1
posts
2
3
4
5
Hello Everyone,
The upcoming 4.14.0 release will have breaking changes for themes and plugins that display html and translation tokens via template variables. This post will outline the changes required to custom themes based on the changes made in the Harmony theme to serve as a guide for upgrading your own themes & plugins.
1. Escape all template variables via {variable}
The first and biggest change is the introduction of html and translation escaping of all variables in templates. Prior to 4.14.0 if you wrote {variable} in a template the value would be inserted into the html page unchanged. Benchpressjs supports escaping these variables but it was disabled to prevent a breaking change when the migration was done from templates.js to benchpressjs. We are now aligning with how most template engines work.
What this means for themes is if variable contained html then it will no longer be displayed properly. For example the content of posts is rendered via {posts.content} in partials/topic/post.tpl. Upgrading to 4.14.0 without fixing the template would result in:
To fix this in 4.14.0, you will have to wrap the variable with double braces like {{posts.content}}. This will stop the escaping and the post content will display properly. Double braces should only be used on content that is html sanitized. In this case NodeBB converts markdown to html and sanitizes it so it is safe. Do not use {{variable}} syntax on untrusted content.
The {{}} syntax should also be used on all helper functions that return html. For example buildAvatar function return html to display the user icon or picture. So {buildAvatar(user, "24px", true)} should be changed to {{buildAvatar(user, "24px", true)}}. We've updated all these helpers to escape the values and attributes used. If you have custom helpers you should do the same. Below is an example of a helper that is used in header.tpl. It uses the same escape function that {variable} uses.
function buildMetaTag(tag) {
const name = tag.name ? `name="${escape(tag.name)}" ` : '';
const property = tag.property ? `property="${escape(tag.property)}" ` : '';
const content = tag.content ? `content="${escape(tag.content).replace(/\n/g, ' ')}" ` : '';
return '\n\t';
}
Refer to section 3, for a full list of changes that were made to Harmony theme to upgrade it to 4.14.0.
2. Migration to tx() and txEscape() helper functions
This is the second major change, and we're introducing it as part of an ongoing upgrade process to help avoid creating too much work for theme maintainers at once.
The way translation works in NodeBB is through a post render step. After benchpressjs renders the template and generates the html page, our translator scans the html page and replaces translation tokens that look like [[namespace:key]] with their correct translation.
Here is roughly how it goes from request to final html presented to user.
- User requests /topic/1
- Load all required data from database
- Call filter:parse.post to turn post markdown into html
- Translator escapes the html from step 3, so tokens in the post content don't get translated
- Benchpress renders the html filling in all data
- Translator scans html replacing translation tokens with their translations
- Translator unescapes the result (reverses step 4)
- Final html sent to user
With the introduction of a helper function tx() instead of scanning the entire page, we can use the helper to translate tokens. For example instead of <button>[[topic:reply]]</button> we can use <button>{{tx("topic:reply")}}</button>. This approach is more efficient because only the translation tokens are processed.
With 4.14.0 we will still run the whole page translation to make migration easier, but for 4.15.0 we are going to remove that step, so the entire flow will be:
- User requests /topic/1
- Load all required data from database
- Call filter:parse.post to turn post markdown into html
- Benchpress renders the html, calls
tx()to translate tokens - Final html sent to user
We are introducing 2 new helper functions for templates:
tx()- translates the string or array passed in. This supports a variety of different usages:
| Old | New |
|---|---|
| [[namespace:key]] | {{tx("namespace:key")}} |
| [[namespace:key, foo]] | {{tx("namespace:key", "foo")}} |
| [[namespace:key, {arg1}, {arg2}]] | {{tx("namespace:key", arg1, arg2)}} |
| {text} | {{tx(text)}} |
You can also pass an array to the tx() helper. For example if you have:
const myVar = ["namespace:key", "arg1", "arg2"];
This can be passed straight to tx in the template {{tx(myVar)}}
tx helper html escapes arguments and invalid translation keys.
txEscape()- escapes variable so it is not translated. This is a stop-gap solution until we remove the whole page translation. For example we use this on content that should not be translated. If someone puts[[namespace:key]]in their post it doesn't get translated. After 4.15.0 it will be safe to remove these since everything will usetx().
3. List of changes for Harmony Theme
Let's summarize the changes needed for 4.14.0.
- Wrap template helper functions that return html with
{{}}instead of{}. - Replace
{translationString}with{{tx(translationString)}}. - Wrap API values that should not be translated with
{{txEscape(content)}}. - (Ongoing) Replace old translation tokens
[[namespace:key]]with{{tx("namespace:key")}}.
Refer to the Harmony Upgrade Changes Topic for the full list of changes.
4. Bootbox & app.renderAsync & Misc.
-
The global
bootboxobject has been removed, there is a newmodalsmodule that also handles translations. Use modals.(dialog|confirm|alert|prompt) instead of bootbox variants. The only difference is these methods return a promise. So the oldconst modal = bootbox.dialog()becomesconst modal = await modals.dialog() -
If you are using
app.renderAsyncto render a template it needs the translation context fortx()helper to work. NodeBB will automatically try to detect the user's language if app.renderAsync is called as part of a web request, but if it is called from a cron job or manually you can pass it the translation data like below:
const languages = nodebb.require('./src/languages);
const data = {
foo: 1,
_i18n: languages.getFull('en-GB'),
};
const html = await app.renderAsync('mytemplate', data);
config.assetBaseUrlwas deprecated in 2.x, it is now removed, useconfig.asset_base_url
Why are we doing this?
As you know, we have a Bug Bounty Program, and the most commonly reported vulnerability is XSS, which is typically caused by unsanitized user input being rendered directly into HTML.
Currently we use the validator module to escape user controlled values however with the introduction of Activitypub support, attackers can manipulate data directly in the database of a remote NodeBB. When this category or user profile is displayed in a target NodeBB instance if any fields are not escaped via validator.escape() then it opens us up for XSS vulnerabilities. By moving the escaping to the template engine, we mitigate this and we no longer have to validator.escape() every value we load from the database.
All these changes are now live on this forum. Please let us know if you notice any issues. We plan to release 4.14.0 in July and follow up with 4.15.0 in August.
Let us know in the Technical Support category if you need help with updating your themes or plugins.
6
7
Hello Everyone 👋,
Today we are releasing NodeBB 4.12.0 and 3.12.9.
These releases contain important security fixes, so upgrading is highly advised. NodeBB 1.x and 2.x no longer receive security updates.
🚨Minimum nodejs version required is 22.x and up.
Along with the security updates there are 4 new features.
Ability to see tags and thumbnails in post queue.
The post will display the tags and thumbnails uploaded, and you can also edit them on the same page. The edit buttons were also moved from the bottom of the card to their respective areas.
Add visual indicators and filter tab for muted users
Muted users were not visible on the /users page and on their profiles. So we added a muted filter on the users page. A badge will also be displayed on their profile page.
Full-text search on chats list
If you have a lot of chats like @julian, you can now search them on the chat page. 🎊
Allow owners to move misplaced topics
Topic owners can now move their topic if they posted it in a wrong category. There is an admin setting to control the number of posts after this feature is disabled. Thanks to @palmoni for contributing this https://github.com/NodeBB/NodeBB/pull/14227
ESM migration of plugins and core
As part of our efforts to modernize the code base we have added support for writing plugins in ESM. Up until now plugins used require.main.require to import modules from core nodebb. This is now deprecated, the new method to require core modules is to replace it with nodebb.require.
Here is a sample plugin written in ESM that uses the new nodebb.require method https://github.com/NodeBB/nodebb-plugin-esm-test/blob/master/index.js.
Using require.main.require will generate a warning in development mode but will still work. We will slowly update bundled plugins over to ESM and the new method.
Bug fixes & Misc 🐛
Full list of closed issues.
8
Hi everybody — late last week we released v4.11.0, which contains the following changes:
ActivityPub Specific Fixes
:rotating_light: AP analytics and error pages
New pages have been added to the control panel to display analytics (send/receive counts) and error counts. There is also a new error page that will show error received within the last 24 hours, and their respective payloads. This will aid in debugging federation issues.
:writing_hand: Article vs. Note distinction updated
Prior to this version, NodeBB would determine whether a federated object was an Article or Note based on content length. This was confusing for end users, and was originally added before NodeBB supported title-less topics.
The revised distinction is much simpler. If it has a title, it's an Article. If it doesn't, it's a Note.
Smaller fixes
- Threadiverse software publishes
Deleteobjects wrapped in anAnnounceactivity. This is how content is moderated across the threadiverse. NodeBB now supports this, although it has not been extensively tested at this time. - There was an interoperability issue with Mitra that was identified and fixed.
- When group actors post content directly, the category info is shown in the user icon. It used to error out and show "Guest".
- Optimized the outbound federation of content so the front-end is more responsive. A bunch of back-end optimizations to reduce the number of calculations needed.
- Emojis now supported in DMs to remote users.
:no_bell: Ability to hide read notifications in user panel
A new option has been added to the "Notifications" sub-section of the user control panel.
This option will allow you to visibly hide read notifications from the notifications dropdown, which reduces visual clutter.
Tinycon customizations
Admins can now customize the notification badge shown in the browser tab icon. We use the Tinycon library for this, and the colour values can be customized now:
9
10
11
12
13
Notice: Breaking change in v4.5.0 (requests to internal IP addresses disallowed)
(community.nodebb.org)
14
Hello all!
(Sorry, I could not resist with the title :laughing:)
Today we are releasing NodeBB v4.9.0, on a Friday, toward the end of the day, because we like having our weekends ruined.
As usual, we recommend you update to this stable version of NodeBB, not least because it fixes a federation issue accidentally introduced last month.
There are a bunch of new features and usability improvements here, for both end users and admins. Federation improvements abound, as well as a few moderation upgrades. As usual, we fixed a ton of bugs, and even a couple open issues from the 2010s :scream:
Here is a list of the changes and new features you should expect to see!
:world_map: New "World" page
/world has been updated so that is closer to a feed-reader than a topic list. While I will continue to iterate on this design over time to better promote topics, I am hoping that this proves to be more accessible of an interface compared to the old topic listing.
Your watched/tracked remote categories will be listed in a sidebar (hidden behind a drawer on mobile views) for easy access.
The default view ("Latest") continues to be a list of content from people you follow, and content shared by those same people. The other view ("Popular") shows unconstrained content, and can include content from people you don't follow.
:lock: Remote topics now unavailable to guests
After an Alibaba bot was recorded mercilessly scraping a lot of the public content served up by NodeBB, we decided to restrict access to that content to registered users.
While this would normally mean that "View Original URL" would stop working from other federates sites (since visitors are usually guests), we have added an exclusion to this logic that will continue to serve up the content to guests if at least one local user has commented on the topic.
:writing_hand: UX change for composer and chats
@baris worked on a number of usability fixes that make the experience of using our post composer and chat interface much better. For the longest time we had issues with the composer not properly resizing when mobile keyboards opened.
Composing and replying should work much better now that we are using the latest CSS and javascript tooling to properly detect visual viewport changes.
:bell: Better notifications
@baris also updated the notifications system so that bodyLong, which usually contains post text, is now sent with all notifications. This should increase the usability of notifications (both via web, email, or push).
:arrows_counterclockwise: Cross-posting privilege
A previous release introduced the ability to cross-post content into local categories. This functionality can now be gated behind a privilege at the category level.
:wave: Guest call-to-action
@baris introduced a new guest "call-to-action" banner that will help guide guests toward registering a new account to contribute to your community :blush:
:label: Title-less topics
As part of the changes to /world, we also allow the creation of topics without a title. If you don't pass in a title, we will generate one for you based on the first sentence in your post. The same title generation logic was applied to remote content in the past, and now it also applies to local content.
This also means you can use the /world page to just fire off something quickly without having to do the hard work of thinking up a title. You're welcome :laughing:
:sparkles: Opportunistic backfill
Now that the fediverse's largest implementor, Mastodon, supports context, which enables backfill, we have implemented an opportunistic backfill feature that will check for new replies when you enter a topic. It'll also regularly check the top most popular remote topics known by the instance for new posts.
:no_entry: Reasons
You can now set up a recurring list of "reasons", which you can invoke on certain moderation actions. These custom reasons can be used when a user is banned, muted, or on post queue rejection.
You can set up these reasons from ACP > Manage > Users > (Gear) > Manage Custom Reasons
:information_desk_person: Registration queue now applies for SSO plugins
This issue, open since 2016 is finally fixed. SSO plugins don't automatically bypass the registration queue anymore. This was a common vector for spammers to bypass registration limitations.
:bug: Additional features and bug fixes
- An improvement to auto-installation of plugins
- Removed many remote tids and pids stored in the db for no reason (thanks @baris)
- A regression that caused nodebb-to-nodebb federation to fail (and possibly many others)
- Notifications can now be passed custom icons
- ACP privilege selector now no longer shows remote categories
- Improvements to mentions to better handle periods at end of sentences, or names within names
- All cached used internally are now exposed in the admin panel for better management.
- Sitemap cache duration is now configurable
- Infinite scrolling now works on
/world - Slug generation errors when you mixed and matched
-and. - Topic pruning applies to all remote cids now, not just cid -1
- Chats list updated properly now, when new messages are received, chat messages now properly backfilled upon reconnection
- NodeBB now federates Delete on both deletion and purge
For the full changelog, please take a look at the closed issues list for this milestone, or take a gander at the much less impressive CHANGELOG.md in our repository root.
15
16
Coming soon to a NodeBB near you... a new way to browse both microblog and threadiverse content all in one feed. 👀
17
Hello from Canada! :flag-ca:
We're a week behind the planned release, but we're dropping v4.8.0 today, containing some changes to our ActivityPub handling, along with a new API route, and bug fixes.
Crossposting
As briefly introduced in my earlier topic on cross-posting, NodeBB v4.8.0 supports cross-posting of topics between categories. More importantly, it means topics from other remote categories can now be added to local categories, which is another way to bring conversations to your local users.
Unlike before, where administrators were the only ones allowed to move topics from cid -1, cross-posting is available to all local users. If you see a topic on the fediverse you'd like to cross-post to a local category, just hit the cross-post button (it's a button with a little upward-right pointing arrow), and share it with other users on your forum!
When you cross-post, it also shares the topic with all of your followers from outside of your forum.
Federated topic moving and removals
This was actually released with v4.7.0 but was improved slightly in the intervening versions. NodeBB now follows the Draft FEP f15d: Context Relocation and Removal and will publish Remove activities when a topic is moved to "Uncategorized", and Move activities when moved to another category.
Developers of other ActivityPub software looking to implement similar mechanics are advised to read the FEP and provide feedback here: https://activitypub.space/topic/86/fep-f15d-context-relocation-and-removal
Other technical debt and bug fixes
- Post ownership websocket call was migrated to a v3 REST API call
- Notifications had issues when user display names contained commas
- Piefed v1.5 supports emoji from remote instances; incoming custom emoji from Piefed are now handled
- Nodeinfo fixes for if a NodeBB instance is not actually federating (has AP turned off)
18
19
20
21
22
23
24
There have been some scattered feedback on a change I made for v4.0.0 that caught some people off-guard: Uploaded media is now shown in addition to topic thumbnails.
I'll start with why this change was made, and then solicit feedback.
The why
v4.0.0 introduced ActivityPub integration into NodeBB. This added dimension meant that content was consumed in a manner that was similar, but unfamiliar to NodeBB, and so much of the work involved normalizing that data into a format that made sense. (As an aside, I tell people that that's pretty much 99% of my job — glueing together APIs. I jest, but it's also basically true.)
One of those unfamiliar aspects was uploaded media in the form of attachments. NodeBB had discrete concepts of inline media and topic thumbnails, but attachments were something different entirely. Attachments were not inlined in the text (they tended to be added before or after the main content), and thumbnails were images only, while attachments could be lots of other things.
The second part was that a lot of the content I received relied on media to do the heavy lifting. Oftentimes the text would be minimal and in response to the attachment. After all, a picture's worth a thousand words.
Given those two things, I allowed NodeBB to consume and store attachments separately, and updated the topic thumbnail retrieval logic to pull media from both post attachments and inline media. That retrieval logic is what governs what you see next to the title. I also decided on the all-in approach because while NodeBB has multiple ways of slotting media, majority of ActivityPub software generally only uses attachments. This means both inline media and topic thumbnails were unceremoniously shoved into attachments when federating outward. There is movement toward changing this, and so this rationale may no longer make sense today.
I initially did have concerns that perhaps this would dilute the meaning and specificity of the "topic thumbnail", but I also wagered that the UX improvement of promoting any and all media found would be of greater benefit.
Your turn — feedback!
Maybe I'm wrong!
- Perhaps the media row is best used to showcase topic thumbnails and post attachments only (not inlined media.)
- Perhaps a configurable option would appease all folks (although I'm usually loathe to add options purely for that reason.)
25
view more:
next ›