fa549a370b
Add a system test for joining an account
...
Reworked the magic link stimulus controller, because the system test
was causing double-submission of the form (because the event was
bubbling up). I think that change simplifies the form and will still
work well for iOS devices.
2025-12-05 21:51:44 -05:00
345f457513
Tune CSP for user extensions and close implicit-allow gaps ( #1974 )
...
Loosen font-src and add media-src to allow browser extensions like
accessibility fonts (OpenDyslexic) and user style managers to work
without CSP violations.
Add default-src and connect-src directives to close security gaps where
unspecified directives were implicitly allowing all sources.
2025-12-05 16:57:03 -08:00
6006491ab4
Content Security Policy ( #1964 )
...
Default to a very narrow policy since there are no CDNs or third-party
resources to contend with.
Configurable via:
- config.x.content_security_policy.* for fizzy-saas gem overrides
- DISABLE_CSP to skip entirely
- CSP_REPORT_ONLY to enable report-only mode
- CSP_REPORT_URI for violation reporting
2025-12-05 14:57:50 -08:00
4c094107b6
Merge pull request #1969 from basecamp/fix-ipaddr-setter
...
Fix ipaddr setter
2025-12-05 20:46:34 +01:00
1b3d7d4276
Fix ipaddr setter
2025-12-05 20:43:56 +01:00
3c72599381
Merge pull request #1967 from basecamp/fix-dns-resolution
...
Fix Resolv::DNS always returning no results
2025-12-05 20:13:44 +01:00
cd3751f4c1
Fix Resolv::DNS always returning no results
2025-12-05 20:09:39 +01:00
bc16f7582e
Merge pull request #1963 from basecamp/update-readme-deploy-info
...
Document deployment
2025-12-05 17:21:37 +00:00
04153038f0
Document deployment
...
- Update the README with detailed information about how to deploy a
Fizzy instance
- Reduce the example deploy config
- Add example SMTP configuration in production.rb
2025-12-05 17:03:07 +00:00
ed6c55adcd
Merge pull request #1931 from basecamp/pin-card-refresh
...
Update pinned cards when the title changes
2025-12-05 10:14:39 +01:00
59ff50c1cb
We can remove ad-hoc handling now that we rely on page refreshes in the card perma
2025-12-05 10:11:24 +01:00
c89db89f2a
Only broadcast when the preview changes, use the _later variant for the broadcast, add tests
2025-12-05 10:09:20 +01:00
bcad6b913c
Update pinned cards when the title changes
2025-12-05 10:09:20 +01:00
046a42c4f6
Rename to be more consistent
2025-12-05 07:55:11 +01:00
d729cf59f9
Beautify board watchers list ( #1946 )
...
* Beautify board_watchers_list by escaping the concat jungle
* Correct it and clean it
* Latest Rails to get the content tag fix
* Test against original collection
2025-12-04 16:14:52 -08:00
d5337d0689
Merge pull request #1938 from basecamp/add-missing-attr-on-public-boards
...
Add missing data attribute on public board
2025-12-04 16:10:42 -06:00
029c151a4e
Add missing data-attr on public board
2025-12-04 15:43:19 -06:00
fce6345fa6
Merge pull request #1936 from basecamp/use-self
...
Use buil-in support for :self in Stimulus
2025-12-04 22:42:55 +01:00
d5f8eeddaa
Merge pull request #1937 from basecamp/mobile-polish
...
Fix hotkey text size on tiny viewports
2025-12-04 15:26:24 -06:00
34d3383cbd
Fix hotkey text size on tiny viewports
2025-12-04 15:23:20 -06:00
effb96537a
Use buil-in support for :self in Stimulus
...
Thanks to @brunoprietog for advice https://github.com/basecamp/fizzy/pull/1927/files/9639e07ab88f628f5f37ad2aa9acee2b86d4fb1a#diff-24a46f2ca97f2964d4d8940123b7f76578694567df84256f576aa4bee221179e
2025-12-04 22:16:00 +01:00
1c5ead0096
Merge pull request #1930 from basecamp/prevent-blank-board-names
...
Prevent board names with only spaces and show validation message
2025-12-04 14:50:17 -06:00
e3e57a6a7e
Merge pull request #1927 from basecamp/speed-up-sorting
...
Faster D&D by optimistically inserting dropped cards
2025-12-04 21:31:21 +01:00
9639e07ab8
Save a bunch of invocations on morph events from children elements
2025-12-04 21:27:22 +01:00
704b5b9788
Fix: memoization was showing stale values when morphing
2025-12-04 21:21:54 +01:00
fee376b12b
Merge pull request #1932 from basecamp/flavorjones-validate-email
...
Validate Identity email address
2025-12-04 14:06:04 -05:00
bc1075f194
GitHub actions: limit GITHUB_TOKEN permissions ( #1933 )
2025-12-04 11:05:50 -08:00
00eee29837
Validate Identity email address
...
using the "standard" email regexp URI::MailTo::EMAIL_REGEXP. The form
field will validate this in the browser, but if bots are creating
identities, they can put whatever they want in here. So let's add some
protection against that.
The HtmlHelper regex was renamed here to avoid confusing Brakeman,
which does imprecise constant lookup and was confusing the two
constants, one of which uses `\A` and `\z` and the other does
not (intentionally).
ref: https://app.fizzy.do/5986089/cards/3276
2025-12-04 14:01:15 -05:00
4e0b83340d
Drop defunct user creation script
2025-12-04 10:42:34 -08:00
bbec988516
Golden cards should be placed at the top
2025-12-04 19:23:55 +01:00
a380492b32
Animate the column height with a stimulus controller so that it does not depend to the server to update when you D&D
2025-12-04 19:15:38 +01:00
53b97c94e0
mise: respect .ruby-version
...
(37signals have this configured globally; setting locally for others)
Closes #1891
2025-12-04 09:59:17 -08:00
23ec3f129a
Support custom validation messages
2025-12-04 11:43:55 -06:00
1122556383
Move css bit to the new blank slates CSS
2025-12-04 18:42:44 +01:00
5c4fe9fe8b
Prevent board names with only spaces and show validation message
2025-12-04 11:37:27 -06:00
03e4f86b7a
Merge pull request #1878 from basecamp/flavorjones/console1984-v2
...
Bump fizzy-saas to enable console auditing
2025-12-04 12:31:34 -05:00
539d3721db
Keep the column color when D&D cards
2025-12-04 18:31:23 +01:00
104bb5faa9
Add container to drop cards when the stream is empty
2025-12-04 18:31:23 +01:00
3536b6fb32
Modify counters optimistically too
2025-12-04 18:31:23 +01:00
19051aec3e
Append dropped cards instead of relying on server-side rendering to refresh the columns
...
This implements a simple strategy to optimistically insert cards in columns without waiting for the column refresh. Cards will be placed at the top respecting golden cards.
This uses sorting by "created at" with sorting by "updated at" for the _Not now_ column, so that the treatment everywhere is homogenous.
2025-12-04 18:31:23 +01:00
912bb8a8e5
Bump fizzy-saas to enable console auditing
...
ref: https://app.fizzy.do/5986089/cards/2469
ref: https://github.com/basecamp/fizzy-saas/pull/20
2025-12-04 12:25:54 -05:00
d4a50c996a
Merge pull request #1894 from Venkat-RK/main
...
Added 'Back to Home' link on notifications list page
2025-12-04 11:19:55 -06:00
c9eb44119d
Fixed typo in VCR filters ( #1929 )
...
I know it's a small thing, but I just noticed that 🤷
Be careful if you reintroduce your old VCRs as they have OPEN_API_KEY
2025-12-04 08:58:12 -08:00
78ea18b5da
Merge pull request #1872 from basecamp/filters-no-results
...
Nicer blank slates
2025-12-04 10:52:08 -06:00
a92aab9981
Removed test to verify back button.
2025-12-04 08:44:37 -08:00
373f4d5116
Merge pull request #1924 from basecamp/flavorjones/retry-mail-jobs
...
Retry mailer jobs on common networking and SMTP errors
2025-12-04 10:29:53 -05:00
c4a8996562
Retry mailer jobs on common networking and SMTP errors
...
This concern is lifted nearly verbatim from Basecamp.
ref: https://app.fizzy.do/5986089/cards/3300
2025-12-04 10:26:24 -05:00
dfe7095ee6
Merge pull request #1917 from basecamp/dont-resize-svg-avatars
...
Don't try to resize non-variable avatars
2025-12-04 14:53:00 +00:00
2fcdd921fc
Merge pull request #1922 from basecamp/flavorjones/revert-board-column-restriction
...
Revert "Changing columns requires board admin"
2025-12-04 09:50:59 -05:00
394c5dbf03
Revert "Changing columns requires board admin"
...
This reverts commit cecccadc14
2025-12-04 09:46:30 -05:00
Mike Dalessio