Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
1,520 Commits 28 Branches 143 Tags 625 MiB
Commit Graph

107 Commits

Author SHA1 Message Date
Keegan McAllister 45387a8e63 Fix logout view 
Previously if you hit /accounts/logout with no ?next=... parameter, you would
see a broken version of index.html missing dynamic content.

(imported from commit d9bca92d1c3c82893524ba69b132d59c48aa34c9)
 2012-10-29 18:30:01 -04:00
Luke Faraone ee31a1b1a6 Allow people with confirmation IDs to register even under ALLOW_REGISTER 
External people won't be able to register unless we initiate the action
and send them an email, because the confirmation token generation code
is in the still-protected accounts_home view.

(imported from commit 8985257576d3dff5b0cad9d4b0ae213f18528865)
 2012-10-29 17:16:22 -04:00
Keegan McAllister 50e40d3f47 Remove comment about XFrameOptionsMiddleware 
We already set X-Frame-Options in nginx.

(imported from commit db2b51340e974f6775001f317dcbdda84be88e38)
 2012-10-29 16:14:40 -04:00
Keegan McAllister 0e03a7acc8 views.home: Use @login_required 
We can't use reverse() due to what amounts to a module import cycle.

(imported from commit 8a2904648173bc3e4ff2079d33320417b28518d3)
 2012-10-29 15:41:28 -04:00
Keegan McAllister 5353f5b3b0 Rename NOT_LOGGED_IN_REDIRECT -> HOME_NOT_LOGGED_IN 
If we have other pages that require login, we might want them to redirect to
the login form.  But the root of the site should take you to /accounts/home --
but only after we launch the product.

(imported from commit b5d10e1c908f1ffe1ee68c2689691ca66c896786)
 2012-10-29 15:41:28 -04:00
Keegan McAllister 7c790357a1 authenticate: Reject None for username or password, without a DB query 
(imported from commit dd76b174a806f9bf4a47f07f124321a025561183)
 2012-10-29 15:41:28 -04:00
Keegan McAllister 5ed13e9079 Remove inactive Django admin code 
These can only cause trouble.

(imported from commit 1def3234675c12461e9fc8b71c6b9e1b107edd1d)
 2012-10-29 13:56:09 -04:00
Keegan McAllister 92b10e3bc2 settings.py: Change deployed check 
This is security-critical so we have two checks.

(imported from commit adaa1cefe2d08526cdaac2fb0d8cc02773390224)
 2012-10-27 11:18:51 -04:00
Keegan McAllister 3e86da67f9 Set the CSRF token cookie as HttpOnly 
(imported from commit 0bf4239db085edcfc311efeb61da3ef409cc6206)
 2012-10-26 16:08:18 -04:00
Keegan McAllister 6f3b9ef00d Enable /terms and /privacy on the live site 
At Jeff's request.

(imported from commit 2cc25252e3183f858fcd63dddcc97573a5ac6082)
 2012-10-26 13:00:01 -04:00
Zev Benjamin 8a66d52228 Expose get_old_messages to API 
(imported from commit d3b86a049440c54b52d96c27f8925a73496eaffe)
 2012-10-26 10:42:11 -04:00
Keegan McAllister 2afa9894ce Add a draft privacy policy 
(imported from commit 4095e3bb72a5975b4353bf0eace9da48c0eec200)
 2012-10-25 19:11:28 -04:00
Jeff Arnold 5316fc9863 Rename tos -> terms in urls.py 
(imported from commit 5cb47202f62b500b2fdaa49b093830df279828b3)
 2012-10-25 16:07:18 -04:00
Keegan McAllister eef027560a Remove unused imports 
(imported from commit eb576627ff72e57fee0e3a4c357f51ad74cd6c86)
 2012-10-25 15:22:18 -04:00
Keegan McAllister f8540dcdae Wrap some other extremely long lines 
(imported from commit e7d55f318c8865ca953bf4520d1b07f7e84a4aeb)
 2012-10-25 15:22:18 -04:00
Zev Benjamin c4189d1029 Add get_old_messages json call 
This new call only allows fetching of existing messages.  The idea is
to remove this functionality from get_updates to simplify the backend
code.

(imported from commit 1345db2f1707e208e7c0bd08b7d444932c68b6a2)
 2012-10-25 12:10:44 -04:00
Keegan McAllister 6172f42b6b Add terms of service at /tos 
Based on Jeff's "Terms of Service.rtf"

(imported from commit 0ac24148cd963c65252c349556cb04aa4a1d79b2)
 2012-10-24 19:31:56 -04:00
Zev Benjamin 732ca19729 Synchronize the pointer across sessions 
The client may now optionally send its current pointer during
get_updates and the server will return the latest pointer if it
differs and was updated more recently by a different session.

(imported from commit e43b377d7dfb52f83cefb0b1003863d5407caf80)
 2012-10-22 16:44:57 -04:00
Jessica McKellar f5f3ffc6a9 Expose an API method for updating the pointer. 
(imported from commit 66d49c149e0bbc60e82a5967b77aff69629b09e7)
 2012-10-21 13:33:14 -04:00
Jessica McKellar 0fb836538d Add an API request for getting profile (specifically pointer) data. 
Mobile clients need it.

We are going to need to sit down and think about how much power we
want to give our API users, though. For example, should they even get
to know about your absolute pointer value (maybe they should only be
able to make requests relative to your pointer), or be able to request
very old ranges of messages?

(imported from commit 1680655f0d9a670bc0da0ddb92fbbd5cf851d3dd)
 2012-10-20 21:59:59 -04:00
Tim Abbott afd141a03e Use fast password hashing when replying old messages locally. 
Without this change, one can only create a few users per second(!),
which really puts a damper on quickly importing old messages.

(imported from commit 26daf61b57154daa067db3daf8254c12d23da353)
 2012-10-20 17:46:12 -04:00
Keegan McAllister f5d4471993 Only serve static files from Django if DEBUG = True 
(imported from commit 5028f9caf637e95aa83a0736bf11930357fc725e)
 2012-10-17 18:24:15 -04:00
Keegan McAllister 94f107e281 Log all requests 
runserver already prints them to the console, but runfcgi doesn't.

(imported from commit 3450e3fd65ef3990729c94e80dad4fc3c89f0e64)
 2012-10-17 18:23:02 -04:00
Keegan McAllister 122edf6a8c Tweak logging config 
(imported from commit 686a843c6ccbc2f514669bb7901daacbe639697c)
 2012-10-17 18:23:02 -04:00
Keegan McAllister ea916951f4 Disable notify_new_message calls in testing and populate_db 
(imported from commit 07a0fea4173e2e27a90ac5f111927f0000377764)
 2012-10-17 18:23:01 -04:00
Keegan McAllister a545876d56 Rename notify_waiting_clients -> notify_new_message 
We might have other URLs for other notifications.

(imported from commit 4c1c5fe2f039816fef4c268f34692ca4f19d81e8)
 2012-10-17 18:23:01 -04:00
Keegan McAllister c851bc4632 Generate initial API keys in the same manner as passwords 
(imported from commit 754fa391b441c520082650a0cf3bacf050bf81b3)
 2012-10-17 18:23:01 -04:00
Keegan McAllister cc8a14fcf8 Create accounts with passwords which are deterministic but hard to guess (from the outside) 
(imported from commit 964610fec6c4690c1e881f2bab252296663c819a)
 2012-10-17 18:23:01 -04:00
Keegan McAllister 1fded25025 Make redirects work properly behind a reverse proxy 
(imported from commit 7ffb0b10e796ab27a8a4d028195637c9dca74aa7)
 2012-10-17 18:23:01 -04:00
Keegan McAllister 5e70b5a291 Split off the Tornado code into a separate process 
(imported from commit 95dbd0f438cdba06d6e6c6c539a2a3d49c577cfd)
 2012-10-17 18:23:01 -04:00
Tim Abbott 758bbe6fc9 Rename api_fetch_key to api_fetch_api_key to match json methods. 
(imported from commit ed1c33f5017426dd38882c06ac38343451edb94b)
 2012-10-17 17:13:33 -04:00
Tim Abbott ae3e24458c Add a UI for requesting your API key. 
(imported from commit 07c40caf73f3b6c1c502a6c8e18109532dd28cc3)
 2012-10-17 17:09:46 -04:00
Keegan McAllister 8070680184 Set the 'secure' flag on Django cookies 
(imported from commit b563f62e2b185a8195daf212574c30f6e252900e)
 2012-10-17 16:53:26 -04:00
Luke Faraone 12bad46740 Introduce API method to return a user's API key by logging in. 
This makes it easier for mobile clients to use the API by enabling them to
present the user with a familiar username / password prompt, rather than
by asking them for their API key.

(imported from commit 6ed06cfe86f87e7aef54a4be7835fb7bf8d7f209)
 2012-10-17 15:33:05 -04:00
Keegan McAllister 62fad52ad6 Remove unused Django staticfiles app 
(imported from commit 275db1a8a752fe307d2b94aa83937ea96fab8a28)
 2012-10-17 15:27:29 -04:00
Keegan McAllister 8d4fefbe95 Remove Django staticfiles config 
We're not really using it, and it's misleading.

(imported from commit 4244934cdcc957b4e12184b935953830ac443280)
 2012-10-17 15:04:33 -04:00
Keegan McAllister 235ce960b8 Use the obfuscated URLs 
The key property is that we never reveal the non-public directory name
4nrjx8cwce2bka8r to a not-logged-in user.  This makes it less likely that
random people from the Internet will download all our client code while we're
still in private beta.

(imported from commit 7428e847e0a1a34152cb6dc2b677c1b47290c202)
 2012-10-17 15:04:33 -04:00
Keegan McAllister cfb72a7337 Add robots.txt 
For now, disallow everything.

(imported from commit fad7ba7ec28c86342a5c11bc721cdf45507c7c4f)
 2012-10-17 15:04:33 -04:00
Keegan McAllister b59e895bbf Remove favicon 
Browsers tend to cache these forever, and it's not our final logo.

(imported from commit 48e607c9e7ff95ee523dd339b3fcc9a1b189fa7f)
 2012-10-17 15:04:33 -04:00
Tim Abbott 7237b4a73e Fix sending to a stream with a space in its name. 
Previously if you tried to send to "a b", we actually ended up trying
to send to "a%20b", since we were url-encoding the stream name and
then not properly decoding it.

(imported from commit 307d2999bd309e47fc654ae4422ab4372edde064)
 2012-10-17 14:06:00 -04:00
Tim Abbott 3e994c16b7 Rename/reorganize our urls to be more consistent. 
(imported from commit ca3cc7ccd5d7da83a9c60968527378ee1118648e)
 2012-10-16 15:56:06 -04:00
Keegan McAllister 8819bdc0fc Hide most of the navbar on the deployed app 
(imported from commit 3b055588f7de805bf1b038f1bc6c03837eda010a)
 2012-10-15 18:44:36 -04:00
Keegan McAllister 489fd58e43 Hide register, confirm, etc. on the deployed app 
(imported from commit 8bcf84383d4ea4c24dfadaee330517bfc9801bbd)
 2012-10-15 18:44:36 -04:00
Keegan McAllister 1876995abb Redirect home to login on deployed server 
(imported from commit 9642a3c6b7b0b55cf5731cc2e241aed51431c8ae)
 2012-10-15 18:44:36 -04:00
Keegan McAllister 5141cd7ab9 Make a setting for where we redirect home for not logged in users 
(imported from commit 95bae4e52d8a8a34c001975e8d3547db5ba256a2)
 2012-10-15 18:44:36 -04:00
Keegan McAllister db0cf88cc0 Log additionally to a file server.log 
(imported from commit eabf9473ae04d4ff95652d4f8c8ab76f70157519)
 2012-10-12 18:01:51 -04:00
Tim Abbott fc99d2983a Add an API call to subscribe to a list of streams. 
(imported from commit 0a5d46d5f54fb4c8ebfad8c9adb777c0b4938dfa)
 2012-10-11 16:20:45 -04:00
Tim Abbott 83f494b1a4 Add API queries to show public streams and the user's subscriptions. 
(imported from commit 5f24e35a9bdd1e40406e2acb0c3713a6517d139b)
 2012-10-11 14:43:23 -04:00
Keegan McAllister 5a7ff70c11 Remove obsolete views 
This functionality is part of the home view now.

(imported from commit 5f0327eb62840bf98af49566e6f3c0b86ca43b8d)
 2012-10-11 11:23:22 -04:00
Tim Abbott b5bb6b9921 Rename test-settings.py to test_settings.py 
(imported from commit c9ad55821bc66a7c11668ac0b40ca13c2e05986e)
 2012-10-10 18:13:45 -04:00