1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-14 19:02:41 +01:00
Commit graph

274 commits

Author SHA1 Message Date
Chad Little
a89483ee5b [Redesign] Swap Slabo for Roboto Slab
Summary: Ref T8099, Moving to Roboto Slab for Document Headers. It's a little less serif-y and fits well with Lato. Also took a pass at cleaning up edge cases in Documents, Diviner, Phriction, Legalpad, and Welcome Screen.

Test Plan: Test Phriction, Diviner, Legalpad, Welcome Screen

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Maniphest Tasks: T8099

Differential Revision: https://secure.phabricator.com/D13439
2015-06-25 09:20:51 -07:00
epriestley
bb58a123e6 Modularize Celerity postprocessors
Summary: Not sure if we want this, but it seems to work fine.

Test Plan: {F516736}

Reviewers: joshuaspence, chad

Reviewed By: joshuaspence, chad

Subscribers: joshuaspence, epriestley

Differential Revision: https://secure.phabricator.com/D13363
2015-06-20 06:10:42 -07:00
Chad Little
b942075205 [Redesign] Darken things when dark header is used
Summary: Ref T8099, uses original bgcolor when dark headers are used.

Test Plan: Switch between light and dark Phabricator, see new colors.

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Maniphest Tasks: T8099

Differential Revision: https://secure.phabricator.com/D13361
2015-06-20 13:16:47 +01:00
Chad Little
3846a00916 [Redesign] Fix alignment of icon/grip on ObjectList
Summary:
Ref T8099, these should sit in a 4px gutter.

Also:
- remove bad route on feed
- Fix issue with custom logos
- Fix unit error

Test Plan: Review on dashboards and on Maniphest homepage

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Maniphest Tasks: T8099

Differential Revision: https://secure.phabricator.com/D13310
2015-06-16 13:09:48 -07:00
Chad Little
b3523adff4 [Redesign] Use Slabo font for headers, Remove Oswald
Summary: Couple of reasons here. Mainly, we're looking at Serif fonts for Phacility, so having headers tie back seems worth exploring. Also Oswals was a bit heavy, and in trying to find a replacement with similiar distinction, was unable to find anything suitable. Trying out Slabo here and have been pleasantly surprised how well the Serif/Sans-Serif combination works here, typographically.

Test Plan:
Test Objects, Documents, and Dashboards.

{F500207}

{F500208}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Differential Revision: https://secure.phabricator.com/D13279
2015-06-14 17:35:01 +01:00
Chad Little
9170e90112 [Redesign] Move basefont to Lato, remove Source Sans Pro
Summary: Working towards a more unified look and feel. This brings in Lato as a complete base font over Helvetica Neue, as well as removing Source Sans Pro from DocumentView and Conpherence. Design-wise Lato provides the nice readability at larger font sizes that Source Sans Pro did, with the ability to scale down to tables and UI widgets with ease. This gives us one font instead of two, and now Object descriptions and Timeline posts all can benefit from a consistent, readable font.

Test Plan:
Test main UI, smaller elements like tables, menus, DocumentViews, Previews, Conpherence.

{F498135}

{F498136}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: epriestley, Korvin

Differential Revision: https://secure.phabricator.com/D13276
2015-06-13 20:32:45 +01:00
Chad Little
274cbf3cdb [Redesign] Uh... Add back gradient headers?
Summary: Ref T8099, hashtag#yolo. Adds back the original gradients plus a 'light' theme. Unclear which should be default, but we can play with it until a decision needs to be made.

Test Plan: Change colors a lot, turn on durable column.

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T8099

Differential Revision: https://secure.phabricator.com/D13146
2015-06-03 20:21:12 -07:00
Chad Little
e81ec738f3 [Redesign] Add back limited header-color options
Summary: Ref T8099. Adds back basic header color options, which change the logo color instead. Also RAINBOW.

Test Plan:
tested each of the new colors.

{F442284}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T8099

Differential Revision: https://secure.phabricator.com/D13040
2015-05-27 14:56:21 -07:00
epriestley
bfca11dbba Merge branch 'master' into redesign-2015 2015-05-22 12:57:32 -07:00
Joshua Spence
36e2d02d6e phtize all the things
Summary: `pht`ize a whole bunch of strings in rP.

Test Plan: Intense eyeballing.

Reviewers: #blessed_reviewers, epriestley

Reviewed By: #blessed_reviewers, epriestley

Subscribers: hach-que, Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12797
2015-05-22 21:16:39 +10:00
Chad Little
ed8118d50c [Redesign] Remove gradient headers
Summary: Ref T8099, this removes the gradient headers and their edge cases in Pinboard View, Setup Issues, Exceptions, and Document Heiriarchy.

Test Plan:
Tested each of these, grep for "gradient" and verify all states are gone.

{F410708}

{F410709}

{F410710}

{F410714}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T8099

Differential Revision: https://secure.phabricator.com/D12944
2015-05-19 19:38:34 -07:00
Chad Little
d714f3273f [Redesign] Update Durable Column header
Summary: Shares more CSS between header styles, unifies the look. Ref T8099

Test Plan: Open and Close Durable Column a lot. Inspect pixels.

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T8099

Differential Revision: https://secure.phabricator.com/D12877
2015-05-16 07:53:03 -07:00
epriestley
b1b97dddc7 Merge branch 'master' into redesign-2015 2015-05-14 09:50:21 -07:00
Joshua Spence
acb45968d8 Use __CLASS__ instead of hard-coding class names
Summary: Use `__CLASS__` instead of hard-coding class names. Depends on D12605.

Test Plan: Eyeball it.

Reviewers: #blessed_reviewers, epriestley

Reviewed By: #blessed_reviewers, epriestley

Subscribers: hach-que, Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12806
2015-05-14 07:21:13 +10:00
epriestley
c94bd8e4f2 Stop using JX.Scrollbar for main page content
Summary:
Ref T8151. This is option (5). It needs a few adjustments but feels pretty good. Major issues are:

  - Without a mouse, the scrollbars overlap by default, so we //must// move the column off the right margin.
  - Scrolling sometimes "bleeds" between the chat vs the main frame in a way that's not as discrete as the old framed content, but feels generally reasonable to me.

If we pursue this, I'd plan to make these additional changes:

  - Move the panel away from the right margin only if the page scrollbars are zero-width (i.e., in OSX trackpad mode).
  - Fix the notch in the upper right corner when the chat is moved away from the right margin.
  - Probably remove the body "overflow-y: scroll" on Conpherence and Workboards.
  - Update the resizing code to deal with 300px vs 315px widths.
  - We can probably clean up some JX.Scrollbar "main panel" code.

Here's the "bad" case, where I've visually separated the column to provide room for a scrollbar. This isn't ideal, but looks and feels OK to me:

{F398375}

Test Plan:
  - Tried Firefox, Chrome, Safari, with and without a mouse.
  - Tried normal Conpherence.

Reviewers: btrahan, chad

Reviewed By: btrahan

Subscribers: avivey, epriestley

Maniphest Tasks: T8151

Differential Revision: https://secure.phabricator.com/D12789
2015-05-11 12:02:00 -07:00
Chad Little
476b7ef816 Redesign main header
Summary: First cut of redesign branch, simpler, lighter header. Will check in new graphics in follow up diff.

Test Plan: Mostly all just new colors, but this also removes setting of `header-color` in Config.

Reviewers: epriestley, btrahan

Subscribers: Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12745
2015-05-07 10:59:57 -07:00
Bob Trahan
b199f7066c Conpherence - add support for linking directly to messages regardless of age of message
Summary: Fixes T7757. Since anchor links can't be processed server side, we have to detect the message is old in javascript, then re-loaded the page. This opens up a new corner case where we have to paginate in newer messages, so this also adds support for that.

Test Plan:
- set main query limit to 8 and then visited ZXX#YYY. noted a second quick load of YYY, that YYY ended up highlighted and scrolled to.
- used "show newer messages" and "show older messages" successfully, taking care to make sure transaction ids were all correct with no off by one errors, etc.
- opened and closed durable column to make sure that still works too

Reviewers: chad, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7757

Differential Revision: https://secure.phabricator.com/D12633
2015-04-30 16:54:57 -07:00
Bob Trahan
00f864b359 Quicksand - fix project board page and quicksand
Summary: Fixes T7913. Collapse the separate board dropdown into the board projects behavior; we always need that anyway and now we can install the listener more granularly.

Test Plan:
 - visted project board
 - invoked create task, cancelled dialog
 - visited project feed
 - visited project board
 - invoked create task, cancelled dialog (FAILED pre patch...!)

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7913

Differential Revision: https://secure.phabricator.com/D12599
2015-04-28 14:51:49 -07:00
epriestley
ae192e5328 Always render extra menu nodes, even when logged out
Summary:
Fixes T7915. This code is a little janky, but make it work for now.

Currently, we render "extra" nodes (dropdowns, etc) only if the user is logged in.

Instead, always render them.

Test Plan:
  - No more "phabricator-help-menu" error in console when logged out.
  - Search selector now works when logged out.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T7915

Differential Revision: https://secure.phabricator.com/D12572
2015-04-27 08:15:51 -07:00
epriestley
0b309b6193 Update the search scope selector after Quicksand navigation
Summary:
Fixes T7900.

  - Update the hidden form input so the current application is searched.
  - Update the menu icon.
  - Update the button icon, if "Search Current Application" is selected.

Test Plan:
  - Navigated between applications with Quicksand.
    - Observed button icon update.
    - Observed menu icon update.
    - Observed results being scoped to the correct application.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T7900

Differential Revision: https://secure.phabricator.com/D12540
2015-04-24 14:20:48 -07:00
epriestley
6f1b39c0b8 Fix call to isGlobalDragAndDropUploadEnabled() from pages with no controller
Summary: Fixes T7902. Some kinds of error pages, including the 404 page, may not have a controller when they reach this method.

Test Plan: Hit 404 page.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T7902

Differential Revision: https://secure.phabricator.com/D12538
2015-04-24 09:11:09 -07:00
Bob Trahan
a903eb2def Quicksand - make things work properly with high security mode
Summary: Fixes T7064. We need to pass the quicksand magic request variable around and then instrument the javascript to handle quicksand page loads.

Test Plan:
Enabled two factor auth on my account and then

 - visited password page
 - filled out 2 factor auth request
 - saw high security bubble
 - clicked about still seeing high security bubble
 - refreshed page and still saw security bubble
 - dismissed bubble by following through workflow after clicking bubble

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7064

Differential Revision: https://secure.phabricator.com/D12536
2015-04-23 16:37:56 -07:00
Bob Trahan
e40aa8f782 Quicksand - make things work correctly with global drag and drop upload
Summary: Fixes T7685. This required making the global drag and drop behavior able to "uninstall" itself so to speak, and then it re-installs it self as necessary.

Test Plan:
Did the following all successfully

 - uploaded a file to homepage
 - homepage -> differential -- no way to upload via drag and drop
 - homepage -> differential -> homepage -- uploaded a file
 - homepage -> differential -> browser back button to homepage -- uploaded a file

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7685

Differential Revision: https://secure.phabricator.com/D12534
2015-04-23 15:08:35 -07:00
epriestley
4d2210a9f0 Write a search user guide
Summary: This covers some of the basics and explains the not-entirely-obvious rules for global search.

Test Plan:
  - Read document.
  - Clicked new help menu link.
  - Clicked link from "advanced function help".

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D12517
2015-04-22 18:25:00 -07:00
Chad Little
636e5dfda9 Tweak uber search dropdown styles
Summary: Moved the dropdown outside of the input to give text more space. Also changed the 'current app' icon to the target icon, it feels a little better in use. I will follow up with a fix to T5218.

Test Plan:
Tested desktop, mobile, tablet searching.

{F379466}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12516
2015-04-22 17:56:47 -07:00
epriestley
b5b8d0982c Make "Current Application" imply "Open documents in..."
Summary: This is probably consistent with user intent like 95% of the time, let's try making it default and documenting it.

Test Plan: Searched in "Current Application" in Maniphest.

Reviewers: chad

Reviewed By: chad

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D12512
2015-04-22 16:34:43 -07:00
epriestley
3a2c2ae3c3 Implement a scope selector for the global search
Summary:
See M1433. Fixes T7266. Fixes T4475. Ref T7314.

Future work/notes/etc:

  - Write the User Guide (see TODO).
  - This might needs some design tweaks -- I think it's functionally almost-equivalent to the mock, but the UI isn't quite the same.
  - (Mobile design is a touch off-looking I think?)
  - When you use a custom query, the duplicate "magnifying glass" icons are a little weird. Maybe change one or the other.
  - Maybe worth adding an "Open Documents in Current Application" option? Planning to wait for feedback on that.
  - Need a Quicksand integration to change the current application at some point.
  - Searching in "Current Application" from, e.g., the 404 page just searches all documents. Current plan is to just document this behavior, since the icon is a pretty good callout and it seems plausible that this is intuitive enough that users won't have a hard time with it.

Test Plan:
New dropdown:

{F379150}

Device-ish:

{F379151}

Normal search (current application, from maniphest, selects tasks):

{F379153}

Application search from non-application:

{F379154}

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: johnny-bit, epriestley

Maniphest Tasks: T7266, T7314, T4475

Differential Revision: https://secure.phabricator.com/D12509
2015-04-22 14:31:36 -07:00
Bob Trahan
688c506ecf Quicksand - update help appropriately as you navigate about
Summary: Fixes T7724. Things are a bit tricky here as sometimes we don't want to display the help icon at all...! Change things such that we always render at least the icon, though it may have the style set to hidden if appropriate. Instrument quicksand javascript to then load the proper help dropdown if it can. Do this generally so other aphlict dropdowns could work pretty easily.

Test Plan: started on home and noted no help. clicked maniphest and saw maniphest help. clicked home and saw no help again. clicked differential and saw differential help.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7724

Differential Revision: https://secure.phabricator.com/D12499
2015-04-22 12:05:27 -07:00
epriestley
e7702acdc6 Don't escape quotation marks when printing the monospaced CSS rule
Summary:
Fixes T7888. This is currently safe, but double quotes are incorrectly escaped.

To keep them unescaped, we have to punch through PhutilSafeHTML a bit. Since the allowable characters are strictly filtered this is still safe in practice, just not as theoretically-safe.

Test Plan: Set font to `32px "impact"` (with quotes), saw impact font.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Maniphest Tasks: T7888

Differential Revision: https://secure.phabricator.com/D12506
2015-04-22 09:28:35 -07:00
Bob Trahan
dd9ec255ec Quicksand - make notification and message counts update as you navigate around
Summary: Ref T7573. Unify code to fetch these counts and do some light formatting since we're going to need to do the same thing for some conpherence-specific ajax in the durable column (See T7708).

Test Plan: loaded up two tabs, one with a durable column on and one without. in the without browser, i read some messages, decrementing my unread count. when i navigated again in the durable column browser, the count updated correctly. with no notifications, commented on a task with another user to get a notification and it showed up properly. visited the task by clicking not the notification and the bubble count decremented correctly

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7573

Differential Revision: https://secure.phabricator.com/D12498
2015-04-21 15:46:36 -07:00
Bob Trahan
2fab72d43b Quicksand - update title while navigating about
Summary: Fixes T7744. Also fixes a bug where we were copying the response object erroneously; that's not necessary to move around since we cleanly initialize it for each load

Test Plan: from user profile, clicked feed tab and saw new title. clicked calendar tab and saw new title. clicked back and saw feed title and page render.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7744

Differential Revision: https://secure.phabricator.com/D12487
2015-04-21 11:01:05 -07:00
Bob Trahan
d8ab5f594c Quicksand - make page object notifications work properly with quicksand
Summary: Fixes T7680. Make it so the listen behavior can be initialized multiple times from the server by having the behavior only update a few static data variables on subsequent initializations.

Test Plan:
visited TX with user A and left a comment with user B and got the "reload" and "TX updated" bubbles.
Reloaded and navigated to /maniphest/ with user A and had user B leave another comment on TX - no "reload" bubble and correct "TX updated" bubble.
Navigated to TX again with user A and had user B leave a comment and got the "reload" and "TX updated" bubbles.
visited TX with user A and left a comment with user B and got the "reload" and "TX updated" bubbles. navigated away with user A and the "reload" bubble was automagically closed.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7680

Differential Revision: https://secure.phabricator.com/D12448
2015-04-20 16:43:32 -07:00
Bob Trahan
4d5badeec0 Quicksand - provide some plumbing for fancier updates
Summary: Ref D12448. Ref T7573. This changes quicksand up a bit so rather than caching just rendered HTML we also cache the initial response from the server. We also fire off a quicksand-redraw event which will let things like the page objects for notifications update correctly while using Quicksand (see D12448).

Test Plan: loaded up /p/btrahan/  Clicked the UI elements to navigate to various profile views up to maniphest. clicked back until back at /p/btrahan/ and it worked. clicked forward until all the way back to maniphest and it worked. clicked back 2x, then clicked new links, then back and it worked

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7573

Differential Revision: https://secure.phabricator.com/D12449
2015-04-20 15:44:14 -07:00
Chad Little
2106a553e4 Move setup issue callout to under the header
Summary: Fixes T7830. Moves the callout to sit under the main header, which resolved Differential issues and Durable Column issues, but still some extra CSS shenanigans.

Test Plan:
Test lots of pages, Home, Dashboards, Conpherence, Durable Column, Inline Diff Replies, Mobile, Workboards, etc.

{F375821}

{F375822}

{F375823}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7830

Differential Revision: https://secure.phabricator.com/D12466
2015-04-19 07:15:59 -07:00
Chad Little
9796515b70 Use white for active state on mobile menus
Summary: Perviously we used {$sky} but we've since change the icons to .8 opacity on white, allowing use of white on select.

Test Plan: Click on the mobile menu, see icon turn white instead of blue.

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12430
2015-04-15 16:04:44 -07:00
Chad Little
2697dd53b6 Use standard icon size, color on mobile headers
Summary: This just matches the UI of icons on mobile with the icons size, color on desktop.

Test Plan:
test tablet and phone breakpoints.

{F369688}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12407
2015-04-14 09:45:58 -07:00
Chad Little
d56012ce26 Move Conpherence when warning is present
Summary: Turns out only Conpherence/Durable Column still have issues. Workboards is OK. Simple 2 new CSS classes and punt the issue down the road.

Test Plan: Test Workboards, Conpherence, Durable Column with a setup check issue.

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12394
2015-04-13 10:30:13 -07:00
Chad Little
f4baa3bd15 New Search UI
Summary: This is the new search UI as seen in Pholio. Unrounds it (mostly, and makes the eyeglass more button like.

Test Plan:
Review in all header colors, check photoshop for pixel layout consistency. Review in FF, Chrome, Safari, IE. Make sure I didn't mess up mobile.

{F359366}

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12277
2015-04-07 12:03:40 -07:00
epriestley
7aebd2388f Remove monospaced font preference global defaults
Summary: Fixes T7764. These settings have low utility, are no longer used by default, have become less useful on modern Windows which has a better selection of available fonts, and will eventually be subsumed (at least, for the most part) by T4103.

Test Plan:
  - Grepped for strings.
  - Viewed settings.
  - Changed font to "24px impact".
  - Viewed diffs with default and custom font.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: chad, epriestley

Maniphest Tasks: T7764

Differential Revision: https://secure.phabricator.com/D12301
2015-04-06 08:08:53 -07:00
Chad Little
d81d8caa93 Hide Search text better
Summary: Previously, this text was transparent, moved it to a new span and set visibility on it.

Test Plan: review search in FF, Chrome. Text no longer displays.

Reviewers: btrahan, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7710

Differential Revision: https://secure.phabricator.com/D12219
2015-03-31 09:59:09 -07:00
Chad Little
97cc3b1588 Use FontAwesome for search icon
Summary: Swaps out search icon for font-awesome. Tweaks colors a bit for different color headers.

Test Plan: Test a number of colors in the search box. Click on button and still go to advanced search.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12200
2015-03-29 16:20:50 -07:00
epriestley
21454842bf Fix comment previews in Quicksand
Summary:
Fixes T7063. Fixes T7059. We were running some extra unnecessary behaviors. In particular, we would render the menu but not actually send it over the wire, so some behaviors would execute, fail to find the nodes they expected, and throw. This cascaded into some other failures.

Do less work and don't activate behaviors which won't be able to run.

Test Plan: Clicked around, no more errors on page transition. Comment previews work.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Maniphest Tasks: T7059, T7063

Differential Revision: https://secure.phabricator.com/D12188
2015-03-28 06:54:04 -07:00
epriestley
1c32c9b965 Improve granluarity and defaults of security.allow-outbound-http
Summary:
Ref T6755. This is a partial fix, but:

  - Allow netblocks to be blacklisted instead of making the feature all-or-nothing.
  - Default to disallow requests to all reserved private/local/special IP blocks. This should generally be a "safe" setting.
  - Explain the risks better.
  - Improve the errors rasied by Macro when failing.
  - Removed `security.allow-outbound-http`, as it is superseded by this setting and is somewhat misleading.
    - We still make outbound HTTP requests to OAuth.
    - We still make outbound HTTP requests for repositories.

From a technical perspective:

  - Separate URIs that are safe to link to or redirect to (basically, not "javascript://") from URIs that are safe to fetch (nothing in a private block).
  - Add the default blacklist.
  - Be more careful with response data in Macro fetching, and don't let the user see it if it isn't ultimately valid.

Additionally:

  - I want to do this check before pulling repositories, but that's enough of a mess that it should go in a separate diff.
  - The future implementation of T4190 needs to perform the fetch check.

Test Plan:
  - Fetched a valid macro.
  - Fetched a non-image, verified it didn't result in a viewable file.
  - Fetched a private-ip-space image, got an error.
  - Fetched a 404, got a useful-enough error without additional revealing response content (which is usually HTML anyway and not useful).
  - Fetched a bad protocol, got an error.
  - Linked to a local resource, a phriction page, a valid remote site, all worked.
  - Linked to private IP space, which worked fine (we want to let you link and redierect to other private services, just not fetch them).
  - Added and executed unit tests.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T6755

Differential Revision: https://secure.phabricator.com/D12136
2015-03-23 10:44:03 -07:00
Bob Trahan
c21301d153 Conpherence - fix 0 messages in header race condition
Summary:
Fixes T7545. Turns out we had the right logic to handle this basically, and just needed to variablize the CSS class that gets added / removed as appropos.

Note the new behavior is to keep the icon highlighted just with no number. This emulates how it would work if e.g. there was no unread message in the first place and you just clicked the message icon to invoke the message menu.

Test Plan: had a durable conpherence open for user A with user B. used a separate browser to send message as user B. reloaded as user A - saw new message in conpherence durable column and the "1" unread icon. I then clicked the "1" and saw it disappear as expected

Reviewers: chad, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7545

Differential Revision: https://secure.phabricator.com/D12091
2015-03-16 14:28:25 -07:00
Bob Trahan
7d7deaf698 Conpherence - fix "pop in" effect
Summary: Ref T7014. This got broken in today's action. For whatever reason the only way I can get the CSS to show up correctly is to move the require statement to where it was before rP5ef99dba2afc9f9ed3ca77707366a78be15f4871. Otherwise, this feature massages the UI a bit to make sure the "loading" stuff is set correctly in this state.

Test Plan: toggled conpherence open and it looked good. reloaded and it looked good.

Reviewers: chad, epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7014

Differential Revision: https://secure.phabricator.com/D12047
2015-03-11 16:20:13 -07:00
Chad Little
5ef99dba2a Visual update to Conpherence Durable Column
Summary: Numerous visual updates to the Durable Column, mostly to emulate current Conpherence look and feel.

Test Plan: Lots of little pixel chasing. Also Chrome, Firefox.

Reviewers: epriestley, btrahan

Reviewed By: btrahan

Subscribers: Korvin, epriestley

Differential Revision: https://secure.phabricator.com/D12041
2015-03-11 11:52:27 -07:00
epriestley
a1820ecf6e Remove Konami code easter egg
Summary:
This is cool in theory, but has broken like 5 times and is broken now too. The CSS magic just isn't robust enough to keep up with CSS changes.

Just strip it out for now; if we come up with some more durable replacement we can put that back in its place.

Test Plan: Typed konami code, page didn't break horribly.

Reviewers: chad, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D12039
2015-03-10 18:46:28 -07:00
epriestley
88b46063b4 Make durable column sticky across requests
Summary: When you open the column, keep it open on future requests.

Test Plan: Opened column, clicked to Conpherence (no column), clicked elsewhere (column again), reloaded page (column), closed column, clicked something (no column).

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D12038
2015-03-10 18:46:16 -07:00
epriestley
6fa507987d Generalize URI pattern blacklist for Quicksand
Summary:
Fixes T7060. Removes some hard-coding.

This assumes that "pages with no durable column" and "pages with no Quicksand" are the same, but that's correct today and I can't come up with a use case where they'd be different offhand.

Test Plan:
  - Clicked a revision with column open, got Quicksand navigation.
  - Clicked into Conpherence with column open, got real navigation.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T7060

Differential Revision: https://secure.phabricator.com/D12036
2015-03-10 15:32:15 -07:00
Bob Trahan
2373185e9b Conpherence - introduce ConpherenceThreadManager
Summary:
Ref T7014. Fixes T7473. This adds a class to handle thread state about what thread is loaded and what transaction we've seen last. It is deployed 100% in the durable column and only partially deployed in the regular view. Future diff(s) should clean up regular view. Note ConpherenceThreadManager API might change a bit at that time.

Also includes a bonus bug fix so logged out users can't toggle this column

Test Plan: tried to use durable column while logged out and nothing happened. sent messages, aphlict-received messages, added people, and changed title from both views

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin, epriestley

Maniphest Tasks: T7473, T7014

Differential Revision: https://secure.phabricator.com/D12029
2015-03-10 12:20:29 -07:00