Commit 4d2a8b2c authored by Martin Weinelt's avatar Martin Weinelt Committed by github-actions[bot]
Browse files

discourse: 3.1.0 -> 3.2.2

https://meta.discourse.org/t/3-1-1-security-and-bug-fix-release/278760
https://meta.discourse.org/t/3-1-2-security-and-bug-fix-release/282427
https://meta.discourse.org/t/3-1-3-security-and-bug-fix-release/284973
https://meta.discourse.org/t/3-1-4-security-and-bug-fix-release/290939
https://blog.discourse.org/2024/01/celebrating-discourse-3-2/
https://meta.discourse.org/t/3-2-1-security-and-bug-fix-release/298237
https://meta.discourse.org/t/3-2-2-bug-fix-release/307780



Co-Authored-By: default avatarChristian Albrecht <christian.albrecht@mayflower.de>
Fixes: CVE-2023-38706, CVE-2023-40588, CVE-2023-41043, CVE-2023-41042,
       CVE-2023-44388, CVE-2023-43814, CVE-2023-45147, CVE-2023-43659,
       CVE-2023-44391, CVE-2023-45131, CVE-2023-47120, CVE-2023-45816,
       CVE-2023-46130, CVE-2023-47119, CVE-2023-47121, CVE-2023-45806,
       CVE-2023-49099, CVE-2024-21655, CVE-2024-21655, CVE-2023-48297,
       CVE-2024-24748, CVE-2024-24827, CVE-2024-27085, CVE-2024-27100,
       CVE-2024-28242
(cherry picked from commit 25755c0d)
parent 427bdcc8
Loading
Loading
Loading
Loading
+0 −13
Original line number Diff line number Diff line
diff --git a/app/assets/javascripts/discourse/package.json b/app/assets/javascripts/discourse/package.json
index 9e4533d2..e57f8a5f 100644
--- a/app/assets/javascripts/discourse/package.json
+++ b/app/assets/javascripts/discourse/package.json
@@ -14,7 +14,7 @@
     "build": "ember build",
     "start": "ember serve",
     "test": "ember test",
-    "postinstall": "yarn --silent --cwd .. patch-package"
+    "postinstall": "patch-package"
   },
   "dependencies": {
     "@babel/core": "^7.21.4",
+9 −9
Original line number Diff line number Diff line
diff --git a/lib/tasks/assets.rake b/lib/tasks/assets.rake
index 68b5db61ac..d460b5753e 100644
index 9608297789..5487490915 100644
--- a/lib/tasks/assets.rake
+++ b/lib/tasks/assets.rake
@@ -19,7 +19,7 @@ task 'assets:precompile:before' do
 
     if only_assets_precompile_remaining
       # Using exec to free up Rails app memory during ember build
-      exec "#{compile_command} && EMBER_CLI_COMPILE_DONE=1 bin/rake assets:precompile"
+      exec "#{compile_command} && EMBER_CLI_COMPILE_DONE=1 bundle exec rake assets:precompile"
@@ -36,7 +36,7 @@ task "assets:precompile:build" do
     if only_ember_precompile_build_remaining
       exec "#{compile_command}"
     elsif only_assets_precompile_remaining
-      exec "#{compile_command} && SKIP_EMBER_CLI_COMPILE=1 bin/rake assets:precompile"
+      exec "#{compile_command} && SKIP_EMBER_CLI_COMPILE=1 bundle exec rake assets:precompile"
     else
       system compile_command
     end
       system compile_command, exception: true
       EmberCli.clear_cache!
+39 −32
Original line number Diff line number Diff line
@@ -46,13 +46,13 @@
}@args:

let
  version = "3.1.0";
  version = "3.2.2";

  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse";
    rev = "v${version}";
    sha256 = "sha256-Iv7VSnK8nZDpmIwIRPedSWlftABKuMOQ4MXDGpjuWrY=";
    sha256 = "sha256-JUCFtB5BvBytO3flq9o6iI3HPmvLU358HEmE6wbBsSk=";
  };

  ruby = ruby_3_2;
@@ -65,6 +65,7 @@ let
    gnutar
    git
    brotli
    nodejs_18

    # Misc required system utils
    which
@@ -200,9 +201,14 @@ let
    pname = "discourse-assets";
    inherit version src;

    yarnDevOfflineCache = fetchYarnDeps {
      yarnLock = src + "/yarn.lock";
      hash = "sha256-0s8c2V8Wl3f5kL1OIn2ps6hL7CUQD5+LJm+9LYHc+W0=";
    };

    yarnOfflineCache = fetchYarnDeps {
      yarnLock = src + "/app/assets/javascripts/yarn.lock";
      sha256 = "0sclrv3303dgg3r08dwhd1yvi3pvlnvnikn300vjsh6c71fnzhnj";
      yarnLock = src + "/app/assets/javascripts/yarn-ember5.lock";
      hash = "sha256-ZBXvNdHHV92kSAswe6KA+OqaY5smf7ZKTTOiY8g78D0=";
    };

    nativeBuildInputs = runtimeDeps ++ [
@@ -210,9 +216,7 @@ let
      redis
      nodePackages.uglify-js
      terser
      nodePackages.patch-package
      yarn
      nodejs_18
      jq
      moreutils
      fixup-yarn-lock
@@ -234,13 +238,14 @@ let
      # assets precompilation task.
      ./assets_rake_command.patch

      # `app/assets/javascripts/discourse/package.json`'s postinstall
      # hook tries to call `../node_modules/.bin/patch-package`, which
      # hasn't been `patchShebangs`-ed yet. So instead we just use
      # `patch-package` from `nativeBuildInputs`.
      ./asserts_patch-package_from_path.patch
      # Little does he know, so he decided there is no need to generate the
      # theme-transpiler over and over again. Which at the same time allows the removal
      # of javascript devDependencies from the runtime environment.
      ./prebuild-theme-transpiler.patch
    ];

    env.RAILS_ENV = "production";

    # We have to set up an environment that is close enough to
    # production ready or the assets:precompile task refuses to
    # run. This means that Redis and PostgreSQL has to be running and
@@ -249,26 +254,29 @@ let
      # Yarn wants a real home directory to write cache, config, etc to
      export HOME=$NIX_BUILD_TOP/fake_home

      yarn_install() {
        local offlineCache=$1 yarnLock=$2

        # Make yarn install packages from our offline cache, not the registry
      yarn config --offline set yarn-offline-mirror $yarnOfflineCache
        yarn config --offline set yarn-offline-mirror $offlineCache

        # Fixup "resolved"-entries in yarn.lock to match our offline cache
      fixup-yarn-lock app/assets/javascripts/yarn.lock
        fixup-yarn-lock $yarnLock

      export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt

      find app/assets/javascripts -name package.json -print0 \
        | xargs -0 -I {} bash -c "jq 'del(.scripts.postinstall)' -r <{} | sponge {}"
      yarn install --offline --cwd app/assets/javascripts/discourse
        # Install while ignoring hook scripts
        yarn --offline --ignore-scripts --cwd $(dirname $yarnLock) install
      }

      patchShebangs app/assets/javascripts/node_modules/
      # Install devDependencies for generating the theme-transpiler executed as
      # dependent task assets:precompile:theme_transpiler before db:migrate
      yarn_install $yarnDevOfflineCache yarn.lock

      # Run `patch-package` AFTER the corresponding shebang inside `.bin/patch-package`
      # got patched. Otherwise this will fail with
      #     /bin/sh: line 1: /build/source/app/assets/javascripts/node_modules/.bin/patch-package: cannot execute: required file not found
      pushd app/assets/javascripts &>/dev/null
        yarn run patch-package
      popd &>/dev/null
      # Install the runtime dependencies
      yarn_install $yarnOfflineCache app/assets/javascripts/yarn-ember5.lock
      # Patch before running postinstall hook script
      patchShebangs --build app/assets/javascripts
      yarn --offline --cwd app/assets/javascripts run postinstall
      export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt

      redis-server >/dev/null &

@@ -286,14 +294,8 @@ let
      psql 'discourse' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
      psql 'discourse' -tAc "CREATE EXTENSION IF NOT EXISTS hstore"

      # Create a temporary home dir to stop bundler from complaining
      mkdir $NIX_BUILD_TOP/tmp_home
      export HOME=$NIX_BUILD_TOP/tmp_home

      ${lib.concatMapStringsSep "\n" (p: "ln -sf ${p} plugins/${p.pluginName or ""}") plugins}

      export RAILS_ENV=production

      bundle exec rake db:migrate >/dev/null
      chmod -R +w tmp
    '';
@@ -352,6 +354,11 @@ let

      # Make sure the notification email setting applies
      ./notification_email.patch

      # Little does he know, so he decided there is no need to generate the
      # theme-transpiler over and over again. Which at the same time allows the removal
      # of javascript devDependencies from the runtime environment.
      ./prebuild-theme-transpiler.patch
    ];

    postPatch = ''
+21 −0
Original line number Diff line number Diff line
diff --git a/lib/discourse_js_processor.rb b/lib/discourse_js_processor.rb
index 26d142fa4d..6040aba6f4 100644
--- a/lib/discourse_js_processor.rb
+++ b/lib/discourse_js_processor.rb
@@ -68,7 +68,7 @@ class DiscourseJsProcessor
     TRANSPILER_PATH =
       (
         if Rails.env.production?
-          "tmp/theme-transpiler.js"
+          "app/assets/javascripts/theme-transpiler.js"
         else
           "tmp/theme-transpiler/#{Process.pid}.js"
         end
@@ -87,6 +87,6 @@ class DiscourseJsProcessor
         "node",
         "app/assets/javascripts/theme-transpiler/build.js",
         TRANSPILER_PATH,
-      )
+      ) if !Rails.env.production? or !File.file?(TRANSPILER_PATH)
       TRANSPILER_PATH
     end
+21 −28
Original line number Diff line number Diff line
@@ -6,28 +6,14 @@ source "https://rubygems.org"

gem "bootsnap", require: false, platform: :mri

def rails_master?
  ENV["RAILS_MASTER"] == "1"
end

if rails_master?
  gem "arel", git: "https://github.com/rails/arel.git"
  gem "rails", git: "https://github.com/rails/rails.git"
else
  # NOTE: Until rubygems gives us optional dependencies we are stuck with this needing to be explicit
  # this allows us to include the bits of rails we use without pieces we do not.
  #
  # To issue a rails update bump the version number here
  rails_version = "7.0.5.1"
  gem "actionmailer", rails_version
  gem "actionpack", rails_version
  gem "actionview", rails_version
  gem "activemodel", rails_version
  gem "activerecord", rails_version
  gem "activesupport", rails_version
  gem "railties", rails_version
gem "actionmailer", "< 7.1"
gem "actionpack", "< 7.1"
gem "actionview", "< 7.1"
gem "activemodel", "< 7.1"
gem "activerecord", "< 7.1"
gem "activesupport", "< 7.1"
gem "railties", "< 7.1"
gem "sprockets-rails"
end

gem "json"

@@ -141,10 +127,11 @@ group :test do
  gem "fakeweb", require: false
  gem "minitest", require: false
  gem "simplecov", require: false
  gem "selenium-webdriver", require: false
  gem "selenium-webdriver", "~> 4.14", require: false
  gem "selenium-devtools", require: false
  gem "test-prof"
  gem "webdrivers", require: false
  gem "rails-dom-testing", require: false
  gem "minio_runner", require: false
end

group :test, :development do
@@ -158,7 +145,7 @@ group :test, :development do

  gem "rspec-rails"

  gem "shoulda-matchers", require: false, github: "thoughtbot/shoulda-matchers"
  gem "shoulda-matchers", require: false
  gem "rspec-html-matchers"
  gem "byebug", require: ENV["RM_INFO"].nil?, platform: :mri
  gem "rubocop-discourse", require: false
@@ -209,7 +196,9 @@ gem "rack-mini-profiler", require: ["enable_rails_patches"]

gem "unicorn", require: false, platform: :ruby
gem "puma", require: false

gem "rbtrace", require: false, platform: :mri

gem "gc_tracer", require: false, platform: :mri

# required for feed importing and embedding
@@ -228,9 +217,8 @@ gem "logstash-event", require: false
gem "logstash-logger", require: false
gem "logster"

# These are forks of sassc and sassc-rails with dart-sass support
gem "dartsass-ruby"
gem "dartsass-sprockets"
# A fork of sassc with dart-sass support
gem "sassc-embedded"

gem "rotp", require: false

@@ -259,6 +247,11 @@ if ENV["IMPORT"] == "1"
  gem "parallel", require: false
end

group :generic_import, optional: true do
  gem "sqlite3"
  gem "redcarpet"
end

gem "web-push"
gem "colored2", require: false
gem "maxminddb"
Loading