20:37 -05:00
Sandeep Sukhani
29060acb45 [MM-13828] Initialize tests in each package with a new temp folder with all test resources (#10261)
* [MM-13828] Running tests from a new temp folder with all test resources

Possible fix for #10132

All packages which have a TestMain and use testlib.MainHelper will have a new current working directory which will have all the test
resources copied.

Note: default.json is copied as config.json as well to make sure tests don't have any impact due to changes in config by devs

* [MM-13828] Added TestMain to remaining packages to use testlib.MainHelper

This makes sure tests from all packages run with same test resources, setup in a new temp folder for each package

* Updated Jenkins file to not not config/default.json

This makes sure CI has same config files as a dev's machine

* [MM-13828] Changes requested from code review

Added accessor methods to testlib.MainHelper for accessing members
Fixed some broken tests due to change in cwd while tests run
Some other code refactoring and improvements

* [MM-13828] Added new factory method with options for creating test main helper and some code refactoring

testlib.NewMainHelperWithOptions supports options to turn on/off test dependencies and environment setup
Some other code refactoring

* Exporting members of testlib.MainHelper to make enterprise tests work

* Fixed gofmt error

* [MM-13828] removed unwanted dependency on plugins directory while setting up test resources

* [MM-13828] Fixed some tests failing due to them being running from temp folder

* [MM-13828] Some code changes suggested in PR review

* Fixed gofmt error
2019-02-19 09:20:11 -05:00
Adzim Zul Fahmi
f4249b5456 [MM-12304] Add channel search support in mattermost cli (#10093)
#### Summary
add command search on channel group.
it could search channel by name or id in general
and search channel with team by team name or id

#### Ticket Link
Fixes https://github.com/mattermost/mattermost-server/issues/9491
https://mattermost.atlassian.net/browse/MM-12304

#### Checklist
- [x] Added or updated unit tests (required for all new features)
2019-02-19 07:42:30 +01:00
Jesse Hallam
9bf5687311 MM-11262: database config store (#10281)
* vendor github.com/jmoiron/sqlx

* MM-11262: introduce a database store

* revert unnecessary fmt.Errorf

* simplify unit test helper methods

* remote TODO re: retry

* relocate initializeConfigurationsTable for clarity

* factor out a commonStore

* acquire database config lock on close for safety

* add missing header

* fix lock comment
2019-02-15 10:05:29 -04:00
Carlos Tadeu Panato Junior
898a3a289c add stale bot (#10143)
* add stale bot

* update per feedback

* update per feedback
2019-02-15 14:25:29 +01:00
Shreyansh Chouhan
39ceaa3e86 [MM-13833] Configured unit tests to log through t.Log (#10272)
* Rerouted the unit test logs through t.Log

* resolving merge confilvts

* Update testing.go

* Update helper_test.go

* Added godocs for NewTestingLogger

* Added go docs for NewTestingLogger

* Resolving conflicts
2019-02-14 13:52:11 -04:00
Daniel Schalla
a6d0b73c0d Keep current eMail verification status when updating the user password (#10284) 2019-02-13 22:08:37 +01:00
Carlos Tadeu Panato Junior
42356bc74f add codecov back (#10215)
* add codecov back

* add token

* remove option

* update codecov

* upddate codecov

* add back threshold

* add some configs

* update per feedback

* add error fallback

* fix error

* testing
2019-02-13 15:32:12 -04:00
Jesse Hallam
cd5d5f832c MM-14052: fix subpath yet again (#10278)
* MM-14052: fix subpath yet again

The server now emits a script-src directive that overrides the root.html
rewrite. Fix this by emitting the requisite sha-256 hash server-side as
well as rewriting root.html. We can't remove the root.html rewrite,
since the assets may be on a CDN instead and we use the same code path
to rewrite them (on demand).

Prior to this change, going from / -> /subpath -> / would leave changes
in root.html: the Content-Security-Policy header would still have the
sha-256 hash, and the inline script would still override the publicPath
but to the default subpath value. To avoid sending down a sha-256 hash
server-side when no subpath is required, change this to fully strip out
the subpath changes. This is the only unit test change, as the existing
coverage proves the algorithm still works.

* fix subpath concatenation in test

path.Join isn't meant to work with a URL + path, and my test was effectively working with the subpath "/localhost:8065/subpath" instead of just "/subpath". The CI servers presumably caught this due to a different configuration than my local development.
2019-02-13 11:30:02 -04:00
Miguel de la Cruz
e9089acb6c Logs the errors when indexing and deleting posts with elasticsearch (#10282) 2019-02-13 16:17:59 +01:00
Daniel Schalla
e8e4e94b37 Fix out of range error if Search Replicas > Replicas (#10280) 2019-02-13 12:47:55 +01:00
Andrew Braunstein
c08fda1337 Added the SearchPostsInTeam method to the plugin API (#10106) 2019-02-13 07:41:32 +01:00
Harrison Healey
87e36a3ecf MM-14146 Update CSP for local image proxy (#10277) 2019-02-12 15:27:17 -05:00
Jesse Hallam
285b646d67 MM-13893: introduce file store (#10243)
* config file store

Introduce an interface and concrete implementation for accessing the config.

This mostly maps 1:1 with the exiting usage in `App`, except for internalizing the watcher. A future change will likely eliminate `App.PersistConfig()` and make this implicit on `Set` or `Patch`

* experimental file test changes

* emoji: move file driver checks from api4 to app

It is no longer possible to app.UpdateConfig and provide an invalid configuration, making it hard to test this case. This check doesn't really belong in the api anyway, since it's a configuration validity check and not a permissions check. Either way, the check now occurs at the App level.

* api4: generate valid public link salts for test

* TestStartServerRateLimiterCriticalError: use mock store to test invalid config

* remove config_test.go

* remove needsSave, and have Load() save to the backing store as necessary

* restore README.md

* move ldap UserFilter check to model isValid checks

* remove databaseStore until ready

* remove unimplemented Patch

* simplify unlockOnce implementation

* revert forgetting to set s.Ldap

* config/file.go: rename ReadOnlyConfigurationError to ErrReadOnlyConfiguration

* config: export FileStore

* add TestFileStoreSave

* improved config/utils test coverage

* restore config/README.md copy

* tweaks

* file store: acquire a write lock on Save/Close to safely close watcher

* fix unmarshal_test.go
2019-02-12 10:19:01 -08:00
Christopher Speller
9cfcab2307 MM-14039 Improving password lockout functionality. (#10254)
* Improving password lockout functionality.

* Switching order of mfa password checks to passowrd -> mfa
2019-02-12 07:56:41 -08:00
Jesse Hallam
3a71709103 MM-13893: refactor config (#10230)
* refactor utils/config* to config/

* pull validateLdapFilter into app

* clean up Config/GetConfig/GetSanitizedConfig usage

Eliminate app.GetConfig() in favour of just using app.Config() directly,
but expose app.GetSanitizedConfig() for when the old behaviour was
required.

* web: isolate config setup

* TestInvitePeopleProvider: make config explicit

* regenerateClientConfig: avoid racey map access

* integrate watch flag into app.ConfigFile option

* make app.Option return an error

* release.mk: only cp static files from config/

* release.mk: fix cp static files from config/

* api4: TestPlugin cleanup

* s/c/cfg/ for clarity

* fix merge conflict

* testlib: allow customization of testlib driver name
2019-02-12 08:37:54 -05:00