912bb8a8e5
Bump fizzy-saas to enable console auditing
...
ref: https://app.fizzy.do/5986089/cards/2469
ref: https://github.com/basecamp/fizzy-saas/pull/20
2025-12-04 12:25:54 -05:00
c9eb44119d
Fixed typo in VCR filters ( #1929 )
...
I know it's a small thing, but I just noticed that 🤷
Be careful if you reintroduce your old VCRs as they have OPEN_API_KEY
2025-12-04 08:58:12 -08:00
78ea18b5da
Merge pull request #1872 from basecamp/filters-no-results
...
Nicer blank slates
2025-12-04 10:52:08 -06:00
373f4d5116
Merge pull request #1924 from basecamp/flavorjones/retry-mail-jobs
...
Retry mailer jobs on common networking and SMTP errors
2025-12-04 10:29:53 -05:00
c4a8996562
Retry mailer jobs on common networking and SMTP errors
...
This concern is lifted nearly verbatim from Basecamp.
ref: https://app.fizzy.do/5986089/cards/3300
2025-12-04 10:26:24 -05:00
dfe7095ee6
Merge pull request #1917 from basecamp/dont-resize-svg-avatars
...
Don't try to resize non-variable avatars
2025-12-04 14:53:00 +00:00
2fcdd921fc
Merge pull request #1922 from basecamp/flavorjones/revert-board-column-restriction
...
Revert "Changing columns requires board admin"
2025-12-04 09:50:59 -05:00
394c5dbf03
Revert "Changing columns requires board admin"
...
This reverts commit cecccadc14
2025-12-04 09:46:30 -05:00
916be75bed
Merge pull request #1859 from basecamp/flavorjones/fix-broken-remote-images
...
Gracefully handle ill-formed remote images in rich text
2025-12-04 09:39:26 -05:00
2e47749739
Don't allow SVG avatar uploads in the first place
2025-12-04 14:27:28 +00:00
89940d36f8
Gracefully handle ill-formed remote images in rich text
...
A better fix has been proposed upstream at
https://github.com/rails/rails/pull/56283 but this should be fine in
the meantime.
ref: https://app.fizzy.do/5986089/cards/3188
2025-12-04 09:24:52 -05:00
6475ad3425
Don't try to resize non-variable avatars
2025-12-04 13:36:21 +00:00
069e0ca0b2
Merge pull request #1920 from basecamp/routes-trailing-whitespace
...
Remove trailing whitespace
2025-12-04 13:36:02 +00:00
08c380cc71
Remove trailing whitespace
...
Appease the Rubocop
2025-12-04 13:32:47 +00:00
150e7caf03
Merge pull request #1908 from basecamp/install-runtime-and-ci-dependencies-on-mac
...
Install any runtime or ci dependencies in bin/setup on MacOS
2025-12-04 13:16:46 +01:00
b3481b10a8
Move legacy out of sight
2025-12-04 03:34:30 -08:00
d466b633fc
Merge pull request #1915 from basecamp/sign-up-new-users-on-sign-in
...
Sign up new users on sign in
2025-12-04 11:32:51 +01:00
9e0b5593ad
Merge pull request #1848 from basecamp/rate-limit-warning
...
Show alert message on login when rate limited
2025-12-04 10:30:37 +00:00
a8f328c921
Sign up new users on sign in
2025-12-04 11:30:21 +01:00
06478f23d2
Merge pull request #1912 from basecamp/refactor-reaction-permission-check
...
Change reaction admin permission check to be in-line with other controllers
2025-12-04 11:04:12 +01:00
5cfe6930ee
Change reaction admin permission check to be in-line with other controllers
2025-12-04 11:01:23 +01:00
6050f187ca
Merge pull request #1895 from jbnunn/remove-legacy-join-pattern
...
Removed legacy join link
2025-12-04 09:21:08 +01:00
ea826860e0
Install any runtime or ci dependencies in bin/setup
2025-12-04 09:16:30 +01:00
af43ef4962
Merge pull request #1897 from Hacksore/fix/board-bell-title
...
Move the title to the button
2025-12-04 09:02:08 +01:00
a0cb25a951
Merge pull request #1881 from basecamp/card-notification-removal-scope
...
Tighten scope on card notification removals
2025-12-04 08:44:52 +01:00
457a6d71b7
Merge pull request #1906 from basecamp/column-management-auth
...
Changing columns requires board admin
2025-12-04 08:34:49 +01:00
40f906f69f
Merge pull request #1896 from umarhadi/main
...
Add Missing Production Databases for Solid Queue and Solid Cache
2025-12-04 08:34:15 +01:00
cecccadc14
Changing columns requires board admin
2025-12-03 23:24:25 -08:00
7af93765a8
Security: close narrow window of exposure to DNS rebinding ( #1903 )
2025-12-03 23:12:17 -08:00
c1468de3d7
Fix title on bell icon
2025-12-03 21:20:34 -06:00
374fa1b5d0
Add production queue and cache database config
2025-12-04 09:50:45 +07:00
383033b9d0
Removed legacy join link
2025-12-03 18:06:38 -08:00
cac0ca1656
Scope the single-board case to just the creator's boards ( #1880 )
2025-12-03 15:47:04 -08:00
f440b0243e
Tighten scope on card notification removals
...
* Iterate each association separately to favor db indexing
* Pluck user IDs rather than select to avoid correlated subquery
2025-12-03 15:46:43 -08:00
49139b7a14
SQLite import creates account-scoped tags
...
References #1879
2025-12-03 15:09:22 -08:00
9cf223aea1
Fix path
2025-12-03 23:53:18 +01:00
efc809c23e
Script to fix misassigned tags
...
See https://github.com/basecamp/fizzy/pull/1879
2025-12-03 23:46:08 +01:00
38d86fb17b
Merge pull request #1879 from basecamp/scope-tags
...
Scope tags by account
2025-12-03 23:42:04 +01:00
4a30663df1
Scope tags by account
...
We missed this one when we went to MySQL. This can results in cards tagged with cards
from other accounts. No data leaked though: the symptom is that you see the card
tagged as expected but you don't see the tag in the menu.
2025-12-03 23:39:37 +01:00
6847c001ea
Merge pull request #1876 from basecamp/column-reordering-auth
...
Fix unauthorized column reordering
2025-12-03 22:18:06 +01:00
367e5aa1dd
Merge pull request #1871 from imbriaco/patch-2
...
Use environment variable for default mailer address
2025-12-03 22:07:39 +01:00
6c9ec052db
Merge pull request #1874 from basecamp/bump-prometheus-client-mmap
...
Bump fizzy-saas to upgrade prometheus-client-mmap to ~> 1.4.0
2025-12-03 22:06:41 +01:00
9f6a4f1cc6
Fix unauthorized column reordering
...
Users could reorder columns they didn't have access to. Fixed by
limiting ColumnScoped to User::Accessor#accessible_columns.
References https://hackerone.com/reports/3449905
2025-12-03 13:00:49 -08:00
7fcf660f05
Merge pull request #1854 from MatheusRich/find-by-over-where-first
...
Prefer find_by! over where + first!
2025-12-03 21:51:18 +01:00
4bcedbbd77
Upgrade prometheus-client-mmap to ~> 1.4.0
2025-12-03 20:46:23 +00:00
cd23a54bb5
Merge pull request #1873 from basecamp/flavorjones/seed-staff-users
...
Update seeds to use `@example.com`
2025-12-03 15:44:54 -05:00
6345aa4787
Update seeds to use @example.com
...
See also https://www.rfc-editor.org/rfc/rfc2606.html
2025-12-03 15:40:58 -05:00
8064e017dc
db:seeds create staff users for testing in development
2025-12-03 15:29:36 -05:00
bb149da532
Move blank slates to its own file
2025-12-03 14:13:04 -06:00
0ef6f8a822
Nicer blank slates
2025-12-03 14:11:08 -06:00
Mike Dalessio