This commit adds WAGTAIL_EMAIL_MANAGEMENT_ENABLED setting that defaults
to True, but when disabled, hides the 'Change email' button in account
management view, and disables the associated route. This is useful when
using external authentication method like LDAP or OpenID Connect where
email management is handled elsewhere.
Wagtail already includes WAGTAIL_PASSWORD_MANAGEMENT_ENABLED setting.
This is almost exact copy of that implementation.
50ms is the equivalent of about 200 words per minute, so typing slower than that
meant that the javascript would send an AJAX request between every single
keystroke. This change makes the javascript wait for 200ms between keystrokes,
which lets you finish typing the word you're looking for before it sends an AJAX
request.
django-taggit 1.x drops Python 2.x support and thus the dependency on django.utils.six; this is a prerequisite for supporting Django 3.0.
The signature of TaggableManager.value_from_object has changed to return a list of Tags (previously it was a QuerySet of TaggedItems) and so search indexing and comparison need to be updated accordingly. There is a corresponding fix to ClusterTaggableManager in django-modelcluster 5.0.
Fix doc and test on ES6 python client compat
This commit changes the statement that version < 6.3.1 of the
elasticsearch python client should be used to instead state
that 6.4.0 is fine.
It also update the tests to reflect the statement.
Initially the `update_all_types` argument has been used to work
around an issue described in:
https://github.com/wagtail/wagtail/issues/2968
This argument was removed in elasticsearch-py 6.3.1 and making
use of it was raising an error.
With 6.4.0 nothing is raising anymore.
* Add tests for custom image on multiple image uploader
* Output form media on image add/edit views
* Output form media for 'add image' form within image chooser modal
Note: this won't work reliably if the media is hosted on a CDN, because script tags inserted as part of a jQuery DOM insertion (as modals are) are loaded asynchronously and not guaranteed to complete loading before inline scripts are run. It's better than not having the includes there at all though...
Currently any user with any page permission can view any page revision.
This commit fixes that, and ensures that the user has publish or edit
permission on the page before showing a page revision. If not, the user
is presented with a 403.
This maintains the current behavior if the user has no page permissions,
which is to redirect to the admin home page.
New tests have been added to cover these changes.
Fixes issue 5426.
When editing a rich text field and entering a link to a page whose Page
type overrides get_admin_display_title, the custom admin display title
is used both when browsing to select the page to link to and also when
viewing the rich text editor.
The first behavior is consistent with how custom admin display titles
are used throughout the admin, but the second behavior is not. The
Wagtail user should be able to use the rich text field as a reasonable
preview of what the rendered content will look like for the end user. To
do this, the "real" page title should be used, not the admin one.
This commit alters the data that gets passed to the rich text editor so
that its title is the real page title and not the admin one.
Fixes issue 5131.
Modeladmin handles notification to the user if a model instance has protected ForeignKey
relationships. However, if the protected relation is a OneToOneField it raises an exception:
File ".../wagtail/wagtail/contrib/modeladmin/views.py", line 742, in post
for obj in qs.all():
AttributeError: 'MyRelatedModel' object has no attribute 'all'
because qs in this case is the related instance rather than a queryset of related instances
(as is the case for a ForeignKey).
This commit handles the OneToOneField case as well.
User interaction with the form within the 10s delay also won’t trigger the confirmation message. There will still be race condition issues if form widgets like rich text take 10+ seconds to initialise – but that doesn’t seem likely.
This hook mimics the functiolity provided by `construct_page_action_menu`
in that it constructs the final list of buttons to be shown in the wagtail
admin interface. This means that within this function button's can be
removed, added or re-ordered.
See #4925
Testing the queryset in the if clause was causing the whole queryset
to be retrieved and populated from DB, all to check whether it was empty
or not.
The optimization is to rely on the strict behavior of
first_common_ancestor, which raises an exception if the queryset is
empty.
The USERNAME_FIELD exists to allow customisation. Therefore we should make an assumption that `.username` exists on the model. Instead, we need to pull the required value from the USERNAME_FIELD and add in a fallback default.
* Ensure that when you open the explorer the focus moves to the first link of the menu, and add a label for the explorer navigation
* Add dialog role to pages explorer popup, and ensure that there is an option to close the dialog window when tabbing by making the close button visually hidden rather than display none
revisions_for_moderation() was iterating over Page instances only
to use their path attribute. The optimization uses values_list()
over the GroupPagePermission queryset to retrieve only the page
paths without having to create the model instances in memory. This
saves roughly 50% of the runtime.
- adds a fieldset around checkboxes with the same name
- add correct labels for object permissions table
- Ensure that image and document permissions labels display correctly, and ensure that labels for the dropdowns for document and image collections are not display:none
- Hide labels from sighted users in group edit / group add pages
* Adds clearer text to the close button for modals
* Use existing wagtailConfig.STRINGS to store the new translatable string for JS, rather than introducing a new library.
* Update list of string constants for translation in the tests file
* Remove aria-hidden on modal dialog close button
- Images in the image listing now have an empty alt tag
- All information about the image, including title and image dimensions are now in the heading below
- The dimensions are visually hidden because they only relevant to screen readers, as sighted users can get and idea of the image dimensions from the thumbnail
Update chooser modal JS to use field IDs with prefixes
Note that the tag field JS no longer needs to be initialised here, as that's done in AdminTagWidget's inline JS
This allows them to work on pages that do not include _editor_js.html (or page-editor.js). However, wagtailadmin/shared/datetimepicker_translations.html will still be required in order to localise the date picker UI.
Move datepicker translations to admin_base.html
The string of self.form is the same as form.as_table - which is too verbose.
This updates the __repr__ of EditHandler/FieldPanel to show the class name of the form being used instead (or NoneType if it's None).
- Fix clear_edit_handler decorator
- Will allow the TestPageEditHandlers test cases to run
- Fixes test for test_check_invalid_base_form_class
- Errors might be returned out of order, so sort them before comparing them to the expected list
* Fetch new translations from Transifex, update contributors, add new languages with >90% coverage to WAGTAILADMIN_PROVIDED_LANGUAGES
* Update transifex config to download Chinese (Simplified) and Chinese (Traditional) translations as zh_Hans and zh_Hant respectively
* Fix get-translator-credits.py to recognise 'tet' as the locale string for Tetum (which Babel doesn't)
Labels for sortable headings need whitespace around them in order for the arrow to be correctly positioned. In addition, some headings had the label outside of the sort link - this is now fixed too.
There was a small bug in the page chooser, where it would display
`page.title` instead of `get_admin_display_title` when loaded on with a
specified parent. This was because the page chooser was falling back to
Page.get_admin_display_title instead of the specific kind
Update PagePermissionTester.can_move_to() to call on the page class's 'can_create_at()' method, and respond accordingly
Add a SingletonPageViaMaxCount to the test.json fixture for use in page permission tests
Add some tests for PagePermissionTester.can_copy_to()
Create a SingletonPageViaMaxCount in setUp() instead of adding to the fixture
* Add test for Image pixel size
* add pixel size check and update test to match
using djangos get_image_dimensions this maybe a internal function
but the commit adding it is over 9 years old
* Update docs and CHANGELOG
* fix typos
Fixes #4791
Previously, our rich text conversion functions handled the case where a document link specified an ID which is not found in the database. However, they failed with a KeyError when the id attribute was missing completely; links of this second type would occur whenever a link of the first type was re-saved from the Draftail editor. The fix is two-fold:
1) Catch the "missing ID attribute" case - in this case, the resulting link will be missing both the href and id attributes
2) Update the handling of the "ID present but document not found" case so that the id attribute survives the round-trip to the editor and back. The final link as rendered on the front-end will still be an attribute-less <a> element, but the id will be retained in the database (and in the versions rendered within rich text editors) which may be useful for troubleshooting.
Currently queries executed in the hooks don't run in the transaction
with the page deletion query and it's harder to write hook without
copying the whole view if you want to keep queries running in the hooks
integral with page deletion.
According to a google search I just did, it seems a lot of people have forgotten to add ``Disallow: /admin`` in their robots.txt (or forgot to add robots.txt) at all.
Adding this meta tag into the head of all admin pages should prevent any admin pages being indexed even if this was missed.
By optionally passing the request object to Page.get_sitemap_urls() it
will now use the cached site root on the request object instead of
retrieving it for each call. This cuts the number of queries required
for a sitemap roughly in half.
After migrating a Wagtail-based site from MySQL to Postgres, we
noticed that malicious requests to the site that included percent-
encoded Unicode NULLs (`%00`) raised a `ValueError` exception that we
hadn't seen when using MySQL: `A string literal cannot contain NUL
(0x00) characters.` This appears to relate to `psycopg2`'s decision to
raise an exception in these situations, as discussed here:
https://github.com/psycopg/psycopg2/issues/420
While newer versions of Django appear to provide some field validation
that addresses these characters, it doesn't look like Wagtail's
redirect middleware is making use of those validators, and so it seemed
reasonable to clean these characters in the context of 'normalizing'
the paths before looking for corresponding redirects -- especially
since a quick investigation on the internet suggests that U+0000 in
URLs can be used as a means of attack, and also since RFC 3986 says:
Note, however, that the "%00" percent-encoding (NUL) may require
special handling and should be rejected if the application is not
expecting to receive raw data within a component.
