Merge branch 'staging' of github.com:xwiki-labs/cryptpad into staging

www/common/migrate-user-object.js

@@ -499,7 +499,7 @@ define([
             }, 500);
             progress(0, 0);*/
         }).nThen(function () {
-            Realtime.whenRealtimeSyncs(store.realtime, Util.bake(cb));
+            Realtime.whenRealtimeSyncs(store.realtime, Util.mkAsync(Util.bake(cb)));
         });
     };
 });

www/common/outer/roster.js

@@ -798,7 +798,6 @@ var factory = function (Util, Hash, CPNetflux, Sortify, nThen, Crypto) {
                     return void console.error(err);
                 }
                 metadata = ref.internal.metadata = (data && data[0]) || undefined;
-                console.log("TEAM_METADATA", metadata);
             });
         }).nThen(function (w) {
             if (!config.keys.teamEdPublic && metadata && metadata.validateKey) {

www/common/sframe-common-mailbox.js

@@ -144,7 +144,6 @@ define([
 
         var onMessage = function (data, cb) {
             // data = { type: 'type', content: {msg: 'msg', hash: 'hash'} }
-            console.debug(data.type, data.content);
             pushMessage(data);
             if (data.content && typeof (data.content.getFormatText) === "function") {
                 var text = $('<div>').html(data.content.getFormatText()).text();

www/common/translations/messages.de.json

@@ -1087,7 +1087,7 @@
     "support_disabledTitle": "Support ist nicht aktiviert",
     "support_disabledHint": "Diese CryptPad-Instanz wurde noch nicht für die Verwendung eines Support-Formulars konfiguriert.",
     "support_cat_new": "Neues Ticket",
-    "support_formTitle": "Titel des Tickets",
+    "support_formTitle": "Neues Ticket",
     "support_formHint": "Mit diesem Formular kann ein neues Support-Ticket eröffnet werden. Es erlaubt die sichere Kontaktaufnahme mit den Administratoren zur Lösung von Problemen oder Beantwortung von Fragen. Bitte eröffne kein neues Ticket, wenn du bereits ein offenes Ticket bezüglich des gleichen Problems hast. Verwende stattdessen die Antworten-Schaltfläche, um weitere Informationen hinzuzufügen.",
     "support_formButton": "Absenden",
     "support_formTitleError": "Fehler: Titel ist leer",

www/common/translations/messages.fr.json

@@ -1086,7 +1086,7 @@
     "support_disabledTitle": "Le support n'est pas activé",
     "support_disabledHint": "Cette instance de CryptPad n'est pas encore configurée pour utiliser le formulaire de support.",
     "support_cat_new": "Nouveau ticket",
-    "support_formTitle": "Titre du ticket",
+    "support_formTitle": "Nouveau Ticket",
     "support_formButton": "Envoyer",
     "support_formTitleError": "Erreur : le titre est vide",
     "support_formContentError": "Erreur : le contenu est vide",

www/common/translations/messages.json

@@ -1108,7 +1108,7 @@
     "support_disabledTitle": "Support is not enabled",
     "support_disabledHint": "This CryptPad instance is not yet configured to use a support form.",
     "support_cat_new": "New ticket",
-    "support_formTitle": "Ticket title",
+    "support_formTitle": "New Ticket",
     "support_formHint": "This form can be used to create a new support ticket. Use it to contact the administrators to solve issues or ask any question in a secure way. Please don't create a new ticket if you already have an open ticket about the same issue, but use the reply button to provide more information.",
     "support_formButton": "Send",
     "support_formTitleError": "Error: title is empty",

www/register/main.js

@@ -115,8 +115,11 @@ define([
             }, {
                 ok: Messages.register_writtenPassword,
                 cancel: Messages.register_cancel,
-                cancelClass: 'safe',
-                okClass: 'danger',
+/*  If we're certain that we aren't using these "*Class" APIs
+    anywhere else then we can deprecate them and make this a
+    custom modal in common-interface (or here).  */
+                cancelClass: 'btn.btn-primary',
+                okClass: 'btn.btn-danger',
                 reverseOrder: true,
                 done: function ($dialog) {
                     $dialog.find('> div').addClass('half');

www/support/ui.js

@@ -66,11 +66,20 @@ define([
         var $cat = $form.find('.cp-support-form-category');
         var $title = $form.find('.cp-support-form-title');
         var $content = $form.find('.cp-support-form-msg');
-        // XXX block submission until pending uploads are complete?
+        // TODO block submission until pending uploads are complete?
         var $attachments = $form.find('.cp-support-attachments');
 
+        var category = $cat.val().trim();
+        /*
+        // || ($form.closest('.cp-support-list-ticket').data('cat') || "").trim();
+        // Messages.support_formCategoryError = "Error: category is empty"; // TODO ensure this is translated before use
+
+        if (!category) {
+            console.log($cat);
+            return void UI.alert(Messages.support_formCategoryError);
+        }
+        */
 
-        var category = $cat.val().trim(); // XXX make category a required field?
         var title = $title.val().trim();
         if (!title) {
             return void UI.alert(Messages.support_formTitleError);
@@ -179,8 +188,6 @@ define([
             }).on('change', function (e) {
                 var files = Util.slice(e.target.files);
                 files.forEach(function (file) {
-                    // XXX validate that the href is hosted on the same instance
-                    // use relative URLs or compare it against a list or allowed domains?
                     var ev = {};
                     ev.callback = function (data) {
                         var x, a;
@@ -321,10 +328,11 @@ define([
 
         var attachments = (content.attachments || []).map(function (obj) {
             if (!obj || !obj.name || !obj.href) { return; }
+            // only support files explicitly beginning with /file/ so that users can't link outside of the instance
+            if (!/^\/file\//.test(obj.href)) { return; }
             var a = h('a', {
                 href: '#'
             }, obj.name);
-            // XXX disallow remote URLs
             $(a).click(function (e) {
                 e.preventDefault();
                 ctx.common.openURL(obj.href);