Commit Graph

66751 Commits

Author SHA1 Message Date
Tim Abbott
6a5d214be6 help: Fix linter errors in last merged PR. 2025-09-17 13:53:02 -07:00
Alya Abbott
d3ca0fc7ae docs: Revamp production doc on security.
- Remove duplicative content.
- Move content to topic-focused pages.
2025-09-17 13:28:02 -07:00
Alya Abbott
be0fc99b58 help: Organize details on bots overview page.
Also document can_forge_sender permission.
2025-09-17 13:27:16 -07:00
Alya Abbott
9e3fea7ed3 help: Add a note about DMs privacy model. 2025-09-17 13:27:16 -07:00
Alya Abbott
10ce39a82c help: Add links to releated articles. 2025-09-17 13:27:16 -07:00
Alya Abbott
9b1c7f761a help: Document logging out by resetting API key and password. 2025-09-17 13:27:16 -07:00
Alya Abbott
f1f9769a08 help: Add a page on protecting your account. 2025-09-17 13:27:16 -07:00
Alya Abbott
0edacce98e help: Update password reset instructions for new UI. 2025-09-17 13:27:16 -07:00
Tim Abbott
0c04f5f101 postprocess_content: Simplify and clarify video logic. 2025-09-17 13:25:50 -07:00
Karl Stolley
d8e58f31b9 tooltips: Rename media tooltip partial. 2025-09-17 13:25:50 -07:00
Karl Stolley
bdf7bdba39 compose_paste: Handle new and legacy media classes. 2025-09-17 13:25:50 -07:00
Karl Stolley
a64276c58f media: Replace legacy .message_inline_image class.
This introduces two new replacement classes, depending on
whether the inner content is an image or a video.
2025-09-17 13:25:50 -07:00
Karl Stolley
1b3ea708be markdown: Don't double-process video elements. 2025-09-17 13:25:50 -07:00
Karl Stolley
a3831770af postprocess_test: Separate link, media tests. 2025-09-17 13:25:50 -07:00
Karl Stolley
d932d8909b postprocess_test: Replace contrived example with real-world one.
The removed lines appear to be fully contrived, as there is no
apparent case where the server would deliver a block of HTML
with `.message_inline_image` without also delivering an inner
<img> or <video> element.

It appears the original outer block was introduced as part of
3df0cacd9e for ensuring coverage
of the post-processing of the `title` attribute to `aria-label`,
which change has since become covered by numerous other
non-contrived examples.

The replaced (and contrived) `<a role="button">` part introduced
by 911b3b5365 is meant to test the
absence of an `href` attribute, which is the minimal new line
introduced here to maintain test coverage while also testing
a genuinely possible pattern a user could send, namely
`[missing href]()`.

See https://chat.zulip.org/#narrow/channel/43-automated-testing/topic/unusual.20.60.2Emessage_inline_image.60.20HTML/with/2261114 for further discussion.
2025-09-17 13:25:49 -07:00
Alex Vandiver
b39188f9cf email_mirror_server: Drop privileges before attaching file handler. 2025-09-17 13:23:48 -07:00
Shubham Padia
468a7a82dd help: Do not treat Help Center as a proper noun.
Fixes https://chat.zulip.org/#narrow/channel/101-design/topic/help.20center.20capitalization
2025-09-17 13:20:25 -07:00
Prakhar Pratyush
421637ce31 push_notifications: Skip enqueuing notif for users without push devices.
Previously, we enqueued events to "missedmessage_mobile_notifications"
even for users who had no registered push devices.
'handle_push_notification' later used to perform the check & skip
if there were no registered devices.

This commit avoids putting such events into the
"missedmessage_mobile_notifications" queue at all. By doing so,
we reduce unnecessary churn.
2025-09-17 12:32:49 -07:00
Tim Abbott
aa317ee844 docs: Remove inaccurate docs on removed avatar feature.
We removed this specific feature a few years ago. While the general
docs there are stale in other ways, we can at least remove this
confusing documentation.

Fixes #18326.
2025-09-17 12:14:09 -07:00
Lauryn Menard
0af56bb80b integrations: Update GitLab doc to direct to create webhook.
GitLab has both integrations and webhooks, and our documentation
should direct users to the webhooks set up for integrating with
Zulip.

Adds a link to GitLab's create a webhook documentation as well.
2025-09-17 09:39:48 -07:00
Rakshit Chauhan
35ed477b32 portico: Scroll to top when clicking logo on home page.
Previously, clicking the logo always triggered a full page reload,
even if the user was already on the home page. This commit adds logic
to intercept the click and smoothly scroll to the top instead,
avoiding an unnecessary reload.

Fixes #35422.

Co-authored-by: Rakshit Chauhan <rxkshit04@users.noreply.github.com>
2025-09-16 11:56:26 -07:00
Karl Stolley
14c51bd0ec compose: Track when the recipient box has recently had focus.
This helps to prevent an edge case where clicking the
new-topic button, `[+]`, in the left sidebar when the
topic box was already empty caused an unexpected flash
of the *general chat* topic.
2025-09-16 11:53:46 -07:00
Karl Stolley
52c75b52fb compose: Update conversation arrow after clearing topic. 2025-09-16 11:53:46 -07:00
Karl Stolley
a4657a5bd7 compose: Correct for undesired outline flash on pills. 2025-09-16 11:53:46 -07:00
Karl Stolley
75714bb44f compose: Remove competing transitions.
The transitions here do not work correctly across all
states, and directly interfere or look goofy with the
transitions in the recipient-row area.

Particularly with the removal from #message-content-container,
that had the annoying effect of just delaying the
appearance of the focus border, regardless of whether
focus was established via keyboard or mouse.
2025-09-16 11:53:46 -07:00
Karl Stolley
de7419a528 compose: Only transition when low-attention row hovered.
Previously, if the mouse cursor were in the vicinity of
the compose box, we'd see transitions even on keyboard
interactions, which should not have been happening.

This also allows instantaneous highlighting for keyboard
users, as well as avoiding any transitions when a
mouse user clicks into a recipient-row element (at
which point the hover transitions will have already
run).
2025-09-16 11:53:46 -07:00
Karl Stolley
2fce6fa317 compose: Offset low-attention pill outlines. 2025-09-16 11:53:46 -07:00
Karl Stolley
415f7610c9 compose: Avoid multiple 'input' handlers on topic box.
It's not good form to register an event handler on a
function that runs fairly frequently--especially one
that stands to override another listener's handler.
2025-09-16 11:53:46 -07:00
Sai
eaa2ece4e1 slack: Fix bugs during import of thread messages.
Consider the following messages JSON (taken from real data, redacted):
```json
[
    {
        "subtype": "bot_message",
        "text": "",
        "attachments": [
            {
                "fallback": "Open Slack to cast your vote in this Simple Poll",
                "title": "Should we do a thing?",
                "id": 1,
                "color": "6ecadc",
                "fields": [
                    {
                        "title": "",
                        "value": "1️⃣ Yes 👍\n\n"",
                        "short": false
                    },
                    {
                        "title": "",
                        "value": "2️⃣ No 👎\n\n",
                        "short": false
                    },
                    {
                        "title": "",
                        "value": "3️⃣ Abstain :spock-hand:\n\n",
                        "short": false
                    }
                ],
                "mrkdwn_in": [
                    "fields"
                ]
            },
            {
                "callback_id": "12345678-1234-1234-1234-123456789abc",
                "fallback": "Open Slack to cast your vote in this Simple Poll",
                "id": 2,
                "color": "6ecadc",
                "actions": [
                    {
                        "id": "1",
                        "name": "vote",
                        "text": "1️⃣",
                        "type": "button",
                        "value": "1",
                        "style": ""
                    },
                    {
                        "id": "2",
                        "name": "vote",
                        "text": "2️⃣",
                        "type": "button",
                        "value": "2",
                        "style": ""
                    },
                    {
                        "id": "3",
                        "name": "vote",
                        "text": "3️⃣",
                        "type": "button",
                        "value": "3",
                        "style": ""
                    },
                    {
                        "id": "4",
                        "name": "delete-v2",
                        "text": "Delete Poll",
                        "type": "button",
                        "value": "",
                        "style": "danger",
                        "confirm": {
                            "text": "Are you sure you want to delete the Poll?",
                            "title": "Delete Poll?",
                            "ok_text": "Yes",
                            "dismiss_text": "No"
                        }
                    }
                ]
            },
            {
                "callback_id": "12345678-1234-1234-1234-123456789abc",
                "fallback": "Open Slack to cast your vote in this Simple Poll",
                "footer": "Simple Poll        <https:\/\/simplepoll.rocks\/dashboard\/redacted\/settings\/|Edit Settings>",
                "id": 3,
                "footer_icon": "https:\/\/simplepoll.rocks\/static\/main\/favicon.png",
                "color": "6ecadc"
            }
        ],
        "type": "message",
        "ts": "1234567890.123456",
        "bot_id": "B1ABCDEF1",
        "thread_ts": "1234567890.123456",
        "reply_count": 1,
        "reply_users_count": 1,
        "latest_reply": "1234567890.765432",
        "reply_users": [
            "U1ABC1234"
        ],
        "replies": [
            {
                "user": "U1ABC1234",
                "ts": "1234567890.765432"
            }
        ],
        "is_locked": false,
        "subscribed": false
    },
    {
        "user": "U1ABC1234",
        "type": "message",
        "ts": "1234567890.765432",
        "text": "Maybe do qux instead",
        "team": "T1AB23456",
        "user_team": "T1AB23456",
        "source_team": "T1AB23456",
        "user_profile": {
            "avatar_hash": "a123456789ab",
            "image_72": "https:\/\/avatars.slack-edge.com\/2017-01-01\/123456789abc_def123456789abcdef12_72.jpg",
            "first_name": "Alice",
            "real_name": "Alice Smith",
            "display_name": "a.smith",
            "team": "T1AB23456",
            "name": "a.smith",
            "is_restricted": false,
            "is_ultra_restricted": false
        },
        "thread_ts": "1234567890.123456",
        "blocks": [
            {
                "type": "rich_text",
                "block_id": "EoBdt",
                "elements": [
                    {
                        "type": "rich_text_section",
                        "elements": [
                            {
                                "type": "text",
                                "text": "Maybe do qux instead"
                            }
                        ]
                    }
                ]
            }
        ]
    }
]
```

533f177175/zerver/data_import/slack.py (L922-L924)
fails for the first message, because it lacks a 'user' key. It should fall back to the bot_id.

533f177175/zerver/data_import/slack.py (L925-L926)
fails for the second message, because it lacks a 'parent_user_id' key.
However, the thread root will have been processed earlier, so
memoization of thread parents fixes this issue. Because the original
message may not be in the same file, the memoization needs to be global
rather than in `channel_message_to_zerver_message`.
2025-09-16 11:35:53 -07:00
Anders Kaseorg
1fdb81b6f8 streams: Remove is_in_zephyr_realm field from database.
Signed-off-by: Anders Kaseorg <anders@zulip.com>
2025-09-16 11:23:11 -07:00
Anders Kaseorg
8a35871217 events: Remove realm_is_zephyr_mirror_realm from API.
Signed-off-by: Anders Kaseorg <anders@zulip.com>
2025-09-16 11:23:10 -07:00
Anders Kaseorg
40a022dcc3 zephyr: Remove Zephyr mirroring support.
Signed-off-by: Anders Kaseorg <anders@zulip.com>
2025-09-16 11:18:18 -07:00
Sahil Batra
fb13de4e10 stream-settings: Do not remove private stream row always.
Previously, private stream row was removed from the relevant
tab view in left panel in stream settings UI when a user was
subscribed or unsubscribed. Now we only remove the row if the
user does not permission to toggle the subscription state just
like we do for public streams where we keep the row as user
can toggle the subscription state again.

Also updated the comment in update_stream_row_in_settings_tab
to be more clear about the behavior.
2025-09-16 11:16:06 -07:00
Sahil Batra
683eca97a7 stream-settings: Replace "Not subscribed" tab with "Available".
This commit replaces "Not subscribed" tab in stream settings
with "Available" tab where only streams which the user can
subscribe to are shown.

Fixes #35919.
2025-09-16 11:16:06 -07:00
Evy Kassirer
24f678feb6 message: Remove unused sender_realm_str.
Briefly discussed here:
https://chat.zulip.org/#narrow/channel/6-frontend/topic/sender_realm_str.20and.20.20client.20in.20message.20objects/near/2254334
2025-09-16 10:55:56 -07:00
Aman Agrawal
e3371cfb72 inbox: Fix user scrolling to top on rerender if filters are focused.
If one of the filters is focused or if we cannot determine the
current focus location, any rerender call will scroll user to
top.

Fixed by only scrolling to top when navigating from other views
and when we don't have a cached scroll position.

Tested by calling `complete_rerender` at 1s intervals.
2025-09-16 10:52:19 -07:00
Evy Kassirer
182baa85ac todo_widget: Move TodoWidgetExtraData type to module. 2025-09-16 10:50:19 -07:00
Alex Vandiver
9fd30a7b78 version: Update version for Zulip Server 11.2 release. 2025-09-16 14:14:04 +00:00
Sayam Samal
3070c78cc5 popovers: Remove "light-border" Tippyjs theme usage.
The "light-border" theme was set as the default theme for all the
popovers, but was no longer in use, since all of our current popovers
either use the "popover-menu" theme or the "dropdown-widget" theme.

In response to the above reasoning, this commit removes the redundant
"light-border" Tippyjs theme usage from the codebase.
2025-09-15 09:25:39 -07:00
Sayam Samal
b9b1798a1e dark_theme: Clean up Tippy box styles.
Fixes part of #35880.
2025-09-15 09:25:39 -07:00
Sayam Samal
930eadb085 dark_theme: Clean up manage user profile footer border color.
Fixes part of #35880.
2025-09-12 13:10:09 -07:00
Sayam Samal
ad8c2b7275 dark_theme: Clean up user profile modal tables' related border colors.
In the light theme, the user profile modal tables were using two
different border colors, both very similar to one another. This commit
consolidates them into a single border color for consistency.
2025-09-12 13:10:09 -07:00
Sayam Samal
ec611fda69 dark_theme: Clean up user profile modal field name related colors. 2025-09-12 13:10:09 -07:00
Aadya
9bc19fb7d5 docs: Fix wording in "Moderating the Zulip community".
Replaced "Here are some guidelines for you how can help:" with 
"Here are some guidelines for how you can help:" for clarity.
2025-09-12 13:07:59 -07:00
bedo
72d1fa7661 default_settings: Add explanatory comment to "sends_email_by_ip".
Add "5 emails per day" comment
to indicate what (86400, 5) inside "sends_email_by_ip" means.
2025-09-12 13:06:29 -07:00
bedo
bc1ed82620 rate_limiter: Block IPv6 by /64 instead of per-single-IP.
Fixes #21544.

The network prefix (e.g. 64) identifies the network portion
which determines which bucket should that IPv6 belong to.

Implemented as a generic approach, so we have the option
to use different prefix sizes (leading to different buckets)
in the future.

Add comprehensive assertions for which IPv6s
are expected to belong to the same bucket and which are not.
2025-09-12 13:06:29 -07:00
Sayam Samal
5fa027a577 views_util: Use ".input-element" selector to check for focused inputs.
Previously, we were using the ".home-page-input" selector to check for
any focused input elements in the home page view of the Zulip Web UI.
Since all of these inputs, other than the navbar search input have now
been converted to filter inputs, we can simplify the logic to check for
any focused input elements with the ".input-element" selector.

The navbar search input has a different selector, "#search_query",
which is already accounted for in the views_util.is_in_focus() method.

Now, ".input-element" class will potentially be used for several other
inputs in the UI other than the home page view, but the is_in_focus()
method already accounts for other focused elements like compose,
overlays, popovers, etc, and thus the logic remains unaffected.

Fixes part of #35135.
2025-09-12 13:00:30 -07:00
Alex Vandiver
8c37e9c7a6 update_subscriber_counts: Fix calling without any flags. 2025-09-12 12:59:46 -07:00
Alex Vandiver
c7810afb33 version: Update version for Zulip Server 11.1 release. 2025-09-11 18:43:09 +00:00
Shubham Padia
35c6dec2b9 help: Ensure trailingSlash is set to never.
Sidebar links were adding a trailing slash to each of the pages. Our
canonical URLs don't have a trailing slash. This will probably also stop
starlight from adding trailing slash at other unexpected places.

When running the astro dev server, if a page has a trailing slash, we
will get a page from astro asking to remove that slash. That will not
happen in static build mode or production since we don't use astro's
serving mechanisms there.
2025-09-11 13:46:58 -04:00