#### What type of PR is this?
/milestone 2.20.x
/area core
/kind improvement
#### What this PR does / why we need it:
允许通过 `halo.security.basic-auth.disabled=true` 配置来禁用 Basic Auth 认证
#### Which issue(s) this PR fixes:
Fixes#5408
#### Does this PR introduce a user-facing change?
```release-note
允许通过 `halo.security.basic-auth.disabled=true` 配置来禁用 Basic Auth 认证，在 2.20 版本生产环境下默认禁用了 Basic Auth
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
备份时忽略缩略图目录
#### Which issue(s) this PR fixes:
Fixes#6717
#### Does this PR introduce a user-facing change?
```release-note
备份时忽略缩略图目录以减少文件大小
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
This PR add support for binding OAuth2 user automatically. So we can remove the user-binding page.
Please note that those changes may break the OAuth2 and SocialLogin plugins.
#### Special notes for your reviewer:
Build OAuth2 plugin from <https://github.com/halo-sigs/plugin-oauth2/pull/64> or use [plugin-oauth2-1.0.4-SNAPSHOT.zip](https://github.com/user-attachments/files/17177592/plugin-oauth2-1.0.4-SNAPSHOT.zip) I built.
- Bind after logging in
1. Log in Halo with username and password method
2. Try to unbind OAuth2 user
3. Bind OAuth2 user again
- Initially bind without logging in
1. Go to login page
2. Log in with OAuth2 method and you will be redirected to login page
3. Log in with username and password method
4. See the result of binding
- Log in with OAuth2 method after binding
1. Go to login page
2. Log in with OAuth2 method and you will be redirected to uc page directly
#### Does this PR introduce a user-facing change?
```release-note
支持自动绑定 OAuth2 登录用户
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
This PR adds confirmPassword field into SignUpData for validation. So the signup page can be rendered correctly.
See https://github.com/halo-dev/halo/issues/6718 for more.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/6718
#### Special notes for your reviewer:
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/area core
/kind improvement
/milestone 2.20.x
#### What this PR does / why we need it:
完善新登录相关页面的多语言资源文件。
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/6721
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/area core
/kind improvement
/milestone 2.20.x
#### What this PR does / why we need it:
移除在 Edge 浏览器中，为密码输入框添加显示密码明文按钮。
<img width="406" alt="image" src="https://github.com/user-attachments/assets/49801c25-d8dc-46db-9cba-302653af1951">
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
将索引构建状态添加到就绪检测的指标中
#### Which issue(s) this PR fixes:
Fixes#6632
#### Does this PR introduce a user-facing change?
```release-note
将索引构建状态添加到就绪检测的指标中以优化就绪时访问出现索引不可用的问题
```
#### What type of PR is this?
/milestone 2.20.x
/area core
#### What this PR does / why we need it:
将内容管理相关的数据更新类归档到 content 包下,如访问量和评论量统计
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
修复文章封面图链接包含空格时主题端会因为生成缩略图错误而无法访问的问题
这是由于 URI string 中包含空格无法创建 URI 对象,目前将忽略这种非法参数,如果生成失败则直接返回原始 URI string
#### Which issue(s) this PR fixes:
Fixes#6690
#### Does this PR introduce a user-facing change?
```release-note
修复文章封面图链接包含空格时主题端会因为生成缩略图错误而无法访问的问题
```
#### What type of PR is this?
/kind feature
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
This PR registers a ServerWebExchangeContextFilter to make ServerWebExchange available under ContextView. The usage example is as follows:
```java
Mono.deferContextual(contextView -> {
var exchange = ServerWebExchangeContextFilter.getExchange(contextView);
assertTrue(exchange.isPresent());
return mono;
})
```
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
修复文件上传时类型校验失效的问题
此问题由 #6390 导致
#### Does this PR introduce a user-facing change?
```release-note
修复文件上传时类型校验失效的问题
```
#### What type of PR is this?
/kind cleanup
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
This PR upgrades to [Spring Boot 3.4.0-M3](https://github.com/spring-projects/spring-boot/releases/tag/v3.4.0-M3).
1. Fix the compilation error of OptimalPropertyAccess because the class has been privated in [this commit](b431594021).
2. Fix exception `org.mockito.exceptions.misusing.UnnecessaryStubbingException` for some unit tests after upgrading.
3. Replace deprecated annotations `@MockBean` and `@SpyBean` with `@MockitoBean` and `@MockitoSpyBean` respectively.
#### Does this PR introduce a user-facing change?
```release-note
升级 Spring Boot 至 3.4.0-M3
```
#### What type of PR is this?
/kind improvement
/area core
/area theme
#### What this PR does / why we need it:
This PR removes ReactivePropertyAccessor because it use `AstUtils#getPropertyAccessorsToTry` which is already hidden in [the commit](33fbd7141d (diff-deaf3517fbd66f40a8717877a8328dee0fb2581dfb6be487f327dc73ea33b5b5)). If we upgraded to Spring Boot 3.4.0-M3, the code in ReactivePropertyAccessor would be broken.
More importantly, I believe there is one issue with the current implementation although it can resolve the reactive issue.
- The PropertyAccessor modified the process flow of SPEL
This PR provides some wrappers to wrap existing PropertyAccessor and MethodResolver to evaluate reactive return value.
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/area plugin
/milestone 2.20.x
#### What this PR does / why we need it:
Plugins can implement their own RouterFunctions and ControllerMappings, but those might expose root ApplicationContext for plugins, which is not expected.
So this PR fixes the insecure access to root ApplicationContext.
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/area plugin
/milestone 2.20.x
#### What this PR does / why we need it:
This PR disables access to ApplicationContext using ITemplateContext.
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
This PR adds chunked transfer support for rendering templates, which means that the max memory used by rendering template will be max chunk size instead of size of rendering result.
Users can define the max chunk size like below:
```yaml
spring:
thymeleaf:
reactive:
maxChunkSize: 8KB # Setting to 0 will disable the chunked response.
```
#### Special notes for your reviewer:
1. Try to start Halo instance
2. Execute the command like below and see if the response headers contain `transfer-encoding: chunked`:
```bash
http http://localhost:8090/ -p h
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Language: en-CN
Content-Type: text/html
Expires: 0
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
content-encoding: gzip
set-cookie: XSRF-TOKEN=1e677724-ce82-4b63-911c-f78b22cd9169; Path=/
transfer-encoding: chunked
```
#### Does this PR introduce a user-facing change?
```release-note
优化模板渲染时所需的内存
```
#### What type of PR is this?
/milestone 2.20.x
/area core
#### What this PR does / why we need it:
替换 Version 过时方法的引用为新 API
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind feature
/milestone 2.20.x
/area theme
#### What this PR does / why we need it:
主题支持通过 `${site.version}` 得到 Halo 版本号
#### Which issue(s) this PR fixes:
Fixes#6676
#### Does this PR introduce a user-facing change?
```release-note
主题支持通过 `${site.version}` 得到 Halo 版本号
```
#### What type of PR is this?
/kind feature
/area plugin
#### What this PR does / why we need it:
This PR provides an interface ElementTagProcessor to make plugin handle element tag easily. e.g.:
```java
public class ImgTagProcessor implements ElementTagPostProcessor {
@Override
public Mono<Void> process(ITemplateContext context, IProcessableElementTag tag,
IElementTagStructureHandler structureHandler) {
var elementName = tag.getElementDefinition().getElementName();
if (!Objects.equals("img", elementName.getElementName())) {
return Mono.empty();
}
var srcAttr = tag.getAttribute("src");
if (srcAttr == null) {
return Mono.empty();
}
var newSrc = srcAttr.getValue();
// TODO rewrite src
structureHandler.setAttribute("src", newSrc);
return Mono.empty();
}
}
```
After PR merged, plugins https://github.com/webp-sh/halo-plugin-webp-cloud and https://github.com/guqing/plugin-cloudinary can be refined with new method.
#### Does this PR introduce a user-facing change?
```release-note
支持在插件中操作渲染结果
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
If we are running Halo instance in machine with small memory available, the JS/CSS bundle might not be accessible.
This RP refactors generation of JS and CSS bundle with fixed buffer size rather than length of original resources.
```java
2024-09-02T15:01:27.667+08:00 WARN 62039 --- [boundedElastic-3] reactor.core.Exceptions : throwIfFatal detected a jvm fatal exception, which is thrown and logged below:
java.lang.OutOfMemoryError: Java heap space
at java.base/java.nio.HeapByteBuffer.<init>(HeapByteBuffer.java:64) ~[na:na]
at java.base/java.nio.ByteBuffer.allocate(ByteBuffer.java:363) ~[na:na]
at org.springframework.core.io.buffer.DefaultDataBuffer.allocate(DefaultDataBuffer.java:234) ~[spring-core-6.1.12.jar:6.1.12]
at org.springframework.core.io.buffer.DefaultDataBuffer.setCapacity(DefaultDataBuffer.java:196) ~[spring-core-6.1.12.jar:6.1.12]
at org.springframework.core.io.buffer.DefaultDataBuffer.ensureWritable(DefaultDataBuffer.java:228) ~[spring-core-6.1.12.jar:6.1.12]
at org.springframework.core.io.buffer.DefaultDataBuffer.write(DefaultDataBuffer.java:296) ~[spring-core-6.1.12.jar:6.1.12]
at org.springframework.core.io.buffer.DefaultDataBuffer.write(DefaultDataBuffer.java:289) ~[spring-core-6.1.12.jar:6.1.12]
at org.springframework.core.io.buffer.DefaultDataBuffer.write(DefaultDataBuffer.java:43) ~[spring-core-6.1.12.jar:6.1.12]
at run.halo.app.core.extension.service.impl.PluginServiceImpl.lambda$uglifyJsBundle$17(PluginServiceImpl.java:257) ~[classes/:na]
at run.halo.app.core.extension.service.impl.PluginServiceImpl$$Lambda$4661/0x000000c80214e298.accept(Unknown Source) ~[na:na]
at reactor.core.publisher.FluxPeekFuseable$PeekFuseableSubscriber.onNext(FluxPeekFuseable.java:196) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxUsing$UsingFuseableSubscriber.onNext(FluxUsing.java:353) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxGenerate$GenerateSubscription.next(FluxGenerate.java:178) ~[reactor-core-3.6.9.jar:3.6.9]
at org.springframework.core.io.buffer.DataBufferUtils$ReadableByteChannelGenerator.accept(DataBufferUtils.java:1002) ~[spring-core-6.1.12.jar:6.1.12]
at org.springframework.core.io.buffer.DataBufferUtils$ReadableByteChannelGenerator.accept(DataBufferUtils.java:974) ~[spring-core-6.1.12.jar:6.1.12]
at reactor.core.publisher.FluxGenerate.lambda$new$1(FluxGenerate.java:58) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxGenerate$$Lambda$4155/0x000000c802069228.apply(Unknown Source) ~[na:na]
at reactor.core.publisher.FluxGenerate$GenerateSubscription.slowPath(FluxGenerate.java:271) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxGenerate$GenerateSubscription.request(FluxGenerate.java:213) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxUsing$UsingFuseableSubscriber.request(FluxUsing.java:320) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxPeekFuseable$PeekFuseableSubscriber.request(FluxPeekFuseable.java:144) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxFlatMap$FlatMapInner.onSubscribe(FluxFlatMap.java:968) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxPeekFuseable$PeekFuseableSubscriber.onSubscribe(FluxPeekFuseable.java:178) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxUsing$UsingFuseableSubscriber.onSubscribe(FluxUsing.java:347) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxGenerate.subscribe(FluxGenerate.java:85) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxUsing.subscribe(FluxUsing.java:102) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.Flux.subscribe(Flux.java:8848) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxFlatMap$FlatMapMain.onNext(FluxFlatMap.java:430) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxHandleFuseable$HandleFuseableSubscriber.tryOnNext(FluxHandleFuseable.java:135) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxIterable$IterableSubscriptionConditional.slowPath(FluxIterable.java:664) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxIterable$IterableSubscriptionConditional.request(FluxIterable.java:623) ~[reactor-core-3.6.9.jar:3.6.9]
at reactor.core.publisher.FluxHandleFuseable$HandleFuseableSubscriber.request(FluxHandleFuseable.java:260) ~[reactor-core-3.6.9.jar:3.6.9]
2024-09-02T15:01:27.681+08:00 DEBUG 62039 --- [boundedElastic-3] a.w.r.e.AbstractErrorWebExceptionHandler : [131a559b-102] Resolved [OutOfMemoryError: Java heap space] for HTTP GET /apis/api.console.halo.run/v1alpha1/plugins/-/bundle.js
2024-09-02T15:01:27.681+08:00 ERROR 62039 --- [boundedElastic-3] a.w.r.e.AbstractErrorWebExceptionHandler : [131a559b-102] 500 Server Error for HTTP GET "/apis/api.console.halo.run/v1alpha1/plugins/-/bundle.js?v=1725260408176"
java.lang.OutOfMemoryError: Java heap space
at java.base/java.nio.HeapByteBuffer.<init>(HeapByteBuffer.java:64) ~[na:na]
```
#### Does this PR introduce a user-facing change?
```release-note
优化在内存紧张时 Console 端无法加载插件资源的问题
```
#### What type of PR is this?
/kind cleanup
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
删除 SubscriptionServiceIntegrationTest 类。因为当前测试类不经常性出错，暂时无法排查原因。
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
修复 external-url 配置带了尾部斜杠导致邮件通知的查看通知链接无法访问的问题
#### Which issue(s) this PR fixes:
Fixes#6655
#### Does this PR introduce a user-facing change?
```release-note
修复 external-url 配置带了尾部斜杠导致邮件通知的查看通知链接无法访问的问题
```
#### What type of PR is this?
/kind feature
/area theme
/sig docs
/milestone 2.20.x
#### What this PR does / why we need it:
After this PR, we can define i18n message files next to the template file.
```yaml
i18n:
default.properties
templates:
index.html
index.properties # Higher properties than default.properties
index_zh.properties # Higher properties than index.properties
index_zh_CN.properties # Higher priority than index_zh.properties
```
It's convenient for plugins that define the template files.
See https://www.thymeleaf.org/doc/tutorials/3.1/usingthymeleaf.html#standard-message-resolver for more.
#### Does this PR introduce a user-facing change?
```release-note
支持在主题中通过 Thymeleaf 默认行为实现国际化
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
This PR adds support changing locale using query `language`. After passing the query, we will automatically respond a cookie `language` back to browser.
Please see the result below:
```bash
http http://localhost:8090/\?language\=zh-CN Accept:text/html -p h
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Language: zh-CN
Content-Type: text/html
Expires: 0
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
content-encoding: gzip
content-length: 4765
set-cookie: language=zh-CN; Path=/; Secure
set-cookie: XSRF-TOKEN=f0f2c972-0024-4575-aef2-0609356b4757; Path=/
```
#### Does this PR introduce a user-facing change?
```release-note
支持利用参数 language 切换地域语言
```
#### What type of PR is this?
/kind improvement
/area theme
/milestone 2.20.x
#### What this PR does / why we need it:
This PR simplifies ThemeLocaleContextResolver by removing unused attributes.
In another PR <https://github.com/halo-dev/halo/pull/6647>, fixed locale resolution for query parameter `language`. This PR fixes locale resolution for cookie `language` as well.
Please see the results below:
```bash
http https://www.halo.run/ Cookie:language=zh-CN -p h
HTTP/1.1 200 OK
Content-Language: und
```
```bash
http http://localhost:8090 Cookie:language=zh-CN -p h
HTTP/1.1 200 OK
Content-Language: zh-CN
```
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
不允许回复未通过审核的评论
#### Does this PR introduce a user-facing change?
```release-note
禁止非管理员回复未通过审核的评论
```
#### What type of PR is this?
/kind bug
/area theme
/milestone 2.20.x
#### What this PR does / why we need it:
If we pass a query `language` while requesting index page, we will get the wrong header `Content-Language`. Please see the result below:
```bash
http https://www.halo.run/\?language\=zh-CN -p h
HTTP/1.1 200 OK
Content-Language: und
...
```
After fixing, we will get the right header `Content-Language`.
```bash
http http://localhost:8090/\?language\=zh-CN -p h
HTTP/1.1 200 OK
Content-Language: zh-CN
...
```
#### Does this PR introduce a user-facing change?
```release-note
修复主题端区域和语言解析错误的问题
```
#### What type of PR is this?
/kind feature
/area core
/area plugin
/milestone 2.20.x
#### What this PR does / why we need it:
Currently, we are refactoring login and logout pages to make them extensible. If plugins want to realize a new authentication method, the CryptoService and RateLimiterRegistry may be used to authenticate.
So this PR exposes the two beans to plugins. No side effect will be introduced.
#### Does this PR introduce a user-facing change?
```release-note
【开发相关】允许在插件使用 CryptoService 和 RateLimiterRegistry
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
优化根据 URI 生成缩略图时的请求头
1. 由于之前 attachment 的 permalink 是 `URI.toString` 会导致根据 permalink 索引查询附件可能由于编码问题无法查询到导致生成缩略图只能根据 URI 生成
2. 可能配置了 nginx 判断请求头不允许脚本请求如导致根据 URI 访问图片无法访问导致无法生成，如
```
if ($http_user agent ~*(python curlljava wget go-http-client httpclient okhttp)){
}
```
Fixes#6627
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
This PR filters blank role name while granting roles for an user to prevent null role in permissions.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/6604
#### Does this PR introduce a user-facing change?
```release-note
修复取消用户角色后无法正常渲染用户列表的问题
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
修复 GIF 缩略图生成只会保留第一帧的问题
#### Which issue(s) this PR fixes:
Fixes#6596
#### Does this PR introduce a user-facing change?
```release-note
修复 GIF 缩略图生成只会保留第一帧的问题
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
当生成缩略图时如果原图尺寸小于请求尺寸则返回原图以保持其质量
#### Which issue(s) this PR fixes:
Fixes#6579
#### Does this PR introduce a user-facing change?
```release-note
当生成缩略图时如果原图尺寸小于请求尺寸则返回原图以保持其质量
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.20.x
#### What this PR does / why we need it:
This PR add keyword synchronized for methods `addOrUpdateDocuments`, `deleteDocuments` and `deleteAll` to ensure the write lock of Lucene is obtained only by one IndexWriter at the same time.
#### Which issue(s) this PR fixes:
Fixes#6569
#### Does this PR introduce a user-facing change?
```release-note
修复重启后无法搜索部分文档的问题
```
#### What type of PR is this?
/area core
/kind improvement
/milestone 2.19.0
#### What this PR does / why we need it:
将缩略图生成的模式改为自动，速度优先会导致图片失真率较高，部分图片在 w1600 的尺寸下看起来会比较模糊。
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.19.x
#### What this PR does / why we need it:
获取缩略图时检查缩略图链接是否可访问否则重定向到原图链接
#### Does this PR introduce a user-facing change?
```release-note
获取缩略图时检查缩略图链接是否可访问否则重定向到原图链接
```
#### What type of PR is this?
/kind cleanup
/area core
/milestone 2.19.0
#### What this PR does / why we need it:
For backward compatibility, the slug of single page should not be unique.
BTW, the problem was introduced by <https://github.com/halo-dev/halo/pull/6540>.
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.19.x
#### What this PR does / why we need it:
优化评论和回复的逻辑并减少重复代码
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.19.x
#### What this PR does / why we need it:
修复 postFinder 的 list 排序参数不生效的问题
此问题由于 https://github.com/halo-dev/halo/pull/6531 导致
#### Which issue(s) this PR fixes:
Fixes#6534
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.19.0
#### What this PR does / why we need it:
This PR refactors LuceneSearchEngine to let IndexWriter and SearcherManager load lazily to prevent LockObtainFailedException from performing a rolling update.
#### Which issue(s) this PR fixes:
Fixes#6541
#### Special notes for your reviewer:
1. Use MySQL or PostgreSQL as database for Halo
2. Start an instance of Halo
3. Try to initialize Halo and search posts
4. Change the `server.port` and start another instance of Halo
5. Check the status of another instance
#### Does this PR introduce a user-facing change?
```release-note
修复滚动更新时无法启动新的 Halo 实例的问题
```
#### What type of PR is this?
/kind cleanup
/kind improvement
/area core
/milestone 2.19.0
#### What this PR does / why we need it:
This PR refactors some requests with sort parameter by reusing SortableRequest, and refactors some queries with indexer.
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.19.x
#### What this PR does / why we need it:
重命名缩略图大小的参数名以便和主题端 finder 用法保持一致
同时确保通过 encode 或者没有 encode 的 uri 都可以获取到缩略图
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind feature
/milestone 2.19.x
/area core
#### What this PR does / why we need it:
为 postFinder 添加一个统一参数的 list 方法并支持传递排序参数
Fixes https://github.com/halo-dev/halo/issues/4933
#### Does this PR introduce a user-facing change?
```release-note
为 postFinder 添加一个统一参数的 list 方法并支持传递排序参数
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.19.0
#### What this PR does / why we need it:
This PR corrects list options builder for listing aggregated roles, because I wrongly used the label selector in <https://github.com/halo-dev/halo/pull/6471>.
#### Special notes for your reviewer:
1. Try to install the plugin <https://www.halo.run/store/apps/app-YXyaD>
2. Enable the plugin and enable setting `匿名评论需要验证码`
3. **Anonymous** request any of posts with comment enabled
4. Check the captcha in comment area
#### Does this PR introduce a user-facing change?
```release-note
修复可能无法正常访问插件提供的接口的问题
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.19.x
#### What this PR does / why we need it:
构建完索引后增加数据量一致性校验的步骤
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.19.0
#### What this PR does / why we need it:
升级预设插件的版本。
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/area core
/kind feature
/milestone 2.19.x
#### What this PR does / why we need it:
升级默认主题的版本为 [1.9.0](https://github.com/halo-dev/theme-earth/releases/tag/v1.9.0)。
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.19.0
#### What this PR does / why we need it:
After merging https://github.com/halo-dev/halo/pull/6512 and https://github.com/halo-dev/halo/pull/6511, unit tests fail due to the changes of <05b73ceeec>.
This PR fixes the problem by letting `run.halo.app.infra.exception.handlers.ProblemDetailErrorAttributes` extend `org.springframework.boot.web.reactive.error.DefaultErrorAttributes`.
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind api-change
/kind feature
/area core
#### What this PR does / why we need it:
see #2335
增加将第三方资源转存为附件资源的接口。
`/apis/api.console.halo.run/v1alpha1/attachments/-/upload-from-url`
UC:
`/apis/uc.api.content.halo.run/v1alpha1/attachments/-/upload-from-url`
其中参数为
```json
{
"url": "string",
"filename": "string",
"groupName": "string",
"policyName": "string"
}
```
#### How to test it?
测试能否将第三方接口的资源保存至附件中。
测试各类附件，例如图片、视频、文本等。
#### Does this PR introduce a user-facing change?
```release-note
增加通过链接转存第三方资源至附件库的接口
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.19.0
#### What this PR does / why we need it:
This PR refactors "Template Not Found Exception" into "NotFoundException" to prevent too many exception stacktraces in logs file.
#### Which issue(s) this PR fixes:
Fixes#6501
#### Special notes for your reviewer:
1. Activate default theme
2. Request <http://localhost:8090/categories>
3. See the result
#### Does this PR introduce a user-facing change?
```release-note
优化当主题模板找不到的异常提示
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.19.x
#### What this PR does / why we need it:
修复切换账号登录时设备信息更新不正确的问题
原因：
1. 使用 admin 账号登录，此时会记录 device_id 的 cookie
2. 退出登录，device_id 会保留在 cookie 中并随着新账号带到服务端
3. 服务端根据 device_id 查询当前设备是否有对应的记录，但是没有校验用户名是否与当前登陆的一致然后就去更新登录时间
4. 正确的处理是校验 device_id 是否有与之对应的记录并且用户名相同，如果不相同则认为是新设备重新生成 device_id
**how to test it?**
1. 先清理 cookie 然后使用一个账号登录
2. 退出登陆并切换新账号登录
3. 检查新登录的账号的设备信息是否正确
#### Does this PR introduce a user-facing change?
```release-note
修复切换账号登录时设备信息更新不正确的问题
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.19.x
#### What this PR does / why we need it:
修复文章的上一篇下一篇链接包含了隐藏分类下的文章
#### Does this PR introduce a user-facing change?
```release-note
修复文章的上一篇下一篇链接包含了隐藏分类下的文章
```
#### What type of PR is this?
/kind improvement
/area core
#### What this PR does / why we need it:
This PR refactors searching roles by using index mechanism to speed up every request and fix the problem of not being able to grant roles to users sometimes.
#### Which issue(s) this PR fixes:
Fixes#5807
Fixes https://github.com/halo-dev/halo/issues/4954
Fixes https://github.com/halo-dev/halo/issues/5057
#### Does this PR introduce a user-facing change?
```release-note
修复有时无法给用户赋权限的问题
```
#### What type of PR is this?
/kind cleanup
/area core
/milestone 2.19.x
#### What this PR does / why we need it:
清理没有用到的索引
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.19.x
#### What this PR does / why we need it:
优化用户创建
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
#### What this PR does / why we need it:
This PR allows users to filter search result by types, owner names, category names and tag names.
#### Does this PR introduce a user-facing change?
```release-note
完善搜索引擎过滤功能
```
#### What type of PR is this?
/milestone 2.19.x
/area core
/kind cleanup
#### What this PR does / why we need it:
删除对文章错误的索引声明
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind feature
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
新增文章摘要生成扩展点用于扩展自动生成摘要的方式
#### Does this PR introduce a user-facing change?
```release-note
新增文章摘要生成扩展点用于扩展自动生成摘要的方式
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
修复保存系统配置时出现的 NPE 问题
此问题由于 PR #6346 导致
#### Which issue(s) this PR fixes:
Fixes#6416
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind cleanup
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
This PR refines debug logs of listing all extensions.
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind cleanup
/area core
#### What this PR does / why we need it:
移除在 https://github.com/halo-dev/halo/pull/6403 中误推送的代码。
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
插件启动时触发一次插件配置更新事件以便进行资源初始化操作
之前配置插件完后重启/升级插件无法监听到事件则不方便初始化资源需要通过再次监听插件启动事件来实现，现在改为插件启动时可以监听到
#### Does this PR introduce a user-facing change?
```release-note
插件启动时触发一次插件配置更新事件以便进行资源初始化操作
```
#### What type of PR is this?
/area ui
/kind improvement
/milestone 2.18.x
#### What this PR does / why we need it:
升级 tiptap 的相关依赖至 2.5.7。
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
通过将 ExtensionGetter Bean 共享到给插件的 ApplicationContext，插件能够方便地使用该 Bean 来获取扩展。此更改确保插件具有可靠的扩展访问方式，从而促进系统内更好的模块化和可扩展性。
#### Which issue(s) this PR fixes:
Fixes#6357
#### Does this PR introduce a user-facing change?
```release-note
将 ExtensionGetter Bean 共享给插件使用，以便插件可以通过它来获取扩展
```
#### What type of PR is this?
/kind bug
/area core
/area plugin
/milestone 2.18.x
#### What this PR does / why we need it:
This PR checks if the plugin is already unloaded while getting dependents to fix the problem that plugins without jar file may not be deleted or not be enabled or disabled.
#### Which issue(s) this PR fixes:
Fixes https://github.com/halo-dev/halo/issues/6072
#### Special notes for your reviewer:
1. Try to move plugins folder to another folder
2. Restart Halo
3. Try to change state of plugins or delete plugins directly
4. See the result
#### Does this PR introduce a user-facing change?
```release-note
修复在没有插件文件的情况下可能无法删除插件的问题
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
This PR checks readable of theme resources while getting resources to prevent Halo from throwing FileNotFoundException.
#### Which issue(s) this PR fixes:
Fixes#6338
#### Special notes for your reviewer:
1. Try to request <https://www.halo.run/themes/fake-theme/assets/favicons/favicon-32x32.png>
2. See the result
#### Does this PR introduce a user-facing change?
```release-note
修复访问不存在的主题资源时出现服务器异常的问题
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
This PR prevent remember-me token from updating after auto login.
#### Which issue(s) this PR fixes:
Fixes#6290
#### Does this PR introduce a user-facing change?
```release-note
修复“保持登录”可能失效的问题
```
#### What type of PR is this?
/kind improvement
/area core
#### What this PR does / why we need it:
更新预设插件版本。
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
This PR fixes the problem of not being able to rebuild search index due to null description and updateTimestamp.
#### Which issue(s) this PR fixes:
Fixes#6317
#### Does this PR introduce a user-facing change?
```release-note
修复无法正常刷新搜索引擎的问题
```
#### What type of PR is this?
/kind cleanup
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
This PR simplifies RememberMeAuthenticationFilter by reusing AuthenticationWebFilter.
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind feature
/kind api-change
/area core
/area plugin
#### What this PR does / why we need it:
This PR adds `BeforeSecurityWebFilter` and `AfterSecurityWebFilter` extension points. See https://github.com/halo-sigs/plugin-page-cache/issues/4#issuecomment-2216677891 for more.
Now, we can do something before and after authenticating.
#### Does this PR introduce a user-facing change?
```release-note
添加认证授权的前置和后置处理器扩展点
```
#### What type of PR is this?
/kind bug
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
设备管理去除 IP 地址检查以避免频繁登录
#### Does this PR introduce a user-facing change?
```release-note
设备管理去除 IP 地址检查以避免频繁登录
```
#### What type of PR is this?
/kind improvement
/area core
/kind api-change
/milestone 2.18.x
#### What this PR does / why we need it:
This PR makes ConcurrencyFailureException respond http status code 409 instead of 500.
#### Which issue(s) this PR fixes:
Fixes#6254
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
为了平滑升级先保留 PluginWrapper 的 Bean
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind feature
/kind api-change
/area core
/area plugin
#### What this PR does / why we need it:
This PR supports obtaining plugins root in plugins. Below is an example in plugin:
```java
@Component
class PluginsRootGetterDemo {
private final PluginsRootGetter pluginsRootGetter;
PluginsRootGetterDemo(PluginsRootGetter pluginsRootGetter) {
this.pluginsRootGetter = pluginsRootGetter;
}
}
```
Meanwhile, I remove the `PluginProperties#pluginsRoot` for a clear way to obtain plugins root.
#### Does this PR introduce a user-facing change?
```release-note
支持在插件中获取插件根目录
```
#### What type of PR is this?
/kind improvement
/area core
/milestone 2.18.x
#### What this PR does / why we need it:
This PR treats `ui/build/dist` as resource dir for application module to adapt building and running using IntelliJ IDEA.
How to use?
1. Build ui project by executing command `./gradlew :ui:build -x :ui:check`.
1. Create a `Run/Debug Configuration` with arguments `--spring.profiles.active=dev --halo.console.proxy.enabled=false --halo.uc.proxy.enabled=false`.
1. Go to `Settings | Build, Execution, Deployment | Build Tools | Gradle` and select `IntelliJ IDEA` for `Build and run using:`
1. Run/Debug the configuration
#### Does this PR introduce a user-facing change?
```release-note
None
```
#### What type of PR is this?
/kind cleanup
/area plugin
/milestone 2.17.x
#### What this PR does / why we need it:
移除 BasePlugin 中已经过时的构造方法
在 2.6.1 版本中将 `BasePlugin(PluginWrapper wrapper)` 标记为过时并使用 `BasePlugin(PluginContext pluginContext)` 代替，现在已经过了很多版本，是时候移除它了。
see also #4023
#### Does this PR introduce a user-facing change?
```release-note
开发者相关：移除 BasePlugin 中已经过时的构造方法
```
#### What type of PR is this?
/kind cleanup
/area core
/milestone 2.17.x
#### What this PR does / why we need it:
清理已经过时很久的 yaml extension 声明
#### Does this PR introduce a user-facing change?
```release-note
None
```
guqing
