חותמות שיח

Am I crazy here or is there no validation on the user input signature image URL at all?
Basically a user can input whatever they want and it will be pushed to other users?

Also, why is the URL signature db size set to 32_000?
Why would anyone need 32000 characters for a URL to an image?

Spooky :ghost:

I modified the css to this in order to hard code a max height and width;

.signature-img {
  max-width: 600px;
  max-height: 100px;
  width: auto;
  height: auto;
  display: block;
  margin: 5px 0;
}

I changed signature URL max size to 250 in plugin.rb

  register_user_custom_field_type("signature_url", :string, max_length: 250)
  register_user_custom_field_type("signature_raw", :string, max_length: 250)

I added this to the bottom of “on(:user_updated) do |user|” in plugin.rb (I won’t be using advanced mode)

    # Validate the URL if not in advanced mode
    if !SiteSetting.signatures_advanced_mode && user.custom_fields["signature_url"]
      url = user.custom_fields["signature_url"]

      # Strict validation: only HTTPS, only certain image file types
      unless url =~ /\Ahttps:\/\/[a-zA-Z0-9.\-\/_]+\.(png|jpe?g|gif|webp)(\?[a-zA-Z0-9=&]+)?\z/
        Rails.logger.warn("[discourse-signatures] Rejected invalid signature_url for user #{user.id}: #{url.inspect}")
        user.custom_fields["signature_url"] = nil
        user.save
      end
    end

If I’m doing anything wrong here (Never worked with Discourse before), please correct it and show me the right way to do it.

לייק 1

{“translation”: "[ציטוט=“bar10dr, פוסט:187, נושא:42263”]
גם, למה גודל מסמכי חתימת ה-URL מוגדר ל-32,000?
למה מישהו צריך 32,000 תווים ל-URL לתמונה?
[/ציטוט]

כי 250 זה לא מספיק…

[ציטוט=“bar10dr, פוסט:187, נושא:42263”]
בעקרון, משתמש יכול להכניס כל דבר שירצה והדבר ייתקן לשאר המשתמשים
[/ציטוט]
זו הרעיון כולו של חתימה. אותו דבר גם בפורום, אנשים מכניסים דברים ואחרים רואים את זה. עולם מטורף הא?"}

5 לייקים

כאשר Discourse משודרג לגרסה 3.5.0.beta8 (גם גרסה 3.5.0.beta9-dev מהווה בעיה), מתגלה שמשתמש שערך את חתימתו אינו יכול לשמור אותה (למרות שהיא מוצגת כשמורה, היא אינה נכנסת לתוקף). המצב תקין בגרסה 3.5.0.beta7. מקווים לתיקון מהיר, מכיוון שפלאגינים רבים מגרסה beta7 ל-beta8 מובנים.

2 לייקים

יש לנו מקרה שימוש ספציפי לחתימות ואני תוהה אם יהיה קל יחסית לבצע כמה שינויים.

  1. אני מסכים שהייתי רוצה לראות חתימות רק לקבוצות ספציפיות בממשק המשתמש, אני לא טוב ב-CSS.
  2. אנו משתמשים ב-Discourse שלנו גם כקהילה וגם כמערכת פניות תמיכה. האם יש דרך לקבל הגדרה ל"הצג חתימות רק בקטגוריות X בלבד"?

אנחנו באמת צריכים אותן רק במחלקת התמיכה שלנו, שם רוב האינטראקציות שלנו מתבצעות באמצעות דואר אלקטרוני.

3 לייקים

4 posts were split to a new topic: Feature request: include sig in email notifications

Anyone good with css know how to:

  1. Limit the ability to have a signature to only specific group(s)?

  2. Limit the max image size and text size for the signature to keep it less spammy

I believe you can use this:

You can right-click > Inspect to get an id/class of an element to hide with display:none. I’m afraid I’m on my phone now so I can’t check the classes/ids :sweat_smile: .

Hey guys.

Is this plugin still available?

I can’t seem to find it …

It’s not included-in-core , so you’d need to install it separately.

Thanks. I’m horrible with figuring that stuff out. No idea how I would even do this. Should be a setting. So much easier. No idea why any group would want to allow signatures for all. Also wish there was an option to hide the “Enable Signatures - See user signatures below posts” setting.

Should also be an option to limit character count in a text signature and limit image size for a banner sig.

Wish I knew css lol

Ok, for those who want to really make their signatures work better for their group (especially if you want to use the options to have a signature as part of a paid upgrade/subscription), here is code (and reasoning behind it) that I think makes it way better, and can help you drive more upgrades. Took me a ton of tries, but it’s working. Pay attention to where you need to replace “XXXXX” parts.

I wanted to accomplish the following 2 things:

A) I wanted to disable the ability to NOT view signatures. This means that those users who do upgrade know that their signature will be seen by everyone.

B) I wanted ONLY a certain group to have the ability to create a signature.

  1. Go to Admin > Appearance > Themes & components > Components > Install > Create new

  2. Add this code to the < head > tab:

<script>
// Wait for the basic page structure to load first
document.addEventListener("DOMContentLoaded", function() {
    
    // Set up the watcher
    const observer = new MutationObserver(function(mutations) {
        // Find all control labels on the page
        const labels = document.querySelectorAll('label.control-label');
        
        labels.forEach(label => {
            // Look for the specific Signatures label
            if (label.textContent.trim() === 'Enable Signatures') {
                // Find the main container holding both the label and the checkbox and hide it
                const controlGroup = label.closest('.control-group') || label.parentElement;
                if (controlGroup) {
                    controlGroup.style.display = 'none';
                }
            }
        });
    });

    // NOW start watching the body, since we know it exists
    observer.observe(document.body, { childList: true, subtree: true });
});
</script>

3. Add this code to the css tab (replace XXXXX with your group name):

/* Hide the signature section for everyone */
.user-preferences .control-group.signatures,
.user-preferences .signature-preferences,
.user-preferences div[data-setting-name="user_card_badge"] + .control-group {
    display: none !important;
}

/* Only show it if the 'user-is-XXXXX' class is present on the body */
body.user-is-XXXXX .user-preferences .control-group.signatures,
body.user-is-XXXXX .user-preferences .signature-preferences,
body.user-is-XXXXX .user-preferences div[data-setting-name="user_card_badge"] + .control-group {
    display: block !important;
}
  1. Add this code to the < head > tag below the first block above (replace XXXXX with your group name):
<script>
(function() {
  const checkAccess = () => {
    // Discourse stores the current user's groups in this global object
    const user = window.Discourse && window.Discourse.User && window.Discourse.User.current();
    
    if (user && user.groups) {
      // Check if any group name matches "XXXXX"
      const is XXXXX = user.groups.some(g => g.name === 'XXXXX');
      
      if (isXXXXX) {
        document.body.classList.add('user-is-XXXXX');
      }
    }
  };

  // Run immediately
  checkAccess();

  // Run whenever the user navigates between pages
  document.addEventListener('discourse-ready', checkAccess);
  
  // Backup: Run again after 1 second to catch slow loads
  setTimeout(checkAccess, 1000);
})();
</script>
  1. Add this code to the css tab below the first block above (replace XXXXX with your group name):
/* Hide the signature section for everyone */
.user-preferences .control-group.signatures,
.user-preferences .signature-preferences,
.user-preferences div[data-setting-name="user_card_badge"] + .control-group {
    display: none !important;
}

/* Only show it if the 'user-is-XXXXX' class is present on the body */
body.user-is-XXXXX .user-preferences .control-group.signatures,
body.user-is-XXXXX .user-preferences .signature-preferences,
body.user-is-XXXXX .user-preferences div[data-setting-name="user_card_badge"] + .control-group {
    display: block !important;
}

Done.

I am not a developer. All I know is this is working 100% on my site.

Also, to the plugin author – would LOVE the ability to limit the signature character count. I tried so many things but nothing worked.

לייק 1

I added the most requested features to the plugin in a branch

If y’all can give this branch a run and give feedback I can merge it next week.

3 לייקים

Regarding the upgrade if it’s next week, how would this be done? :slight_smile:

How do we test this? Sorry for the noob question. Would prefer this over what I came up with above. Also, would it be possible to add an option to toggle off image signatures and only allow text-based ones? Thank you!

Hi Long! Are you sef-hosting your Discourse site? If so, you can install the plugin using the instructions linked in the first post.

Personally I’d recommend waiting until Falco’s branch is finalized and merged.

Yes, self hosting. I have the plugin installed. Once that branch is finalized and merged it will auto update? Thanks!

לייק 1

You change your plugin line on the app.yml to be like this

- sudo -E -u discourse git clone -b feature/group-category-restrictions git@github.com:discourse/discourse-signatures.git

Thank you. I will wait for the updated plugin. I’m less likely to mess that up :rofl:

This might be a dumb question, but when update is merged does the plugin automatically update and we will see the new options in the settings?

No, I believe you’ll need to update it manually.

2 לייקים