#### What type of PR is this?
/area plugin
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
Update preset plugins version
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind feature
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
Add role template for managing cache. Anyone with role `role-template-manage-cache` can see the `Refresh Page Cache` button.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/4143
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind feature
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
支持通过 ExternalUrlSupplier 获取 externalUrl 配置
#### Which issue(s) this PR fixes:
Fixes#4149
#### Does this PR introduce a user-facing change?
```release-note
支持通过 ExternalUrlSupplier 获取 externalUrl 配置
```
#### What type of PR is this?
/kind feature
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
Refactor configuration properties to configure caching with separate names, so that we can enable / disable cache with name.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/4144
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind feature
/milestone 2.7.x
/area core
/area theme
#### What this PR does / why we need it:
主题端支持获取最新评论
可能存在的问题：
主题端如果想展示评论所属的具体的主体比如 Moment 可能不好展示
how to test it?
通过 list 方法获取评论看排序和数据是否正确
```html
<p th:each="result : ${commentFinder.list(null,1,10)}">
<span th:text="${result.spec.raw}"></span>
-> <span th:text="${#temporals.format(result.spec.creationTime, 'yyyy-MM-dd HH:mm:ss')}"></span>
-> <span th:text="${result.spec.subjectRef}"></span>
</p>
```
#### Which issue(s) this PR fixes:
Fixes#4088
#### Does this PR introduce a user-facing change?
```release-note
主题端支持获取最新评论
```
#### What type of PR is this?
/kind feature
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
Add rate limiter for signing up. We only allow 3 registrations within 1 hour by default, despite registration failure.
#### Special notes for your reviewer:
1. Start Halo and console.
2. Try to enable registration for public users.
3. Browse <http://localhost:8090/console/login?type=signup>
4. Input duplicate username for 4 times and see the result.
5. Or input valid username for 4 times and see the result.
#### Does this PR introduce a user-facing change?
```release-note
限制注册接口的请求速率
```
#### What type of PR is this?
/kind feature
/milestone 2.7.x
/area core
#### What this PR does / why we need it:
为主题端的文章和自定义页面内容添加扩展点
插件可以通过实现扩展点来干预文章和自定义页面的内容显示，如修改内容的 html 结构，改变特定样式等
使用方式参考：[docs/extension-points/content.md](9b2b9f1837)
#### Which issue(s) this PR fixes:
Fixes#4003
#### Does this PR introduce a user-facing change?
```release-note
为主题端的文章和自定义页面内容添加扩展点
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
修复文章页 HTML Meta 标签重复问题
see #4049 for more details.
#### Which issue(s) this PR fixes:
Fixes#4049
#### Does this PR introduce a user-facing change?
```release-note
修复文章页 Meta Description 标签重复问题
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
In some special situations, Halo can not obtain client IP address from request headers and socket address is unresolved, so that `java.lang.NullPointerException: Cannot invoke "java.net.InetAddress.getHostAddress()" because the return value of "java.net.InetSocketAddress.getAddress()" is null` will happen.
This PR will resolve the problem by checking `X-Real-IP` header and checking if remote address is unresolved.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/4134
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind cleanup
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
Upgrade Spring Boot to 3.1.1. See https://github.com/spring-projects/spring-boot/releases/tag/v3.1.1 for more.
#### Does this PR introduce a user-facing change?
```release-note
升级 Spring Boot 至 3.1.1
```
#### What type of PR is this?
/kind feature
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
Apply rate limiter for replying a comment as well. This feature is supplement of <https://github.com/halo-dev/halo/pull/4084>.
#### Special notes for your reviewer:
Try to reply any comments 11 times within 1 minute.
#### Does this PR introduce a user-facing change?
```release-note
对评论回复添加频率限制
```
#### What type of PR is this?
/kind improvement
/area console
/milestone 2.7.x
#### What this PR does / why we need it:
简化请求异常提示的逻辑。
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind feature
/area core
#### What this PR does / why we need it:
This PR adds dependency [spring-boot-starter-cache](https://docs.spring.io/spring-boot/docs/current/reference/html/io.html#io.caching) as cache framework and [caffeine](https://github.com/ben-manes/caffeine/wiki) as cache implementation to cache template rendering result.
By default, we disable the cache feature. If you want to enable it, please try to configure properties like this:
```yaml
halo:
cache:
disabled: false
```
#### Which issue(s) this PR fixes:
Fixes#2827
#### Special notes for your reviewer:
1. Start Halo
2. Browse any page twice
3. See the difference in request times
#### Does this PR introduce a user-facing change?
```release-note
支持模板渲染结果缓存
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.7.x
/kind api-change
#### What this PR does / why we need it:
统一主题和插件描述文件的部分字段
1. 统一网站字段为 homepage，将主题的 website 标记为过时并兼容为 homepage
2. 主题添加 license 字段
3. 插件添加 repo
#### Which issue(s) this PR fixes:
Fixes#4011
#### Does this PR introduce a user-facing change?
```release-note
统一主题和插件描述文件的部分字段
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
插件的 Controllers 支持自定义 API Group
如：
```java
@RestController
@ApiVersion("fake.halo.run/v1")
@RequestMapping("/fake")
public class DemoController {
}
```
则生成路由为 `/apis/fake.halo.run/v1/fake`
如果没有 group 默认兼容以前的为 `/apis/api.plugin.halo.run/{version}/plugins/{pluginName}/**`
```java
@RestController
@ApiVersion("v1alpha1")
@RequestMapping("/fake")
public class DemoController {
}
```
#### Which issue(s) this PR fixes:
Fixes#4053
#### Does this PR introduce a user-facing change?
```release-note
插件的 Controllers 支持自定义 API Group
```
#### What type of PR is this?
/kind improvement
/area core
/area plugin
#### What this PR does / why we need it:
插件的 ApplicationContext 刷新之后在注册到 Registry 中
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area console
/milestone 2.7.x
#### What this PR does / why we need it:
Console 端部分使用了复制功能的页面，所使用的 useClipboard hook 添加 legacy 参数以解决部分浏览器的兼容问题。
#### Which issue(s) this PR fixes:
Fixes#4113
#### Special notes for your reviewer:
1. 使用路由地址（192.168.x.x）访问 Halo。
2. 测试附件详情弹框的链接复制和概览页面中的复制功能是否正常。
#### Does this PR introduce a user-facing change?
```release-note
优化 Console 端部分页面复制功能的兼容性问题。
```
#### What type of PR is this?
/area console
/kind improvement
/milestone 2.7.x
#### What this PR does / why we need it:
修复在部分移动端浏览器（比如 iOS Safari）中，下拉框组件（VDropdown）的选项点击无效的问题，即没有触发 click 事件。此问题的原因可能是因为我们用的 floating-vue 组件提供的 `v-close-popper` 指令的兼容问题，最小复现：https://stackblitz.com/edit/vitejs-vite-ncpzhj?file=src%2FApp.vue
此 PR 改写了关闭下拉框的方式，不再使用 v-close-popper 指令，而且对其他使用此组件的地方没有破坏性更新。
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/3689
Ref https://github.com/halo-dev/halo/issues/2699
#### Special notes for your reviewer:
如果有条件可以在移动端测试一下，尤其是 iOS Safari，目前在桌面端 Chrome 的设备模拟中测试正常。
#### Does this PR introduce a user-facing change?
```release-note
修复 Console 端的下拉框组件选项在移动端无法正常点击的问题。
```
#### What type of PR is this?
/kind bug
/area core
#### What this PR does / why we need it:
Catch UserNotFoundException instead of ExtensionNotFoundException to map correctly to BadCredentialsException.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/4057
#### Special notes for your reviewer:
1. Start Halo
2. Login with an username which does not exist
3. Check the response
#### Does this PR introduce a user-facing change?
```release-note
修复登录时出现用户名不存在的问题。
```
#### What type of PR is this?
/kind improvement
/area console
/milestone 2.7.x
#### What this PR does / why we need it:
为仪表板内置的小组件添加权限设置，解决部分没有权限的用户访问仪表盘提示异常的问题。
#### Which issue(s) this PR fixes:
Fixes#4111
#### Special notes for your reviewer:
测试方式：
1. 创建一个访客角色的用户。
2. 访问仪表盘，观察是否有异常提示，以及是否出现没有权限的小组件。
#### Does this PR introduce a user-facing change?
```release-note
Console 端仪表盘的内置小组件添加权限设置。
```
#### What type of PR is this?
/area console
/kind improvement
/milestone 2.7.x
#### What this PR does / why we need it:
维护 Console 端的开发基础设施。
- 升级 TypeScript 以及 Vue 对于 TS 支持的相关包。
- 优化 packages 下所有包的配置，解决构建时生成 d.ts 文件的异常。
- 解决 TS 异常。
#### Special notes for your reviewer:
尝试执行：
1. pnpm build:packages
2. pnpm typecheck
观察是否正常即可。
#### Does this PR introduce a user-facing change?
```release-note
维护 Console 端的开发基础设施。
```
#### What type of PR is this?
/kind feature
/kind core
#### What this PR does / why we need it:
This PR limited comment creation at a rate of 10 per minute.
See https://github.com/halo-dev/halo/issues/4044 for more.
#### Special notes for your reviewer:
1. Start Halo.
2. Create 11 new comments
3. Check the response.
#### Does this PR introduce a user-facing change?
```release-note
增加发表评论频率限制功能
```
#### What type of PR is this?
/area console
/kind improvement
/milestone 2.7.x
#### What this PR does / why we need it:
为默认类型的按钮添加鼠标悬浮的样式。
<img width="333" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/922dd681-a2f1-4875-adef-9d1c5a075467">
#### Which issue(s) this PR fixes:
Fixes#4067
#### Does this PR introduce a user-facing change?
```release-note
Console 端默认类型的按钮添加鼠标悬浮的样式。
```
#### What type of PR is this?
/kind improvement
/area core
#### What this PR does / why we need it:
Define a global map to mapping exception to problem detail type.
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind bug
/area core
#### What this PR does / why we need it:
This PR excludes WebSocket request when serving console index and remove request predicate accept in ConsoleProxyFilter.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/4083
#### Special notes for your reviewer:
1. Start Console with dev environment
2. Start Halo with dev profile
3. Try to browse <http://localhost:8090/console> and check the log
#### Does this PR introduce a user-facing change?
```release-note
修复开发环境下访问 Console 出现错误的问题
```
#### What type of PR is this?
/kind bug
/area core
#### What this PR does / why we need it:
This is a bug introduced from https://github.com/halo-dev/halo/pull/4062. I have overridden onAuthenticationSuccess to create rate limiter in advance instead of invoking `securityContextRepository#save` before.
See https://github.com/halo-dev/halo/pull/4099#issuecomment-1598074131 for more.
#### Special notes for your reviewer:
1. Try to log in with incorrect password three times
2. Log in with correct password and check if the response headers contain `Set-Cookie`
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/area console
/kind feature
/milestone 2.7.x
#### What this PR does / why we need it:
支持在创建分类的时候选择上级分类。
<img width="805" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/02912f70-4de4-4b8e-bbbe-f973fbd3e684">
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/4040
#### Special notes for your reviewer:
测试方式：
1. 测试新建的时候指定上级分类的功能是否正常。
2. 点击某个分类的操作按钮，选择添加子分类的菜单项，检查在新建分类的表单中上级分类是否选中了此分类。
#### Does this PR introduce a user-facing change?
```release-note
Console 端的文章分类支持在新建时指定上级分类。
```
#### What type of PR is this?
/area console
/kind improvement
/milestone 2.7.x
#### What this PR does / why we need it:
在使用某个三方登录的时候，禁用其他三方登录，防止重复点击。
#### Which issue(s) this PR fixes:
Fixes#4064
#### Special notes for your reviewer:
测试方式：
1. 可安装 https://github.com/halo-sigs/plugin-oauth2 进行测试，可以不用配置各个登录方式，只需开启即可。
2. 在登录页面点击某个三方登录方式，观察所有三方登录方式的按钮是否被禁用。
#### Does this PR introduce a user-facing change?
```release-note
优化 Console 端登录页面的三方登录方式按钮，禁用重复点击。
```
#### What type of PR is this?
/kind improvement
/area console
#### What this PR does / why we need it:
去除`index.html`的`lang`属性以避免console端出现翻译提示
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/3692
#### Special notes for your reviewer:
#### Does this PR introduce a user-facing change?
```release-note
避免 Console 端出现翻译提示
```
#### What type of PR is this?
/kind feature
/area core
#### What this PR does / why we need it:
This PR introduces https://github.com/resilience4j/resilience4j to archive the feature. The login endpoint has limited login failures at a rate of 3 per minute.
See https://github.com/halo-dev/halo/issues/4044 for more.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/4044
#### Special notes for your reviewer:
1. Start Halo.
2. Try to login with incorrect credential 4 times
3. Check the response.
#### Does this PR introduce a user-facing change?
```release-note
增加登录失败次数限制功能
```
#### What type of PR is this?
/kind improvement
/kind bug
/area core
/area plugin
/milestone 2.6.x
#### What this PR does / why we need it:
修复插件重启后 MainClass 对象缓存未清除的问题
how to test it?
下载此插件：
[plugin-starter-1.0.0-SNAPSHOT.jar.zip](https://github.com/halo-dev/halo/files/11620847/plugin-starter-1.0.0-SNAPSHOT.jar.zip)
安装并启动插件，会看到类似如下日志：
```
测试从 [/var/folders/1z/3hlt62691tx63dxx6y0mryw00000gn/T/halo-plugin3709893537121269748.txt] 文件读取内容
插件启动成功！
```
修改日志中给出的文件的内容后 reload 插件会看到`插件启动成功！` 后会跟随最新的文件内容则表示 MainClass 是最新的状态没有缓存。
#### Which issue(s) this PR fixes:
Fixes#4016
#### Does this PR introduce a user-facing change?
```release-note
修复插件重启后 MainClass 对象缓存未清除的问题
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.7.x
#### What this PR does / why we need it:
修复主题和插件静态资源的文件遍历漏洞
漏洞描述：
攻击者可以通过`/plugins/{name}/assets/console/{*resource}` 和 `/themes/{themeName}/assets/{*resource}` 的 resource 参数部分添加特殊字符（如 ../ 或 ..\）来绕过应用程序的访问控制，访问他们没有权限访问的文件或目录。
修复方法：
访问文件之前检查文件路径是否在被限制的目录下，如:
resource = /themes/default/templates/../../test
简化路径为 /themes/test
想限制路径在 `/themes/default/templates` 则已经越权拒绝访问
how to test it?
1. 访问例如 `localhost:8090/themes/theme-earth/assets/dist/../../../../../keys/id_rsa` 来检查获取上级目录，上上级目录是否可以访问到，必须只能访问到 themes/assets下的文件即为合理
2. 类似步骤 1 可以尝试`../`， `..\` 来访问 `localhost:8090/plugins/{name}/assets/console/{*resource}`，必须只能访问到插件的 `classpath:console/` 下的文件即为合理
#### Does this PR introduce a user-facing change?
```release-note
修复主题和插件静态资源的路径遍历漏洞
```
<!-- Thanks for sending a pull request! Here are some tips for you:
1. 如果这是你的第一次，请阅读我们的贡献指南：<https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>。
1. If this is your first time, please read our contributor guidelines: <https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>.
2. 请根据你解决问题的类型为 Pull Request 添加合适的标签。
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request.
3. 请确保你已经添加并运行了适当的测试。
3. Ensure you have added or ran the appropriate tests for your PR.
-->
#### What type of PR is this?
/kind bug
<!--
添加其中一个类别：
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind improvement
适当添加其中一个或多个类别（可选）：
Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->
#### What this PR does / why we need it:
Fix AttachmentReconciler repeated execution.
#### Which issue(s) this PR fixes:
<!--
PR 合并时自动关闭 issue。
Automatically closes linked issue when PR is merged.
用法：`Fixes #<issue 号>`，或者 `Fixes (粘贴 issue 完整链接)`
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
-->
Fixes#3746
#### Special notes for your reviewer:
The reconile method in run.halo.app.core.extension.reconciler.attachment.AttachmentReconciler will be executed repeatedly, uploading an attachment will be executed twice, because updating the finalizers property will be in onUpdate of run.halo.app.extension.controller.ExtensionWatcher Will request duplicate addition, I provide a fix for you to review
#### Does this PR introduce a user-facing change?
<!--
如果当前 Pull Request 的修改不会造成用户侧的任何变更，在 `release-note` 代码块儿中填写 `NONE`。
否则请填写用户侧能够理解的 Release Note。如果当前 Pull Request 包含破坏性更新（Break Change），
Release Note 需要以 `action required` 开头。
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
-->
```release-note
修复 AttachmentReconciler 重复执行
```
#### What type of PR is this?
/kind feature
/area core
/area plugin
#### What this PR does / why we need it:
This PR adds property sources into PluginApplicationContext environment to support configuration properties mechanism.
See https://github.com/halo-dev/halo/issues/4015 for more.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/4015
#### Special notes for your reviewer:
You can verify the mechanism in [plugin-starter](https://github.com/halo-dev/plugin-starter) according to documentation `docs/developer-guide/plugin-configuration-properties.md`.
I've only tested it on macOS, looking forward to feedback on Windows.
#### Does this PR introduce a user-facing change?
```release-note
支持在插件中定义 @ConfigurationProperties 注解
```
<!-- Thanks for sending a pull request! Here are some tips for you:
1. 如果这是你的第一次，请阅读我们的贡献指南：<https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>。
1. If this is your first time, please read our contributor guidelines: <https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>.
2. 请根据你解决问题的类型为 Pull Request 添加合适的标签。
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request.
3. 请确保你已经添加并运行了适当的测试。
3. Ensure you have added or ran the appropriate tests for your PR.
-->
#### What type of PR is this?
<!--
添加其中一个类别：
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind improvement
适当添加其中一个或多个类别（可选）：
Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->
/kind bug
/area core
#### What this PR does / why we need it:
Fix the problem that the meta description with special characters causes the page to display abnormally.
Use htmlEscape in org.springframework.web.util.HtmlUtils to escape the special characters contained in the original description.
see #4000
#### Which issue(s) this PR fixes:
<!--
PR 合并时自动关闭 issue。
Automatically closes linked issue when PR is merged.
用法：`Fixes #<issue 号>`，或者 `Fixes (粘贴 issue 完整链接)`
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
-->
Fixes#4000
#### Special notes for your reviewer:
#### Does this PR introduce a user-facing change?
<!--
如果当前 Pull Request 的修改不会造成用户侧的任何变更，在 `release-note` 代码块儿中填写 `NONE`。
否则请填写用户侧能够理解的 Release Note。如果当前 Pull Request 包含破坏性更新（Break Change），
Release Note 需要以 `action required` 开头。
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
-->
```release-note
NONE
```
#### What type of PR is this?
/kind cleanup
/area core
#### What this PR does / why we need it:
Bump Halo to 2.7.0-SNAPSHOT for next development iteration.
#### Does this PR introduce a user-facing change?
```release-note
None
```
Halo Dev Bot