With webpack, variables declared in each file are already file-local
(Global variables need to be explicitly exported), so these IIFEs are
no longer needed.
Signed-off-by: Anders Kaseorg <andersk@mit.edu>
Bootstrap v2.2.0^2~40^2~6 changes this default to false, so this is a
prerequisite to upgrading Bootstrap, and it’s also safer.
This closes an HTML injection path via user full names in the emoji
reaction tooltip. It doesn’t appear to be exploitable for cross-site
scripting because we disallow `>` in full names, and the code happens
to be written such that the next `>` is in a different parser
invocation.
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
This commit achieves two things:
1. Changes the UI of the "Create stream" form to make the
textarea previously used to get the stream description
a simple input field of type text (to suggest a single
line description).
2. Adds an extra check on the frontend side to make sure that
when users create a new stream via. the "Create stream"
option in the settings panel, they can't enter any newline
characters (i.e. we disallow the enter key from being
registered when typing out the stream description).
We must also make sure that they cannot copy-and-paste over
descriptions containing newline characters.
resolves#11617
This fixes a bug where hitting the "n" hotkey was
causing double work related to the hashchange system.
The code is now organized like this:
do_open_create_stream() does the GUI piece
We call the above directly for hash changes.
For in-app actions, whether clicks or hotkeys,
we call open_create_stream(), which delegates
most of the work to do_open_create_stream() but
also updates the hash.
Function `update_announce_stream_state` is used to update announce-stream
checkbox. If stream is private announce-stream checkbox gets disabled
by this function.
There are unncessary calls to `update_announce_stream_state` fuction.
i.e. it is called
- when user clicks on `copy-from-stream` link to toggle streams-list
- when stream-checkboxes value is changed to copy subs from stream
- when user-filter value is changed to search users
These events does not affect announce-stream value, therefore
there is no need to call this function to update it.
Currently in create new stream form, announce_stream option isn't get
disabled for private stream with public history.
This commit fixes the above issue.
This commit prepares the frontend code to be consumed by webpack.
It is a hack: In theory, modules should be declaring and importing the
modules they depend on and the globals they expose directly.
However, that requires significant per-module work, which we don't
really want to block moving our toolchain to webpack on.
So we expose the modules by setting window.varName = varName; as
needed in the js files.
This commit fixes a regression which was introduced while
we were removing icon-vector and replacing the same with
font-awesome. We forgot to update the toggle icons from the
JS file.
The user can now specify the value while creating a stream.
An admin can later change it via `Change stream permissions`
modal. Add is_announcement_only to subscription type text.
This is preparation for enabling an eslint indentation configuration.
90% of these changes are just fixes for indentation errors that have
snuck into the codebase over the years; the others are more
significant reformatting to make eslint happy (that are not otherwise
actually improvements).
The one area that we do not attempt to work on here is the
"switch/case" indentation.
This commit is similar to the prior commit, in that we are
more disciplined about setting up handlers. We set them up right
as the widgets get rendered, and the handlers only delegate
up to the container div (id="stream_creation").
We now wire up the handlers that correspond to elements in
the 'new_stream_users' template when we render that template,
rather than at startup time.
We also delegate the events only up to #people_to_add, rather
than all the way up to body/document.
Only allow realm admins to create stream without subscribing
themselves, restrict non realm admin users.
This new restriction is only for the UI; we don't actually block it at
the backend/API level (one could always create and then remove oneself
anyway).
Restrict users(even realm admins) from creating stream with zero
subscribers only in UI.
In backend, if subscribers are zero, we automatically subscribe
current user to stream.
Add div element to inform user whether stream is successfully
created or not. This will help to inform user in case if current
user is not subscribed to created stream.
Add a spinner for when a stream is being created to show that
an operation is being performed, while also disallowing users to
modify the form in the meanwhile.
Commit modified by Brock Whittaker <brock@zulipchat.com>.
Fixes: #5268.
Our current workflow for creating a new stream allows the user to
invite as many other users as they like but since there can be
mistakes in doing so, we now open a modal with a warning if the
number of invites are more than 100 just to confirm that user indeed
wanted to do this.
Fixes: #1663.
When you create a stream, there was always an "Announce stream"
option that would be enabled for public streams.
We are about to make it so that we never send PMs to announce
new streams to folks, so the only mechanism will be sending a message
to the realm's notification stream. If a realm has no notifications
stream, the decision is moot, so we hide the option.
The function check_stream_existence() temporarliy got moved
to stream_create.js, and our call from compose.js was still trying
to find it in subs.js. Now we move the function to compose.js,
since we no longer use it stream_create.js.
This function is pretty dubious, and we may want to only check
for duplicate stream names locally.
When the user creates a stream, we no longer do a synchronous
check on the back end to find if the stream name already exists.
Instead, we only check our local data, which will prevent many
typical errors, and then we let the back end capture duplicates for
stream names that the client doesn't know about.
We also tone down errors when the stream name is blank--we
only whine about empty streams right before submitting the form.
Also, since our check for duplicate streams is less expensive,
we now capture the "input" event instead of the "focusout" event,
so that if you fix up the name to avoid a collision, you get more
immediate feedback.
When we do detect stream name errors, we conveniently focus the
text field to let the user correct the problem.
This new modules handles the UI to create streams. It mostly moves
code from subs.js.
It introduces an API around what used to be called meta.stream_created:
reset_created_stream()
set_name()
get_name()
It only partially moves new_stream_clicked().
Anders Kaseorg
Hemanth V. Alluri
Steve Howell
Yashashvi Dave
Armaan Ahluwalia
Akash Nimare
Shubham Dhama
Shubham Padia
Eeshan Garg
Tim Abbott
Greg Price
Rhea Parekh
Cynthia Lin
Angelika Serwa
Brock Whittaker
Harshit Bansal
Steve Howell