bc073a7e79
Merge pull request #2008 from nqst/involvement-button-label-restore
...
Restore "Watch this" / "Stop watching" button labels
2025-12-08 11:57:16 -06:00
cf6d3e2361
Merge pull request #2010 from basecamp/flavorjones/search-results-datetime
...
Add datetime to the search results
2025-12-08 12:12:36 -05:00
642506e79e
Add datetime to the search results
...
I find it helpful (especially when going through a long list of
results) to know how far back in time I'm looking.
A note on the timestamp being used: it's the search index
timestamp. Using the card or comment `updated_at` is fraught because
we do so much touching of records (e.g., comment is touched when a
reaction is added; card is touched when a comment is added). Let's
display the search record's `created_at`, which is the ordering used
for the overall results.
2025-12-08 11:58:54 -05:00
63805aee0f
Merge pull request #1984 from gijigae/fix/japanese-ime-input
...
Fix Japanese IME input handling for tag, step, and reaction fields
2025-12-08 11:09:33 -05:00
c479235c60
Fix involvement button label
2025-12-08 15:54:36 +01:00
2110fba227
Bump mittens to 0.3.1 ( #2006 )
2025-12-08 15:26:39 +01:00
15983cede3
No need to pass Currentl.user since it is the default value for the param
2025-12-07 20:03:06 +01:00
30422486df
Merge pull request #2005 from basecamp/flavorjones/join-code-email-validation
...
Validate email before creating identity during join code redemption
2025-12-07 13:33:01 -05:00
661a7e5e2d
Validate email before creating identity during join code redemption
...
Avoid Sentry exceptions when attackers try to stuff invalid emails. The
browser performs form field validation that should normally prevent this
from occurring, so we just return 422 without validation error messages.
See similar change in #1996 for sign-in and sign-up
2025-12-07 13:26:34 -05:00
12eceb97eb
Merge pull request #2001 from basecamp/revert-1955-immediate-variants
...
Revert "Immediate avatar and embed variants"
2025-12-07 12:09:03 +01:00
c8c91259c7
Revert "Immediate avatar and embed variants"
2025-12-07 12:06:03 +01:00
7fe22b5767
Merge pull request #1971 from ari-party/patch-02
...
README.md codeblock consistency
2025-12-07 11:59:52 +01:00
2ef0377f56
Merge pull request #1966 from ari-party/main
...
Add WEB_CONCURRENCY env support for Puma worker count
2025-12-07 11:59:15 +01:00
568783efd1
Merge pull request #1905 from basecamp/web-push-ssrf
...
Security: Web Push SSRF
2025-12-07 11:58:14 +01:00
91017c9208
Merge pull request #1955 from basecamp/immediate-variants
...
Immediate avatar and embed variants
2025-12-07 11:50:02 +01:00
4a6f28b7c5
Merge pull request #1948 from jstarner/custom-delete-modals
...
Replace turbo confirmation dialogs with custom delete modals
2025-12-07 11:48:58 +01:00
9f20e8bfbb
Merge pull request #1973 from basecamp/lightbox-transitionend-handler
...
Fix lightbox transitionend listener leak
2025-12-07 11:44:03 +01:00
d19c02d19d
Merge pull request #1998 from felixefelip/test-notifications_settings_controller
...
Test Notifications::SettingsController
2025-12-07 11:43:13 +01:00
f2c676e69d
Merge pull request #1983 from AmiasYaska/fix-activity-typo
...
Fix typo in back link: Actvity -> Activity
2025-12-07 11:42:20 +01:00
d90548873d
Merge pull request #1999 from basecamp/refactor-column-title-route
...
Make column have a proper ID instead of inferring it from the title
2025-12-07 11:39:35 +01:00
31a41e66c2
Make column have a proper ID instead of inferring it from the title
2025-12-07 11:34:54 +01:00
4c9d8edbc6
Test Notifications::SettingsController
2025-12-07 04:25:11 -03:00
a6cb569945
Merge pull request #1996 from basecamp/flavorjones/email-validation-in-signup-signin
...
Validate email before creating identity during sign-up and sign-in
2025-12-06 16:56:38 -05:00
0160f215f2
Validate email before creating identity during sign-up and sign-in
...
Avoid Sentry exceptions when attackers try to stuff invalid emails. The
browser performs form field validation that should normally prevent this
from occurring, so we just return 422 without validation error messages.
Also:
- extract redirect_to_session_magic_link helper
- some controller refactoring and cleanup
2025-12-06 16:52:16 -05:00
95ba2c01b8
Add email validation to Signup
2025-12-06 16:50:39 -05:00
3ff45d77bb
Ensure test coverage for invalid Signup#complete
2025-12-06 16:46:51 -05:00
b2250b6d35
Ensure test coverage for all branches of JoinCodesController#create
2025-12-06 16:40:51 -05:00
d747d1bfa3
Ensure we have good test coverage on Signup.create_identity
...
because we're relying on it returning a MagicLink
2025-12-06 16:40:17 -05:00
0793400771
Merge pull request #1994 from basecamp/flavorjones/signup-dev-magic-link
...
Render verification code in dev for signups, too
2025-12-06 15:07:47 -05:00
c32685981f
Merge pull request #1993 from basecamp/flavorjones/avatar-image-type-error-message
...
User profile edit form shows validation errors
2025-12-06 15:04:42 -05:00
b439a7695b
Render verification code in dev for signups, too
...
Related to 5865d79e#1991
2025-12-06 15:02:22 -05:00
675600af72
Improve presentation of validation errors
2025-12-06 14:57:27 -05:00
c388f5ef20
Display validation errors for user profiles.
...
Specifically this will help people understand why their SVG avatar
uploads are being rejected, and will keep the RecordInvalid exception
out of Sentry logs.
2025-12-06 14:34:08 -05:00
1883473de1
Remove duplication in the list of supported avatar file types
2025-12-06 14:34:08 -05:00
8992a45c35
Merge pull request #1991 from basecamp/flavorjones/dev-mode-verification-code
...
Display the verification code in the development environment
2025-12-06 13:49:29 -05:00
5865d79ed9
Display the verification code in the dev env
...
This seems better and easier than the console log.
2025-12-06 13:46:13 -05:00
529f5af5f6
CSP adherence: fix magic links console logging ( #1989 )
...
* CSP: fix magic link console logging by including nonce in the script tag
* Remove unused back-nav controller
Unused since c0f842427d
2025-12-06 10:08:22 -08:00
e6e0048103
Merge pull request #1987 from basecamp/indented-list-alignment
...
Small visual tweak for indented list style
2025-12-06 18:58:01 +01:00
e562c72ec9
Small visual tweak for indented list style
2025-12-06 17:58:01 +01:00
7d4775d249
Fix typo in back link: Actvity -> Activity
2025-12-06 14:32:05 +03:00
acedb76598
Merge pull request #1952 from luojiyin1987/chore/dockerfile-prod-exclude-test-gems
...
chore: exclude test gems from production bundle
2025-12-06 11:31:17 +01:00
f3e47901ec
Merge pull request #1980 from basecamp/reverv-ssrf-acronym
...
Rever to using Ssrf instead of SSRF
2025-12-06 11:10:24 +01:00
73c2b00211
Rever to using Ssrf instead of SSRF
...
Ref: https://github.com/basecamp/fizzy/pull/1967#discussion_r2593750027
2025-12-06 11:04:55 +01:00
ffb357becf
Merge pull request #1742 from basecamp/latest-lexxy
...
Update lexxy to latest
2025-12-06 10:31:19 +01:00
e03c002efd
Fix Japanese IME input handling for tags and form fields
...
When typing in Japanese, the Enter key is used to confirm kanji conversion
during IME composition. Previously, pressing Enter would immediately save
the tag, which prevented users from completing the conversion.
Changes:
- Add isComposing check to navigable_list_controller.js Enter handler
- Add IME composition tracking to form_controller.js
- Add compositionstart/compositionend event handlers to tag, step, and
reaction input fields
- Add preventComposingSubmit action to prevent form submission during
composition
This fix supports all IME input methods (Japanese, Chinese, Korean, etc.)
using standard browser composition events.
2025-12-06 17:26:35 +09:00
af14feb8fc
CSP gives env config precedence ( #1976 )
...
Bit clearer, and simpler config wrangling: presence of ENV → use it.
2025-12-05 20:49:41 -08:00
ab5964a375
Tune CSP: allow required external sources and user tools ( #1977 )
...
External sources:
- challenges.cloudflare.com for Turnstile (script-src, frame-src)
- storage.basecamp.com for Active Storage (connect-src)
User tools: loosen style/img/font/media/worker-src to avoid fighting
accessibility extensions, privacy tools, and custom fonts.
2025-12-05 20:45:48 -08:00
7694ade843
Merge pull request #1975 from basecamp/flavorjones/fix-webhook-view
...
Pass correct params to webhook reactivation url helper.
2025-12-05 22:47:33 -05:00
69f8216982
Pass correct params to webhook reactivation url helper.
...
ref: https://app.fizzy.do/5986089/cards/3219
2025-12-05 22:44:34 -05:00
00db048f9e
Merge pull request #1968 from basecamp/flavorjones/only-email-confirmed-users
...
Mark users as "verified" and only send notifications to verified users
2025-12-05 22:15:13 -05:00
Jason Zimdars