Commit Graph

4419 Commits (58679b28117b1d6271dbb8ab995d24061d4ae5ec)

Author SHA1 Message Date
Ryan Wang 8db4cec91e
feat: add support for inserting external media resources to the default editor (#4126)
#### What type of PR is this?

/kind feature
/area console
/area editor
/milestone 2.7.x

#### What this PR does / why we need it:

默认编辑器支持直接插入图片、视频、音频,提供除了附件库的媒体插入入口。

<img width="1011" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/4c9be243-882f-4d21-9fa8-ce3033744746">

通过链接插入图片需要 https://github.com/halo-sigs/richtext-editor/pull/17 的支持。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/3882
Fixes https://github.com/halo-dev/halo/issues/3994

#### Special notes for your reviewer:

测试编辑器通过链接插入图片、视频、音频的功能是否正常。

#### Does this PR introduce a user-facing change?

```release-note
默认编辑器支持不通过附件库直接插入图片、视频、音频。
```
2023-06-28 09:54:11 +00:00
John Niang 4aec1ba8f6
Check X-Real-IP header when obtaining client IP (#4139)
#### What type of PR is this?

/kind bug
/area core
/milestone 2.7.x

#### What this PR does / why we need it:

In some special situations, Halo can not obtain client IP address from request headers and socket address is unresolved, so that `java.lang.NullPointerException: Cannot invoke "java.net.InetAddress.getHostAddress()" because the return value of "java.net.InetSocketAddress.getAddress()" is null` will happen.

This PR will resolve the problem by checking `X-Real-IP` header and checking if remote address is unresolved.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/4134

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-28 09:50:11 +00:00
John Niang 25103b9ff8
Upgrade Spring Boot to 3.1.1 (#4136)
#### What type of PR is this?

/kind cleanup
/area core
/milestone 2.7.x

#### What this PR does / why we need it:

Upgrade Spring Boot to 3.1.1. See https://github.com/spring-projects/spring-boot/releases/tag/v3.1.1 for more.

#### Does this PR introduce a user-facing change?

```release-note
升级 Spring Boot 至 3.1.1
```
2023-06-28 08:08:11 +00:00
John Niang ff33608fed
Apply rate limiter for replying a comment (#4135)
#### What type of PR is this?

/kind feature
/area core
/milestone 2.7.x

#### What this PR does / why we need it:

Apply rate limiter for replying a comment as well. This feature is supplement of <https://github.com/halo-dev/halo/pull/4084>.

#### Special notes for your reviewer:

Try to reply any comments 11 times within 1 minute.

#### Does this PR introduce a user-facing change?

```release-note
对评论回复添加频率限制
```
2023-06-28 07:38:11 +00:00
Ryan Wang 02e7068ee0
refactor: simplify request exception handling (#4129)
#### What type of PR is this?

/kind improvement
/area console
/milestone 2.7.x

#### What this PR does / why we need it:

简化请求异常提示的逻辑。

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-28 06:44:12 +00:00
John Niang d0526ec592
Add support for caching template rendering result (#4091)
#### What type of PR is this?

/kind feature
/area core

#### What this PR does / why we need it:

This PR adds dependency [spring-boot-starter-cache](https://docs.spring.io/spring-boot/docs/current/reference/html/io.html#io.caching) as cache framework and [caffeine](https://github.com/ben-manes/caffeine/wiki) as cache implementation to cache template rendering result.

By default, we disable the cache feature. If you want to enable it, please try to configure properties like this:

```yaml
halo:
  cache:
    disabled: false
```

#### Which issue(s) this PR fixes:

Fixes #2827 

#### Special notes for your reviewer:

1. Start Halo
2. Browse any page twice
3. See the difference in request times

#### Does this PR introduce a user-facing change?

```release-note
支持模板渲染结果缓存
```
2023-06-26 14:38:00 +00:00
guqing 2791d2f0e5
refactor: uinify some properties of plugins and themes (#4061)
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.7.x
/kind api-change

#### What this PR does / why we need it:
统一主题和插件描述文件的部分字段
1. 统一网站字段为 homepage,将主题的 website 标记为过时并兼容为 homepage
2. 主题添加 license 字段
3. 插件添加 repo

#### Which issue(s) this PR fixes:
Fixes #4011

#### Does this PR introduce a user-facing change?
```release-note
统一主题和插件描述文件的部分字段
```
2023-06-26 14:33:58 +00:00
guqing ff7ab4e4f1
refactor: support for custom api group in plugin controllers (#4065)
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.7.x

#### What this PR does / why we need it:
插件的 Controllers 支持自定义 API Group
如:
```java
@RestController
@ApiVersion("fake.halo.run/v1")
@RequestMapping("/fake")
public class DemoController {
}
```
则生成路由为 `/apis/fake.halo.run/v1/fake`
如果没有 group 默认兼容以前的为 `/apis/api.plugin.halo.run/{version}/plugins/{pluginName}/**`
```java
@RestController
@ApiVersion("v1alpha1")
@RequestMapping("/fake")
public class DemoController {
}
```

#### Which issue(s) this PR fixes:
Fixes #4053

#### Does this PR introduce a user-facing change?
```release-note
插件的 Controllers 支持自定义 API Group
```
2023-06-26 14:01:57 +00:00
Ryan Wang e13beb4cd1
feat: add redirect support for social auth provider (#4063)
#### What type of PR is this?

/area console
/kind feature
/milestone 2.7.x

#### What this PR does / why we need it:

三方登录时支持传入 `login_redirect_uri` 参数,以让三方登录提供方支持适配登录后重定向到具体页面的功能。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/4029

#### Special notes for your reviewer:

测试方式:

1. 可以使用 https://github.com/halo-sigs/plugin-oauth2/pull/33 进行测试。
2. 手动在登录页面构造如 https://127.0.0.1:8090/console/login?redirect_uri=/ 的地址,观察使用三方登录之后是否会跳转到指定页面。

#### Does this PR introduce a user-facing change?

```release-note
Console 端三方登录支持重定向参数。
```
2023-06-26 13:35:58 +00:00
Ryan Wang c39691d6fe
feat: make default editor extensible (#4090)
#### What type of PR is this?

/area console
/kind feature
/milestone 2.7.x

#### What this PR does / why we need it:

默认编辑器支持扩展,包括输入类型、工具栏、Slash Command 等。

Ref https://github.com/halo-sigs/richtext-editor/pull/16

## 定义方式

```ts
import ExtensionFoo from "./tiptap/extension-foo.ts"

export default definePlugin({
  extensionPoints: {
    "default:editor:extension:create": () => {
      return [ExtensionFoo];
    },
  },
});
```

其中,`ExtensionFoo` 是一个 Tiptap Extension,可以参考 [Tiptap 文档](https://tiptap.dev/) 和 [https://github.com/halo-sigs/richtext-editor/blob/main/docs/extension.md](https://github.com/halo-sigs/richtext-editor/blob/main/docs/extension.md)。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/4028

#### Does this PR introduce a user-facing change?

```release-note
Console 端的默认编辑器支持被扩展
```
2023-06-26 13:33:59 +00:00
guqing 532d7e0632
refactor: register plugin application context after context refreshed (#4092)
#### What type of PR is this?
/kind improvement
/area core
/area plugin

#### What this PR does / why we need it:
插件的 ApplicationContext 刷新之后在注册到 Registry 中

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-26 13:31:59 +00:00
Ryan Wang 34d0f9369b
refactor: add legacy option for useClipboard hook to solve compatibility issues (#4114)
#### What type of PR is this?

/kind improvement
/area console
/milestone 2.7.x

#### What this PR does / why we need it:

Console 端部分使用了复制功能的页面,所使用的 useClipboard hook 添加 legacy 参数以解决部分浏览器的兼容问题。

#### Which issue(s) this PR fixes:

Fixes #4113 

#### Special notes for your reviewer:

1. 使用路由地址(192.168.x.x)访问 Halo。
2. 测试附件详情弹框的链接复制和概览页面中的复制功能是否正常。

#### Does this PR introduce a user-facing change?

```release-note
优化 Console 端部分页面复制功能的兼容性问题。
```
2023-06-26 13:28:08 +00:00
Ryan Wang 27ef8d3bab
fix: dropdown options cannot be clicked in some mobile devices (#4116)
#### What type of PR is this?

/area console
/kind improvement
/milestone 2.7.x

#### What this PR does / why we need it:

修复在部分移动端浏览器(比如 iOS Safari)中,下拉框组件(VDropdown)的选项点击无效的问题,即没有触发 click 事件。此问题的原因可能是因为我们用的 floating-vue 组件提供的 `v-close-popper` 指令的兼容问题,最小复现:https://stackblitz.com/edit/vitejs-vite-ncpzhj?file=src%2FApp.vue

此 PR 改写了关闭下拉框的方式,不再使用 v-close-popper 指令,而且对其他使用此组件的地方没有破坏性更新。

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/3689
Ref https://github.com/halo-dev/halo/issues/2699

#### Special notes for your reviewer:

如果有条件可以在移动端测试一下,尤其是 iOS Safari,目前在桌面端 Chrome 的设备模拟中测试正常。

#### Does this PR introduce a user-facing change?

```release-note
修复 Console 端的下拉框组件选项在移动端无法正常点击的问题。
```
2023-06-26 13:21:57 +00:00
John Niang aaa3548c97
Fix the problem that the username does not exist when the username does not exist (#4070)
#### What type of PR is this?

/kind bug
/area core

#### What this PR does / why we need it:

Catch UserNotFoundException instead of ExtensionNotFoundException to map correctly to BadCredentialsException.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/4057

#### Special notes for your reviewer:

1. Start Halo
2. Login with an username which does not exist
3. Check the response

#### Does this PR introduce a user-facing change?

```release-note
修复登录时出现用户名不存在的问题。
```
2023-06-26 12:21:57 +00:00
John Niang ecc617c709
Remap RequestNotPermittedException with RateLimitExceededException (#4119) 2023-06-26 16:12:54 +08:00
Ryan Wang 8c05a6d30e
feat: make comment subject ref provider extensible (#4039)
#### What type of PR is this?

/area console
/kind feature

#### What this PR does / why we need it:

让评论来源的显示支持通过插件扩展,目前如 [瞬间](https://github.com/halo-sigs/plugin-moments) 这类的插件如果使用了评论模块,那么在评论管理是无法显示具体来源的:

<img width="627" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/0df354dc-ed42-4217-abbd-5bce67329e0d">

此 PR 为 Console 端提供了拓展方法,使用方式如下:

```ts
import { definePlugin } from "@halo-dev/console-shared";
import type { CommentSubjectRefResult } from "@halo-dev/console-shared";
import type { Extension } from "@halo-dev/api-client";
import type { Moment } from "./types";

export default definePlugin({
  components: {},
  extensionPoints: {
    "comment:subject-ref:create": () => {
      return [
        {
          kind: "Moment",
          group: "moment.halo.run",
          resolve: (subject: Extension): CommentSubjectRefResult => {
            const moment = subject as Moment;
            return {
              label: "瞬间",
              title: determineMomentTitle(moment),
              externalUrl: `/moments/${moment.metadata.name}`,
              route: {
                name: "Moments",
              },
            };
          },
        },
      ];
    },
  },
});

```

#### Which issue(s) this PR fixes:

Fixes #3554 

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
Console 端的评论来源显示支持通过插件扩展
```
2023-06-26 04:20:18 +00:00
Ryan Wang ac47942a04
feat: add permission settings to dashboard widgets (#4112)
#### What type of PR is this?

/kind improvement
/area console
/milestone 2.7.x

#### What this PR does / why we need it:

为仪表板内置的小组件添加权限设置,解决部分没有权限的用户访问仪表盘提示异常的问题。

#### Which issue(s) this PR fixes:

Fixes #4111 

#### Special notes for your reviewer:

测试方式:

1. 创建一个访客角色的用户。
2. 访问仪表盘,观察是否有异常提示,以及是否出现没有权限的小组件。

#### Does this PR introduce a user-facing change?

```release-note
Console 端仪表盘的内置小组件添加权限设置。
```
2023-06-26 04:12:16 +00:00
Ryan Wang 96225e4040
chore: improve the console project infrastructure (#4105)
#### What type of PR is this?

/area console
/kind improvement
/milestone 2.7.x

#### What this PR does / why we need it:

维护 Console 端的开发基础设施。

- 升级 TypeScript 以及 Vue 对于 TS 支持的相关包。
- 优化 packages 下所有包的配置,解决构建时生成 d.ts 文件的异常。
- 解决 TS 异常。

#### Special notes for your reviewer:

尝试执行:

1. pnpm build:packages
2. pnpm typecheck

观察是否正常即可。

#### Does this PR introduce a user-facing change?

```release-note
维护 Console 端的开发基础设施。
```
2023-06-26 03:54:17 +00:00
d28f6075c1
feat: add rate limiter for comment endpoint (#4084)
#### What type of PR is this?

/kind feature
/kind core

#### What this PR does / why we need it:

This PR limited comment creation at a rate of 10 per minute.

See https://github.com/halo-dev/halo/issues/4044 for more.

#### Special notes for your reviewer:
1. Start Halo.
2. Create 11 new comments
3. Check the response.

#### Does this PR introduce a user-facing change?

```release-note
增加发表评论频率限制功能
```
2023-06-26 03:30:25 +00:00
Ryan Wang f37085f5a6
perf: improve the text length style of the comment subject ref title (#4115)
#### What type of PR is this?

/area console
/kind improvement
/milestone 2.7.x

#### What this PR does / why we need it:

Fix style issue of the comment subject ref title.

before:

<img width="1386" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/d6c845d4-039b-42bb-855a-01c9ddf113ee">

after:

<img width="1390" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/0f53f3fb-ab59-4b12-9352-49623b121347">


#### Which issue(s) this PR fixes:

Fixes #4068 

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-25 06:34:17 +00:00
Ryan Wang 1b6d081750
feat: add mouse hover style to the default type of button (#4108)
#### What type of PR is this?

/area console
/kind improvement
/milestone 2.7.x

#### What this PR does / why we need it:

为默认类型的按钮添加鼠标悬浮的样式。

<img width="333" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/922dd681-a2f1-4875-adef-9d1c5a075467">

#### Which issue(s) this PR fixes:

Fixes #4067 

#### Does this PR introduce a user-facing change?

```release-note
Console 端默认类型的按钮添加鼠标悬浮的样式。
```
2023-06-25 06:28:14 +00:00
Ryan Wang e658097b99
fix: modal height issue in ios devices (#4106)
#### What type of PR is this?

/area console
/kind improvement
/milestone 2.7.x

#### What this PR does / why we need it:

优化 VModal 组件在 iOS 设备上底部和顶部被遮挡的问题,解决方案来自于:https://github.com/Faisal-Manzer/postcss-viewport-height-correction

| before                                                       | After                                                        |
| ------------------------------------------------------------ | ------------------------------------------------------------ |
| ![IMG_0319](https://github.com/halo-dev/halo/assets/21301288/71d15e51-5cf9-402e-b6ce-fff4e1014f72) | ![IMG_0315](https://github.com/halo-dev/halo/assets/21301288/6c3b4b75-2029-4b32-8dcc-eead3e479ab1) |
| ![IMG_0318](https://github.com/halo-dev/halo/assets/21301288/b4f586b4-34e1-48ea-97ed-7f1f70184346) | ![IMG_0316](https://github.com/halo-dev/halo/assets/21301288/7dee64bb-2328-44ef-a9f6-534ea4c005fe) |

<!--fuck apple, fuck safari-->

#### Which issue(s) this PR fixes:

Ref https://github.com/halo-dev/halo/issues/2699


#### Does this PR introduce a user-facing change?

```release-note
优化 Console 端弹框组件(VModal)在 iOS 设备的高度问题。
```
2023-06-25 02:06:14 +00:00
Ryan Wang f6a6b25dd6
chore: bump formkit version to 0.17.3 (#4103)
#### What type of PR is this?

/area console
/kind improvement
/milestone 2.7.x

#### What this PR does / why we need it:

升级 FormKit 的版本至 0.17.3

- https://formkit.com/changelog
- https://github.com/formkit/formkit/releases/tag/0.17.0
- https://github.com/formkit/formkit/releases/tag/0.17.3

#### Which issue(s) this PR fixes:

Fixes #3951 

#### Special notes for your reviewer:

测试 Console 端各个表单功能是否正常即可。

#### Does this PR introduce a user-facing change?

```release-note
升级 Console 端 FormKit 的依赖版本至 0.17.3
```
2023-06-21 08:28:13 +00:00
John Niang 5e9e87582e
Refactor setting of problem detail type (#4099)
#### What type of PR is this?

/kind improvement
/area core

#### What this PR does / why we need it:

Define a global map to mapping exception to problem detail type.

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-21 04:40:12 +00:00
John Niang 12a426c9ae
Exclude WebSocket request when serving console index (#4096)
#### What type of PR is this?

/kind bug
/area core

#### What this PR does / why we need it:

This PR excludes WebSocket request when serving console index and remove request predicate accept in ConsoleProxyFilter.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/4083

#### Special notes for your reviewer:

1. Start Console with dev environment
2. Start Halo with dev profile
3. Try to browse <http://localhost:8090/console> and check the log

#### Does this PR introduce a user-facing change?

```release-note
修复开发环境下访问 Console 出现错误的问题
```
2023-06-21 03:42:12 +00:00
John Niang a19f342b47
Fix the problem of logging in successfully even if request not permitted (#4101)
#### What type of PR is this?

/kind bug
/area core

#### What this PR does / why we need it:

This is a bug introduced from https://github.com/halo-dev/halo/pull/4062. I have overridden onAuthenticationSuccess to create rate limiter in advance instead of invoking `securityContextRepository#save` before.

See https://github.com/halo-dev/halo/pull/4099#issuecomment-1598074131 for more.

#### Special notes for your reviewer:

1. Try to log in with incorrect password three times
2. Log in with correct password and check if the response headers contain `Set-Cookie`

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-21 03:26:12 +00:00
Ryan Wang 2fd9cbde33
feat: add support for selecting the parent category when creating a new category (#4056)
#### What type of PR is this?

/area console
/kind feature
/milestone 2.7.x

#### What this PR does / why we need it:

支持在创建分类的时候选择上级分类。

<img width="805" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/02912f70-4de4-4b8e-bbbe-f973fbd3e684">

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/4040

#### Special notes for your reviewer:

测试方式:

1. 测试新建的时候指定上级分类的功能是否正常。
2. 点击某个分类的操作按钮,选择添加子分类的菜单项,检查在新建分类的表单中上级分类是否选中了此分类。

#### Does this PR introduce a user-facing change?

```release-note
Console 端的文章分类支持在新建时指定上级分类。
```
2023-06-19 02:54:11 +00:00
Ryan Wang 4a1fe8dd1e
perf: disallow repeated clicks when third-party login (#4066)
#### What type of PR is this?

/area console
/kind improvement
/milestone 2.7.x

#### What this PR does / why we need it:

在使用某个三方登录的时候,禁用其他三方登录,防止重复点击。

#### Which issue(s) this PR fixes:

Fixes #4064 

#### Special notes for your reviewer:

测试方式:

1. 可安装 https://github.com/halo-sigs/plugin-oauth2 进行测试,可以不用配置各个登录方式,只需开启即可。
2. 在登录页面点击某个三方登录方式,观察所有三方登录方式的按钮是否被禁用。

#### Does this PR introduce a user-facing change?

```release-note
优化 Console 端登录页面的三方登录方式按钮,禁用重复点击。
```
2023-06-19 02:36:10 +00:00
longjuan 1b581d5d6f
perf: remove html lang attribute in console (#4085)
#### What type of PR is this?
/kind improvement
/area console

#### What this PR does / why we need it:

去除`index.html`的`lang`属性以避免console端出现翻译提示

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/3692

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?


```release-note
避免 Console 端出现翻译提示
```
2023-06-19 01:30:10 +00:00
John Niang 02369fbd3c
Add rate limiter for login endpoint (#4062)
#### What type of PR is this?

/kind feature
/area core

#### What this PR does / why we need it:

This PR introduces https://github.com/resilience4j/resilience4j to archive the feature. The login endpoint has limited login failures at a rate of 3 per minute.

See https://github.com/halo-dev/halo/issues/4044 for more.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/4044

#### Special notes for your reviewer:

1. Start Halo.
2. Try to login with incorrect credential 4 times
3. Check the response.

#### Does this PR introduce a user-facing change?

```release-note
增加登录失败次数限制功能
```
2023-06-16 04:50:12 +00:00
guqing 350e54d42a
chore: bump google guava version to 32.0.1-jre (#4081)
#### What type of PR is this?
/milestone 2.7.x
/area core

#### What this PR does / why we need it:
升级 Google Guava 版本至 32.0.1-jre

Guava [31.1](https://github.com/google/guava/releases/tag/v31.1) 至 [32.0.1](https://github.com/google/guava/releases/tag/v32.0.1) 的变化:
1. 移除了部分 API 的 `@Beta` 注解进入稳定版
2. 关于 `Files.createTempDir` 方法的安全性修复 https://github.com/advisories/GHSA-7g45-4rm6-3mm3 (https://github.com/google/guava/issues/2575)

详情参考:https://github.com/google/guava/releases/tag/v32.0.0

#### Does this PR introduce a user-facing change?

```release-note
升级 Google Guava 版本至 32.0.1-jre
```
2023-06-15 14:30:12 +00:00
guqing 6d251a7f58
refactor: refresh the plugin wrapper when starting the plugin (#4023)
#### What type of PR is this?
/kind improvement
/kind bug
/area core
/area plugin
/milestone 2.6.x

#### What this PR does / why we need it:
修复插件重启后 MainClass 对象缓存未清除的问题

how to test it?
下载此插件:
[plugin-starter-1.0.0-SNAPSHOT.jar.zip](https://github.com/halo-dev/halo/files/11620847/plugin-starter-1.0.0-SNAPSHOT.jar.zip)

安装并启动插件,会看到类似如下日志:
```
测试从 [/var/folders/1z/3hlt62691tx63dxx6y0mryw00000gn/T/halo-plugin3709893537121269748.txt] 文件读取内容
插件启动成功!
```
修改日志中给出的文件的内容后 reload 插件会看到`插件启动成功!` 后会跟随最新的文件内容则表示 MainClass 是最新的状态没有缓存。

#### Which issue(s) this PR fixes:

Fixes #4016

#### Does this PR introduce a user-facing change?

```release-note
修复插件重启后 MainClass 对象缓存未清除的问题
```
2023-06-14 10:08:14 +00:00
guqing 997a73d81b
fix: file path traversal vulnerability in theme and plugin resource APIs (#4072)
#### What type of PR is this?
/kind bug
/area core
/milestone 2.7.x

#### What this PR does / why we need it:
修复主题和插件静态资源的文件遍历漏洞

漏洞描述:
攻击者可以通过`/plugins/{name}/assets/console/{*resource}` 和 `/themes/{themeName}/assets/{*resource}` 的 resource 参数部分添加特殊字符(如 ../ 或 ..\)来绕过应用程序的访问控制,访问他们没有权限访问的文件或目录。

修复方法:
访问文件之前检查文件路径是否在被限制的目录下,如:
resource = /themes/default/templates/../../test
简化路径为 /themes/test
想限制路径在 `/themes/default/templates` 则已经越权拒绝访问

how to test it?
1. 访问例如 `localhost:8090/themes/theme-earth/assets/dist/../../../../../keys/id_rsa` 来检查获取上级目录,上上级目录是否可以访问到,必须只能访问到 themes/assets下的文件即为合理
2. 类似步骤 1 可以尝试`../`, `..\` 来访问 `localhost:8090/plugins/{name}/assets/console/{*resource}`,必须只能访问到插件的 `classpath:console/` 下的文件即为合理

#### Does this PR introduce a user-facing change?
```release-note
修复主题和插件静态资源的路径遍历漏洞
```
2023-06-14 08:36:13 +00:00
contour 636ec6329a
Fix AttachmentReconciler repeated execution (#4052)
<!--  Thanks for sending a pull request!  Here are some tips for you:
1. 如果这是你的第一次,请阅读我们的贡献指南:<https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>。
1. If this is your first time, please read our contributor guidelines: <https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>.
2. 请根据你解决问题的类型为 Pull Request 添加合适的标签。
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request.
3. 请确保你已经添加并运行了适当的测试。
3. Ensure you have added or ran the appropriate tests for your PR.
-->

#### What type of PR is this?
/kind bug
<!--
添加其中一个类别:
Add one of the following kinds:

/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind improvement

适当添加其中一个或多个类别(可选):
Optionally add one or more of the following kinds if applicable:

/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

#### What this PR does / why we need it:
Fix AttachmentReconciler repeated execution.

#### Which issue(s) this PR fixes:

<!--
PR 合并时自动关闭 issue。
Automatically closes linked issue when PR is merged.

用法:`Fixes #<issue 号>`,或者 `Fixes (粘贴 issue 完整链接)`
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
-->
Fixes #3746

#### Special notes for your reviewer:
The reconile method in run.halo.app.core.extension.reconciler.attachment.AttachmentReconciler will be executed repeatedly, uploading an attachment will be executed twice, because updating the finalizers property will be in onUpdate of run.halo.app.extension.controller.ExtensionWatcher Will request duplicate addition, I provide a fix for you to review
#### Does this PR introduce a user-facing change?

<!--
如果当前 Pull Request 的修改不会造成用户侧的任何变更,在 `release-note` 代码块儿中填写 `NONE`。
否则请填写用户侧能够理解的 Release Note。如果当前 Pull Request 包含破坏性更新(Break Change),
Release Note 需要以 `action required` 开头。
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
-->

```release-note
修复 AttachmentReconciler 重复执行
```
2023-06-10 14:48:14 +00:00
John Niang 31740e732f
Support configuration properties mechanism for plugin in Halo core (#4043)
#### What type of PR is this?

/kind feature
/area core
/area plugin

#### What this PR does / why we need it:

This PR adds property sources into PluginApplicationContext environment to support configuration properties mechanism.

See https://github.com/halo-dev/halo/issues/4015 for more.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/4015

#### Special notes for your reviewer:

You can verify the mechanism in [plugin-starter](https://github.com/halo-dev/plugin-starter) according to documentation `docs/developer-guide/plugin-configuration-properties.md`.

I've only tested it on macOS, looking forward to feedback on Windows.

#### Does this PR introduce a user-facing change?

```release-note
支持在插件中定义 @ConfigurationProperties 注解
```
2023-06-07 09:55:23 +00:00
contour a56d4f2a92
Fix the meta description with special characters causing the page to display abnormally (#4031)
<!--  Thanks for sending a pull request!  Here are some tips for you:
1. 如果这是你的第一次,请阅读我们的贡献指南:<https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>。
1. If this is your first time, please read our contributor guidelines: <https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>.
2. 请根据你解决问题的类型为 Pull Request 添加合适的标签。
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request.
3. 请确保你已经添加并运行了适当的测试。
3. Ensure you have added or ran the appropriate tests for your PR.
-->

#### What type of PR is this?

<!--
添加其中一个类别:
Add one of the following kinds:

/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind improvement

适当添加其中一个或多个类别(可选):
Optionally add one or more of the following kinds if applicable:

/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->
/kind bug
/area core

#### What this PR does / why we need it:
Fix the problem that the meta description with special characters causes the page to display abnormally.
Use htmlEscape in org.springframework.web.util.HtmlUtils to escape the special characters contained in the original description.

see #4000 
#### Which issue(s) this PR fixes:

<!--
PR 合并时自动关闭 issue。
Automatically closes linked issue when PR is merged.

用法:`Fixes #<issue 号>`,或者 `Fixes (粘贴 issue 完整链接)`
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
-->
Fixes #4000

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

<!--
如果当前 Pull Request 的修改不会造成用户侧的任何变更,在 `release-note` 代码块儿中填写 `NONE`。
否则请填写用户侧能够理解的 Release Note。如果当前 Pull Request 包含破坏性更新(Break Change),
Release Note 需要以 `action required` 开头。
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
-->

```release-note
NONE
```
2023-06-04 02:15:21 +00:00
John Niang 430b5fb270
Bump Halo to 2.7.0-SNAPSHOT (#4026)
#### What type of PR is this?

/kind cleanup
/area core

#### What this PR does / why we need it:

Bump Halo to 2.7.0-SNAPSHOT for next development iteration.

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-01 08:13:15 +00:00
Ryan Wang 65b27eed6c
chore: release 2.6.0 (#4021)
#### What type of PR is this?

/area core

#### What this PR does / why we need it:

修改版本号,准备发布 2.6.0。

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-01 03:08:12 +00:00
John Niang ede1f2098d
Set open mode of indices to CREATE_OR_APPEND (#4020)
#### What type of PR is this?

/kind bug
/area core
/milestone 2.6.x

#### What this PR does / why we need it:

On first start, we will receive an exception about post indices, please see the logs below:

```java
2023-06-01T10:49:57.191+08:00  INFO 7 --- [         task-1] run.halo.app.search.IndicesInitializer   : Initialize post indices...
2023-06-01T10:49:57.352+08:00 ERROR 7 --- [-controller-t-1] reactor.core.publisher.Operators         : Operator called default onErrorDropped

reactor.core.Exceptions$ErrorCallbackNotImplemented: org.apache.lucene.index.IndexNotFoundException: no segments* file found in LockValidatingDirectoryWrapper(MMapDirectory@/root/.halo2/indices/posts lockFactory=org.apache.lucene.store.NativeFSLockFactory@3de15f4f): files: [write.lock]
Caused by: org.apache.lucene.index.IndexNotFoundException: no segments* file found in LockValidatingDirectoryWrapper(MMapDirectory@/root/.halo2/indices/posts lockFactory=org.apache.lucene.store.NativeFSLockFactory@3de15f4f): files: [write.lock]
	at org.apache.lucene.index.IndexWriter.<init>(IndexWriter.java:1075) ~[lucene-core-9.5.0.jar:9.5.0 13803aa6ea7fee91f798cfeded4296182ac43a21 - 2023-01-25 16:44:59]
	at run.halo.app.search.post.LucenePostSearchService.removeAllDocuments(LucenePostSearchService.java:133) ~[classes/:2.6.0-SNAPSHOT]
	at run.halo.app.search.IndicesServiceImpl.lambda$rebuildPostIndices$0(IndicesServiceImpl.java:31) ~[classes/:2.6.0-SNAPSHOT]
	at reactor.core.publisher.MonoRunnable.call(MonoRunnable.java:73) ~[reactor-core-3.5.6.jar:3.5.6]
	at reactor.core.publisher.MonoRunnable.call(MonoRunnable.java:32) ~[reactor-core-3.5.6.jar:3.5.6]
```

The problem is caused by <https://github.com/halo-dev/halo/pull/3877>.

This PR sets open mode of indices to `CREATE_OR_APPEND`, which should resolve the problem.

#### Special notes for your reviewer:

1. Try to delete indices folder, such as `~/halo2-dev/indices`
2. Start Halo and check the log

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-01 03:04:11 +00:00
Ryan Wang 51816776ba
chore: update default theme to 1.4.0 (#4019)
#### What type of PR is this?

/kind improvement
/area core
/milestone 2.6.x

#### What this PR does / why we need it:

更新默认主题至 1.4.0

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-06-01 03:02:15 +00:00
John Niang ede8ea4827
Adapt HTML5 history mode of console in non-proxy mode (#4018)
#### What type of PR is this?

/kind bug
/area core

#### What this PR does / why we need it:

This PR adapts HTML5 history mode of console in non-proxy mode. In PR <https://github.com/halo-dev/halo/pull/4005>, history mode of console has changed from hash mode into HTML5 mode, so that we cannot access console project when refreshing pages.

#### Special notes for your reviewer:

1. Build console project by executing command `make -C console build`
1. Change value of property `halo.console.proxy.enabled` into `false`.
2. Start Halo and check console pages.

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-05-31 14:09:03 +00:00
Ryan Wang b37ec04c87
perf: improve the experience of redirection after login (#4014)
#### What type of PR is this?

/area console
/kind improvement
/milestone 2.6.x

#### What this PR does / why we need it:

优化 Console 端登录之后重定向的体验,解决在重定向时会重新显示登录页面的问题。

#### Which issue(s) this PR fixes:

Fixes #4010 

#### Special notes for your reviewer:

测试方式与 https://github.com/halo-dev/halo/pull/3989 相同。

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-05-31 06:55:01 +00:00
John Niang ebcafe6117
Replace R2DBC MySQL driver to io.asyncer:r2dbc-mysql (#3918)
#### What type of PR is this?

/kind improvement
/area core

#### What this PR does / why we need it:

Replace R2DBC MySQL driver to io.asyncer:r2dbc-mysql. See https://github.com/halo-dev/halo/issues/3804 for more.

Please note that there will be an error like below when starting up Halo on MacOS:

```java
2023-05-09T14:24:45.161+08:00 ERROR 4668 --- [  restartedMain] i.n.r.d.DnsServerAddressStreamProviders  : Unable to load io.netty.resolver.dns.macos.MacOSDnsServerAddressStreamProvider, fallback to system defaults. This may result in incorrect DNS resolutions on MacOS. Check whether you have a dependency on 'io.netty:netty-resolver-dns-native-macos'. Use DEBUG level to see the full stack: java.lang.UnsatisfiedLinkError: failed to load the required native library
```

After manual test, I haven't found any problems caused by the error. And this only occurs on MacOS when developing.

#### Which issue(s) this PR fixes:

Fixes https://github.com/halo-dev/halo/issues/3804

#### Special notes for your reviewer:

Steps to test:

1. Start up a MySQL server, e.g.:
    ```bash
    docker run -it --rm --name halodb -p 3306:3306 -e MYSQL_ROOT_PASSWORD=openmysql -e MYSQL_DATABASE=halo mysql:8
    ```
3. Start Halo with mysql profile active
    ```bash
    make -C console dev
    ./gradlew bootRun --args="--spring.profiles.active=dev,mysql --halo.plugin.runtime-mode=deployment"
    ```
5. Check the functionality of Halo

#### Does this PR introduce a user-facing change?

```release-note
替换 R2DBC MySQL 驱动为:io.asyncer:r2dbc-mysql
```
2023-05-31 06:41:03 +00:00
John Niang 4c2e8410b9
Fix the problem of crashing requests when slug names of single page contains special chars (#4013)
#### What type of PR is this?

/kind bug
/area core
/milestone 2.6.x

#### What this PR does / why we need it:

This PR refactors request predicate of path when building router functions for single page. I only compare the exact slug name instead of treating it as a URI template.

See <https://github.com/halo-dev/halo/issues/3931> for more.

#### Which issue(s) this PR fixes:

Fixes <https://github.com/halo-dev/halo/issues/3931>

#### Special notes for your reviewer:

1. Try to create a single page with slug name like `{}[]{[]}[{}]`.
2. Publish the single page.
3. Try to request the page.
4. See the result.

#### Does this PR introduce a user-facing change?

```release-note
修复页面别名包含特殊字符导致无法访问的问题
```
2023-05-31 04:21:00 +00:00
Ryan Wang ee1ea06171
fix: text content overflowing the container in the dialog component (#4007)
#### What type of PR is this?

/kind improvement
/area console
/milestone 2.6.x

#### What this PR does / why we need it:

修复 Console 端 Dialog 对话框组件中的文字内容可能会溢出容器的问题。

before:

<img width="623" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/ca9817c6-66e4-41f0-8112-4308913efcf2">

after:

<img width="666" alt="image" src="https://github.com/halo-dev/halo/assets/21301288/9d64ee23-124c-434a-b8da-669cfd727dd0">


#### Which issue(s) this PR fixes:

Fixes #4006 

#### Does this PR introduce a user-facing change?

```release-note
修复 Console 端 Dialog 对话框组件中的文字内容可能会溢出容器的问题。
```
2023-05-29 11:38:56 +00:00
John Niang 937d48b839
Fix the problem of deleting failed plugins for a long time (#4002)
#### What type of PR is this?

/kind bug
/area core
/milestone 2.6.x

#### What this PR does / why we need it:

This PR fixes the problem of deleting failed plugins for a long time by replacing older delayed entry in reconciler queue.

#### Does this PR introduce a user-facing change?

```release-note
修复长时间删除失败的插件问题
```
2023-05-29 09:10:56 +00:00
Ryan Wang e95caa2c21
refactor: use createWebHistory instead of createWebHashHistory (#4005)
#### What type of PR is this?

/kind improvement
/area console
/milestone 2.6.x

#### What this PR does / why we need it:

将 Console 的 Router 模式从 Hash History 改为 Web History。可以让路由看起来更加简洁,也方便在后端或者页面上构建路由。

文档:https://router.vuejs.org/zh/guide/essentials/history-mode.html

#### Special notes for your reviewer:

测试 Console 的各个页面是否正常访问即可。

#### Does this PR introduce a user-facing change?

```release-note
修改 Console 的路由模式为 HTML5 模式。
```
2023-05-29 08:48:55 +00:00
Ryan Wang 67e13546ae
chore: bump up version to 2.6.0-rc.1 (#3998)
#### What this PR does / why we need it:

修改版本号,准备发布 2.6.0-rc.1。

#### Does this PR introduce a user-facing change?

```release-note
None
```
2023-05-26 15:06:13 +00:00
guqing c8cc9f2710
refactor: exception prompts during plugin installation (#3993)
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.6.x

#### What this PR does / why we need it:
优化插件安装失败的提示信息

插件安装和升级时由于包格式不正确改为如下提示(Localization)
<img width="449" alt="image" src="https://github.com/halo-dev/halo/assets/38999863/37da0d42-88fa-40c5-a2b9-b8e2698a5930">

how to test it?
使用下面的插件安装和升级会提示 plugin.yaml 缺失
[failed-plugins.zip](https://github.com/halo-dev/halo/files/11560921/failed-plugins.zip)

see #3843 for more details

#### Which issue(s) this PR fixes:

Fixes #3843

#### Does this PR introduce a user-facing change?

```release-note
优化插件安装失败的提示信息
```
2023-05-26 14:56:12 +00:00
guqing 710261b035
feat: add the ability to install plugins remotely via URI (#3963)
#### What type of PR is this?
/kind feature
/area core
/area console
/milestone 2.6.x
/kind api-change

#### What this PR does / why we need it:
支持通过 URI 远程安装和升级插件

how to test it?
1. 测试插件安装
```shell
curl -u admin:admin -X POST http://localhost:8090/apis/api.console.halo.run/v1alpha1/plugins/-/install-from-uri --data '{
  "uri": "https://halo.run/apis/api.store.halo.run/v1alpha1/applications/app-KhIVw/releases/app-release-canxF/download/app-release-canxF-znFre"
}'
```
2. 测试插件升级
```shell
curl -u admin:admin -X POST http://localhost:8090/apis/api.console.halo.run/v1alpha1/plugins/PluginFeed/upgrade-from-uri --data '{
  "uri": "https://halo.run/apis/api.store.halo.run/v1alpha1/applications/app-KhIVw/releases/app-release-canxF/download/app-release-canxF-znFre"
}'
```
#### Which issue(s) this PR fixes:
Fixes #2292

#### Does this PR introduce a user-facing change?
```release-note
支持通过 URI 远程安装和升级插件
```
2023-05-26 14:54:16 +00:00