* Adjust registerProduct to accept generic icon
* Undo unnecessary changes
* Anotha one
* Fix linting errors in product menu tests
- Fix jsx-quotes to use single quotes instead of double quotes
- Fix react/jsx-max-props-per-line by placing props on separate lines
- Fix react/jsx-no-literals by wrapping literal strings in JSX expression containers
- Fix react/jsx-wrap-multilines by wrapping multiline JSX in parentheses
- Fix react/jsx-closing-bracket-location for proper bracket alignment
* don't use snapshots or enzyme
* Fix pipelines?
* Allow building the server on FreeBSD
* Fix merge
---------
Co-authored-by: Erwan Martin <erwan@pepper.com>
Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>
* Channel Info RHS: add rename-from-info and settings access
Add channel name editable area with pencil hover and wire to a lightweight Rename Channel modal; add Channel Settings item to RHS menu with permission checks; ensure navigation after rename uses relative path to avoid 404.
* linter changes
* add padding so field labels don't get cut off
* fixes for keyboard accessibility and tooltips
* don't show channel settings for DMs and GMs
* chore(i18n): run extract to reorder new keys and fix CI
Re-extracted webapp i18n to place newly added keys (editable tooltips and rename modal) in canonical order expected by translation tooling.
* use generic_btn.cancel/save for rename modal buttons
* chore(i18n): remove unused rename_channel.cancel/save keys
* updated tests to account for new elements in the info rhs
* add cypress test for new rhs info function
* fix linting issues
* fixed tests
* linter fixes
* tweak position of edit button
* style tweaks, remove subtitle from info rhs head (redundant now), update archived state
* added 'unarchive' button to archived notice, updated translations
* fixed tests that I broke in channel info header
* add url name to channel info view
* update to 'channel handle' instead of url name'
* change order of channel handle
* add copy button
* Update about_area_channel.test.tsx
* fixed test and brought back channel subtitle in header for consistency
* fixed header test
* make channel info rhs scrollable
* fix merge issue
* Fix lint
---------
Co-authored-by: yasserfaraazkhan <attitude3cena.yf@gmail.com>
This tells the TypeScript compiler (only used for type checking in the web app)
to use the `imports` and `exports` field of a package's `package.json` to find
modules. Those fields are standard in newer versions of Node.js, and hopefully
supporting them means that we'll have to do less work to configure tooling in
the future.
We could also get similar behaviour by using the `nodenext` option, but that
adds some additional requirements to include file extensions which ES Modules
technically require, but I don't think we need to enforce because other tooling
doesn't require them.
I wanted to make that change in all of the subpackages as well, but we can't do
that without having TypeScript output ES Modules which, unless we change their
build processes to generate multiple formats (like the shared package in
client package, or the types package which is more than I want to do at the
moment.
The changes to other files are either because they incorrectly imported types
from a file that isn't intentionally exposed by the plugin or it's because we
had a typo in a file path.
* Fix 500 errors on check-cws-connection in non-Cloud environments
The check-cws-connection endpoint was returning 500 errors in
self-hosted enterprise environments because:
1. The client only checked BuildEnterpriseReady before making the
request, which is true for all enterprise builds
2. The server handler didn't check for a Cloud license before
attempting to connect to CWS
3. The CWS URL is not configured in non-Cloud environments, causing
the connection check to fail
This fix:
- Server: Add IsCloud() license check to match other cloud endpoints,
returning 403 instead of 500 for non-Cloud licenses
- Client: Add Cloud license check to skip the request entirely in
non-Cloud environments
* Add unit tests for check-cws-connection license check
* Return JSON status from check-cws-connection endpoint
Change the check-cws-connection endpoint to return 200 with a JSON body
containing status (available/unavailable) instead of using HTTP error
codes. This allows the endpoint to be used for air-gap detection on
self-hosted instances, not just Cloud deployments.
* i18n
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
Security fixes:
- Add sanitize option to marked() to escape HTML embedded in markdown
- Extend URL sanitization to cover both href and src attributes
- Add null check to isUrlSafe() to prevent crashes
Code improvements:
- Remove unused parseDOM rules from export-only schema (~65 lines)
- Export security helper functions for testing
Tests added:
- Add tests for sanitizeCodeLanguage, sanitizeFilename, escapeMarkdownText
- Add tests for extractFileId, getFileExtension
- Add tests for video node, file attachment, channel mention handling
- Add XSS prevention tests for paste markdown extension
- Add E2E test for markdown round-trip
Script fix:
- Remove non-existent test file reference from run_pages_tests.sh
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: run e2e full tests after successful smoke tests both in cypress and playwright
* fix lint check on jsdoc req in playwright test
* update smoke test filter
* update test filter for cypress tests
* update docker services, fix branch convention and rearrange secrets
* update e2e-test workflow docs
* reorganized
* fix lint
* fix playwright template
* fix results assertion
* add retest, e2e-test-verified, gh comments of failed tests, path filters, run e2e-tests check first and demote unstable tests
* run using master image for e2e-only changes, add ts/js actions for cypress and playwright calculations, add verified by label
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* MM-67279: Fix private channel enumeration via /mute slash command
Return the same error message when a user tries to mute a channel
they are not a member of as when the channel doesn't exist. This
prevents authenticated users from discovering private channels
by observing different error responses.
* update i18n
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* Improve rewrite menu guidance
Keep AI rewrite prompts visible on focus and clarify the empty-state instruction.
* Apply suggestions from code review
* Apply suggestion from @nickmisasi
* Fix rewrite menu test assertions
Update test expectations to match component string values after defaultMessage changes. Fix syntax error with unterminated string and correct placeholder text expectation.
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* Include last root, and most recent 10 posts in a thread with the rewrite system prompt
* Include user's names in the thread context for better reference
* Revert package-lock to master
* Fix tests
When the Type column was added to the Drafts table, it did not add a
DEFAULT value, so we need to handle the NULL values for the pre-existing
rows.
Co-authored-by: Mattermost Build <build@mattermost.com>
* [MM-66789] Fix arbitrary file read vulnerability in advanced logging
Add path validation to prevent reading files outside the logging root
directory via GetAdvancedLogs (used in support packet generation).
Security controls:
- Validate file paths are within logging root before reading
- Support MM_LOG_PATH environment variable to allow system admins
to configure a custom logging root directory
- Resolve symlinks to prevent bypass attacks
- Detect and block path traversal attempts
Also adds:
- Audit logging for support packet generation
- Config-time validation that logs errors for paths outside logging
root (will become blocking in future version)
- Comprehensive test coverage for path validation
* Update server/channels/app/platform/log_test.go
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix linter errors
* Update server/channels/api4/system.go
Co-authored-by: Ben Schumacher <ben.schumacher@mattermost.com>
* Simplify unit tests for platform/log_test.go by moving some test logic to config/logger_test.go
* Fix unit tests requiring logging root to be set
* enforce LogSettings.FileLocation path validation; simplify path checking
* fix linter errors
* use dir in logging root for all unit test logging
* MM_LOG_PATH is set once, centrally, for all tests
* fix flaky test
* fix flaky test
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Ben Schumacher <ben.schumacher@mattermost.com>
* MM-67274: Fix panic in getBrowserVersion with empty User-Agent version
Refactor getBrowserVersion to use a table-driven approach that
centralizes bounds checking, preventing panic when User-Agent strings
contain identifiers like "Mattermost Mobile/" with no version token.
* Refactor user agent tests to use structured test cases
Move expected values into the testUserAgent struct for clarity,
making it easier to see what each test case expects at a glance.
* Add Client4 route building functions
* Make DoAPIRequestWithHeaders add the API URL
This makes it consistent with the other DoAPIXYZ functions, which all
prepend the provided URL with the client's API URL.
* Use the new route building logic in Client4
* Address review comments
- clean renamed to cleanSegment
- JoinRoutes and JoinSegments joined in Join
- newClientRoute uses Join
* Fix new routes from merge
* Remove unused import
* Simplify error handling around clientRoute (#34870)
---------
Co-authored-by: Jesse Hallam <jesse@mattermost.com>
Co-authored-by: Jesse Hallam <jesse.hallam@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
Canonicalize IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) to
their native IPv4 form in IsReservedIP before checking against reserved
IP ranges. This prevents attackers from bypassing SSRF protections by
using IPv4-mapped IPv6 literals to access internal services.
* remove permalink embeds when user loses access to orginating channel
* remove posts & embeds on team_leave event; simplify preview index.ts
* cleanup
* remove dead code
* more dead code elimination
