2007/2010/2013/2016 Outlook button padding

How can we reproduce this bug?
SCSS:
$button-padding: (
  tiny: 4px 16px 4px 16px,
  small: 4px 32px 4px 32px,
  default: 4px 48px 4px 48px,
  large: 8px 60px 8px 60px,
);

HTML / INKY:

    <button href="#" class="secondary">Book your free place today</button>

What did you expect to happen?
The button renders like this correctly on all but the ones mentioned below.

What happened instead?
The button renders like this...

What email clients does this happen in?
Outlook 2007,2010,2013,2016 (On Windows, only)

Just to be sure - is it Outlook 2007,2010,2013,2016 on windows only - or is it just 2016 on windows only?

@rafibomb Outlook 2007,2010,2013 I am having this issue as well on 2.1

@rafibomb @bc-ian Is there any working fix for this? I'm also seeing the same issue in my litmus tests.

I wonder if it would be possible to use campaign monitor's bulletproof buttons, they use a conditional statement for outlook https://buttons.cm

@nitrokevin Bulletproof buttons is on our roadmap - adding them in can be done easily. Using them with Inky is a different challenge since we'd like to pull the height and width from the settings file rather than hard coding the values.
There is a discussion started here on it we'd love for your opinions on: https://github.com/zurb/inky/issues/35
@iamsankalp I tested removing the expander but that's not it. Not sure what other ideas anyone has on this one - leaving it open to more suggestions.

Has anyone fixed this yet?

The problem with buttons is that padding does not work in Outlook for p, a, and div elements. A quick fix to this is using a border, instead of padding.
I have a custom _buttons.scss where I customize my buttons:
table.button {
	a {
		padding: 0 !important;
		border-style: solid;
	}

	&.tiny a {
		border-width: 4px 8px;
	}

	&.small a {
		border-width: 5px 10px;
	}

	&.default a {
		border-width: 8px 16px;
	}

	&.large a {
		border-width: 20px 30px;
	}
}

No need to override anything else, it will pick it up from your _settings.scss.
Maybe FEW's buttons could use the border technique instead of padding? I've seen consistent results in all major clients I've tested with.

@hellocosmin How does this affect the touch target. The reason we went to pading was to allow the whole button to be clickable.

@rafibomb it does affect the target, yes, so it's not the best way to go about it.
Lately, I've been using the anchor padding approach just like you have it, but I also declare a 0-width solid border that has the same colour as the button's background. This seems to limit the left/right collapsing of the button in Outlook, but it still collapses.
This is what I'm using currently:

      Button

The 0-width border on the anchor didn't work for me, but giving it a 1px border did. Thanks for pointing me in the right direction @rafibomb; it was driving me crazy.
Like you say, it doesn't retain the desired horizontal padding, but at least it's passable now, and that's good enough for Outlook in my case.

@benwakeford interesting, what Outlook versions didn't work? I've seen it limiting the collapsing in all Outlook versions available for testing with Email on Acid (2003 - 2016).

@hellocosmin Sorry, just back on this project now after a hiatus.
I couldn't replicate what I experienced before with the 0-width border not working; I expect my results were muddied by other custom code I was trying at the time. Just tried again and it does indeed prevent full collapsing for me in all Outlooks (2003 - 2016, via EoA).
One point to note for others is that Outlook does render the 0-width border as having a 1px border with colour - hence why it should have either the page or button background colour.

Alas, in 2017 the padding problem still persists in (at least) the outlook.com web client.
My button is slightly different, it is the large button and not an expanded one.
Somehow the button has no padding. Adding either a 0 border or 1px border to the a href= made no visible improvements.

I have seen this behavior (in the browser, while in development) when I have missed a quote or some other small syntax error that hasn't caused the compiler to completely fail on the command line. However, I have never tried this same code in Litmus to see how it looks in something like Gmail or Outlook.
For the ymail and outlook clients, is the left alignment of the button the desired effect?

I understand from many google-searches that Litmus does not (always) represent the actual look in Outlook. Where it has given screenshots that look acceptable, the reality is a broken layout or undesired effects. I myself have no experience with Litmus whatsoever, so I do not actually know anything on that front ;)
The gmail look is the desired look and alignment. I will double check all the quotes and such just to be certain. I have not found any syntax errors before, but might have missed something!

Everything that goes into the compiler is both correct and valid (according to the w3c validation tool).
After I input the compiled html with inlined css code in the W3C validator, it screams a bunch of syntax errors.. Most are about the depricated style="" attribute being used. (The doctype is xhtml 1.0). And the non-closing tags without the forward slash at the end is kicking up a storm.
It is going to take me a while, but I think it is safe to say that IF there's a syntax error, it is to do with the compiler.

I have found no syntax errors..
The button behaves as expected in Outlook 2016. It is now just outlook webmail that is messing it up.

My final comment:
Outlook.com is a very annoying webmail to design for. On Windows in Chrome, the buttons are stripped of padding and font-color, UNTIL you double click to open the email in a new windows. All of a sudden, the button appears as intended.
To fix the layout of the button (at least with padding) I have given them an additional border. It won't be touchable, but it'll look more like a button. So all the other clients will have an even bigger looking button.

Code I provide below should resolve the appearance of the lost padding in buttons for various clients (Android too). Note, the entire button will not be a link however the clients which can support padding on  tag will then have a button which will be linked in its entirety.
This was tested against v2.2.1; the develop branch seems to have various PRs pulled into the branch that don't address the issue.
table.button {

  table {

    td {
      mso-cellspacing: map-get($button-padding, default);
      mso-padding-alt: map-get($button-padding, default);
    }
  }
}

table.button.tiny {
  table td {
      mso-cellspacing: map-get($button-padding, tiny);
      mso-padding-alt: map-get($button-padding, tiny);
  }
}

table.button.small {
  table td {
      mso-cellspacing: map-get($button-padding, small);
      mso-padding-alt: map-get($button-padding, small);
  }
}

table.button.large {
  table td {
      mso-cellspacing: map-get($button-padding, large);
      mso-padding-alt: map-get($button-padding, large);
  }
}

@Luneya do you have an href="#" and a valid url in the button? I've seen this if that's not set.

@stevesmename That's similar to how V1 did buttons. The new buttons feel like a progression because the touch target is the whole button.

They all had valid URL's as href.

Bump this bug. Having the same problem for
<row>
            <columns small="12" class="content__intro">

                    <button href="https://test.com" class="small-expanded radius">Test</button>

            </columns>
        </row>

Any progress on this? It's very noticeable when the button has a white background with a solid color border. The words of the link go right up against the border.

@keithwyland do you have a valid href="http://..." in your  tag? Your issue sounds more related  tags turning into  tags. This converted tag happens in Outlook if they don't see a valid URL (loses expected styles).

@stevesmename just checked. yep. There's a valid URL there when I receive the email in Outlook.

Is it possible to wrap the text with a  within the , surely we can apply padding to the span and still keep the target area for touch/click?

Had the same problem. Was able to solve it with applying line-height on the a instead of borders or padding:
HTML:
<button href="http://something.com" class="radius">UPGRADE</button>

_settings.scss:
$button-padding: (
  tiny: 0 8px,
  small: 0 10px,
  default: 0 15px,
  large: 0 20px,
);

_template.scss:
table.button table td a {
   line-height: 2.5;

   @media only screen and (max-width: #{$global-breakpoint}) {
      line-height: 2;
   }
}

But looking for a less hacky way for buttons to work properly on Outlook.

Yes, i agree, this is a very annoying problem on Outlook!
My hack was:

instead of top and bottom-padding: line-height
instead of right and left-padding: a couple of   before and after the button text

The solution proposed by @stevesmename works for me.


List support for coupling map in pass manager (#10920)

Summary
Fixes #10920
Details and comments
The preset pass manager previously only allowed the user to provide a coupling map as an object, not as a list. Since the creation of a coupling map is typically a straightforward process, it makes sense to allow users to directly input the list into the preset pass manager generator. This is what this PR is about.
Example :
pm = generate_preset_pass_manager(basis_gates = ['cz', 'sx', 'rz'], coupling_map =[[0,1], [1,2]], optimization_level=3)

Thanks for the guidance and clarification!


Marker's anchor field can be public

Marker is basically data holder class and all the other fields are public already. It would be nice to have access to all its fields after creation.

+1
Sent from my iPhone

On 29 Sep 2018, at 20:48, tomwyr<EMAIL_ADDRESS>wrote:
Marker is basically data holder class and all the other fields are public already. It would be nice to have access to all its fields after creation.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

I've added a commit that fixes this and changes the way Anchor is created (right now it's possible to pass both anchor and anchorOverride to the Marker's constructor at the same time ). Please take a look and decide if it's worth PRing it.

+1

Can you make a PR for that? I am currently very busy this month but I can try to make time to release some of the outstanding PRs we have and would like to include this.


microk8s.reset doesn't clean up volumes

I attempted to remove the microk8s snap, and it hung on Save data of snap "microk8s" in automatic snapshot set. After investigating a bit, it looks like microk8s.reset doesn't clean up volumes, and I had many of them left over:
$ sudo du -sh /var/snap/microk8s/common/
37G	/var/snap/microk8s/common/

With paths like this: /var/snap/microk8s/common/default-storage/kubeflow-database-a6dbbcb2-mariadb-0-pvc-a75a4c3b-6b61-11e9-bf3c-e86a6466b483/
After running sudo rm -rf /var/snap/microk8s/common/*, removing the microk8s snap worked great.

@knkski this is somewhat expected. We are not removing persistent volumes unless you do a microk8s.disable storage and answer "Yes" to the respective question. The reasn for not cleaning up persistent volumes without confirmation is that you may have some data you may want to keep. Having said that, we may want to have a flag on the microk8s.reset to clean persistent volumes as well. What do you think?

@ktsakalozos: A flag on microk8s.reset sounds perfect. For comparison, juju has a --destroy-storage on kill-controller that does the same thing

I am facing this issue as well, I think it would be nice for a warning to show up here .e.g.
Save data of snap "microk8s" in automatic snapshot set #2
WARN: persistent data exists in /var/snap/microk8s/common/, run microk8s.disable storage to remove

@ktsakalozos: I tried disabling storage (after having just done a microk8s.reset), and got this:
$ microk8s.disable storage
Disabling default storage
storageclass.storage.k8s.io "microk8s-hostpath" deleted
Error from server (NotFound): error when deleting "/home/knkski/snap/microk8s/522/tmp/temp.storage.yaml": deployments.extensions "hostpath-provisioner" not found
Failed to disable storage

Did you microk8s.disable storage after a microk8s.reset?
Could you do a microk8s.enable storage and then a  microk8s.disable storage? I suspect the microk8s.reset removed the storage daemon resulting in the error you got.

@ktsakalozos: Looks like microk8s.enable storage, then microk8s.disable storage worked, thanks! Do you think it would make sense to open a new bug for adding in some output like this?
Failed to disable storage, is the storage daemon running? You may need to run `microk8s.enable storage` first.

open a new bug for adding in some output

Yes, that would be a great entry level patch! Go ahead with creating an issue with the suggested improvement.

I guess this issue can be closed since release of  v1.16.0  (920) ?
microk8s.reset --destroy-storage
du -csh /var/snap/microk8s/common/*
40K     /var/snap/microk8s/common/run
176M    /var/snap/microk8s/common/var
176M    total

Relate-to: https://github.com/ubuntu/microk8s/pull/616

Yes, thank you @rzr


feat: add zoneOffset to ExerciseSessionRecord results

Also fixes types indicating these could be present but it was not implemented so it could not.
(not planning to add those to other record types, but a good place to continue next would be sleep records)

Included in v2.2.0.


Does it only support Ubuntu?

Does it only support Ubuntu?

@kangvcar ...the install.sh script works on any debian based linux distribution...and the main subdomains.sh script should work on any linux distribution, not tested on non debian based distributions though.


Remove client class

As mentioned in #24, the WebSocketClient class is a confusing and unnecessary part of the API. This PR replaces that class with a context manager. It also adds support for opening a WebSocket by URL.

Merged directly to master.


[Event Request] Table 38 "PurchaseHeader" - procedure PerformManualRelease

Describe the request
Describe the request
The current change would benefit the fact that we could handle the code from the procedure PerformManualRelease inside "Purchase Header" table.
Current:
    internal procedure PerformManualRelease()
    var
        ReleasePurchDoc: Codeunit "Release Purchase Document";
    begin
        if Rec.Status <> Rec.Status::Released then begin
            ReleasePurchDoc.PerformManualRelease(Rec);
            Commit();
        end;
    end;

Requested:
    ...

    internal procedure PerformManualRelease()
    var
        ReleasePurchDoc: Codeunit "Release Purchase Document";
        IsHandled: Boolean;
    begin
        OnBeforePerformManualRelease(Rec, IsHandled);
        if IsHandled then
            exit;

        if Rec.Status <> Rec.Status::Released then begin
            ReleasePurchDoc.PerformManualRelease(Rec);
            Commit();
        end;
    end;
   ...

    [IntegrationEvent(false, false)]
    local procedure OnBeforePerformManualRelease(var PurchaseHeader: Record "Purchase Header"; var IsHandled: Boolean)
    begin
    end;

Additional context
Justification: we request the event since in BC22 it was introduced that in the actions Create Warehouse Shipment and Create Warehouse receipt the document is released automatically in case it was open.
That conflicts now with existing custom logic, that the warehouse document is created already after the release of a document, leading to the issue that it is now tried two times to create the warehouse document.
Internal work item: AB#544589

Thanks for reporting this. We agree, and we’ll publish a fix asap, either in an update for the current version or in the next major release. Please do not reply to this, as we do not monitor closed issues. If you have follow-up questions or requests, please create a new issue where you reference this one.
Build ID: 23666.


Prevent XSS in commit messages

It appears that HTML in commit messages is unescaped when being displayed on certain pages, including:

Commit messages next to each file in a repository view (https://try.gogs.io/calzoneman/html-test)
List of commits in a repository (https://try.gogs.io/calzoneman/html-test/commits/master)
Commit detail view (https://try.gogs.io/calzoneman/html-test/commit/17abb433b8d7703c82df66d29e6ef6c5086dcfa0)
Commit comparisons (https://try.gogs.io/calzoneman/html-test/compare/17abb433b8d7703c82df66d29e6ef6c5086dcfa0...354b62a13eee288081e3c0b965979be65ba5e327)

It appears to be escaped correctly on the Dashboard and the Public Activity tab on a user's profile (https://try.gogs.io/calzoneman?tab=activity).  I'm not sure if any other pages are affected.
Example repository: https://try.gogs.io/calzoneman/html-test
Steps to reproduce:

Create a commit with HTML in the message, e.g. git commit -m ""
Push the commit
Visit the repository

I actually discovered this by accident because one of my commit messages was "Fix <textarea> to not be indented" and this was the result:

The gogs version listed on try.gogits.io is <IP_ADDRESS>2 Beta; the version I'm running on which I discovered the issue is <IP_ADDRESS>3 Beta.

I've started looking into this to see if I can shed more light on the issue.  To me, it appears to be caused by the use of Str2HTML in a lot of places:
./templates/admin/dashboard.tmpl
./templates/user/settings/delete.tmpl
./templates/user/settings/sshkeys.tmpl
./templates/user/dashboard/feeds.tmpl
./templates/user/auth/activate.tmpl
./templates/user/auth/forgot_passwd.tmpl
./templates/user/auth/signin.tmpl
./templates/user/auth/signup.tmpl
./templates/repo/settings/hook_slack.tmpl
./templates/repo/settings/options.tmpl
./templates/repo/settings/hooks.tmpl
./templates/repo/settings/githooks.tmpl
./templates/repo/settings/hook_gogs.tmpl
./templates/repo/settings/hook_settings.tmpl
./templates/repo/fork.tmpl
./templates/repo/issue/milestone.tmpl
./templates/repo/issue/view.tmpl
./templates/repo/diff.tmpl
./templates/repo/view_file.tmpl
./templates/repo/create.tmpl
./templates/repo/bare.tmpl
./templates/repo/release/edit.tmpl
./templates/repo/release/list.tmpl
./templates/repo/release/new.tmpl
./templates/repo/migrate.tmpl
./templates/repo/header.tmpl
./templates/org/settings/hooks.tmpl
./templates/org/settings/delete.tmpl
./templates/org/team/sidebar.tmpl

The definition of Str2HTML is as follows:
func Str2html(raw string) template.HTML {
    return template.HTML(raw)
}

From the html/template documentation:

type HTML string

HTML encapsulates a known safe HTML document fragment. It should not be used for HTML from a third-party, or HTML with unclosed tags or comments. The outputs of a sound HTML sanitizer and a template escaped by this package are fine for use with HTML.

This seems like something that should not be used in anything that renders user input.  Can anyone shed light on why this is used in so many places?

OK, I see why it is used in some places, like translations (action.create_repo = created repository %s), however there are also a lot of places where it should not be used.  I'm trying to hunt all of them down but it may prove difficult to find all of the places.

I did some narrowing down by filtering out files that were only using Str2html in the context of i18n and fixed several instances that were allowing XSS with commit titles:
---
 templates/repo/commits_table.tmpl | 2 +-
 templates/repo/diff.tmpl          | 2 +-
 templates/repo/view_list.tmpl     | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/templates/repo/commits_table.tmpl b/templates/repo/commits_table.tmpl
index bd3777b..eb819e3 100644
--- a/templates/repo/commits_table.tmpl
+++ b/templates/repo/commits_table.tmpl
@@ -32,7 +32,7 @@
                     {{end}}

                 {{SubStr .Id.String 0 10}}
-                {{Str2html .Summary}}
+                {{.Summary}}
                 {{TimeSince .Author.When $.Lang}}

             {{end}}
diff --git a/templates/repo/diff.tmpl b/templates/repo/diff.tmpl
index 225175e..3f9cee1 100644
--- a/templates/repo/diff.tmpl
+++ b/templates/repo/diff.tmpl
@@ -17,7 +17,7 @@

                 {{.i18n.Tr "repo.diff.browse_source"}}
-
{{Str2html .Commit.Message}}

+
{{.Commit.Message}}

diff --git a/templates/repo/view_list.tmpl b/templates/repo/view_list.tmpl
index fed91ef..4fd64eb 100644
--- a/templates/repo/view_list.tmpl
+++ b/templates/repo/view_list.tmpl
@@ -14,7 +14,7 @@

                 {{ShortSha .LastCommit.Id.String}}
-                {{Str2html .LastCommit.Summary}}
+                {{.LastCommit.Summary}}

             {{TimeSince .LastCommit.Author.When $.Lang}}

@@ -53,7 +53,7 @@
                   {{SubStr $commit.Id.String 0 10}}

-                  {{Str2html $commit.Summary}}
+                  {{$commit.Summary}}

                 {{TimeSince $commit.Committer.When $.Lang}}

@@ -62,4 +62,4 @@

 {{if .ReadmeExist}}
     {{template "repo/view_file" .}}
-{{end}}
\ No newline at end of file
+{{end}}
--
2.2.1

Please look it over, and if you'd like I'll open a pull request.
I also discovered a separate XSS vulnerability while fixing this.  If you have a file named README.html in your repository, the contents are dumped into the README display on the repository, which again can be used to run arbitary JavaScript.  Shall I open a separate issue for this?  Example repo: https://try.gogs.io/calzoneman/readme-pwned

https://try.gogs.io/calzoneman/readme-pwned/raw/master/README.html also serves the raw HTML file.  Seems like the raw link should serve text/plain.

The raw link for any file appears to be text/html.  That seems like a bad idea.  See: https://try.gogs.io/calzoneman/readme-pwned/raw/master/eula.txt

XSS filtering for markdown is provided by this gem:
type xssFilter struct {
	reg  *regexp.Regexp
	repl []byte
}

var (
	whiteSpace = []byte(" ")
	xssFilters = []xssFilter{
		{regexp.MustCompile(`\ [ONon]\w*=["]*`), whiteSpace},
		{regexp.MustCompile(`<[SCRIPTscript]{6}`), whiteSpace},
		{regexp.MustCompile(`=[` + "`" + `'"]*[JAVASCRIPTjavascript \t\0
]*:`), whiteSpace},
	}
)

// XSS goes through all the XSS filters to make user input content as safe as possible.
func XSS(in []byte) []byte {
	for _, filter := range xssFilters {
		in = filter.reg.ReplaceAll(in, filter.repl)
	}
	return in
}

func XSSString(in string) string {
	return string(XSS([]byte(in)))
}

I shouldn't have to explain why rolling your own XSS filter is a bad idea, and could probably easily be bypassed with something like onmouseover. Blackfriday suggests using Bluemonday.

@PiPeep it's easier than that, just use this:

https://try.gogs.io/calzoneman/readme-pwned/issues/1

How about using kennygrant/sanitize?
diff --git a/modules/base/template.go b/modules/base/template.go
index 462269a..e826e6a 100644
--- a/modules/base/template.go
+++ b/modules/base/template.go
@@ -17,10 +17,12 @@ import (
        "github.com/gogits/gogs/modules/mahonia"
        "github.com/gogits/gogs/modules/setting"
        "github.com/saintfish/chardet"
+    "github.com/kennygrant/sanitize"
 )

 func Str2html(raw string) template.HTML {
-       return template.HTML(raw)
+    sanitizedStr, _ := sanitize.HTMLAllowing(raw)
+       return template.HTML(sanitizedStr)
 }

 func Range(l int) []int {

To summarize the issues brought up in this thread:

Think very carefully before allowing a string to be passed into HTML unescaped.  Things like commit messages which can be arbitrary strings need to be escaped
Limit the places where user input is displayed as raw HTML to a bare minimum.  Personally, I would not even want the Markdown renderer to allow bare HTML.
For places where user-supplied HTML is allowed, use a reputable sanitizer and a whitelist of non-malicious tags.  Don't use a blacklist and don't just apply rudimentary regular expressions
Don't dump README files as raw HTML
When a user clicks on "Raw" on a file, serve it as text/plain, not text/html

I should note that I recently set up gogs on my server to try it out as a private git server.  I like the interface and the ease of setup and administration.  I would love to continue using it, but these glaring security holes need to be fixed first.
@TonyTsangHK I think sanitizing inside of Str2html is wise, but I don't think that's the only place where the problem is.  For example, the Markdown renderer should do its own escaping, and not rely on the template editor to remember to call Str2html.

@TonyTsangHK, better, but a quick glimpse over the code concerns me. For example, this snippet:
                // Walk through the string removing all tags
		b := bytes.NewBufferString("")
		inTag := false
		for _, r := range s {
			switch r {
			case '<':
				inTag = true
			case '>':
				inTag = false
			default:
				if !inTag {
					b.WriteRune(r)
				}
			}
		}
		output = b.String()

That will remove legitimate content. If I have a standalone < surrounded by spaces in a page, the browser will treat it like text, but this state machine will treat it as a tag, and nuke the rest of the page.
Why are they doing this at all? It's not a security problem, because they call template.HTMLEscapeString later which replaces all < and > entities. But at that point, why wouldn't you simply call template.HTMLEscapeString and forget the rest of this mess? Doesn't that do everything we need?

@calzoneman Unfortunately, markdown needs to support bare HTML, because the spec allows it (with a limited number of "safe" tags), lots of people use that feature, and gogs' markdown renderer code actually inserts html tags for some stuff, prior to markdown rendering. That's why Bluemonday is suggested.

I should add: You guys need an easily found email address and responsible disclosure policy for this type of stuff (example). A public issue tracker isn't exactly the best place to discuss this stuff when there are presumably people running instances of gogs in production.

@PiPeep, you are talking about sanitize.HTML, more or less the same as template.HTMLEscapeString, but not sanitize.HTMLAllowing.
sanitize.HTMLAllowing will remove all tag & attribute not in its allowing list and resulting string can be safely used as HTML content.
Since Str2html is to convert string into type HTML, it is better to sanitize it before converting.
For README.html, it should go through a sanitization process before displaying.
Other content like commit message, README.txt etc., should be processed by template.HTMLEscape.
I think the problem here is that these content are converted to HTML directly without any sanitization or escaping.

It's been nearly 2 weeks now with no news; is this being looked at by anyone?

Since Str2html is to convert string into type HTML, it is better to sanitize it before converting.

The better solution is not to use Str2html to convert things into type HTML to begin with.  Why sanitize things rather than just escape them and avoid using HTML where it shouldn't be used entirely?

For README.html, it should go through a sanitization process before displaying.

Any user-supplied HTML (and by extension, Markdown, since Markdown allows inline HTML) should be sanitized by a reputable whitelist module.

Other content like commit message, README.txt etc., should be processed by template.HTMLEscape

Go's HTML templates should automatically escape these things as text for you.  The problem is that Str2html is being used everywhere to dump raw HTML into the page.

I think the problem here is that these content are converted to HTML directly without any sanitization or escaping.

That is most of the problem, yes.
I think some administrative changes are in order as well in light of these issues:

A security review process to ensure that mistakes like these don't make it to production
List an email address or other form of private contact information for security disclosure

+1 complete blocker to considering deployment

Not only is this a big red flag to anyone considering deploying this, it's also a current issue with the demo environment.  The test cases I demonstrated are harmless alert()s, but as was mentioned in #843, it is possible to do nefarious things on the test instance without detection.

@Unknwon This is pretty much critical: is anyone looking at it?

Yes, I'm working on it. Should have a push today CST.

Hi @calzoneman , very thanks to your report and very sorry for this important security issue, I've pushed a fix to dev branch, you're free to test again on https://try.gogs.io/calzoneman/html-test .
@TonyTsangHK , thanks for recommendation! But I used https://github.com/microcosm-cc/bluemonday because it looks like having more specific control on elements, what's your thoughts?
@PiPeep Thanks your participation as well!
PS: I'm not going to explain when I'm off site so long, families are important :smile:

@Unknwon thank you for looking into this.  I'm happy to see that my demo repositories are no longer injecting arbitrary HTML/JavaScript.
I do have one request-- would you consider displaying the commit message as plain text rather than sanitized HTML?  See my patch above.  I think it would be nicer to display commit messages with HTML in them as text rather than strip out all the HTML tags and end up with some information missing from the commit message.

@calzoneman , hmm.. it is a problem. We want to render #15 like GitHub, I don't know how GitHub behaves on this, would it display plain message on arbitrary HTML/JavaScript?

@Unknwon, First off, great job. As far as I can tell, this fixes the immediate security issues.
As for the commit messages, I think an algorithm like this would work:

Take the user's input, and replace things like < with < using template.HTMLEscapeString or equivalent. Not bluemonday.
Apply regexp substitutions on the escaped version to replace #[0-9]+ with the html equivalent.

Other things:

The old XSS function should be completely removed.

Using bluemonday for everything ATM makes sense to avoid breaking things, but Str2Html should really use template.HTMLEscapeString. bluemonday should only be used when the user can directly input arbitrary HTML, or when prior transformations are potentially unsafe (markdown). bluemonday is (1) slow and (2) may lead to strange/hard-to-find bugs.
For cases where you have trusted data and don't want to remove all HTML tags, you might want to provide a Str2UnsafeHtml, which would behave like the old version of Str2Html.

@Unknwon GitHub escapes the HTML, rather than sanitizing it (meaning it replaces < with <, > with > etc. so that no HTML tags are present in the result).  My assumption is that GitHub escapes the message first, then replaces #[0-9]+ with a link to the issue.
I think this is more desirable than rendering HTML in commit messages and sanitizing them.

@calzoneman thanks your investigation!
Go has hard issues with escaping HTML, it escapes everything automatically for you, looks like user got no choice on showing partial escaped HTML, escaped all or unescaped all.
Let me work around.

@Unknwon What I was thinking of, which @PiPeep mentioned as well, is something like this (pseudocode, since I'm not extremely familiar with Go):

Start with a commit message commit.
Use a regexp to replace #1 with a link to the issue.  commit is now "<span>testing #1".
Use template.HTML as before to indicate that this string is safe HTML and place it into the page.

By escaping in step 1, you ensure that no HTML in the commit message can possibly be interpreted as HTML in the result, while still preserving the text of the message for display to the user.

@calzoneman I see, thanks!

It's closed by commit, I reopen here for better solution of @calzoneman

:metal: :heart:

@calzoneman , hi, I've rewrite code about how to handle commit messages.
Online example is on https://try.gogs.io/unknwon/html-test based on your previous code.

@lbeltrame issue has been fixed.
@PiPeep old XSS functions are removed and now all use bluemonkey.

Looks good at first glance, I'll take a more detailed look later.  Thanks for your work on this important issue.

@calzoneman Thank you!
I've noticed this but not good at XSS simulations, your feedback is very valuable!

@Unknwon I had some time to take a closer look.

Commit message handling is mostly good, there is one place where Str2html is still being used: https://try.gogs.io/calzoneman/testing/raw/master/other.html.  Since Str2html is now using the sanitizer, this can't be exploited the same way as before, however it does render incorrectly since safe HTML tags are rendered as HTML and unsafe tags are removed from the commit message.  In the case of https://try.gogs.io/calzoneman/testing, the commit message contains a


ARROW-5615: [C++] gcc 5.4.0 doesn't want to parse inline C++11 string R literal

I ran into this while trying to tinker with ARROW-5474 (checking minimum Boost version).
This occurs for me on master with
docker-compose build cpp-ubuntu-xenial
docker-compose run cpp-ubuntu-xenial

Error looks like
/arrow/cpp/src/arrow/ipc/json-simple-test.cc:543:9: error: missing terminating " character [-Werror]
   ASSERT_OK(ArrayFromJSON(type, R"delim(
         ^
/arrow/cpp/src/arrow/ipc/json-simple-test.cc:543:2: error: missing terminating " character
   ASSERT_OK(ArrayFromJSON(type, R"delim(
  ^
/arrow/cpp/src/arrow/ipc/json-simple-test.cc:550:1: error: stray '\' in program
 )delim",

I'm perplexed about why this is a problem and why it has not been encountered by others.

This failure occurs also in gcc 4.8. We are seeing https://issues.apache.org/jira/browse/ARROW-5616, I will push fix separately

I'll have to rebase after ARROW-5616 goes in...

@kszucs @nealrichardson Buildbot is not building Parquet, so one of the failures here was not caught on account of that

Appveyor build: https://ci.appveyor.com/project/wesm/arrow/builds/25297865


Introduce the ASM project group

Rendered

The reposity link is currently broken, could someone with the appropriate permissions create rust-lang/project-asm?

cc @eternaleye

This looks great to me. We already discussed this in last week's language team meeting, and this proposal is just to charter the team to work on the problem rather than endorsing any particular solution, so let's go ahead and get consensus and get this rolling!
@rfcbot merge

Certain elements are definitively out of scope:

The chosen asm! syntax should not involve rustc "understanding" the asm code itself, since this would require a huge amount of work in the compiler to support the full assembly syntax of multiple architectures. Instead, interpretation of the assembly code should be left to the compiler backend (LLVM) or an external assembler (GAS).

Is this saying that the resulting design must have rustc treat the asm code as an opaque string, or just that rustc can't be expected to compile the code itself? There is vast middle ground between these two requirements. For instance, the project group might want to define a single comment syntax so higher level tools (like say syntax highlighters) can at least partially interpret the code

That sounds neat, but also that sounds like something that should wait for the project group to be accepted and then have that discussion of the details there.

I'm not super familiar with how Rust project groups operate, but my expectation would be that if the charter says something is out of scope, then the project group isn't "allowed" to discuss it. That's why I'm hoping to clarify the group scope before it is accepted/started. (This is of course the wrong place to debate my hypothetical comment syntax proposal, I just wanted to give an example of an issue that I wasn't sure if it was germane or not)

The scope is intentionally a bit vague here. The intent is that we do not want to have to re-implement a whole assembler ourselves, for every supported architecture.

I had the exact same reaction while reading this sentence, and hesitated commenting on it. Maybe it'd make sense to just remove that “this is out of scope” line, so that the ambiguity is not there and the project group can just reasonably end up with the conclusion that the solution is not going to be re-implementing a whole assembler?
For instance, I seem to remember some pretty convincing arguments saying that all stable asm should actually be at least completely parsed by rustc, if not more, which comes close enough to “re-implement a whole assembler ourselves” to be in the gray zone, as far as I understand.

For instance, I seem to remember some pretty convincing arguments saying that all stable asm should actually be at least completely parsed by rustc, if not more

I'm guessing this is https://internals.rust-lang.org/t/inline-assembly-syntax/239/5, which was brought up in the recent irlo inline asm thread here: https://internals.rust-lang.org/t/pre-rfc-2-inline-assembly/11310/102
Although I disagree with these arguments, I do think it's reasonable to expect that any future RFC produced by the ASM project group to explicitly say "we didn't go with asm-as-syntax for reasons X, Y, Z", and "because the charter said so" would be a pretty unsatisfying reason. So I'd be fine with removing that qualifier for now. It's not like there's another Rust project group working on reimplementing assemblers or assembly syntax, and assembly syntax is certainly relevant to the whole discussion of inline asm (as opposed to e.g. how two-phase borrows are technically irrelevant to NLL, but that's not obvious unless you've memorized niko's blog or the RFCs).

Love it :)

ping @Centril @scottmcm @withoutboats

ping @Centril @scottmcm @withoutboats for fcp

We discussed this some in our lang team meeting last Thursday. @Centril expressed some concerns, though it would be helpful if he could elaborate them, since I don't think I have a great grasp of what they are. One thing that he raised I know is a question of whether we'll have the bandwidth available to tackle this.
I personally feel pretty good about this, since I think that

the interaction of inline assembly with the compiler is generally broad but shallow. That is, I feel like inline assembly touches a lot of the compiler, but it doesn't usually require very complex modifications to any one piece.
@Amanieu is (as I understand it) volunteering to do a lot of the implementation work, and @joshtriplett is happy to help summarize and bring things to lang team.

In particular I'd like for the @rust-lang/lang team to get better at being able to "delegate" projects like this. The hope would be that the group can handle figuring out the right path, and keep the team updating both via RFCs and regular updates.
As far as priority, I feel that this fits our current project goals in a few ways:

I would like us to be taking unfinished features with no particular path to stability and either removing them or finishing them off. Prioritization in these cases can be hard, because most individual features may not be that high priority one by one, but I think that reducing their number is valuable.
As for this individual feature, it falls in a few categories ("systems programming", "C parity") that I think are important, and I think that it is clearly of high importance to many potential adopters (especially given the interest we've seen). I think it's important for Rust to both have capabilities that rival C in terms of enabling low-level, systems applications, but also to do a good job on their design.

One thing that would be helpful is if we had some folks from @rust-lang/compiler (or @rust-lang/compiler-contributors) who was excited to serve as a dedicated reviewer here.

Incidentally, we've just finished the RFC for inline assembly and it is now up at #2850.

Is there much point on continuing to block the project group RFC? At this point, we've already published the RFC (#2850) and incorporated feedback from the community into it. We even have an implementation of the RFC (rust-lang/rust#69171) which is 90% complete.

OK, this has obviously been stalled for some time. I feel we need to push this towards resolution. As of this writing, everyone in the @rust-lang/lang team has checked their box apart from @Centril, who has raised blocking objections in [this comment]. The comment is quite detailed and worth a read, but I believe the core points are as follows (@Centril, feel free to let me know if you feel I overlooked or de-emphasized something):

Implementation and maintenance costs: getting inline assembly over the finish line is a lot of work and not to be underestimated; further, there will be continual maintenance costs
Not the best design: the compiler must treat inline assembly as totally opaque and doesn't understand what's going on; offering custom intrinsincs for instructions would be a better solution
Hard to spec: how should the "Rust Abstract Machine" incorporate inline assembly?
Portability across backends: supporting inline assembly requires all backends to offer native support, which can be prohibitive
Poor fit for Rust: the feature is a poor fit for Rust and encourages people to rely on impl details they shouldn't rely on. It must either be prohibitively restrictive for generics or can result in errors post-monomorphization.
FFI is good enough: given the above concerns, people should be satisfied pulling their custom assembly into external functions and invoking them.

Since those concerns were posted, there have been a number of replies, as well as further developments. Most notably the project group has been active, the asm! RFC is pending and has received a lot of comments, and there is an initial prototype implementation available.
My feeling is that most of the above points have been addressed. I'm going to briefly summarize:

Implementation and maintaince costs: They could be high, but there is a known reviewer (nagisa) and Amanieu has already made great progress on the implementation. The branch that removes existing inline assembly support isn't, all things considered, that large (1000 lines) and it seems to back up the contention that inline assembly support is "broad but shallow" -- that is, it affects many parts of the compiler, but typically in a relatively simple way.
Not the best design: This is obviously something of a judgement call. Intrinsics are an appealing solution, but maintaining an exhaustive set of intrinsics is both difficult and time consuming in its own right (there will always be things missing). Further, for many folks doing system's level programming, inline assembly is "table stakes", so to speak. I think I would personally add this one feature and "be done", while simultaneously providing people with the tools they expect. Furthermore, we can still add intrinsics in the future for particularly common instructions, thus giving people the ability to execute those instructions without using the "big hammer" of inline assembly (but also without the need for us to have exhaustive coverage).
Hard to spec: This has been discussed on the asm RFC, but given that we must have a spec that can accommodate calls to random FFI functions, inline assembly doesn't seem impossible, just harder. I think this concern would be better lodged as a "concern that must be addressed prior to stabilization" rather than blocking the creation of the project group itself.
Portability across backends: the proposed design includes the idea of using C FFI and an external assembler, essentially doing the boilerplate work users would otherwise have to do. This seems like a viable path to address portability, though it is more complex. Personally I don't feel this is a blocker: I would even just think it's ok to just say that Rust backends ought to support inline assembly (or can perhaps refuse to compiler crates that use it, at least to start).
Poor fit for Rust: this strikes me as a pretty surprising assertion, I feel like inline assembly is an example of a feature that Rust should "obviously have", precisely because of "table stakes" nature. In other words, if our goal is to be able to replace all uses cases of C or C++ with Rust (and I think it should be), then I think we clearly need something like inline assembly, as it is pervasive in certain kinds of projects.
FFI is good enough: This again is a value judgement, obviously, but I think this sends a message that Rust isn't truly targeting low level systems programming tasks, and considers them second tier. I don't think this should be the case.

In the interests of driving this discussion to a conclusion, I would like to ask a few things:

To everyone in @rust-lang/lang who checked their boxes: I haven't seem much comments on the RFC, but it sometimes happen when there are pending concerns that others don't speak of because the concern exists. Are there others out there who would wish to "second" centril's concerns? This could be because you share the concern yourself, or because -- even though you think you disagree with it -- you don't think the concern has been fully understood yet and would like to discuss further. If so, can you speak up and perhaps elaborate what parts of the concerns are most convincing?
To @Centril or others: I'd like to hear your take on my responses above. Did I miss an aspect of one of your concerns? Do you feel something in my response is either factually inaccurate or misleading? To make it easier to have that conversation, I've created a dropbox paper document where you can leave comments if you like. I'll try to update the document in response.

Note that my goal here is not to convince you necessarily (though that'd be nice!), but I want to make sure we understand each other's takes.

Just a quick update: the PR implementing the new asm! macro (rust-lang/rust#69171) is now complete.

It seems that this discussion has deadlocked. @Centril has valid concerns which should definitely be resolved prior to stabilizing asm!. However I don't think that these concerns should block landing the new asm! syntax that we proposed on the nightly compiler.
asm is perhaps the single most widely used unstable feature today. However the current llvm_asm! macro (formerly asm!) is very error prone due to the lack of validation and the confusing syntax. When looking at uses of asm! in the wild, I often find mistakes involving improper use of memory operands or missing "memory"/"volatile" qualifiers.
The new asm! syntax is strictly better than the old one in every way and I think it would be huge a quality of life improvement for many users of Rust even if it is never stabilized.

I've discussed this over with the @rust-lang/lang team and our consensus is that we should move forward with this project group. The team feels that the concerns @Centril raised have been sufficiently addressed by the responses posted above, as well as the events that have occurred in the meantime, such as the work on RFC #2850. Moreover, even without this RFC being accepted, the project group was active regardless, and has indeed nearly completed its work, so it's evident that this particular RFC should be accepted. Given that @Centril has stepped back from the language design team, I'm going to go ahead and resolve the concerns they left on this issue on their behalf (let's see if this works...):
@rfcbot resolve i-dont-think-we-should-do-this
@rfcbot resolve particularly-not-now

(The resolutions aren't acknowledged in https://github.com/rust-lang/rfcs/pull/2836#issuecomment-565269781)

Yeah, I thought that would work but I guess it didn't. I've notified @anp but that's ok. I'm just going to "cancel" the FCP and handle it manually, since the requisite 10 day period has long since expired.

@rfcbot fcp cancel

Huzzah! The @rust-lang/lang team has decided to accept this RFC.


'_bpy.ops' has no attribute 'render'

I am trying to make a render, change some parameters and do another. Doing it via CLI - creating two blend files and then executing them seems like a bit too much 🤷 . Is there a way to execute the render operator under _bpy.context?
filename = 'stars_before.jpg'

    def _render_image(filename):
        _bpy.context.scene.render.image_settings.file_format='JPEG'
        _bpy.context.scene.render.filepath =  os.path.join(images_dir, filename)
>       _bpy.ops.render.render(use_viewport = True)
E       AttributeError: module '_bpy.ops' has no attribute 'render'

tests/unit-tests/test_stars_texture.py:31: AttributeError

Could you explain where _bpy come from and what information is accessible and when? Another day I noticed when writing a test and trying to access an operator that I could access through Blender console, I couldn't access it through _bpy.ops which was quite confusing.

Nope, this is the bug tracker for pytest-blender.

My bad. I thought that it is part of and developed for pytest-blender package.


Does neovim-remote need NeoVim?

Hi there!
Sorry for this noob question yet still I have to ask it: does NeoVim-remote require NeoVim for its work or do I just open terminal, write there $pip3 install neovim-remote press enter and that is it?

nvr is used to control Nvim processes, so, yes, it's needed. :)


Service locator fails when using a class derived from ITenantInfo

I'm trying to add a CosmosDb store implementation (not using EFCore) which works fine if I use TenantInfo for the record model but if I change to another class that implements ITentantInfo it fails to locate the MultiTenantContextAccessor and from the error below it looks like it's trying to resolve TenantInfo instead of ITenantInfo
Executed 'Devices' (Failed, Id=1d9ccd0c-c57d-41d1-8514-0ba84d3c8e89, Duration=272ms)
System.Private.CoreLib: Exception while executing function: Devices. Microsoft.Extensions.DependencyInjection.Abstractions: No service for type 'Finbuckle.MultiTenant.IMultiTenantContextAccessor`1[Finbuckle.MultiTenant.TenantInfo]' has been registered.

I also tried using the InMemoryStore and get the same error. Any thoughts?

Nevermind, it was an oversight on my part when I call GetMultiTenantContext<TenantInfo>. I was looking everywhere except the actual function using the code...

@Valks Glad you sorted it out! Let me know how the CosmosDb store works out for you. I'll probably eventually add it to the library.


Incompatible with Effortless Building

According to your testing, does the issue occur with ONLY Immersive Portals mod and Farbic API?
Yes
Describe the issue
Describe the issue.

Will crash the game with the error code in the picture if you try to destroy blocks with the mod (in survival)
Basically if it needs to drop any blocks because it works fine in creative.
Playing in singleplayer
Wouldnt let me put the log as text
latest.log
Post the log here
No response

This is probably an issue of effortless building. It seems that effortless building does entity-related operations in non-server thread. I need the server log to know the details. You can report this in effortless building.


adds strong naming for NLog adapter

I need strong named assemblies for my project.

Hi, I understand your need for the signed version, but I don't want to change the original NLog tracer for backward compatibility reasons. So I opted for creating a signed nuget package beside the original one. I've just published it under the name Tracer.4NLog.Signed.Fody. It is the exact same DLL, just signed.

pr is obsolete due to changes in commit 37d6401a203ed6bca76e9d4d68b0879c2c764920


wasm-pack build --dev panicked at 'assertion failed: !self.dead.contains(&id)'

🐛 Bug description
wasm-pack build --dev panics inside walrus's tombstone_arena.  It shouldn't.
👟 Steps to reproduce
git clone https://github.com/MaulingMonkey/rust_wasm_sample.git
cd rust_wasm_sample
git checkout ff3bbedbcf3b717a0ae
wasm-pack build --dev

(Github view of the checkout: ff3bbedbcf3b717a0ae)
I've been having trouble figuring out how to get a useful stack backtrace out of wasm-pack, if you have suggestions I'll be happy to rerun.
HEAD is now at ff3bbed Add bin version, scripts for dual native/wasm builds.
[INFO]: Checking for the Wasm target...
[INFO]: Compiling to Wasm...
    Finished dev [unoptimized + debuginfo] target(s) in 0.04s
[INFO]: Installing wasm-bindgen...
thread 'main' panicked at 'assertion failed: !self.dead.contains(&id)', C:\Program Files\Rust\.cargo\registry\src\github.com-1ecc6299db9ec823\walrus-0.8.0\src\tombstone_arena.rs:139:9
stack backtrace:
   0: <unknown>
   1: <unknown>
   2: <unknown>
   3: <unknown>
   4: <unknown>
   5: <unknown>
   6: <unknown>
   7: <unknown>
   8: <unknown>
   9: <unknown>
  10: <unknown>
  11: <unknown>
  12: <unknown>
  13: <unknown>
  14: <unknown>
  15: BaseThreadInitThunk
  16: RtlUserThreadStart
Error: Running the wasm-bindgen CLI
Caused by: failed to execute `wasm-bindgen`: exited with exit code: 101

Misc. notes:

wasm-pack build (without the --dev flag) works.
wasm-pack build --dev stops panicing after https://github.com/MaulingMonkey/rust_wasm_sample/commit/0def95e70a7cc2732327326819965c3df139dac1

🌍 Your environment
wasm-pack version: 0.8.1
rustc version: rustc 1.35.0 (3c235d560 2019-05-20)
toolchain: stable-x86_64-pc-windows-msvc

Ahh, this is actually a wasm-bindgen bug, not a wasm-pack one.  Will refile with more info there...


Easy consumption of tt-metal

From the community:

Could we get a straight-forward way to build a program outside of the repo? My current way is through a hacky cmake file, would be super nice to have an example of how to do this in the docs too. Also like corsix said, more documentation would help as well.

@bbeggsTT please look into this ask


Failed to create CoreCLR, HRESULT: 0x8007FF02

The first roadblock I hit when trying to port this:
/wrkdirs/usr/ports/lang/dotnet/work/dotnet nuget add source 'https://fbsdnugetfeed.mooo.com/v3/index.json' --name ghsec --configfile runtime/NuGet.config
Failed to create CoreCLR, HRESULT: 0x8007FF02

This is a jail context so it might have something to do with that. Any ideas @sec @Thefrank ?

Yes, outside of jail this command at least starts doing something:
/usr/local/poudriere/ports/default/lang/dotnet/work/dotnet nuget add source 'https://fbsdnugetfeed.mooo.com/v3/index.json' --name ghsec --configfile runtime/NuGet.config

Welcome to .NET 8.0!
---------------------
SDK Version: 8.0.100

----------------
Installed an ASP.NET Core HTTPS development certificate.
...

Bakctrace that might be useful:
(gdb) bt
#0  _write () at _write.S:4
#1  0x0000000801345157 in _swrite (fp=0x8014064e0, buf=buf@entry=0x801b12a90 "Failed to create CoreCLR, HRESULT: 0x8007FF02", n=45) at /usr/src/lib/libc/stdio/stdio.c:117
#2  0x000000080134047c in __sfvwrite (fp=fp@entry=0x8014064e0, uio=uio@entry=0x7fffffffe0a0) at /usr/src/lib/libc/stdio/fvwrite.c:89
#3  0x000000080133eced in fputs_unlocked (s=0x801b12a90 "Failed to create CoreCLR, HRESULT: 0x8007FF02", fp=0x8014064e0) at /usr/src/lib/libc/stdio/fputs.c:63
#4  fputs (s=0x801b12a90 "Failed to create CoreCLR, HRESULT: 0x8007FF02", fp=0x8014064e0) at /usr/src/lib/libc/stdio/fputs.c:75
#5  0x00000008016b5970 in pal::err_fputs (message=0x801b12a90 "Failed to create CoreCLR, HRESULT: 0x8007FF02") at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/hostmisc/pal.h:227
#6  trace::error (format=0x8016831c8 "Failed to create CoreCLR, HRESULT: 0x%X") at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/hostmisc/trace.cpp:182
#7  0x00000008016af08a in (anonymous namespace)::create_coreclr () at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/hostpolicy/hostpolicy.cpp:84
#8  0x00000008016ae918 in corehost_main (argc=10, argv=0x801a2f050) at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/hostpolicy/hostpolicy.cpp:422
#9  0x000000080164fcb3 in execute_app (impl_dll_dir="/wrkdirs/usr/ports/lang/dotnet/work/shared/Microsoft.NETCore.App/8.0.0", argc=10, argv=0x801a2f050, init=<optimized out>)
    at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/fxr/fx_muxer.cpp:145
#10 (anonymous namespace)::read_config_and_execute (host_command=..., host_info=..., app_candidate="/wrkdirs/usr/ports/lang/dotnet/work/sdk/8.0.100/dotnet.dll", opts=..., new_argc=10, new_argv=0x801a2f050, mode=<optimized out>, is_sdk_command=<optimized out>,
    out_buffer=<optimized out>, buffer_size=<optimized out>, required_buffer_size=<optimized out>) at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/fxr/fx_muxer.cpp:532
#11 fx_muxer_t::handle_exec_host_command (host_command="", host_info=..., app_candidate="/wrkdirs/usr/ports/lang/dotnet/work/sdk/8.0.100/dotnet.dll", opts=std::unordered_map with 0 elements, argc=<optimized out>, argv=<optimized out>, argoff=1, mode=muxer,
    is_sdk_command=<optimized out>, result_buffer=0x0, buffer_size=0, required_buffer_size=0x0) at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/fxr/fx_muxer.cpp:1007
#12 0x000000080164f362 in fx_muxer_t::handle_cli (host_info=..., argc=argc@entry=9, argv=argv@entry=0x7fffffffea30, app_candidate="nuget") at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/fxr/fx_muxer.cpp:1093
#13 0x000000080164ec7c in fx_muxer_t::execute (host_command="", argc=9, argv=0x7fffffffea30, host_info=..., result_buffer=0x0, buffer_size=0, required_buffer_size=0x0)
    at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/fxr/fx_muxer.cpp:567
#14 0x000000080164b6ad in hostfxr_main_startupinfo (argc=9, argv=0x7fffffffea30, host_path=0x801a1b030 "/wrkdirs/usr/ports/lang/dotnet/work/dotnet", dotnet_root=0x801a1b060 "/wrkdirs/usr/ports/lang/dotnet/work/",
    app_path=0x801a1b090 "/wrkdirs/usr/ports/lang/dotnet/work/dotnet.dll") at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/fxr/hostfxr.cpp:62
#15 0x000000000102f2c7 in exe_start (argc=argc@entry=9, argv=argv@entry=0x7fffffffea30) at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/corehost.cpp:240
#16 0x000000000102f526 in main (argc=9, argv=0x7fffffffea30) at /usr/home/sec/dotnet-dotnet/src/runtime/artifacts/source-build/self/src/src/native/corehost/corehost.cpp:308

Hi.
Make sure that you have allow.mlock=true when working under jail.
Also make sure all the packages needed by dotnet are accessible also under jail (icu libunwind krb5 openssl, etc.).
Next thing is elfctl -e +noaslr dotnet to disable ASLR on dotnet binary.
Just fyi - what procedure are you trying to port? When doing build from VMR, you only need bootstrapped SDK and artifacts produced (plus extra patches) to perform the build. If you try to port build using my scripts/steps, there will be rough edges :) I would go with VMR route

Yep, I just tracked this down to
mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) =<PHONE_NUMBER>7440 (0x2f5134a00000)
mlock(0x2f5134a00000,4096)                       ERR#1 'Operation not permitted'

which is 99% the problem you're describing.

Just fyi - what procedure are you trying to port? When doing build from VMR, you only need bootstrapped SDK and artifacts produced (plus extra patches) to perform the build. If you try to port build using my scripts/steps, there will be rough edges :) I would go with VMR route

I'm doing porting based on your steps. From my understanding, following these steps would produce me both VMR and SDK suitable for further bootstrapping?

Nope, my steps will produce only SDK and runtime nuget's that can be used to build/run application - those are hacky ways of getting the SDK as it require some manual patching etc.
The easiest way now, at least for v8.0 is to go straight with VMR build - https://github.com/Thefrank/freebsd-dotnet-sourcebuild/tree/main/patches/Net8.0.100 - this will produce all you need, SDK, artifacts, etc., that can also be used to re-build the same VMR :) You can use bootstrapped SDK and private artifacts either from my releases or from frank's - they are the same, only difference is that he did then on 12 and mine are build on 13 - I also took his runtime patch for GC memory thing, which you can also include in build steps until it's not up-streamed.
Doing build straight from VMR repository should be 3 line operation assuming everything is in place :)

Ok, I'll try going that route.
As for the intial problem, it can be fixed by putting JAIL_PARAMS=allow.mlock=true into poudriere.conf.


editor.copyWithSyntaxHighlighting: false doesn't work with Jupyter notebook

VSCode Version: 1.25.1
OS Version: Windows 10 20H2 19042.685

Steps to Reproduce:

Set "editor.copyWithSyntaxHighlighting": false
Copy input or output of a Jupyter notebook
Paste somewhere else and formatting is preserved (The copyWithSyntaxHighlighting option works with normal text file)

Does this issue occur when all extensions are disabled?: I don't know. I tried and it looked like the Python extension is required to render the notebook.

Dupe

Dupe


Fixing issue where memory would bloat in UITest runner when running o…

…n device.  It seemed to have been caused by XCUIApplication() getting called multiple times per execution of an action.  Its now only retained once per action. Resolves #23

Hey there, does this apply to Xcode 10.2 only? I've tested on a device (iOS 13, Xcode 11) using public XCTest actions (see #81) and the memory seems to be stable.

Ok, I take it back. I left tests running for some time and when I came back, there was about 8GB of memory used by the UI tests target 😱
With your changes the memory stays on a very low level. Thank for the support! 🎉

👍

👍


Add support for Language hashtag in the tweet body

This is the initial pr. Still wip 🙂

@musically-ut Thanks for the comments. I agree with all the issues you mentioned. I fixed them. For now am using the language itself as the tag. I will implement the dict of languages and tags we talked about in the next commit. I will also look into unifying the whole search through pyGithub.

@musically-ut Lets hold on to this for a bit... till we figure out which direction to take regarding... #8


ds-host DropID management UI is flawed

Needs fixing:

a hyphen in handle (and others characters surely) result in 400 bad request on validation
special characters in display name don't seem to work. An é ends up as e. Test more and fix.
Auto-select domain on form load.
Editing the DropID doesn't work as expected: the display name is not populated in the form?
Probably more issues.

Fixed in fb4e51fc192f1ad37832a3166c541338e6153dec


Translition

Translated Code of conduct , readMe and Contributing into somali language
Note: May be some of my words are wrong so if someone can correct it will be great

Thanks @mohamed20039, can you resolve that conflict?


ci: drop official support for rustc < 1.7.0

Supporting older versions of rust is causing CI to fail and is
a somewhat constant support burden with questionable value.  1.7.0
is the oldest I have seen that people have had a requirement on
supporting in recent history.
It may make sense to work toward a more official policy on
what version of rust we will support in the future.  Users of
older version of rust are, of course, welcome to use older versions
of nix and everything else in the ecosystem.
r? @kamalmarhubi @fiveop

I'm ok with this so long as we mention it in the changelog and make it a "major" bump to 0.8.

(Seeing how this review business works)

As my issue #432 indicates, I'm all for it. Given changes are made as suggested by @kamalmarhubi r=me (or him I suppose :)).

As my issue #432 indicates, I'm all for it. Given changes are made as suggested by @kamalmarhubi r=me (or him I suppose :)).

Ah, missed that.  I'm still a big fan of having a minimum supported version that is tested by CI, but I agree that we don't need to support ancient versions.  Even 1.7 is older than I think we need to support, but that is where CI is at present.  More discussion on that over at rust-embedded/rfcs: https://github.com/rust-embedded/rfcs/issues/16

Please add a note in the changelong, and bump the version to 0.8.0-pre.

Will do.

@homu r=kamalmarhubi

:pushpin: Commit 360f7aa has been approved by kamalmarhubi

:hourglass: Testing commit 360f7aa with merge bf1e6b2...

As a note, I have now also enabled nightly builds via https://nightli.es/ which I have been using on other projects for some time.  This will give us a better indication of when things may be broken on a new stable/beta/nightly release without having a contributor bump into it first.

:sunny: Test successful - status

@posborne does nightlies have a dashboard?

@posborne does nightlies have a dashboard?

They have a page called the dashboard when logged in.  It basically just shows rust projects under your account and whether nightli.es has setup webhooks or not.  Code is here: https://github.com/coderanger/nightlies.  It is quite barebones but will get us notifications via travis when things start failing.

Thought of an additional benefit bumping tro 1.7 is that we get AsRef<CStr> impls (https://github.com/rust-lang/rust/pull/30616). This will make the solution to #230 nicer.


Japanese Vicuna QA Benchmark

https://github.com/hitoshizuku7/LLM_Judge_ku

https://speakerdeck.com/olachinkei/jgluenogou-zhu-sosite-ri-ben-yu-llmping-jia-nokorekara?slide=34


[Feature Request] An option to exclude loading wallpapers from sub-folders

Some versions ago, there was an inclusion of sub-folders introduced – would be great if it was optional for more control over wallpaper management

It was a bug actually that the subdirectory wasn't read properly and was fixed. It's an intended behavior.

The app was designed to read a single directory and show all wallpapers to a single place. Your problem can be easily solved by storing your wallpapers in a different directory where there isn't other photos you don't want to be listed in the app.

It's added now :)


Improve password and user entry

OraclePatchDownloader.java:

Add methods readLine and readPassword that handle an absent console gracefully.  Use the former to read the OTP.

Read password from environment variable if possible.

Read user and password from console if not specified on command line.

README.md:

Sync option description from online help.  Mark it as plain, non-shell verbatim text to avoid wrong syntax highlighting.

Add note on password entry options.  Expand example by environment variable reference.

After the 1st PR was well received (thanks) here comes the next one, this time a bit simpler.
I still have plans, though:

Next PR would be dedicated to error handling and better maintainability - I'd like to have an option to get the pages dumped, so that it gets easier to spot problems when scraping fails.
After that I'd like to implement some support for scraping the checksums from MOS and use them to verify the downloaded files, for example.

Hope this is OK with you to continue in that way - for me this was just the right project at the right time.

After the 1st PR was well received (thanks) here comes the next one, this time a bit simpler.
I still have plans, though:

Next PR would be dedicated to error handling and better maintainability - I'd like to have an option to get the pages dumped, so that it gets easier to spot problems when scraping fails.
After that I'd like to implement some support for scraping the checksums from MOS and use them to verify the downloaded files, for example.

Hope this is OK with you to continue in that way - for me this was just the right project at the right time.

Thanks for improving the tool, will help all other users... i commented the password.match... not shure what the \A and \z will do, i prefer ^ and $ for start and end..


Translate guides/routing/index.md to French

Resolves #66

@MrChocolatine so happy that you open an MR 🎉🎉🎉🎉 :D


Wallet passphrase lock fixes

Changes:
Wallet passphrase lock fixes:

wallet should not allow cli commands to bypass lock validation
wallet should lock again in mixing mode if it was unlocked for mixing and next unlock (e.g. for sending funds) happened
removed AnonymizeOnlyUnlocked status, it's never going to be reached anymore
"For anonymization only" checkbox:

should be available only when user click "Start Mixing"
should be set on by default when available
adjusted title

adjusted error messages in walletpassphrase for unlocked wallets
refactored few more names and strings

Works for me but testers/reviewers are highly welcome for this one!

Addressed additional issues that were found during review, refactored. PR description updated.

I'm not convinced it's a good design to put fOnlyMixingAllowed in CCryptoKeyStore because as far as I can tell that class does nothing to enforce it.  It seems like the flag should be in the class that actually enforces the constraint, which I think should be CWallet.

Not sure what kind of fOnlyMixingAllowed enforcement is expected but it's a) private b) set in Lock/Unlock. Or I don't quite understand the question, maybe..

I thought the wallet would have a way of allowing only specific types of access based on the value of the fOnlyMixingAllowed but maybe that's out of scope for this PR.
If I understand correctly the only way of controlling access currently is via IsLocked.

utACK


ref: Accept client-side wayland connection, global

@Shinyzenith may I merge this one? will that be ok?

ok

Thank you for the help @Decodetalkers ❤ I'll keep making a few more improvements and get back to you!


Signatures URLs added to any task are actually applied to all tasks

Consider the case where your test configuration has commons-lang3, but main does not.
So you think you're adding the signatures only to the test task:
tasks.forbiddenApisTest {
    signaturesURLs.add(loadResource("commons-lang3-extra.txt"))
}

But then you get a build failing in forbiddenApisMain because it can't find commons-lang3's StringUtils.
This is flaky behaviour, which is why we hadn't noticed it immediately: If forbiddenApisMain runs first, it will work fine, because the configuration for forbiddenApisTest hasn't been evaluated yet. But if forbiddenApisTest runs first, it configures signaturesURLs, which turns out to be the same collection used by forbiddenApisMain. Since forbidden APIs depends on the result of compilation, and main always finishes compiling before test, this would only happen in larger projects where there are so many tasks running concurrently that it's possible for the test one to run first.
From quickly reading the code, it would look like each task uses its own collection, but it seems that the convention mapping then stomps all the references with a reference to the collection in the shared extension. So all tasks actually use the same collection object, and thus using +=/add isn't actually safe right now.
The workaround is to copy the collection first:
tasks.forbiddenApisTest {
    signaturesURLs = signaturesURLs.toMutableSet()
    signaturesURLs.add(loadResource("commons-lang3-extra.txt"))
}

Odds are, the same issue exists with all other collections, including bundledSignatures. But with bundledSignatures it's less noticeable because you're going to be using the same JDK on main and test.
Ideally, these collections would actually be SetProperty, with the initial contents of the set coming from the shared extension. But of course, that changes the public API. :(

This looks indeed like a bug.
I will fix this before releasing the java 19 update.

I think the easiest fox is to modify the convention mapping to make a clone: https://github.com/policeman-tools/forbidden-apis/blob/89dd05342ee87cbb9b8721dcb9b9fe6840315443/src/main/resources/de/thetaphi/forbiddenapis/gradle/plugin-init.groovy#L48
Should be trivial to do with some instanceof check or a simple call to clone().

Hi,
it is not so easy to fix, because cloning would prevent the "add" from working, but what I figured out: If you use signaturesURLs += it works correctly, if you add you will modify the shared one.
forbiddenApisTest {
    signaturesURLs += loadResource("commons-lang3-extra.txt")
}

I have no idea about Kotlin, but in fact the Groovy DSL clones correctly. So it looks like affecting kotlin only.
So at moment I am not sure if this is a bug at all. Other tasks in Gradle behave the same. It also affects classpath.
I can't change to SetProperty at the moment because of Gradle 3.x minimum dependency, so I would leave this as won't fix (and I am not sure if using SetProperty would help at all, as the SetProperty would be modified in the same way).

A final fix would be to use XxxProperty for all settings, but this would require upgrading gradle, so needs to be delayed. I will put this on the backlog.
Workaround:

use += in Groovy DSL
use signaturesURLs = signaturesURLs.toMutableSet() in Kotlin DSL

I will think about it a bit more, but the change to properties requires more work - and would finally remove the (outdated) convention mapping technique.

I finally found a solution to fix #203. I studied other old plugins and the trick is the following: Instead of returing a new instance in the convention, have some collection available as template. When the convention is executed, it takes the template, adds the extensions's data to it (addAll for Collections, source for ConfigurableFileCollections).
I added a Gradle-like += and a Kotlin-like with add to the sample project which gets tested. I verified that in both cases the data is kept and the extension is not modified.
I may release a bugfix version 3.4.1 this week or maybe a 3.5. I have one othe rissue to fix.


Proposal: parallel utility function

I was going to make this as a pull request, but I don't grok all the typescript stuff going on here (and testing it the way I wanted would have involved adding sinon).
Something to this effect:
export function parallel(thunks) {
  return async (dispatch, getState) =>
    await Promise.all(thunks.map(t => t(dispatch, getState)));
}

Used like so:
const [ aresult, bresult, cresult ] =
  await dispatch(parallel(athunk(), bthunk(), cthunk()));

I don't think adding utility flow control functions to redux-thunk is a good idea, this time we add parallel and next time we will add series, throttle, debounce and so on...
In other words, parallel is the easiest to handle, just call dispatch multiple times:
let [aResult, bResult, cResult] = await Promsie.all([dispatch(athunk), dispatch(bthunk), dispatch(cthunk)]);

I don't quite get the benefit of having an extra parallel utility function, even if you really want a parallel utility, it should be much simpler than you expected:
let parallels = ...thunks => Promise.all(thunks.map(dispatch));
let [a, b, c] = parallels(thunkA, thunkB, thunkC);

This does not involve redux-thunk's internal implement at all

even if you really want a parallel utility, it should be much simpler than you expected:

This whole library is 14 lines, 12 if you remove extra line breaks. With this line of reasoning you could delete the repo and tell people to implement it themselves.

this time we add parallel and next time we will add series, throttle, debounce and so on...

Valid point

npm ecosystem encourages small and dedicated packages, if 2 things are not coupled to each other's internal implement, they'd better be different package, in this way a redux-thunk-flow package could help more users
Another point is that in my mind it is not a good practice to await a dispatch, in a full fledged multi-layered app, redux-thunk is an dependency injection tool to provide dispatching ability to a certain layer, and this layer should be focused on "invoking business logic and do dispatching stuff", the core business logic should spread in another layer, so await is better to used with the business logic layer but not the thunk itself


Set-up Kanban - Board

Implemented Changes
Set-up Kanban Board

Link to the Project: https://github.com/Diegogagan2587/space-travelers
Size of the Team: 2 Members

STATUS: REQUIRED CHANGES ♻

Hi @Team,

Good job so far! There are some issues that you still need to work on to go to the next project but you are almost there!

Highlights

[ ].. ✅ Project created
[ ].. ✅ Tasks assigned up

Required Changes ♻

[ ] We have a small issue that you will have to address before this Pull request is approved, in the requirement it is said that all the tasks for the 3 students are meant to be removed if the team only has 2, check these, 1,2,3,4, 5, 8, 9

,
Optional suggestions
Every comment with the [OPTIONAL] prefix is not crucial enough to stop the approval of this PR. However, I strongly recommend you take them into account as they can make your code better.
Cheers, and Happy coding!👏👏👏

Feel free to leave any questions or comments in the PR thread if something is not 100% clear.
Please, remember to tag me(@joskalenda) in your question so I can receive the notification.

Please, do not open a new Pull Request for re-reviews. You should use the same Pull Request submitted for the first review, either valid or invalid unless it is requested otherwise.

As described in the Code reviews limits policy you have a limited number of reviews per project (check the exact number in your Dashboard). If you think that the code review was not fair, you can request a second opinion using this form.

Hi @Diegogagan2587 and @joskalenda  ,
STATUS: APPROVED! 🥇 💯

Your project is complete!  There is nothing else to say other than... it's time to merge it :shipit:
Congratulations! 🎉
Cheers and Happy coding!👏👏👏
Feel free to leave any questions or comments in the PR thread if something is not 100% clear.

As described in the Code reviews limits policy  you have a limited number of reviews per project (check the exact number in your Dashboard). If you think that the code review was not fair, you can request a second opinion using this form.


Automated cherry pick of #8926: fix(monitor): modify suggestrule  process influxdb data

Cherry pick of #8926 on release/3.5.
#8926: fix(monitor)：suggestrule

Codecov Report

Merging #8928 (aca754b) into release/3.5 (6a15e02) will decrease coverage by 1.77%.
The diff coverage is n/a.

@@               Coverage Diff               @@
##           release/3.5   #8928       +/-   ##
===============================================
- Coverage         5.98%   4.20%    -1.78%
===============================================
  Files              796     163      -633
  Lines           125693   24870   -100823
===============================================
- Hits              7522    1047     -6475
+ Misses          117504   23731    -93773
+ Partials           667      92      -575

Flag
Coverage Δ

aFlag
4.20% <ø> (-1.78%)
:arrow_down:

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files
Coverage Δ

pkg/keystone/tokens/payloads.go

pkg/cloudcommon/db/quotas/quotas.go

pkg/compute/models/resource_syncstatus.go

pkg/apigateway/handler/resource.go

pkg/compute/models/keypairs.go

pkg/compute/models/projectquota.go

pkg/util/ansiblev2/session.go

pkg/util/printutils/printobj.go

pkg/baremetal/utils/disktool/disktool.go

pkg/keystone/models/userresource.go

... and 621 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d35a076...aca754b. Read the comment docs.

/lgtm
/approve


Add support to golines

Hi all,
would you consider adding support to golines? Would a PR for it be welcome?
Thanks for the work!

Just saw #11


Specify location of .netrc file if netrcCreds are provided for plugin installation.

Description
There is currently an issue where if a user needs to provide credentials to a server in order to retrieve a plugin for installation, the .netrc file that is created by the chart (using the secret specified at .Values.plugins.netrcCreds) is not used. This causes issues in scenarios where users want to install internal plugins that have been published to private artifact registries that don't allow anonymous access.
Normally we would just need to specify the '-n' flag to curl to tell it to use the .netrc file in the users home directory, but as we have mounted the .netrc secret at the root directory (see here), we have to specify the '--netrc-file' flag to tell it to retrieve the file from the /root directory.
Changes

Added conditional rendering of the --netrc-file flag (driven by the value provided in .Values.plugins.netrcCreds), and have defaulted the value of it to /root/.netrc. I've not made the location for this configurable, as the mount location for the secret mentioned above is also not configurable, so its not really expected to change.

Ah sorry, totally missed the annotation when looking at the Chart.yml. I've made the required changes, and have ported them to the DCE chart as well.


Verical slider

Describe the feature
Same functionality but supporting a 90° rotation.
Describe the solution you'd like
Exactly the same functionality but in vertical orientation
Additional context (If there is no relevant content, please delete the block)
There's a dashboard I need to make that requires sliders with ranges but it has to be in an vertical orientation.

nevermind, found the undocumented feature in the source code :) basically just set :direction='vertical' if anyone stumbles upon this


chore(release): 0.6.4

When I run this release locally against sidecar i get this logging warning:
can't resolve reference #/definitions/directiveConfigSchema from id #

It can be ignored but I would like to get it resolved before we release

Interesting; it sounds like an openapi type thing offhand to me! I wonder whether directiveConfigSchema or similar appears anywhere in the node_modules stuff.

Interesting; it sounds like an openapi type thing offhand to me! I wonder whether directiveConfigSchema or similar appears anywhere in the node_modules stuff.

I think youre correct about this. If I had to take an accurate guess it's probably with one of the 2 deps I updated.


Only Dming5 users

Only Dming 5 users in my server when there is 100+

Did you check any other issues to see if they resembled yours? Also, next time, please post more debugging information so I can help fix your issue faster!

Did you check any other issues to see if they resembled yours? Also, next time, please post more debugging information so I can help fix your issue faster!


Add requests and add ssh_port to options

In our infra, we are doing the whole templates with custom ssh port, which was not supported by your module. in this change I'm reading the ssh_port from the options but also with a fallback to 22.
The other change is dependency to requests module.

Thank you.   Do you know why we need to add the requests module dependency?

in the create step on the TASK [Create molecule instance(s).] I get this error:
failed: [localhost] (item=test-srv) => {"ansible_loop_var": "p", "changed": false, "module_stderr": "Chosen backend requires 'requests' module\n\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "p": {"name": "test-srv", "newid": 1200}, "rc": 1}

it seems requests is a dependency for proxmox_kvm: https://docs.ansible.com/ansible/latest/collections/community/general/proxmox_kvm_module.html#requirements

Thank you. Yes, I see I missed that dependency. Thank you for the fix!  Let me get this one merged.

Wouldn't it be helpful to enable alternative ports not only at the options level, but as well on the platform level?
For example like that:
          user: "{{ options.ssh_user | d(ra.rc.p.ssh_user, true) | d('molecule') }}" # while we are at it
          port: "{{ options.ssh_port  | d(ra.rc.p.ssh_port, true) | d('22') }}"

Wouldn't it be helpful to enable alternative ports not only at the options level, but as well on the platform level?
For example like that:
user: "{{ options.ssh_user | d(ra.rc.p.ssh_user, true) | d('molecule') }}" # while we are at it
port: "{{ options.ssh_port  | d(ra.rc.p.ssh_port, true) | d('22') }}"

Yes, I think that could be added later. I think it would first check the platform level, and if not found, check the drivers options, and finally fall back to default value, something like (untested)
port: "{{ ra.rc.p.ssh_port | d(options.ssh_port, true) | d(22, true) }}"
(and similar for the user)


Add PHP 8.1 Support

This PR adds PHP 8.1 support to the tests workflow.
It also removes unused packages (v2 of php-cs-fixer, which is run via a workflow instead) and an unused psalm script.
Additionally, it adds the auto changelog updater workflow.

Thanks!


[AB3: Tracing Code] Breakpoint in main method

Current:

Problem:
Students might not know what to expect after setting a breakpoint at the first statement of the main method.
Proposed:
Insert the following paragraph at the end, to show the result of putting a breakpoint in the first statement of the main method:
Upon running the application with the breakpoint in the first statement of the main method, you will realize that the app is launched via this method.

hmm... the tutorial doesn't actually ask the reader to put a breakpoint in the main method. It's just a hypothetical statement.
Is there a way to make it clearer (and avoid possible confusion)?

Will the following phrasing be better?
Proposed:
As you know, the first step of debugging is to place a breakpoint where you want the debugger to pause the execution. For example, if you want to understand how a specific feature of your application works, you might put a breakpoint in the method where that feature is initialized. This is similar to how you would put a breakpoint at the first statement of the main method if you wanted to understand the application's startup process. However, this is just a hypothetical example; you should place breakpoints at points in the code that are relevant to what you're trying to debug.

Proposed:
As you know, the first step of debugging is to place a breakpoint where you want the debugger to pause the execution. For example, if you want to understand how a specific feature of your application works, you might put a breakpoint in the method where that feature is initialized. This is similar to how you would put a breakpoint at the first statement of the main method if you wanted to understand the application's startup process. However, this is just a hypothetical example; you should place breakpoints at points in the code that are relevant to what you're trying to debug.

@tayruxin 🤔 hmm... I'm not sure. If we improve the page on debugging (given below) I imagine most students might be OK with the current version without further elaboration.

In any case, I took another pass at revising the text in that section. Can you take a look here and share what you think? I revised the content up to the Intellij code search screenshot.

I believe the revised text makes the paragraph more coherent. Thank you for the revision.


Remove SVGs?

The SVGs are replaced on the website with WEBP, should they stay in the repo or removed?

I'd rather not remove the versions which are the source files from this repo.


Update SeBa version

@rieder I tried to update the SeBa version in AMUSE (needed for my triple project with planets) but the checks failed. Not sure why. Is this related to the other changes made to SeBa recently?

@rieder I tried to update the SeBa version in AMUSE (needed for my triple project with planets) but the checks failed. Not sure why. Is this related to the other changes made to SeBa recently?

@rieder I tried to update the SeBa version in AMUSE (needed for my triple project with planets) but the checks failed. Not sure why. Is this related to the other changes made to SeBa recently?

no, it's just that the checks currently aren't doing a great job.

@rieder I tried to update the SeBa version in AMUSE (needed for my triple project with planets) but the checks failed. Not sure why. Is this related to the other changes made to SeBa recently?

no, it's just that the checks currently aren't doing a great job.


Fix mapDecoder.DecodeStream() for empty objects containing whitespace

Current master breaks when encountering JSON containing an empty object containing whitespace like {"obj":{ }} when using the stream decoder - Unmarshal() behaves as expected.
This PR fixed that problem, and NewDecoder().Decode() will behave like Unmarshal().

Thank you for your contribution !!! LGTM


Fix issue when minorVersion is not just number

Fix issue when minorVersion is not just number, such as "1 Beta" (for such scenarios that the OS version is like 8.1 Beta), which will cause error in [int]$minorVersion.
Test results after fix:
[LISAv2 Test Results Summary]
Test Run On           : 11/07/2019 09:04:49
VHD Under Test        : D:\RHEL-8.1.0-xxxx-x86_64-GEN2-A.vhdx
Initial Kernel Version: 4.18.0-xxx.el8.x86_64
Final Kernel Version  : 4.18.0-xxx.el8.x86_64
Total Test Cases      : 1 (1 Passed, 0 Failed, 0 Aborted, 0 Skipped)
Total Time (dd:hh:mm) : 0:0:11
ID TestArea             TestCaseName                                                                TestResult TestDuration(in minutes)
1 NETWORK              NET-VXLAN                                                                         PASS                 9.77

@huijuanzhao, I am not sure this is the right place of your change. I think you should check out utils.sh, GetOSVersion(). This is only change in a test script

@juhlee-microsoft, thanks for your suggestion, I also thought over it. The minorVersion comes from  $os_UPDATE, and for the $os_UPDATE, only this test script uses 'int' type, all the other test scripts use 'string' type, so I think it is better just fix it in this special test script.

In other words, if fix it in utils.sh, GetOSVersion(), it maybe affect other test scripts.  [int]$os_UPDATE is just used in this test script, so I think it is more safe to fix it in this test script.

In other words, if fix it in utils.sh, GetOSVersion(), it maybe affect other test scripts. [int]$os_UPDATE is just used in this test script, so I think it is more safe to fix it in this test script.
It is hard to believe we can make a change of my design ground. I recently changed my PR based on the same condition. I suggest new code of utils.sh will be right and we should make it right.

@huijuanzhao I am just giving you a friendly reminder that PR opens for a long time. If you need more time, please let me know your ETA.

@juhlee-microsoft, thanks for your reminder, sorry to response late since other high priority tasks.
Revert the original fix in NET-Test-Vxlan.ps1, and fix the utils.sh according to your suggestion, please review.
Thank you

Test results after fix:
[LISAv2 Test Results Summary]
Test Run On           : 11/22/2019 08:42:06
VHD Under Test        : D:\RHEL-8.1.0-xxxx.0-x86_64-GEN2-A.vhdx
Initial Kernel Version: 4.18.0-xxx.el8.x86_64
Final Kernel Version  : 4.18.0-xxx.el8.x86_64
Total Test Cases      : 1 (1 Passed, 0 Failed, 0 Aborted, 0 Skipped)
Total Time (dd:hh:mm) : 0:0:11
ID TestArea             TestCaseName                                                                TestResult TestDuration(in minutes)
1 NETWORK              NET-VXLAN                                                                         PASS                 9.68

@juhlee-microsoft, could you please help to review the fix when you are available?
Thank you!


[Desktop] Hidden cursor while typing, which complicates deleting with [BACKSPACE] key.

My issue is about [Desktop]
The cursor is hidden while typing which makes it quite hard to delete with [BACKSPACE], unless you manually reposition the cursor and delete one character at a time!

@izamha This happens when setState or notifyListeners is called from the client side, usually when the input changes.
It's happening on mobile too.
It's not an issue when you want nothing depends on the text field change.
It becomes more of an issue when a button needs to be enabled or disabled depending on the input; which required calling setState or notifyListeners depending on the use-case

It is indeed an issue when other/native apps do it fine. The cursor stays visible whether you are typing or deleting.

has anyone resolve this problem yet?

The current version does not have this problem.
If the problem still exists, please reopen and let us know how to reproduce the program.


⚠ 2 Minutes de génie (gitlab page) has degraded performance

In 123610c, 2 Minutes de génie (gitlab page) (https://2mdg.gitlab.io/) experienced degraded performance:

HTTP code: 200
Response time: 997 ms

Resolved: 2 Minutes de génie (gitlab page) performance has improved in 7681702.


Revert "chore(release): 0.2.6 (#863)"

This reverts commit 79543f0015ead19743f18adf35533a08acb8ba92.

Using this https://github.com/codecov/uploader/pull/866 instead


Is median absolute deviation used in forecasting and written accurately?

xskillscore includes median absolute deviation (MAD). It seems to be returning different results than other packages and is not written as Wikipedia (https://en.wikipedia.org/wiki/Median_absolute_deviation) or scipy (https://scipy.github.io/devdocs/generated/scipy.stats.median_absolute_deviation.html) would suggest it to be. I also can't find any documentation on it in forecast literature/pages.
import numpy as np
import pandas as pd
import xarray as xr
import xskillscore as xs
import astropy.stats
import scipy.stats

np.random.seed(12345)
def generate_data():
    time = pd.date_range("1/1/2000", "1/5/2000", freq="D")
    da = xr.DataArray(np.random.rand(len(time)), dims=["time"], coords=[time])
    return da

a = generate_data()
b = generate_data()

xs.mad(a, b, "time")
<xarray.DataArray ()>
array(0.46925829)

astropy.stats.median_absolute_deviation(a, b)
0.13518689535658013

scipy.stats.median_absolute_deviation(a, b)
0.2004280910556657

The scipy description suggests that MAD is the median of the median error. I.e. np.median(x - np.median(x)). It seems like a statistic for a single time series. Does it make sense to apply this to the absolute error of A and B?
Just checking that there's some evidence of this being used in the field.
CC @raybellwaves, @aaronspring

Haven’t seen MAD in a forecasting paper. However, why should the mean have more physical meaning than the median for the best forecast?
Interesting that astropy and scipy differ on this.
I mostly implemented MAD according to the existing metrics. Very possible that I missed something.

I implemented median absolute error. https://github.com/scikit-learn/scikit-learn/blob/bf24c7e3d/sklearn/metrics/_regression.py#L333
I didn’t give it the proper naming MAE because already taken. Then I mistakenly named it MAD but that’s apparently a different thing. Maybe naming with short abbreviations is not so clever...

Fixed in https://github.com/raybellwaves/xskillscore/pull/63.

On a side note: Today I learned that L1loss (used in ML/DL) is MAE https://pytorch.org/docs/stable/nn.html#torch.nn.L1Loss


Unfriendly API?

Consider the following function:
fn make_container<'b>(containers: &'b Containers) -> Container<'b, 'b> {
    let cont_opts = ContainerOptions::builder("alpine")
        .cmd(vec!["true"])
        .build();
    let cont_info = containers.create(&cont_opts).unwrap();
    containers.get(&cont_info.Id)
}

It doesn't compile because the returned Container needs to have a reference to its Id. I'm not sure if it's even possible to do this.
Having more structs that own their data might make the API a bit easier to use.

This seems to be not relevant anymore, as the API changed since. Feel free to reopen if you see need.


.playFile() & .playStream() delays

First of all, I am not quite sure if this has something to do with versions stuff, and I think it is an issue, and yes this is my first time doing this, and yes I have been asking for several days in the support server, but no one seems to figure it out so I have decided to post it here, if this is not an issue then I am so sorry.
Issue: If a bot is playing songs, when a song ends, the .playFile() delays, at first it does not delay but after a lot of songs, it can delay for up to 2 minutes(according to what I've only experienced), the duration of delay increases more and more after each song. According to what I've been experimenting it might not be because of my code, and yes I am still a noob, even though I've been coding with Discord.JS for like 7 months.
Additional information (Mostly assumption):
i) The delays are differentiated in each server, even though the bot has delayed a lot in a server, but if you play in another server it'll play immediately.
ii) Messages sent before the delays, which kinda means it has nothing to do with CPU usage or whatever.
Further details:
Discord.JS version: 11.1.0
Node.JS version: 8.0.0
Operating system: Ubuntu

I'm not sure why people always delete the Issue template. Would be nice if you could edit your post with the Issue template.

i have seen this issue as well

Can't repro

I also have that issue here and it only happen if my bot plays on 2 different voiceConnections at the same time here but the dispatcher start event id emitted when the stream should start

Same here, the first play is almost instant but then it gradually gets more and more delayed until it takes up to half a minute for the file to play back. I only use one voiceConnection ever.

I had an issue with similar symptoms. In my case, it happens when you pause, and unpause a stream. It was due to the pausedTime prop on the AudioPlayer class. Everytime a new dispatcher is created, the pausedTime is carried over as the AudioPlayer is instantiated once per connection. Any summation on this prop between dispatchers (Noticed a few lines in the StreamDispatcher) will also be carried over. Based on the way the nextTick is calculated in StreamDispatcher, this delay only really occurs when startTime === Date.now() (When a dispatcher emits the start event).
My resolution was resetting this field to 0 on a new dispatcher instance.
For example;
message.channel.join()
    .then(connection => {
      ....
      const dispatcher = connection.playFile(path);
      dispatcher.on('start', => {
        connection.player.streamingData.pausedTime = 0;
      });
      ....
    });

i can only say for myself in my code i dont have any pause&resume function so it cant be this for my thing

@co-jo your fix work well so far for myself thank you 👍

can't someone just make a pr /tableflip

@co-jo Thanks for pointing out your fix involving connection.player.streamingData.pausedTime. I've been trying to battle this issue for a while thinking it was a combination of v8/node/opus version conflicts causing me this issue but after reading your post and logging that pausedTime value I could see it increasing every playback - setting it back to zero has completely resolved the issues I've been having for many months!