Commit Graph

32 Commits

Author SHA1 Message Date
Anders Kaseorg 68cfcd6446 CVE-2020-9444: Prevent reverse tabnabbing attacks.
While we could fix this issue by changing the markdown processor,
doing so is not a robust solution, because even a momentary bug in the
markdown processor could allow cached messages that do not follow our
security policy.

This change ensures that even if our markdown processor has bugs that
result in rendered content that does not properly follow our policy of
using rel="noopener noreferrer" on links, we'll still do something
reasonable.

Co-authored-by: Tim Abbott <tabbott@zulipchat.com>
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2020-04-01 14:01:45 -07:00
Anders Kaseorg 59d55d1e06 js: Use modern spread arguments syntax.
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2020-02-11 17:43:35 -08:00
Steve Howell 3cc6ff5480 templates: Cache translations.
For Manage Streams, when we render the subscriptions
template, a significant amount of time is taken
by the "t" helper.

Obviously for the first call, we expect "t" to be
somewhat expensive, but subsuquent calls should be
fast, but i18next seems to have some overhead.
Also, we can save a tiny bit of overhead (marking it
as a safe string) that comes from our helper.

As an aside, are we sure it's ok to mark translations
as safe strings?

To test before and after, use blueslip.timings before
and after this commit.  When I tested with about 300
streams, the difference is pretty striking:

    without cache: 100ms
    with cache: 20ms

This is particularly interesting, since the subscriptions
templates have long strings for things like the SVG-based
checkmarks, but they're not really the bottleneck.

Unfortunately, this doesn't seem to be a huge win
elsewhere.  In some places we don't call "t", but of
course those might change in the future and benefit from
the cache.  And in other places we have smart widgets
that avoid rendering all N objects at one (e.g. buddy
list and list_render).

So this might be too big a hammer to speed up one
screen (albeit a really slow one).  It's possible
that we should simply move the i18n.t step **outside**
of certain templates to avoid doing them in a loop.
2020-01-15 18:01:59 -08:00
Dinesh c2e0c492f8 i18n: Fix translation of multi-line strings.
When strings are tagged for translation using `tr this`, the strings
were passed into the frontend i18n as-is (including new line and tab
characters that are not functional in the text, existing just to
format the HTML files reasonably).

This did not match the algorithm used in `manage.py makemessages` for
extracting strings for translation, which (correctly) removed that
whitespace to provide a good experience for translators.  The fix is
for the `tr this` implementation to use that same whitespace-stripping
algorithm.

Tested manually by checking if those strings that were not translated
earlier were translated, and also fixed an automated test that had the
wrong result, which should help prevent regressions.

Fixes #13389.
2019-11-20 10:58:15 -08:00
Anders Kaseorg 28f3dfa284 js: Automatically convert var to let and const in most files.
This commit was originally automatically generated using `tools/lint
--only=eslint --fix`.  It was then modified by tabbott to contain only
changes to a set of files that are unlikely to result in significant
merge conflicts with any open pull request, excluding about 20 files.
His plan is to merge the remaining changes with more precise care,
potentially involving merging parts of conflicting pull requests
before running the `eslint --fix` operation.

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2019-11-03 12:42:39 -08:00
Anders Kaseorg d17b577d0c js: Purge useless IIFEs.
With webpack, variables declared in each file are already file-local
(Global variables need to be explicitly exported), so these IIFEs are
no longer needed.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2019-10-25 13:51:21 -07:00
Anders Kaseorg adcfa68da8 templates: Remove partial helper.
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2019-07-12 21:11:14 -07:00
Anders Kaseorg db0b33842c templates: Replace templates.render with require calls.
This removes an unnecessary layer of indirection and allows webpack to
catch filename mistakes.

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2019-07-12 21:11:14 -07:00
Anders Kaseorg 3c3471b720 templates: Rename *.handlebars ↦ *.hbs and - ↦ _.
Tweaked by tabbott to avoid accidentally disabling the linter for
handlebars templates.

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2019-07-12 21:11:03 -07:00
Thomas Ip f6aaf43029 refactor: Use explicit path when referencing handlebars templates. 2019-07-02 16:23:30 -07:00
Thomas Ip 8c199fd44c webpack: Use handlebars-loader to handle frontend templates.
And remove the compile-handlebars-templates system.
2019-07-02 16:23:29 -07:00
Anders Kaseorg e8d49330f2 templates: Replace logic helpers with sensible logic helpers.
`if_not_a_or_b_and_not_c`?  Really?

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2019-06-26 12:03:53 -07:00
Yashashvi Dave 30821dbcbb handlebars: Register `if_equal` handlebar helper.
`if_equal` execute conditional code if both
conditions are equal in templates.
2019-06-24 14:46:45 -07:00
Shikhar Vaish 5ffca5e388 settings: Warn if server is unable to deliver mobile push notifications.
The "notification settings" page previously advertised support for
mobile push notifications via checkboxes, even if the server hadn't
yet been registered for push notifications.  This was a frequent
source of onboarding pain for new Zulip organizations.

We fix this by providing a clear warning and disabling the relevant
inputs on the settings pages.

Modified significantly by tabbott to correct some tricky logic errors
as well as some copy-paste bugs.

Fixes #10331.
2018-10-31 13:18:17 -07:00
Shubham Dhama d1c62369b7 templates: Add `is_false` handlebars helper.
There is need for such a helper because `unless` executes to be true even
when we haven't passed the context variable on which we are checking the
conditional statement.
2018-10-16 13:07:53 -07:00
Armaan Ahluwalia 6d255efe4c app: Prepare JS files for consumption by webpack.
This commit prepares the frontend code to be consumed by webpack.

It is a hack: In theory, modules should be declaring and importing the
modules they depend on and the globals they expose directly.

However, that requires significant per-module work, which we don't
really want to block moving our toolchain to webpack on.

So we expose the modules by setting window.varName = varName; as
needed in the js files.
2018-07-05 10:53:36 +02:00
Shubham Dhama dcb6254a4e eslint: Enable `no-extra-parens` rule.
Following sub-configuration is disabled:
                "nestedBinaryExpressions": false,
2018-06-11 07:51:24 -04:00
Yago González 67433691a9 templates: Fix typo in error message. 2017-06-26 19:33:25 -04:00
kevv87 e6369fc29b eslint: change no-plusplus from warning to 2 and fix violations. 2016-12-01 14:27:17 -08:00
Tim Abbott 30c654f83f templates: Fix stack traces throwing handlebars errors.
This fixes the fact that we weren't using `throw` correctly, and also
the "handlerbars" typo.

Fixes #2143.
2016-10-27 22:06:56 -07:00
acrefoot c671ae22d1 Error better when handlebars template is missing (#1338)
Currently if you try to use a non-existent handlebars
template, you get this error:

Uncaught TypeError: Handlebars.templates[name] is not a function

This change makes it a little more clear what the issue is
and what the fix would be.
2016-07-20 15:56:27 -07:00
Umair Khan 82b5d9304b [third] Integrate i18next with Handlebars 2016-05-19 22:58:25 -07:00
Kartik Maji 206452c867 Add stream subscription button added narrowed views.
Fixes: #273
2016-05-18 20:06:23 -07:00
Jessica McKellar c96ceeaea4 Add a handlebars helper for variadic compound OR conditions.
(imported from commit 9f08e998f9f699c05ccf3f5948fe3361a3834ba1)
2014-03-03 16:08:32 -05:00
Zev Benjamin 865c57fa72 Allow our template partials to take additional named arguments
(imported from commit 20e7dae7b5d27ee34936d400394357fc31c8e628)
2014-02-27 20:25:32 -05:00
Steve Howell 2504baf783 Use compiled.js in dev environments.
Make our dev setup more similar to prod by using compiled.js,
instead of AJAX-ing templates on the fly and compiling them
with non-node code.  This will make our dev environment more
consistent with prod (to avoid surprising bugs), plus it should
be faster (fewer AJAX calls).

This change also means we don't have to keep two copies
of static/third/handlebars/handlebars.js around.

(imported from commit d8d584b9aa13adcdcce7e424033610d77d2df79b)
2014-01-10 21:39:04 -05:00
Steve Howell c53845a69c Add unit tests for stream_list.
(imported from commit 1d04a2e6115f29b7949466260ec2ba3126b882e6)
2013-11-27 15:09:20 -05:00
Scott Feeney 967d0f7473 Don't wait for DOM ready to register Handlebars helpers
This fixes a bug (hit by a branch of mine) wherein you could not
render Handlebars templates from a DOM-ready callback in a file that
came before templates.js alphabetically.

(imported from commit 48091d016776eb6f12d33db199781e776af18fc5)
2013-08-27 15:32:20 -04:00
Jessica McKellar f7784a2f1d Add a handlebars helper for variadic compound AND conditions.
e.g., from a comment in the commit:

// Execute the conditional code if all conditions are true.
// Example usage:
//     {{#if_and cond1 cond2 cond3}}
//         <p>All true</p>
//     {{/if_and}}

We'll use this for the email forwarding UI, but it may also be
generally useful, and easy to generalize to OR.

(imported from commit da601f94d9da300213ff46be50255135c014eca0)
2013-08-13 14:28:47 -04:00
Kevin Mehall eac6463031 Implement message summarization experiment.
When you read messages in a narrow and then un-narrow, collapse
adjacent messages read in the narrow into a summary row that can
be clicked to expand those messages.

Scoped to staging with feature flags.

The implementation of this within our current MessageList is rather ugly.

(imported from commit bcb3a39d8c0c334136fe86318f18ead03f0f50bf)
2013-08-07 10:24:03 -04:00
Tim Abbott 5a320db3c1 Add curly braces for all javascript if statements lacking them.
(imported from commit 32c7643d1a6ecdfaf634424d217938c8a368dade)
2013-08-01 11:47:54 -04:00
Tim Abbott 3bba0cc927 Move zephyr/static to just static.
It's not really a part of the server (aka the rest of zephyr/).

(imported from commit 27f6b6b064938ad927075a68d873e4b68710d279)
2013-07-29 12:11:26 -04:00