Commit Graph

63435 Commits

Author SHA1 Message Date
Lauryn Menard
9fa57fd24a api-docs: Update feature level 329 changelog entry and related notes.
Clarifies that the alert is shown if the current time displayed by
the time zone configured on the user's device differs from the
time displayed for the users's profile time zone.

Removes incorrectly having web_suggest_update_timezone as a separate
field returned by the POST /register response. It will only be a
field in the user_settings and realm_user_settings_defaults objects.
2025-02-13 12:41:21 -08:00
Lauryn Menard
d32f9862a5 api-docs: Clarify documentation for "timezone" user setting.
Refers to the setting as the "profile time zone" to help clarify
that this user setting is used for displaying the user's local
time to other users.

Adds links to the help center article about this user setting.

More consistently notes the format of the string that's being
returned is an IANA identifer of the time zone.
2025-02-13 12:41:21 -08:00
Alex Vandiver
adbdbee26b cache: Rename user_profile_cache_key to be more specific. 2025-02-13 12:40:53 -08:00
Alex Vandiver
11c32dcfb2 cache_helpers: Fill the narrow-user cache as well. 2025-02-13 12:40:53 -08:00
Alex Vandiver
9ff68a45c5 cache_helpers: Switch to storing the by-id user cache, not by-email.
The email is not the most commonly used user cache -- the by-id one is.
2025-02-13 12:40:53 -08:00
Alex Vandiver
a7d513e5ec users: Remove unnecessary get_api_key helper.
Using the column name is clearer.
2025-02-13 12:40:53 -08:00
Alex Vandiver
8804c1afaa users: Remove weird get_all_api_keys helper.
This implied by its name that users could have more than one key.
They cannot, currently; make the code clearer by switching to the
explicit column access.
2025-02-13 12:40:53 -08:00
Alex Vandiver
c29e11de93 cache_helpers: Use the same select_related as the cache methods use.
Only prefetching `realm` and `bot_owner` means that the cache values
filled by this process differ from the cache values that would be
stored on a cache miss -- leading to extra database queries for those
objects.

Use the same `base_get_user_queryset()` to ensure we get the same
related prefetches.
2025-02-13 12:40:53 -08:00
Alex Vandiver
392f7556dd users: Use the same select_related for API-key and by-id user loads.
These were likely mistakenly left off of 6098c2cebe, leading to
1847086044 likely not switching to `base_get_user_queryset` for this
function because the list differed.
2025-02-13 12:40:53 -08:00
Alex Vandiver
9f23a3ee32 cache_helpers: Use the configured timeout.
It is the same for all of the caches, but make it not misleading.
2025-02-13 12:40:53 -08:00
Alex Vandiver
f58c29b290 presence: Use the narrow user cache.
These two endpoints make up ~85% of requests to Zulip servers; since
presence is also a performance-critical endpoint, having them share
the same cache increases how hot it stays in memcached, in addition to
making the presence endpoint faster.

This comes at the very slightly cost of one extra field.  Checks
for the `is_bot` column are switched to the equivalent `bot_type`
check, since the columns are slightly duplicative, and we can get away
with only checking bot_type.
2025-02-13 12:40:53 -08:00
Alex Vandiver
44f0e936c2 sessions: Use the narrow user fetch when expiring sessions. 2025-02-13 12:40:53 -08:00
Alex Vandiver
58bf2a7935 tornado: Limit the width of the user queries, when they're needed.
Tornado requests try hard to not make SQL queries -- and if they're
necessary, to minimize the number of them.  Specifically, both session
objects and user objects are cached in memcached, and we expect that
both of them will have been filled there by Django before any requests
are made to Tornado.

In the event that memcached is flushed, or data is otherwise evicted,
we perform two database queries -- one for the session, and one for
the user.  However, the *width* of the latter query has grown
significantly over time, as the Realm object grew more fields, and
recently with the addition of role groups, which require multiple
joins each.  This leads to a query which is over 12k of text long, and
results in 319 columns.  In the event of a memcached flush, this can
result in a *significant* amount of SQL traffic, as nearly every
active Tornado request will make that query.

We do not wish to narrow the default query for Django; we instead tag
the request in the REST wrapper, and use that to use a much narrower
user cache entry.  That narrower cache entry is filled before the
queue is created in Django; we also use it to explicitly set the log
data, so the second "half" of the continued Tornado request does not
need to fetch any user data either when writing its log line.

Because they use different cache keys, this only affects the
session-based `/json/events` endpoint, which caches by user-id; the
`/api/v1/events` endpoint, which uses an API-key cache, keeps its wide
user object.  The former is 50% of the total request volume, whereas
the latter is only 2%, so adding an additional cache for it is
unnecessary complexity.
2025-02-13 12:40:53 -08:00
Alex Vandiver
7c20f1d3ea tornado: Always copy requester_for_logs from initial request.
The previous logic over-wrote the requester with the old value if it
had been set to anything in the new request, which it never could have
been.  This logic likely stems from confusion in the hasattr
introduced in `89394fc1ebee`.

Always copy the `requester_for_logs` from the first half of the
request.
2025-02-13 12:40:53 -08:00
Alex Vandiver
7ed35845df tornado: Remove incorrect rate_limit request note.
1ea2f188ce mistakenly introduced a `_rate_limit` member of the
request, which was dutifully transcribed in 3f9a5e1e17.  However,
`_rate_limit` was never read from, nor written to -- `_ratelimit` (with
no middle `_`) was the dict that contained rate-limiting data.  This
`_ratelimit` dict was later renamed to the `_ratelimits_applied` list,
in e86cfbdbd7, which became the `ratelimits_applied` request note
field in 03693cd27e.

Remove the entirely unused `rate_limit` note, and properly copy the
`ratelimits_applied` data into the new request.
2025-02-13 12:40:53 -08:00
roanster007
f3fbf314e2 echo: Update channel-topic link to permalink upon new message arrival.
This commit updates the traditional url of a channel-topic narrow
to topic permalink upon arrival of new message in the narrow, by
using the `with` operator on it.

The requirement for this change arises when we navigate to an
empty topic. Since it has no messages yet, we fallback to the
traditional channel-topic links. However, when a new message
arrives to this empty topic, we want the url to live update to
a permalink of the narrow.

This is done as an effort to make sure channel-topic narrows
always contain `with` term.
2025-02-13 12:40:37 -08:00
Aman Agrawal
75be449d45 CVE-2025-25195: Only send "active" change events to channel subscribers.
This fixes a bug where private stream event to update stream's
active status was sent to all active users instead of just
its subscribers.
2025-02-13 11:58:23 -08:00
Aman Agrawal
a2a1a7f8d1 streams: Use a common func to send stream recently active update event.
This helps us to apply fix for sending event update for
private stream to only its subscribers.
2025-02-13 11:58:23 -08:00
Kartikay5849
6edbca981d settings: Make clicking "Channel color" label open color picker.
Clicking the "Channel color" label in the stream settings did not
open the color picker, unlike other settings where clicking the label
triggers the same action as clicking the value. This commit adds an
event listener to the label that triggers the associated button's
click event, ensuring consistent behavior across all settings.

Fixes #33446.
2025-02-13 11:33:33 -08:00
Mateusz Mandera
367d193639 register_server: Rename flag to --agree-to-terms-of-service.
That's a better style than the underscores.
2025-02-13 11:03:44 -08:00
Mateusz Mandera
1c57e04cc1 docs: Change /doc-permalinks/ redirects to point to /stable/ RTD.
With the exception of /registration-transfer, the /stable/ docs have the
relevant sections - so that's the better choice to link to.
2025-02-13 11:03:44 -08:00
Abhay Upadhyay
51a4ed61ee settings: Validate candidate linkifier before sending to server.
Before submitting a candidate custom linkifier, the web app now
validates it locally using `python_to_js_linkifier`. This prevents
invalid linkifiers from reaching the server, as the server may
support some linkifiers that the web app does not.

To achieve this, `python_to_js_linkifier` is exported from
`linkifiers.ts`, and a try-catch block is added in
`settings_linkifiers.ts`. If the web-app does not support
the linkifier, the app displays an error message
and prevents submission.
Fixes:#33238
2025-02-13 10:07:02 -08:00
Mateusz Mandera
a8fbf6d5d5 docs: Remove HostnameAlreadyInUseBouncerError.docs_url.
Now that we introduced an URL for serving permalinks redirecting to
docs in #33444, the docs_url mechanism is no longer needed, as we can
have a URL that's safe to hard-code in register_server.py.

The HostnameAlreadyInUseBouncerError.docs_url has been merged in main
briefly enough, that this should be safe to remove.
2025-02-13 09:49:28 -08:00
Mateusz Mandera
0a45a289f2 install: Add --agree-to-terms-of-service flag. 2025-02-13 09:49:28 -08:00
Karl Stolley
0362e53dbf rendered_markdown: Bump margin by half a character on ordered lists.
This is a regrettable adjustment, necessary for how certain
browsers (especially Safari on both iOS and macOS) present a
larger, non-adjustable gap between the list marker and the list
item's text.
2025-02-13 09:26:12 -08:00
evykassirer
454803ea4d inbox: Use em for more spacing measurements. 2025-02-13 09:20:53 -08:00
Shubham Padia
436244edb2 stream: Reset created stream early when not subscribed to it.
Fixes
https://chat.zulip.org/#narrow/channel/9-issues/topic/.22Add.22.20button.20gives.20channel.20created.20modal
2025-02-13 09:02:42 -08:00
Maneesh Shukla
7a935d876f styles: Fix different field widths in invite modal. 2025-02-13 09:01:51 -08:00
Vector73
2ef9695ef0 settings: Migrate wildcard_mention_policy to group-based permission.
Added new group-based permission setting
`can_mention_many_users_group` to replace `wildcard_mention_policy`.
2025-02-12 23:21:33 -08:00
Alya Abbott
befe49c293 channel settings: Clarify channel permission settings.
- Explain how content access works.
- Label settings more accurately, and remove incorrect notes.
2025-02-12 17:23:26 -08:00
roanster007
41f30e1052 topics: Change topic links of left sidebar to use new permalinks.
This commit updates the topic links obtained from clicking
the topics in the left sidebar, recent view and inbox, and
those obtained from "Copy link to topic" to use the new
topic permalinks.

Fixes part of #21505.
2025-02-12 16:21:03 -08:00
Anushrut pandit
e67786154a settings: Hide upgrade links and storage stats for guests.
Avoids displaying the upgrade banner in upgrade_tip_widget.hbs and attachments stats banner in 'Uploaded files' UI when the user is logged in as a guest. This ensures that guest users do not see upgrade-related links that do not apply to them and cause 404 errors.

Fixes #20630.
2025-02-12 16:05:14 -08:00
evykassirer
ee3660ae19 settings: Use new icon for plus (stream/usergroup) button. 2025-02-12 16:03:44 -08:00
opmkumar
2a15da47d9 message_edit: Show typing indicator for message editing.
This commit adds typing indicators for message editing in stream
as well as in dm, if the send typing notification
for corresponding is enabled.

Based on earlier work in #28585.

Co-authored-by: Rohan Gudimetla <rohan.gudimetla07@gmail.com>

Fixes #25719.
2025-02-12 15:08:56 -08:00
opmkumar
c2821ef0f4 typing: Remove an unnecessary comment in zerver/actions/typing.py.
The comment was incorrectly placed and misleadingly suggested that
`long_term_idle` subscribers were excluded from `subscription_query`,
whereas they were not.
2025-02-12 15:08:56 -08:00
Prakhar Pratyush
1aa048df35 channel_email: Make sender configurable when generating channel email.
Earlier, it was not possible to configure the user that the forwarded
email will be sent by.

This commit updates the 'Generate channel email address' modal to
make sender configurable when generating channel email.

Fixes #31566.
2025-02-12 15:08:32 -08:00
Prakhar Pratyush
7fa8b46c5c edit_bot_form: Remove stale context parameters. 2025-02-12 15:08:32 -08:00
Prakhar Pratyush
a639bc03a5 stream_settings: Disable "Generate Channel Email" button with a tooltip.
Previously, the button to generate channel email address was removed
for users without post permissions. Now, it is disabled and includes
a tooltip: "You do not have permission to post in this channel."
2025-02-12 15:08:32 -08:00
Prakhar Pratyush
1acf309d57 stream_data: Fix 'can_access_stream_email' function.
'can_access_stream_email' function determines who can
generate email to send message in a channel.

Earlier, the function was not considering channel post policy.
So, a user which doesn't have permission to post in
a channel as per channel post policy could generate channel email.

This commit makes sure to not show the "Generate email address"
button in such cases.

We show the button only if the current user or any of the bots
they control has the permission to post in the channel.

Fixes part of #31566.
2025-02-12 15:08:32 -08:00
Prakhar Pratyush
a94cc47879 bot_data: Remove the stale 'get_editable' function. 2025-02-12 15:08:32 -08:00
Karl Stolley
e352ab628c message_row: Refine grid for better-fitting action icons. 2025-02-12 13:54:52 -08:00
Aman Agrawal
e285711abf unread_ops: Hide unread banner after marking msgs read.
If we marked all messages in a narrow as read, hide the unread
banner.
2025-02-12 13:23:42 -08:00
Aman Agrawal
3d5307c0a9 message_summary: Add markdown support for generated summary. 2025-02-12 13:23:42 -08:00
Tim Abbott
ca0babc7e9 message_summary: Don't meter analytics query as AI work. 2025-02-12 13:23:42 -08:00
Alya Abbott
8525a31a66 help: Tweak support Zulip help page.
- Add blog, Mastodon account.
- Point contributor doc links to /latest.
2025-02-12 12:58:10 -08:00
Alya Abbott
ea7cc614a5 contributor docs: Reorganize contributor guide.
- Offer more hand-holding at the start.
- Clean up dev environment setup steps.
- Move joining CZO later in the process.
- Move feedback section to feature suggestions page.
- Drop other non-coding info, as it exists elsewhere.
2025-02-12 12:58:10 -08:00
roanster007
c562503089 markdown: Fix stream description with topic permalink not rendered.
Previously, when description for a channel -- either during its
creating or when we change its description contained a topic
permalink (through #-mention), then it was not rendered. This
is because of lack of authorization to access the channel.

This is fixed by passing the acting_user through the methods
which update or add the description, so that permissions
of the acting_user could be used to determine whether to
render the #-mention in stream description or not.
2025-02-12 12:50:25 -08:00
roanster007
4789de2e96 markdown: Fix #-mention of private channel's topic made by system bots.
Previously when system bots used to `#-mention` a private
channel's topics in cases like moving messages of a private
channel, then the #-mentions were not rendered by the
markdown. This was because the system bots did not have
authorization to mention these channels.

This is fixed by passing down an `acting_user` parameter
in code paths involving sending these move message
notifications so that permission of acting_user to mention
the topic is verified for rendering the markdown, rather
than that of the system bot.
2025-02-12 12:50:25 -08:00
Aman Agrawal
a2dd84541d auth: Fix 500 error on accessing selfhosting subdomain user login page.
selfhosting in not to valid subdomain for user login, so we render
invalid_realm page on that URL.
2025-02-12 12:43:23 -08:00
Aman Agrawal
b6814d6192 portico-header: Don't show login on server login page.
User cannot login to selfhosting subdomain since it is not a realm.
2025-02-12 12:43:23 -08:00