Generate Releeph GLYPHICON

Summary: Generate a gunsights stylesheet entry for use in Releeph.

Test Plan: None!

Reviewers: edward

Reviewed By: edward

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D3773
Defuse a "Host:" header attack

Summary:
Django released a security update recently dealing with malicious "Host" headers:

https://www.djangoproject.com/weblog/2012/oct/17/security/

We're vulnerable to the same attack. Plug the hole.

The risk here is that an attacker does something like this:

  # Register "evil.com".
  # Point it at secure.phabricator.com in DNS.
  # Send a legitimate user a link to "secure.phabricator.com:ignored@evil.com".
  # They login and get cookies. Normally Phabricator refuses to set cookies on domains it does not recognize.
  # The attacker now points "evil.com" at his own servers and reads the auth cookies on the next request.

Test Plan: Unit tests.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D3766
Add setup check to detect attempts to install on a path

Summary:
We don't support this and say so in the documentation, but can check explicitly.

https://github.com/facebook/phabricator/issues/148

Test Plan: Set base-uri to stuff with/without paths, verified setup caught mistakes and gave useful errors.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D3768
Add a `post_max_size` exception for drag and drop uploads

Summary: See comments.

Test Plan: Uploaded a small image in Safari via drag-and-drop.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D3771
Fix a string in PhabricatorObjectHandleData

Summary: This got copy/pasted at some point long in the past, it should clearly read "Task".

Test Plan: Looked at the rest of the strings.

Reviewers: btrahan, vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D3774
Unlink Q1 - Q4

Summary:
Q1 to Q4 is used for parts of the year.

Also unlink all `[A-Z]0.*`, we don't route them anymore.

Test Plan:
Q0
Q1
Q10

Reviewers: epriestley, pieter

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D3781
Don't count "\r" or "\n" for purposes of linewrapping text in Differential

Summary: This should all go away at some point when we move to fluid layout, but don't be more annoying than necessary in the meantime.

Test Plan: Meta.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D3788
Add a generateNewTestUser() method to PhabricatorTestCase

Summary: I need this shortly and it seems like something we're likely to need more of in the future now that fixtures work.

Test Plan: Ran unit tests. Used this productively in an upcoming diff.

Reviewers: btrahan, vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D3775
Fix some Editor issues

Summary: The property is called 'actor', not 'user'. Extend from Phobject to catch this class of error automatically. Upgrade a couple of getActor() to requireActor().

Test Plan: Created new users.

Reviewers: btrahan, vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D3776
Clean up and expose filtered recipient lists for PhabricatorMetaMTAMail

Summary: Provide a public interface to get all the filtered recipients of an email. The intent is to pass this along to Notifications so it can mark notifications as read if the user is also receiving an email, possibly based on some preference (see T1403). This also simplifies the enormous sendNow() method a little bit.

Test Plan: Added unit tests, and sent a few mails that should cover most/all of these cases. They appeared to produce the correct recipients.

Reviewers: btrahan, vrana, nh

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T1403

Differential Revision: https://secure.phabricator.com/D3778
Prevent typos in feed publishing

Summary: See D3789. Moving away from constants means less safety; provide a runtime check at least.

Test Plan: Took some actions which caused feed stories to publish, verified they showed up.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D3792
Flip dem tables on E_COMPILE_ERROR

Summary: We currently show the table flipping error page only for E_ERROR and E_PARSE, but should for E_COMPILE_ERROR as well.

Test Plan: Added a method with a bad signature to a class. Loaded page. Got a helpful message instead of a blank page.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Differential Revision: https://secure.phabricator.com/D3791
Introduce lightbox view for images

Summary:
images attached to maniphest tasks and mentioned in remarkup anywhere now invoke a lightbox control that lets the user page through all the images.

lightbox includes a download button, next / prev buttons, and if we're not at the tippy toppy of hte page an "X" or close button.

we also respond to left, right, and esc for navigating.

next time we should get non-images working in here...!

Test Plan:
played with maniphest - looks good
made comments with images. looks good.
made sure multiple image comments worked.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin, chad

Maniphest Tasks: T1896

Differential Revision: https://secure.phabricator.com/D3705
merge upstream