Merge remote-tracking branch 'meteor/master' into rus-docs

History.md

@@ -1,6 +1,40 @@
 ## v.NEXT
 
 
+## v.0.8.1.3
+
+* Fix a security issue in the `spiderable` package. `spiderable` now
+  uses the ROOT_URL environment variable instead of the Host header to
+  determine which page to snapshot.
+
+* Fix hardcoded Twitter URL in `oauth1` package. This fixes a regression
+  in 0.8.0.1 that broke Atmosphere packages that do OAuth1
+  logins. #2154.
+
+* Add `credentialSecret` argument to `Google.retrieveCredential`, which
+  was forgotten in a previous release.
+
+* Remove nonexistent `-a` and `-r` aliases for `--add` and `--remove` in
+  `meteor help authorized`. #2155
+
+* Add missing `underscore` dependency in the `oauth-encryption` package. #2165
+
+* Fix minification bug that caused some apps to fail to render in IE8. #2037.
+
+
+## v.0.8.1.2
+
+* Fix memory leak (introduced in 0.8.1) by making sure to unregister
+  sessions at the server when they are closed due to heartbeat timeout.
+
+* Add `credentialSecret` argument to `Google.retrieveCredential`,
+  `Facebook.retrieveCredential`, etc., which is needed to use them as of
+  0.8.1. #2118
+
+* Fix 0.8.1 regression that broke apps using a `ROOT_URL` with a path
+  prefix. #2109
+
+
 ## v0.8.1.1
 
 * Fix 0.8.1 regression preventing clients from specifying `_id` on insert. #2097

docs/.meteor/release

@@ -1 +1 @@
-0.8.1.1
+0.8.1.3

docs/client/api.html

@@ -2243,6 +2243,8 @@ <h2 id="ui"><span>Template utilities</span></h2>
 
 {{> api_box ui_insert}}
 
+{{> api_box ui_getelementdata}}
+
 
 
 {{#api_box eventmaps}}

docs/client/api.js

@@ -1918,6 +1918,18 @@ Template.api.ui_insert = {
     }]
 };
 
+Template.api.ui_getelementdata = {
+  id: "ui_getelementdata",
+  name: "UI.getElementData(el)",
+  locus: "Client",
+  descr: ["Returns the data context that was used when rendering a DOM element from a Meteor template."],
+  args: [
+    {name: "el",
+     type: "DOM Element",
+     descr: "An element that was rendered by a Meteor template"
+    }]
+};
+
 
 
 var rfc = function (descr) {

docs/client/docs.js

@@ -255,7 +255,8 @@ var toc = [
         "UI.body",
         "UI.render",
         "UI.renderWithData",
-        "UI.insert"
+        "UI.insert",
+        "UI.getElementData"
       ],
       {type: "spacer"},
       {name: "Карты событий", style: "noncode", id: "eventmaps"}

docs/lib/release-override.js

@@ -1,5 +1,5 @@
 // While galaxy apps are on their own special meteor releases, override
 // Meteor.release here.
 if (Meteor.isClient) {
-  Meteor.release = Meteor.release ? "0.8.1.1" : undefined;
+  Meteor.release = Meteor.release ? "0.8.1.3" : undefined;
 }

examples/clock/.meteor/release

@@ -1 +1 @@
-0.8.1.1
+0.8.1.3

examples/leaderboard/.meteor/release

@@ -1 +1 @@
-0.8.1.1
+0.8.1.3

examples/parties/.meteor/release

@@ -1 +1 @@
-0.8.1.1
+0.8.1.3

examples/todos/.meteor/release

@@ -1 +1 @@
-0.8.1.1
+0.8.1.3

examples/wordplay/.meteor/release

@@ -1 +1 @@
-0.8.1.1
+0.8.1.3

packages/facebook/facebook_server.js

@@ -95,6 +95,6 @@ var getIdentity = function (accessToken) {
   }
 };
 
-Facebook.retrieveCredential = function(credentialToken) {
-  return OAuth.retrieveCredential(credentialToken);
+Facebook.retrieveCredential = function(credentialToken, credentialSecret) {
+  return OAuth.retrieveCredential(credentialToken, credentialSecret);
 };

packages/github/github_server.js

@@ -67,6 +67,6 @@ var getIdentity = function (accessToken) {
 };
 
 
-Github.retrieveCredential = function(credentialToken) {
-  return OAuth.retrieveCredential(credentialToken);
+Github.retrieveCredential = function(credentialToken, credentialSecret) {
+  return OAuth.retrieveCredential(credentialToken, credentialSecret);
 };

packages/google/google_server.js

@@ -78,6 +78,6 @@ var getIdentity = function (accessToken) {
 };
 
 
-Google.retrieveCredential = function(credentialToken) {
-  return OAuth.retrieveCredential(credentialToken);
+Google.retrieveCredential = function(credentialToken, credentialSecret) {
+  return OAuth.retrieveCredential(credentialToken, credentialSecret);
 };

packages/htmljs/html.js

@@ -31,7 +31,7 @@ HTML.ensureTag = function (tagName) {
 // Given "p" create the function `HTML.P`.
 var makeTagConstructor = function (tagName) {
   // HTMLTag is the per-tagName constructor of a HTML.Tag subclass
-  var HTMLTag = function HTMLTag(/*arguments*/) {
+  var HTMLTag = function (/*arguments*/) {
     // Work with or without `new`.  If not called with `new`,
     // perform instantiation by recursively calling this constructor.
     // We can't pass varargs, so pass no args.

packages/livedata/livedata_server.js

@@ -298,7 +298,7 @@ var Session = function (server, version, socket, options) {
       heartbeatInterval: options.heartbeatInterval,
       heartbeatTimeout: options.heartbeatTimeout,
       onTimeout: function () {
-        self.destroy();
+        self.close();
       },
       sendPing: function () {
         self.send({msg: 'ping'});

packages/meetup/meetup_server.js

@@ -55,6 +55,6 @@ var getIdentity = function (accessToken) {
 };
 
 
-Meetup.retrieveCredential = function(credentialToken) {
-  return OAuth.retrieveCredential(credentialToken);
+Meetup.retrieveCredential = function(credentialToken, credentialSecret) {
+  return OAuth.retrieveCredential(credentialToken, credentialSecret);
 };

packages/meteor-developer/meteor_developer_server.js

@@ -93,6 +93,7 @@ var getIdentity = function (accessToken) {
   }
 };
 
-MeteorDeveloperAccounts.retrieveCredential = function (credentialToken) {
-  return OAuth.retrieveCredential(credentialToken);
+MeteorDeveloperAccounts.retrieveCredential = function (credentialToken,
+                                                       credentialSecret) {
+  return OAuth.retrieveCredential(credentialToken, credentialSecret);
 };

packages/oauth-encryption/package.js

@@ -7,6 +7,7 @@ Package.describe({
 
 Package.on_use(function (api) {
   api.export("OAuthEncryption", ["server"]);
+  api.use("underscore");
   api.add_files("encrypt.js", ["server"]);
 });
 

packages/oauth1/oauth1_server.js

@@ -11,7 +11,8 @@ OAuth._requestHandlers['1'] = function (service, query, res) {
 
   if (query.requestTokenAndRedirect) {
     // step 1 - get and store a request token
-    var callbackUrl = Meteor.absoluteUrl("_oauth/twitter?close&state=" +
+    var callbackUrl = Meteor.absoluteUrl("_oauth/" + service.serviceName +
+                                         "?close&state=" +
                                          query.state);
 
     // Get a request token to start auth process

packages/spiderable/package.js

@@ -12,3 +12,8 @@ Package.on_use(function (api) {
   api.add_files('spiderable.html', 'client');
   api.add_files('spiderable.js', 'server');
 });
+
+Package.on_test(function (api) {
+  api.use(['spiderable', 'tinytest']);
+  api.add_files('spiderable_tests.js', 'server');
+});

packages/spiderable/spiderable.js

@@ -23,6 +23,30 @@ var REQUEST_TIMEOUT = 15*1000;
 // small for our docs.
 var MAX_BUFFER = 5*1024*1024; // 5MB
 
+// Exported for tests.
+Spiderable._urlForPhantom = function (siteAbsoluteUrl, requestUrl) {
+  // reassembling url without escaped fragment if exists
+  var parsedUrl = urlParser.parse(requestUrl);
+  var parsedQuery = querystring.parse(parsedUrl.query);
+  delete parsedQuery['_escaped_fragment_'];
+
+  var parsedAbsoluteUrl = urlParser.parse(siteAbsoluteUrl);
+  // If the ROOT_URL contains a path, Meteor strips that path off of the
+  // request's URL before we see it. So we concatenate the pathname from
+  // the request's URL with the root URL's pathname to get the full
+  // pathname.
+  if (parsedUrl.pathname.charAt(0) === "/") {
+    parsedUrl.pathname = parsedUrl.pathname.substring(1);
+  }
+  parsedAbsoluteUrl.pathname = urlParser.resolve(parsedAbsoluteUrl.pathname,
+                                                 parsedUrl.pathname);
+  parsedAbsoluteUrl.query = parsedQuery;
+  // `url.format` will only use `query` if `search` is absent
+  parsedAbsoluteUrl.search = null;
+
+  return urlParser.format(parsedAbsoluteUrl);
+};
+
 WebApp.connectHandlers.use(function (req, res, next) {
   // _escaped_fragment_ comes from Google's AJAX crawling spec:
   // https://developers.google.com/webmasters/ajax-crawling/docs/specification
@@ -35,13 +59,7 @@ WebApp.connectHandlers.use(function (req, res, next) {
       _.any(Spiderable.userAgentRegExps, function (re) {
         return re.test(req.headers['user-agent']); })) {
 
-    // reassembling url without escaped fragment if exists
-    var parsedUrl = urlParser.parse(req.url);
-    var parsedQuery = querystring.parse(parsedUrl.query);
-    delete parsedQuery['_escaped_fragment_'];
-    var newQuery = querystring.stringify(parsedQuery);
-    var newPath = parsedUrl.pathname + (newQuery ? ('?' + newQuery) : '');
-    var url = "http://" + req.headers.host + newPath;
+    var url = Spiderable._urlForPhantom(Meteor.absoluteUrl(), req.url);
 
     // This string is going to be put into a bash script, so it's important
     // that 'url' (which comes from the network) can neither exploit phantomjs

packages/spiderable/spiderable_tests.js

@@ -0,0 +1,47 @@
+var url = Npm.require("url");
+
+Tinytest.add("spiderable - phantom url generation", function (test, expect) {
+  var absUrl = "http://example.com";
+  _.each([
+    {
+      requestUrl: "/?_escaped_fragment_=1",
+      expected: "/"
+    },
+    // Test that query strings are preserved
+    {
+      requestUrl: "/?_escaped_fragment_=1&foo=bar",
+      expected: "/?foo=bar"
+    },
+    {
+      requestUrl: "/?foo=bar&_escaped_fragment_=1",
+      expected: "/?foo=bar"
+    },
+    // Test that paths are preserved
+    {
+      requestUrl: "/foo/bar?_escaped_fragment_=1",
+      expected: "/foo/bar"
+    },
+    {
+      requestUrl: "/foo/bar?_escaped_fragment_=1&foo=bar",
+      expected: "/foo/bar?foo=bar"
+    },
+    // Test with a path on the site's absolute url
+    {
+      requestUrl: "/foo/bar?_escaped_fragment_=1",
+      expected: "/foo/bar",
+      absUrl: "http://example.com/foo"
+    },
+    {
+      requestUrl: "/bar?_escaped_fragment_=1",
+      expected: "/bar",
+      absUrl: "http://example.com/foo"
+    }
+  ], function (testCase) {
+    testCase.absUrl = testCase.absUrl || absUrl;
+
+    test.equal(
+      Spiderable._urlForPhantom(absUrl, testCase.requestUrl),
+      absUrl + testCase.expected
+    );
+  });
+});

packages/twitter/twitter_server.js

@@ -36,6 +36,6 @@ OAuth.registerService('twitter', 1, urls, function(oauthBinding) {
 });
 
 
-Twitter.retrieveCredential = function(credentialToken) {
-  return OAuth.retrieveCredential(credentialToken);
+Twitter.retrieveCredential = function(credentialToken, credentialSecret) {
+  return OAuth.retrieveCredential(credentialToken, credentialSecret);
 };

packages/webapp/boilerplate.html

@@ -1,13 +1,13 @@
 <html {{htmlAttributes}}>
 <head>
-{{#each css}}  <link rel="stylesheet" href="{{bundledJsCssPrefix}}{{url}}">{{/each}}
+{{#each css}}  <link rel="stylesheet" href="{{../bundledJsCssPrefix}}{{url}}">{{/each}}
 
 {{#if inlineScriptsAllowed}}
 <script type='text/javascript'>__meteor_runtime_config__ = {{meteorRuntimeConfig}};</script>
 {{else}}
 <script type='text/javascript' src='{{rootUrlPathPrefix}}/meteor_runtime_config.js'></script>
 {{/if}}
-{{#each js}}  <script type="text/javascript" src="{{bundledJsCssPrefix}}{{url}}"></script>
+{{#each js}}  <script type="text/javascript" src="{{../bundledJsCssPrefix}}{{url}}"></script>
 {{/each}}
 {{#if inlineScriptsAllowed}}
 <script type='text/javascript'>{{{reloadSafetyBelt}}}</script>

packages/weibo/weibo_server.js

@@ -72,6 +72,6 @@ var getIdentity = function (accessToken, userId) {
   }
 };
 
-Weibo.retrieveCredential = function(credentialToken) {
-  return OAuth.retrieveCredential(credentialToken);
+Weibo.retrieveCredential = function(credentialToken, credentialSecret) {
+  return OAuth.retrieveCredential(credentialToken, credentialSecret);
 };

scripts/admin/banner.txt

@@ -1,7 +1,5 @@
-=> Meteor 0.8.1.1: OAuth security fix, bug fixes and new features for
-   Blaze, improved latency compensation, and more.
+=> Meteor 0.8.1.3: Fixes a security flaw in the `spiderable` package and
+   minor regressions from 0.8.1.
 
    This release is being downloaded in the background. Update your
-   project to Meteor 0.8.1.1 by running 'meteor update'. If you haven't
-   yet upgraded to 0.8.x, we've backported the security fix to a new
-   0.7.2.2 release as well.
+   project to Meteor 0.8.1.3 by running 'meteor update'.

scripts/admin/notices.json

@@ -132,6 +132,12 @@
   {
     "release": "0.8.1.1"
   },
+  {
+    "release": "0.8.1.2"
+  },
+  {
+    "release": "0.8.1.3"
+  },
   {
     "release": "NEXT"
   }

tools/help.txt

@@ -203,8 +203,8 @@ yourself. (Ask someone else who is an authorized user to do it.)
 You can only add or remove one authorized user at a time.
 
 Options:
-  --add, -a     add an authorized user
-  --remove, -r  remove an authorized user
+  --add         add an authorized user
+  --remove      remove an authorized user
   --list        list authorized users (the default)