Integrate retire.js static analysis tool#148
Open
alexbock2 wants to merge 97 commits into
Open
Conversation
- Created createInstructorsGroup() function to initialize Instructors group during setup - Created giveInstructorPrivileges() function to assign category and global privileges - Instructors can now edit/delete posts, move topics, ban users, and purge content - Group is visible in admin panel for manual member assignment - Integrated both functions into install.setup() execution sequence
- Add 'endorsed' to intFields for proper integer parsing - Initialize endorsed=0 on post creation - Add endorse/unendorse API endpoints (PUT/DELETE /api/v3/posts/:pid/endorse) - Add corresponding controller and route wiring https://claude.ai/code/session_015H7tVc6LK7fwqr4tMk2psJ
Add 'endorsed' field to posts (0 or 1)
…nd real-time updates - Template: show endorse/unendorse toggle with icons, restrict to moderators - API: add admin/mod privilege check, emit websocket events on endorse/unendorse - Socket handler: include endorsed field in loadPostTools data - Client JS: fix toggleEndorse to use data-endorsed attribute, remove debug logs - Events: add onPostEndorsed handler for real-time UI updates across clients - Theme: add endorsed indicator (check-circle) on post headers, endorsed CSS class - Locales: add "endorsed" translation string https://claude.ai/code/session_014eoruhm2UVyiTefaNqPBCx
- Created createInstructorsGroup() function to initialize Instructors group during setup - Created giveInstructorPrivileges() function to assign category and global privileges - Instructors can now edit/delete posts, move topics, ban users, and purge content - Group is visible in admin panel for manual member assignment - Integrated both functions into install.setup() execution sequence
…-4 into userstory1
…QKOH Wire up endorse button end-to-end with UI toggle, privilege checks, a…
- Register 'posts:endorse' in category privilege map (moderation type)
- Add to topics.get() privilege check and returned privilege object
- Give default endorse privilege to admins/mods on new category creation
- Update API endorse/unendorse to use privileges.posts.can('posts:endorse')
- Add canEndorse check and display_endorse_tools flag in socket handler
- Set display_endorse_tools in modifyPostsByPrivilege from topic privileges
- Update template to gate endorse button on display_endorse_tools
- Add 'endorse-posts' admin UI label in en-US and en-GB locales
https://claude.ai/code/session_014eoruhm2UVyiTefaNqPBCx
…QKOH Replace isAdminOrMod check with dedicated posts:endorse privilege
The endorse privilege was previously in the category privilege map, which meant it only appeared when viewing a specific category's privileges in the admin panel. Moving it to the global privilege map makes it visible on the default admin privileges page under the Moderation tab. https://claude.ai/code/session_014eoruhm2UVyiTefaNqPBCx
…QKOH move post.endorse to global privilege
Add Instructor Role Support to User Management System
Refactor (src/user/posts.js:33): Reduce complexity for isReady()
…mail. Each user row now list their groups as badges. users.js, users.tpl, and users.json were edited.
…am-4 into Instructor-endorsed-answers
Each test now has a comment explaining: - What behaviour or code path it targets - Why that specific assertion is meaningful - Any relevant state dependencies between tests The describe block itself has a top-level JSDoc summary covering the feature, the setup rationale, and the roles of each fixture variable. https://claude.ai/code/session_01MB2cJMrbN13ELYXE5A9pn2
…in posts added. There was an issue pertaining test in anonymous.js, but was fixed as we consider anonymou users to be displayed with A.
…om/CMU-313/nodebb-spring-26-team-4 into claude/implement-endorse-button-WQKOH
Tests for post endorsement feature
…mation-Testing-for-U3 User Guide on Anonymous Feature updated, as well as automation tests in posts added.
Fix anonymous avatar default picture path. Updates to testing will be done.
…d-Testing-for-US1 Added automated tests and updated UserGuide.md
…mation-Testing-for-U3 Test Case updates
…am-4 into Instructor-endorsed-answers
Add comments and documentations to the endorse functionalities
give NodeBB root privileges to the docker compose
Add VM Deploy workflow
Integrate JSHint Static Analysis Tool for JavaScript Code Quality Flagging
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is for the integration of the static tool retire.js to find library/node module vulnerabilities within the project. NodeBB already has "retire": "^5.4.2", in devDependencies.
Files changed:
modified package.json and added "scan:retire": "retire" to the scripts.
added file retire-install-log.txt for evidence that retire was installed with npm install retire --save-dev (evidence taht I have successfully installed the tool)
added retirejs-output.txt that contains the output of the tool (artifact to demonstrate the tool has successfully run on the repo)
Run tool with npm run scan:retire. It detects vulnerabilities of various severity, including prototype pollution in lodash, stack overflow denial-of-service in underscore, and regular expression Dos in markdown-it.
Pros and cons:
Pros:
Cons:
Customizations:
Priori: Add ignore files to lessen false positives
Ongoing: ignore vulnerabilities that have been handled elsewhere