Cross Site Scripting - Reflected

There is a XSS vulnerability without need for any authentication at all. It seems to be also present in the newest versions.
To reproduce:
1)If you created sample users such as "Avis", "Clark", "Raphael", etc , click on their photos on the home page.
2)The endpoint "/signup/"  has parameters that are vulnerable to Cross Site Scripting. Here is an example:
http://example.com/pH7-Social-Dating-CMS/signup/?ref=main&a=index&u=chaya-ward&f_n=Avis">
The reason this is a valid vulnerability is because if you do this without the quote in the payload, it will not work. For example, this will not work:  but this will: ">
I hope it will be fixed because I really like this project. It should not be too difficult to sanitize those parameters.

Also, since the CMS uses Smarty templates, it could also be vulnerable to template injection, although I'm not sure if that is possible with GET requests.

@squelch0 Does not use the Smarty template. Has a somewhat "lookalike" template language but that's it.

Tried this on my live production site and all I get is a 404 page not found.

Tried this on my live production site and all I get is a 404 page not found.

It could be because your live production site has a WAF.

@squelch0 Does not use the Smarty template. Has a somewhat "lookalike" template language but that's it.

Either way, template injection could be possible. Often if it's vulnerable to XSS it is also vulnerable to template injection if there is any template system involved.

@squelch0 Does not use the Smarty template. Has a somewhat "lookalike" template language but that's it.

Either way, template injection could be possible. Often if it's vulnerable to XSS it is also vulnerable to template injection if there is any template system involved.

and template injection could lead to Remote Code Execution.

Tried this on my live production site and all I get is a 404 page not found.

It could be because your live production site has a WAF.

okay the payload is ">

Tried this on my live production site and all I get is a 404 page not found.

It could be because your live production site has a WAF.

okay the payload is ">

try that instead of "

@squelch0 Sorry but part of what you say is wrong...
First of all the template system only treat the code from a file, not from a stream.
Second, maybe you should give us your version number because what you are telling use does not work. Could you either supply a screenshot or some proof, for example a W3AF log ?

@squelch0 Sorry but part of what you say is wrong...
First of all the template system only treat the code from a file, not from a stream.
Second, maybe you should give us your version number because what you are telling use does not work. Could you either supply a screenshot or some proof, for example a W3AF log ?

Okay, well nevertheless, there is a Cross Site Scripting vulnerability here that needs to be fixed. You can literally prove this by going to any live website and typing "> into the "f_n" parameters or "u" parameters.

@squelch0 Okay, one last shot here...

I tried this on the latest version and it doesn't seem to work. And so did @Undefined-Variables

@polynamaude He is up to something...

My sever is under attack!

@squelch0 Okay, one last shot here...

I tried this on the latest version and it doesn't seem to work. And so did @Undefined-Variables

I tried it on 15.4 stable.

My sever is under attack!

...what?

this is on my own website.

@polynamaude He is up to something...

are you being serious or trolling me right now?

make sure you type ">

If anyone has Discord I can show you there.

@squelch0 Please keep polite, no trolling allowed here.

@squelch0 Please keep polite, no trolling allowed here.

I'm not trolling. I'M the one being trolled.

@squelch0 Please keep polite, no trolling allowed here.

I'm not "attacking" anyone. I'm trying to help.

You told me to try a url now my server is throwing alerts XSS on every site and all cpanels are you telling me thats chance? No

You told me to try a url now my server is throwing alerts XSS on every site and all cpanels are you telling me thats chance? No

Dude I have no idea what you're talking about. I'm not trying to do anything, this is a bug in the framework.

You told me to try a url now my server is throwing alerts XSS on every site and all cpanels are you telling me thats chance? No

The site I linked doesn't exist! It's just an "example" domain.

You told me to try a url now my server is throwing alerts XSS on every site and all cpanels are you telling me thats chance? No

Do you have any way to contact you? Phone, whatever, I don't care. I just want to prove to you I'm not malicious..

 You said try that alert now I have XSS poping up on all websites, whm, cpanel

@Undefined-Variables I am not attacking your server! I don't even know what your server is! I'm just trying to bring a security issue to the attention of the admins! You don't have to open the url I sent you!

Someone just email me<EMAIL_ADDRESS>I will explain everything.

 That's why I reported this to you guys..

@Undefined-Variables We now have "Shit in the fan !"

@Undefined-Variables We now have "Shit in the fan !"

Well, you are the security guy, right? It's not a bad vulnerability, it can be fixed easily using HTML entity encoding.

I'm looking in to what can be done to stop this now.

@Undefined-Variables We now have "Shit in the fan !"

Well, you are the security guy, right? It's not a bad vulnerability, it can be fixed easily using HTML entity encoding.

I have only tested this on my own websites

I'm looking in to what can be done to stop this now.

Good. I have my own production site as well. I can help fix it when I am not too busy.

This needs solving straight away!

I

This needs solving straight away!

Yes it does, if you want I can send you some contact info. I'm a security researcher.

I

This needs solving straight away!

Yes it does, if you want I can send you some contact info. I'm a security researcher.

It's not hard to fix the XSS, but hopefully it isn't vulnerable to template injection..

I'm sorry for disclosing it publicly like this, but I figured it would be the best way to get it fixed.

You need to use htmlentities() function to convert symbols such as " > < to &quot &lt &gt

yes but you can get around that by url encoding so what is the point?

yes but you can get around that by url encoding so what is the point?

I'm not sure the details of what you need to do. Like I said, I am new with this framework, but either way there needs to be a way to prevent dangerous characters like < > "  or {}

There are messures in place. I think we have shared enough to the world for now and like I said im looking in to it.

I don't want to test it either as that was a nightmare. Ive had to reboot more than once to clear this.

@squelch0 Thank you for reporting this! You have done the right thing and we are being highly suspicious. We get a lot of this kind of thing and normally it's rubbish.
Thanks

@squelch0 Thank you for reporting this! You have done the right thing and we are being highly suspicious. We get a lot of this kind of thing and normally it's rubbish.
Thanks

You're welcome! Haha, I understand, I know you get a lot reports. It shouldn't be difficult to fix though. I have a website running this right now, and as long as it's not vulnerable to template injection it shouldn't be too severe. That's why the { } characters should be properly sanitized, to prevent template injection vulnerabilities.

I don't want to test it either as that was a nightmare. Ive had to reboot more than once to clear this.

I'm not sure how many servers you have running, but this should only make 1 pop-up alert saying "XSS". It shouldn't crash the server or anything unless it's something else.

From what I have found in mod security log I am Speechless!! From that single call of that URL I have over 500 hits all XSS rules all at the same time.
That is no normal XSS attempt.
I can't find much about the components that make up the URI request except...
?ref=main relatrs to IPV4 addresses
&a=indexu has some link to iframe injection
And
Chaya-ward is most commonly referred to as a name, but pops up in owasp reports here and there so with all that considered I'd guess it is some form of callback
There are rules covering this in the framework which is why we don't see an initiate alert this is much more complex.

From what I have found in mod security log I am Speechless!! From that single call of that URL I have over 500 hits all XSS rules all at the same time.
That is no normal XSS attempt.
I can't find much about the components that make up the URI request except...
?ref=main relatrs to IPV4 addresses
&a=indexu has some link to iframe injection
And
Chaya-ward is most commonly referred to as a name, but pops up in owasp reports here and there so with all that considered I'd guess it is some form of callback
There are rules covering this in the framework which is why we don't see an initiate alert this is much more complex.

Hmm that is really odd. Are you getting attacked? I haven't checked my logs yet but I doubt anyone would start attacks after reading this so quickly. As long as the only problem is Reflected XSS it shouldn't be too severe. The only vulnerability with the XSS is if someone sends you a link to your own website with this payload, they can potentially steal your auth cookie or do "session fixation". Thankfully it doesn't appear to be "stored XSS".

No not right now. Its odd how there are so many hits on mod securiry and all at the same time, all from my ip starting with that request. I have asked cloudflare what they think and they are looking in to it. They asked for the logs and normally are fast at answering but its been hours.

No not right now. Its odd how there are so many hits on mod securiry and all at the same time, all from my ip starting with that request. I have asked cloudflare what they think and they are looking in to it. They asked for the logs and normally are fast at answering but its been hours.

So the requests were from you? This bug shouldn't effect anything server side. The only vulnerability is when you send the link with the payload and someone clicks it. What I think could be happening here is called "Blind XSS". You should test this with xsshunter.com. It's helpful for tracking down Blind XSS triggers.

@Undefined-Variables I think what is happening is "Blind XSS". The payload is being processed by many different scripts, and with a template system between everything it could possibly execute the payload in many different areas.

How did you find this?

How did you find this?

I do bug bounties and I'm hoping to make a career of Penetration Testing. I'm on HackerOne and other bug bounty platforms. This is a classic XSS and I found it just by manually testing those parameters. If you put a quote(") in the parameters you will see that whatever you input is directly reflected on the page , and the quote causes some problems. Anything you input into the "f_n" parameter can be treated as html. So you can actually for example put href tag: "> TEST  and that should simply make a link render on the page.
https://hackerone.com/squelch0
https://www.openbugbounty.org/researchers/squelch000

@Undefined-Variables It's a very simple classic case of reflected XSS. And it surprised me that it wasn't already being sanitized as it is supposed to be a secured and soooo secured software (as per the author).
Most automated testing framework will do this type of check in a automatic fashion.

@Undefined-Variables It's a very simple classic case of reflected XSS. And it surprised me that it wasn't already being sanitized as it is supposed to be a secured and soooo secured software (as per the author).
Most automated testing framework will do this type of check in a automatic fashion.

Yes I was surprised to find it although I tested all parameters with sqlmap and they seem to be secure against that. I also tried payloads like {{5*5}} to test for template injection, but I have no idea how the syntax works for ph7 yet. If you can get it to show 25 on the page, its vulnerable to template injection. Just gonna do black box testing then I will start looking at the source code. As long as all parameters use prepared statements there should be no SQL injection risk.

@Undefined-Variables It's a very simple classic case of reflected XSS. And it surprised me that it wasn't already being sanitized as it is supposed to be a secured and soooo secured software (as per the author).
Most automated testing framework will do this type of check in a automatic fashion.

I actually think this framework is quite good, it will just take some time to improve this young project and fix the bugs. Looking forward to finding more of the bugs to keep everything secure!

Yeah SQL injection is impossible as it uses PDO prepaired statements. I have tried myself. The template system core file is found here https://github.com/pH7Software/pH7-Social-Dating-CMS/tree/master/_protected/framework/Layout/Tpl/Engine/PH7Tpl and is simular to smarty. See what you can find...

Also, since the CMS uses Smarty templates, it could also be vulnerable to template injection, although I'm not sure if that is possible with GET requests.

pH7Builder uses pH7Tpl. A homemade template engine. Only the installation wizard still uses Smarty.

Thanks very much for reporting this @squelch0!!! 💯 It seems that https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/b52f033692a4d4fc512d0b161b39e19e28335541 opened an XSS flaw that occurs in <link rel="canonical" href=""> value. I will patch it and release an update ASAP.

Patch available here: https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/ee647aa628a14aa8c0cc3654f4a7ee0e46354080
@squelch0, @Undefined-Variables, @polynamaude

-> Patch available here: ee647aa
@squelch0, @Undefined-Variables, @polynamaude
And it will also be included in the next release.

Great job on the fast fix!

on the fast fix!

You're very welcome!

@ph-7 Thank you great response and rapid fix :)
@squelch0 Thank you for reporting this :)

This is still possible with this...

Which is
<script>alert('FUCK')</script>

HTML Encoded....

Still a problem, can we stop it?

Still a problem, can we stop it?

This is still possible but not directly on the page it gets cached by nginx then executes when any nginx action is preformmed
with this...

Which is
<script>alert('FUCK')</script>

URL Encoded
then
HTML `Encoded....

Damn, well I guess this is Stored XSS now. Definitely going to take some tweaking to fix. Unfortunately there are a million ways to skin the cat with XSS. Using "onmouseover",  tags,  tags,  tags, etc. Hopefully there is a CSRF token somewhere or else the XSS could lead to hijacking an admin account.

Still a problem, can we stop it?
This is still possible but not directly on the page it gets cached by nginx then executes when any nginx action is preformmed

with this...

no

Which is

<script>alert('FUCK')</script>

URL Encoded

then

HTML `Encoded....

Damn, well I guess this is Stored XSS now. Definitely going to take some tweaking to fix. Unfortunately there are a million ways to skin the cat with XSS. Using "onmouseover", tags,

not sure why GitHub cut out the rest of my reply...anyway, I hope there is a CSRF token or else this XSS can lead to account hijacking.

Still a problem, can we stop it?
This is still possible but not directly on the page it gets cached by nginx then executes when any nginx action is preformmed

with this...

no

Which is

<script>alert('FUCK')</script>

URL Encoded

then

HTML `Encoded....

Damn, well I guess this is Stored XSS now. Definitely going to take some tweaking to fix. Unfortunately there are a million ways to skin the cat with XSS. Using "onmouseover", tags,

not sure why GitHub cut out the rest of my reply...anyway, I hope there is a CSRF token or else this XSS can lead to account hij

Still a problem, can we stop it?
This is still possible but not directly on the page it gets cached by nginx then executes when any nginx action is preformmed

with this...

no

Which is

<script>alert('FUCK')</script>

URL Encoded

then

HTML `Encoded....

Damn, well I guess this is Stored XSS now. Definitely going to take some tweaking to fix. Unfortunately there are a million ways to skin the cat with XSS. Using "onmouseover",  tags,  tags, etc.

Still a problem, can we stop it?
This is still possible but not directly on the page it gets cached by nginx then executes when any nginx action is preformmed

with this...

no

Which is

<script>alert('FUCK')</script>

URL Encoded

then

HTML `Encoded....

Damn, well I guess this is Stored XSS now. Definitely going to take some tweaking to fix. Unfortunately there are a million ways to skin the cat with XSS. Using "onmouseover", tags,

Also I'm not too knowledgeable on Cache Poisoning, but it sounds like what's happening here.

Still a problem, can we stop it?
This is still possible but not directly on the page it gets cached by nginx then executes when any nginx action is preformmed

with this...

no

Which is

<script>alert('FUCK')</script>

URL Encoded

then

HTML `Encoded....

Damn, well I guess this is Stored XSS now. Definitely going to take some tweaking to fix. Unfortunately there are a million ways to skin the cat with XSS. Using "onmouseover", tags,

Also it might be worth trying this header: "Pragma: no-cache" to prevent any more cache problems.

@squelch0 Yeah to be honest I was waiting for an upload to finish so was just messing about with Burp and didn't think it would work in a million years. If you just URL encode it it gets escaped, if you just HTML encode it again it gets escaped but if you do one on top of the other it gets missed and yeah like you say its stored in the cache and in a worst case scenario could end up being able to hijack an account if CSRF is not being used. You would be silly though to allow any form on the public internet to not be protected by a token. I'm not sure what the solution to this is!

Plus it may still work directly on the page as thinking about it the original did the same thing on my live server. I haven't got a local copy to hand to test it. My production server is protected by mod security which stops it directly on pages.

@squelch0 Yeah to be honest I was waiting for an upload to finish so was just messing about with Burp and didn't think it would work in a million years. If you just URL encode it it gets escaped, if you just HTML encode it again it gets escaped but if you do one on top of the other it gets missed and yeah like you say its stored in the cache and in a worst case scenario could end up being able to hijack an account if CSRF is not being used. You would be silly though to allow any form on the public internet to not be protected by a token. I'm not sure what the solution to this is

Plus it may still work directly on the page as thinking about it the original did the same thing on my live server. I haven't got a local copy to hand to test it. My production server is protected by mod security which stops it directly on pages.

Hmm, unfortunately I haven't been able to get a local copy running either. I have FastCGI and everything else I think but it still doesn't want to work. It also throws an error mentioning cache and Smarty. Anyway, a cached payload could execute any time a victim loads the page. You could easily steal everyone's session cookie and then log in as them. You could even use window.location.replace() to redirect them to another site, for example a replica site for phishing.

@squelch0 Yeah to be honest I was waiting for an upload to finish so was just messing about with Burp and didn't think it would work in a million years. If you just URL encode it it gets escaped, if you just HTML encode it again it gets escaped but if you do one on top of the other it gets missed and yeah like you say its stored in the cache and in a worst case scenario could end up being able to hijack an account if CSRF is not being used. You would be silly though to allow any form on the public internet to not be protected by a token. I'm not sure what the solution to this is

Plus it may still work directly on the page as thinking about it the original did the same thing on my live server. I haven't got a local copy to hand to test it. My production server is protected by mod security which stops it directly on pages.

Hmm, unfortunately I haven't been able to get a local copy running either. I have FastCGI and everything else I think but it still doesn't want to work. It also throws an error mentioning cache and Smarty. Anyway, a cached payload could execute any time a victim loads the page. You could easily steal everyone's session cookie and then log in as them. You could even use window.location.replace() to redirect them to another site, for example a replica site for phishing.

Of course, that's only a risk if it's stored XSS. If it is reflected we only have to worry about someone being tricked into opening a malicious link..

Could always be worse you could own Twitter or be one of the greedy people trying to double their money out of thin air  😂

Could always be worse you could own Twitter or be one of the greedy people trying to double their money out of thin air
Too good to be true springs to mind!

True that! Luckily there are still some good people out there, we need more of them though.
Right now is a terrible time for web-app bugs..but anyway if you have any free time maybe we can try to fix this. I think there is a pretty large attack surface for this parameter, unfortunately, but I think this bug can be fixed easily. If anything you can simply filter any symbols, and only allow uppercase/lowercase letters. That would fix it.

Removing the & symbol would break PHP

Removing the & symbol would break PHP

Couldn't you use some regex to filter dangerous symbols? You could maybe use Ajax to prevent using symbols client-side..

You could use regex to match offending URL's I suppose.

Haha we both thought that at the exact same time.

You could use regex to match offending URL's I suppose.

There are "best methods" for these kinds of things, but I haven't read about them yet. I'm not really used to being a blue teamer haha.

You could use regex to match offending URL's I suppose.

There are "best methods" for these kinds of things, but I haven't read about them yet. I'm not really used to being a blue teamer haha.

The very best hackers start out blue team but that evil money stuff corrupts them!

You could use regex to match offending URL's I suppose.

There are "best methods" for these kinds of things, but I haven't read about them yet. I'm not really used to being a blue teamer haha.

The very best hackers start out blue team but that evil money stuff corrupts them!

Definitely, I think blue teaming is the best experience. I know it is stressful when something like this is found, though, as the blue teamers have to rush to fix it. For me it's bittersweet, I like finding these bugs because it is fun for me and I can get paid to hack legally, but I know that it's not fun for the blue teamers. In this case, I have my own production website of this, so in a way it is kind of funny that we are all on the same boat here, haha.

This deals with something similar and is in
 /_protected/framework/Security/Validate/Filter.class.php

/*
         * URL Decode
         *
         * Just in case stuff like this is submitted:
         *
         * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>
         *
         * Note: Use rawurldecode() so it does not remove plus signs
         *
         */
        $str = rawurldecode($str);

So its just a matter of tweaking this file... Leave it with me till im more awake! Its nearly bed time here nd im half asleep... Not best time for this type of thing!

You could use regex to match offending URL's I suppose.

There are "best methods" for these kinds of things, but I haven't read about them yet. I'm not really used to being a blue teamer haha.

The very best hackers start out blue team but that evil money stuff corrupts them!

Definitely, I think blue teaming is the best experience. I know it is stressful when something like this is found, though, as the blue teamers have to rush to fix it. For me it's bittersweet, I like finding these bugs because it is fun for me and I can get paid to hack legally, but I know that it's not fun for the blue teamers. In this case, I have my own production website of this, so in a way it is kind of funny that we are all on the same boat here, haha.

Yeah I have spent sometime on HackerOne and found a load of issues but somehow the company who own the site always seem to get away with paying the reward as say things like its outside the scope but fix it anyway :/ Think Blue team is more about the satisfaction after you fix something where red team are happy when they break something. Two different types of people!

This deals with something similar and is in
 /_protected/framework/Security/Validate/Filter.class.php

         /*
         * URL Decode
         *
         * Just in case stuff like this is submitted:
         *
         * <a href="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">Google</a>
         *
         * Note: Use rawurldecode() so it does not remove plus signs
         *
         */
        $str = rawurldecode($str);

So its just a matter of tweaking this file... Leave it with me till im more awake! Its nearly bed time here nd im half asleep... Not best time for this type of thing!

 It's afternoon here in U.S.

You could use regex to match offending URL's I suppose.

There are "best methods" for these kinds of things, but I haven't read about them yet. I'm not really used to being a blue teamer haha.

The very best hackers start out blue team but that evil money stuff corrupts them!

Definitely, I think blue teaming is the best experience. I know it is stressful when something like this is found, though, as the blue teamers have to rush to fix it. For me it's bittersweet, I like finding these bugs because it is fun for me and I can get paid to hack legally, but I know that it's not fun for the blue teamers. In this case, I have my own production website of this, so in a way it is kind of funny that we are all on the same boat here, haha.

Yeah I have spent sometime on HackerOne and found a load of issues but somehow the company who own the site always seem to get away with paying the reward as say things like its outside the scope but fix it anyway :/ Think Blue team is more about the satisfaction after you fix something where red team are happy when they break something. Two different types of people!

For me, I enjoy finding them before a cyber-criminal does. Even if I don't get paid I will report it. If it's really severe, I won't report it publicly, obviously.

Please stop reinventing the wheel.
There's nice OWASP sheet on preventing XSS on PHP.
There's already made library that work to sanitize input. They are much more tested than what we can do here.

Please stop reinventing the wheel.
There's nice OWASP sheet on preventing XSS on PHP.
There's already made library that work to sanitize input. They are much more tested than what we can do here.

Exactly. It can probably be fixed using one of the many tried and true methods used by every secure PHP site that has ever existed. Maybe I should have been more blunt in the beginning and said this: 1) Google "XSS Prevention" 2) Click first Google link 3) Use any of the many methods listed boom there you go, simple as that. Thanks, Google!

@polynamaude Why is this not already in place here then?

@Undefined-Variables Good question because there's already half of the Internet as dependecies for library...
There's a sanitizer in the framework itself that is itself a copy of a already written library.
I'll show you where it lives...

https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/master/_protected/framework/Security/Validate/Xss.class.php
https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/master/_protected/framework/Security/Validate/Purifier.class.php
https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/master/_protected/framework/Security/Validate/Validate.class.php
https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/master/_protected/framework/Security/Validate/Filter.class.php
3 of the classes are close to empty and are only extension of the preceeding one, adding some function.
That's what we call a city's contractor job. Looks nice on the plan but when you look in the inside, it gets pretty strange with some strange colored wire.

The main problem is that they use the allow all that's not rejected when it shall instead use the "accept what we are looking for only". Example, if one parameter is a number then you reject all that is not a number. By trying to find "specific xss spices" you risk missing the new ones.

The main problem is that they use the allow all that's not rejected when it shall instead use the "accept what we are looking for only". Example, if one parameter is a number then you reject all that is not a number. By trying to find "specific xss spices" you risk missing the new ones.

Right, it's just a problem with what is blacklisted and whitelisted.

@squelch0 When doing input sanitizing it is not recommended to use the blacklist bad stuff method. Because doing so will require to do update everytime a new method is discovered. When you limit to accepting only what can be logically used and rejecting all else, then you have less to watch for.
Too often people wanna go what they think is the safe route and code all by themselves. But the more you test, the more chance you have to find both bugs and breach. So by using external library you can easily get the advantages of having a bigger base for testing.
As for this software, if we use a in-house code to do sanitizing then only the user of this software will be testing it. If we use a external library, we may have hundres, even thousands of people doing the tests.
https://owasp.org/www-community/xss-filter-evasion-cheatsheet
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
https://owasp.org/www-project-cheat-sheets/
This look like a pretty active library...
https://github.com/leizongmin/js-xss

https://cheatsheetseries.owasp.org/Glossary.html

@squelch0 A simple example of why to use whitelisting is the grave accent escaping for XSS. Also when you are working with specific type of data, you can always play safe by doing type casting.
example :
x = (int) data

https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html

@squelch0 I'd say simply that this is part of good programming. When you work on big project, with many developers, you have some coding standard that are enforced by team manager and code revisor. The following are example of rules that must be followed (those are common rules that most project enforce)

Your variables must be named following to specifications (CamelCase, if possible a descriptive name).
Your code must be documented.
Your variables must have the least visibility possible that allow the algorithm to work properly.
Your variables must have the most limited type possible that allow the algorithm to work properly.
Your code must check for bound violation when doing operation on variable that are subject to such problem (go over 65535 and go back to 1).
Everything that is allocated must be freed.
Don't cast alphanumerics into integer or the opposite.
... etc

So the whitelisting approach is just part of the global.
Many years ago we didn't have much to think about security so some programming tricks we're done to make thing go faster. Now those same trick can cause us problem because there's not only the user in front of the computer that can give order to the software, there's also thousands / millions of other user on the network.
If you want a nice story relating to the risk of bad software verification procedure
https://en.wikipedia.org/wiki/Therac-25
There was dead people in this one...
And the story about the Ariane 5 first launch is pretty bad too. They re-used part of the code of the previous launcher. But Ariane 5 does a different trajectory than Arianne 4 and is a bit heavier. So the computer did a overflow on one variable, went thinking that the rocket was off course when it was going exactly where supposed. So it engaged the "self destruct" mode and blew itself.... The story is a bit more complex about the self-destruction but it's something related to reusing old code without validating...

Thanks you for the excellent information & tips, those are things that every programmer needs to learn. My first programming language was C, so what you said about freeing anything allocated is music to my ears. Is it correct to say #5 is concerning stack-overflow while #6 is concerning heap-overflow?
Very sad tragedy, but also fascinating. All it takes is one insecure, outdated function to cause these problems. And all too often these insecure, outdated functions are used for decades before anyone realizes they have privilege escalation or code execution vulnerabilities.

Sorry guys I have been super busy! I still don't see a solution to this so will have a proper look today!

Okay... Just installed a local version to test this properly and the good news is this doesn't work directly on pages (reflected). The only way I can get this to do anything worth worrying about is on a live server running Apache that is using nginx engintron which integrates nginx as a reverse caching proxy sitting in front Apache.
When used with this set up you get the 404 as normal and only has effect if you purge cache from cmd line as root.
Think this is cached and not escaped when you are purging as system assumes you are not trying to hack it as you are root. I can see this being something that may catch someone out if a malicious script is set and awaiting for an admin to purge cache so I have reported this to nginx's dev team.
Most important thing is the software is secure for the time being :)

@squelch0 just had the same issue with version 16.0.0. beta 2 There is a template error in _install I just swapped _install for an earlier version.

@squelch0 just had the same issue with version 16.0.0. beta 2 There is a template error in _install I just swapped _install for an earlier version.

I use 15.4, but it won't work on my local server. I could try an earlier one than that

@squelch0  yeah 16 has a lot of bugs just hit another one.

Turns out the problem is when you unzip on windows all the folders are moved but the files are left behind, I gave 16.0.0 working now, maybe you done the same thing?

Can we please stop talking about Smarty ? This doesn't use smarty even if it has a similar syntax for templating.
It's like saying the Spanish is Portuguese or that French is English because they share same words sometime.

I know it can be quite confusing... @Undefined-Variables is absolutely right.
Only the installation wizard uses Smarty, because it used to be a standalone tool I initially built separately for different projects, and then reused for pH7CMS.
That's why the installer uses Smarty (for legacy reasons mentioned above), but the rest of the whole software uses pH7Tpl (you right @polynamaude). The installer is usually removed once the software is installed. At that point, we can say that there is no Smarty anymore!

You get A smarty template error. I will see if I can reproduce it and upload a screenshot.

This would be awesome @Undefined-Variables
I reinstalled a new version from scratch and there was no error :(  Since I cannot replicate the problem, a screenshot or an error log would be really helpful!!

@Undefined-Variables And sorry, I have been really busy lately, so I couldn't help much around for the past weeks.

@pH-7 im also having problems trying to get this to throw the error again, perfect install every time. There is a way to mess the install up and you get a yellow error box with a Smarty error.
What was the reason you decided to create your own template system? I like pH7Tpl and its simpler than Smarty but do wonder what the reason to do your own engine was as this was a lot of extra work...

@Undefined-Variables Hi !
I could answer for him...
It wasn't that much work. The nice thing with object based and design pattern is that you can reuse what you develop in different settings. And honestly, writing such a templating system is a week or two, at most, when you do the correct planing from the beginning.
It's nothing more than a huge "Regular Expression" parser...
Nice reflection... sorry trying to joke around with "Reflected" ;-)

I see what you are saying... By putting the effort in at the beginning with careful plaining of course the job only needs doing once and from then on it will benefit you, improve workflow and make life easier too!

@pH-7 im also having problems trying to get this to throw the error again, perfect install every time. There is a way to mess the install up and you get a yellow error box with a Smarty error.

Thanks very much. Okay, so that's good news if we cannot reproduce that Smarty error anymore. I will then go ahead releasing v16 🎉

What was the reason you decided to create your own template system? I like pH7Tpl and its simpler than Smarty but do wonder what the reason for designing and creating your own template engine was, this was clearly a lot of extra work...

@Undefined-Variables Great question!! Indeed, we shouldn't reinvent the wheel. I could just use Twig or Smarty. However, at that time (10 years ago when the first pH7Tpl came up), I was really focus deeply in lexical and syntactic parsers and analyzers, and I just also wanted to build a template language for my framework. It was more a personal challenge :) FInally, most of the template languages out there (except Smarty) were just an interpreter, and not a lot of them compiled the template language into PHP code,and optimized and stored them as cached files.
The goal with pH7Tpl was to build a really fast and lightweight template language, that can stores all compiled files as long as the source tpl files aren't modified, and with the least  regular expressions (since it slows the performance and ugly)

@Undefined-Variables Hi !
I could answer for him...
It wasn't that much work. The nice thing with object based and design pattern is that you can reuse what you develop in different settings. And honestly, writing such a templating system is a week or two, at most, when you do the correct planing from the beginning.
It's nothing more than a huge "Regular Expression" parser...
Nice reflection... sorry trying to joke around with "Reflected" ;-)

I wouldn't agree with it... Yes, it can take two weeks to ship the first version, but it doesn't mean it's always easy, depending on how fancy and how many features you want in your language.
If you want to build a very simple one, yes of course that's possible. However, if you want to create a production template language, it takes much more time.
First of all, you have to design the template language. pH7Tpl has also involved a lot, and the syntax is now smoother than before. If you want to make sure that it behaves as expected, unit tests are inevitable. For example, just for pH7Tpl tests, I think it took me two days or so to accomplish all of them (there are many files) https://github.com/pH7Software/pH7-Social-Dating-CMS/tree/master/_tests/Unit/Framework/Layout/Tpl/Engine/PH7Tpl
It's not as simple as it looks like, although a very simple template language can be made in 2 hours.

This is really out of topic, but since we are speaking about programming languages and parsing, my favorite book of all time was the Dragon compilation book https://www.amazon.co.uk/Compilers-Alfred-V-Aho/dp/0321486811

Oh, the book has also a Wikipedia page :) https://en.wikipedia.org/wiki/Compilers:_Principles,_Techniques,_and_Tools

@Undefined-Variables Hi !
I could answer for him...
It wasn't that much work. The nice thing with object based and design pattern is that you can reuse what you develop in different settings. And honestly, writing such a templating system is a week or two, at most, when you do the correct planing from the beginning.
It's nothing more than a huge "Regular Expression" parser...
Nice reflection... sorry trying to joke around with "Reflected" ;-)

@polynamaude I wouldn't really agree with it... Yes, it can take two weeks to ship the first version, but it doesn't mean it's always easy, depending on how fancy and how many features you want in your language.
If you want to build a very simple one, yes of course that's possible. However, if you want to create a production template language, it takes much more time.
First of all, you have to design the template language. pH7Tpl has also involved a lot, and the syntax is now smoother than before. If you want to make sure that it behaves as expected, unit tests are inevitable. For example, just for pH7Tpl tests, I think it took me two days or so to accomplish all of them (there are many files) https://github.com/pH7Software/pH7-Social-Dating-CMS/tree/master/_tests/Unit/Framework/Layout/Tpl/Engine/PH7Tpl
It's not as simple as it looks like, although a very simple template language can be made in 2 hours.

Yeah I have had a good look at the code and can see it is not something thrown together quickly. Thanks for explaining, I found your reasons interesting :)


ResetAssistedSetup doesn't take filter into consideration

Summary
The ResetAssistedSetup function does not take filter into consideration in the final modification.
Work Item(s)
Fixes AB#524168

Closing as the newest commit took forever to push


Why the filepond not work as simple file type input

Is there an existing issue for this?

[X] I have searched the existing issues

Have you updated FilePond and its plugins?

[X] I have updated FilePond and its plugins

Describe the bug
Hi Filepond,
Very very URGENT
I am creating the file type input field which is looks like
< input type="file" name="jform[com_fields][logo-details-bd]" id="jform_com_fields_logo-details-bd" class="form-control filepond">
I have added the class in this field "filepond" it's replacing my filetype field that is ok but when I submit the form, I am not getting my file will you please explain me why it's happening
Thanks
Preetam kumar joshi
Reproduction
< input type="file" name="jform[com_fields][logo-details-bd]" id="jform_com_fields_logo-details-bd" class="form-control filepond">
I am getting my files in PHP i am using JOOMLA framwork
$uploads = $this->input->files->get('jform');
but the only file which is I upload in "jform[com_fields][logo-details-bd]" this field which is filepond type field not getting in php
Please please help, It's relly super urgent
Environment
- Device: Laptop
- OS: windows8
- Browser: Chrome

This is a free product, and the issue tracker is not a support desk, as requested in the issue template please ask questions on stack overflow → https://stackoverflow.com/questions/tagged/filepond


[PLC] [Builtins] Made the sum and product 'KnownDynamicBuiltinType' instances pure

This removes all the unsafePerformIO nonsense from dynamic builtin types. Yay!
Also fixes a couple of bugs and adds the funny KnownDynamicBuiltinType (() -> a) instance.

Much nicer.


Support DataLakeStorage 11-09-18 Version.

Latest improvements:
MSFT employees can try out our new experience at OpenAPI Hub  - one location for using our validation tools and finding your workflow.

Contribution checklist:

[ ] I have reviewed the documentation for the workflow.
[ ] Validation tools were run on swagger spec(s) and have all been fixed in this PR.
[ ] The OpenAPI Hub was used for checking validation status and next steps.

ARM API Review Checklist

[ ] Service team MUST add the "WaitForARMFeedback" label if the management plane API changes fall into one of the below categories.
adding/removing APIs.
adding/removing properties.
adding/removing API-version.
adding a new service in Azure.

Failure to comply may result in delays for manifest application. Note this does not apply to data plane APIs.

[ ] If you are blocked on ARM review and want to get the PR merged urgently, please get the ARM oncall for reviews (RP Manifest Approvers team under Azure Resource Manager service) from IcM and reach out to them.
Please follow the link to find more details on API review process.

Automation for azure-sdk-for-js

Automation for azure-sdk-for-python

Automation for azure-sdk-for-ruby

Automation for azure-sdk-for-node

Link to the PR from private Repo: https://github.com/Azure/azure-rest-api-specs-pr/pull/628

Automation for azure-sdk-for-go

Automation for azure-sdk-for-java

Can one of the admins verify this patch?


Add support for variable substitution in @media parameters

This specifically calls out media at-rules and runs the existing variable substitution step against its parameters.

Brilliant.


Allow focus restoration to be disabled for Bottom Sheet just like dialog

Bug, feature request, or proposal:
Feature request
What is the expected behavior?
To be able to disable the focus restoration for the bottom sheet component just like the dialog component https://github.com/angular/material2/pull/12519
What is the current behavior?
restoreFocus config doesn't exist on Bottom Sheet
What is the use-case or motivation for changing an existing behavior?
This is a useful feature to have and keeping it consistent with the dialog config options
Which versions of Angular, Material, OS, TypeScript, browsers are affected?
7.0.0-beta.0

Man that was quick :)


Fix Haxe path resolving from SDK

Fix Haxe path resolving from SDK

Discovered that is outputs mostly haxe and sometimes I that if Haxe SDK is not set up properly, like invalid file path, plugin would not check if file exists or not

So, why is it a bug in the plugin code if the user inputs an incorrect path?  If we check this path at this point, and find that it doesn't exist, then we're going to try and run whatever the default haxe is, and not tell the user, which is a bad thing -- and can lead to subtle errors if the wrong compiler is used. So...
We should check whether the file exists when the user adds the command to the SDK (in the dialog code), and at this point, if there is a setting, but the file doesn't exist, we should put an error in the status bar at the bottom of the screen, put an error message into the system event log, and throw an error so that the completion continues to fail.
Is there a bug filed for this?

And, I guess that the subtle bugs are why you saw this as an issue in the first place.  Maybe defaulting to 'haxe' is a bad thing to do in this function.
We should detect that at some other point -- maybe when we load the haxe settings for the first time: perhaps, HaxeSdkDta.loadState().


Refactor: Language selection disappears from homepage when returning to the page

[x] Make language selection persist on homepage

It isn't regularly visible once leaving it.
Here, the language selection appears on the first return to homepage but not on the second.
Same issue for desktop and mobile
https://github.com/user-attachments/assets/e8180508-219b-4bf7-8ccb-9861d92e73c4

@jbeard4 I want language selection to be available on all pages.

fixed otherwise


Clean up the Benchmarking and Testing Libraries

Summary
Currently we have rudimentary benchmarking and testing libraries as part of Base. As part of #1231, however, they are moved to their own library, Test. In order to be able to release them with the standard library we need to ensure that we are happy with their APIs and their documentation.
Value
We will be able to release the benchmarking and testing libraries.
Specification

[x] Move them to the correct package, as described in #1231.
[ ] Talk to @kustosz about the API, and make any requested changes.
[ ] Add a summary printout at the end of the test suite, showing the specs executed, and summarising any failures. It should be similar to scalatest.
[ ] Add a summary printout at the end of the benchmark suite, showing the benchmarks executed and a summary of their results.
[ ] Add functionality for nesting describe blocks in the testing library.
[ ] Add a regression framework to the benchmarking library, to catch performance regressions. This should use the same definition of a regression as the framework we have in Scala.
[ ] Ensure that the API is well documented, including comprehensive examples in the documentation.

Acceptance Criteria & Test Cases

[ ] The basic benchmarking and testing libraries are ready for release.

Things I'd like:

Spec autodiscovery (see Tests.Main for an explanation of why that's needed...) – this will require the meta-stuff to be able to dynamically import modules, so probably also requires wiring the incremental compiler back into Enso.
Running benchmarks in forked JVMs. Without it the benchmarks are order dependent and generally unreliable. Needs careful design.


Data Request Physical Parameters - Labelling choices and options

Themes:

Ocean & Sea-Ice

Description
There are many variables for which choices are specified: output A or B depending on model physics/configuration. There are also variables which should only be produced under certain conditions. Such options and choices should be made more visible. Some of them are listed in this query,

From an email chain.
From Martin
There have been a couple of questions about how we handle conditional elements of the request. One from Marie-Pierre a week or two back and more recently from Anne-Marie.
There were 25 variables in the CMIP6 data request which had a conditional element:
4 associated with different numbers of pressure levels.
21 associated with choices depending on model configuration/physics.
These are listed in https://clipc-services.ceda.ac.uk/dreq/index/varChoiceLinkR.html and https://clipc-services.ceda.ac.uk/dreq/index/varChoiceLinkC.html. Many of these conditions are inherited from the CMIP5 Standard Output workbook, where they were referred to in the "comment" text for each variable.
The table in the baseline variables paper contains, I hope, information which is consistent with the CMIP6 request.
We took the explicit references to these conditions out of the CMIP7 database structure because we felt that it added too much complexity. The CMIP6 approach included extra tables to describe the choices. The advantage of this approach is that you can easily link to the tables (links above) to see a full list, but the attempt to make the whole process machine operable made it too complicated.
I can see 3 options:
Return to the CMIP5 approach and describe these options in the existing "Processing Notes" column.
Add an extra column for this information, as Eleanor suggests.
Add two extra columns: one for the explanation and a 2nd to link to related variables.
2 & 3 involve modifications to the database schema but would still be significantly simpler than what was done in CMIP6. 1 & 2 would refer to related variables by name in the text. This carries the risk of becoming ambiguous if variable names are revised. Option 3 provides a more robust link to related variables as well as the convenience of a link to follow to the related variables in the web interface.
Chloe
So thinking through these options, I'd like to suggest an additional potential option that hopefully sits somewhere in the middle:
We add a Boolean column called 'conditional', and then put the condition description into the 'processing note' (clearly indicated as 'Condition: ..."
I don't know if full variable linking (option 3) is necessary, and there is a reason it was pulled in the move to airtable.
This 'conditional' column would make it easy for people to see whether there is a condition to check on, and allows for filtering for conditional variables collectively, but is less onerous and confusing than 2 whole extra columns.

I've added a "Conditional" column to the physical parameters table, and added entries for bigthetao (and variants) , msfty (and variants), hfgeo and hfgeobed.
There are many more to add which are referred to in the links above and in processing notes.


886 update derive disposition reason

close #886.
Thank you for your Pull Request! We have developed this task checklist from the Development Process Guide to help with the final steps of the process. Completing the below tasks helps to ensure our reviewers can maximize their time on your code as well as making sure the admiral codebase remains robust and consistent.
Please check off each taskbox as an acknowledgment that you completed the task or check off that it is not relevant to your Pull Request. This checklist is part of the Github Action workflows and the Pull Request will not be merged into the devel branch until you have checked off each task.

[x] Code is formatted according to the tidyverse style guide
[x] Updated relevant unit tests or have written new unit tests - See Unit Test Guide
[x] If you removed/replaced any function and/or function parameters, did you fully follow the deprecation guidance?
[x] Update to all relevant roxygen headers and examples
[x] Run devtools::document() so all .Rd files in the man folder and the NAMESPACE file in the project root are updated appropriately
[x] Address any updates needed for vignettes and/or templates
[x] Update NEWS.md
[x] Build admiral site pkgdown::build_site() and check that all affected examples are displayed correctly and that all new functions occur on the "Reference" page.
[x] Address or fix all lintr warnings and errors - lintr::lint_package()
[x] Run R CMD check locally and address all errors and warnings - devtools::check()
[x] Link the issue so that it closes after successful merging.
[x] Address all merge conflicts and resolve appropriately
[x] Pat yourself on the back for a job well done!  Much love to your accomplishment!

@bundfussr Hi Stefan, thanks for the review. All the suggested part has been updated. I also updated other code parts in the header of R file that does not have backticks. Please check to see if they are ok. thanks!

can you run devtools::document to see if R-CMD latest check resolves itself.  It is falling over and I am not quite sure why

Hi Ben,
I ran both devtools::document() and devtools::check() locally. They seem fine to me.

Can you add hms to this file for importfrom lubridate and rerun devtools::document() and push up

Hi Ben, done as suggested .

fingers crossed

Hi Ben,
R-CMD-check runs fine on github a couple of days ago. The recent branch updates only touched a few documentation such as  help manual, vignette and NEWs. Not sure how NAMESPACE in importFrom get impacted now on the github R-CMD-check whereas devtools::check() runs fine locally.
I also noticed R-CMD-check failed for other PR on github with similar reason (#776). Maybe some other reason leading to the error ?

Thank you, Stefan and Ben!
Update is completed based on the suggestion.

@bms63 , could you merge this PR using admin privileges?

Look at all those green checks!

@bms63 , that's great but we still have the issue that there are two R 3.6 checks and the required one does not run. This happens even in very recent PRs like https://github.com/pharmaverse/admiral/pull/1098. Any ideas?

It is on my list! :)  Hopefully an easy fix!


Check SHA-256 checksum of the artifact in setup action

I propose to check the checksum of the artifact in the setup action. This validation prevents malicious executable to be installed caused by supply chain attacks. However, this improvement makes version update quite difficult to be automated. When you update the version, new checksums need to be appended to the checksum file (keep existing checksums to support older versions). What do you think?

@itchyny
Proposed Thank you.
I agree that it’s important to consider supply chain attacks when downloading artifacts. However, I don’t think that sver-action holding checksums is ultimately a reliable way. It would be better to pass checksum as an argument of sver-action@setup and verify it when the user specifies the checksum.
Would this response meet your request with this kind of response?
example)
- uses: ./.github/actions/setup_sver
  with:
    os: linux
    version: v0.1.14
    sha256sum: 407875b9e2263fb3ca94a6be166cd280f92404f01b1a00989a6deec441635706

Yeah, the issue can be resolved in that way, too.

@itchyny
I have released a fix for #9 in response to this Pull Request.
Thank you for your proposal.


ubuntu 24.04 freezes with ocamlfuse

I've been using Ocamlfuse for more than 1 years, and while it was successfully installed on Ubuntu 22.04, I experienced constant system freezes. Hoping for a resolution, I upgraded to Ubuntu 24.04 and ran a week-long test with just basic applications like VS Code to use my GPU. Everything worked fine without ocamlfuse for a week. Unfortunately, the issue came back as soon as i installed ocamlfuse- my system became unstable again.
In my previous setup with Ubuntu 22.0, I suspected the Bluetooth module might be the culprit, so I kept it disabled. But that did not resolve my freezing issue.
However, my lack of debugging expertise makes it difficult to pinpoint the exact cause.
I'm reaching out to the community for any suggestions or potential solutions to this Ocamlfuse-related hanging issue on Ubuntu 24.04/22.04. Any insights would be greatly appreciated!

I just started having a similar problem with 18.04 which until the last couple of works was working relatively well.
Specifically, until a couple of weeks ago, google-drive-ocamlfuse would stop working every few days but the problem was limited to the drive -- i.e., I could unmount and/or kill the google-drive-ocamlfuse process and start again.
For the past couple of weeks, when google-drive-ocamlfuse fails, it effectively locks up my system in that I can no longer login again or if I am logged in again, I can't use sudo to get root privileges.
If I have an existing login process, I can kill google-drive-ocamlfuse and resolve the problem but if I have no open login, then I am effectively shut out -- I can neither ssh or login from the console (whether using X or using one of the virtual consoles).
The machine otherwise seems to continue running in that I can ping the computer, it receives emails, and I can even access the web server. Only login and sudo are effected...


Add upload to (S)FTP/S3 option

If pulling my static site through fastatic is the last step of my development process, I probably want to deploy the site after that. Having an option to automatically upload all files to a folder on an (S)FTP, or S3 bucket, is probably very useful

Shouldn't each tool just do one thing and do that well? The app's UX is currently extremely simple. The more options we add, the more complexity we add. Both in code and UX. From CONTRIBUTING.md:

The aim of this project is to allow developers to make every static website as fast as possible, with just one command: fastatic. Fastatic must work-out-of-box with zero configuration required. If a new feature does require configuration it must be on opt-in basis.
Contributions should be aimed towards this and / or improve the development workflow.

Ah yeah this was supposed to be in fastatic-app :)


-sourcemap-output path containing spaces in Xcode projects results in no sourcemaps

Description
See https://github.com/facebook/react-native/pull/40937
Fix is already provided, needs to be merged.
React Native Version
0.71.0
Output of npx react-native info
https://github.com/facebook/react-native/pull/40937
Steps to reproduce
See https://github.com/facebook/react-native/pull/40937
Snack, screenshot, or link to a repository
Fix provided in https://github.com/facebook/react-native/pull/40937.  Needs to be merged.

See also:

https://github.com/facebook/react-native/issues/41844
https://github.com/facebook/react-native/pull/41845

Closing as fix has been merged in 0.74.x


Updating comments.

It should be True instead of true.
A user can write true by modifying the argument "False" in lines 18 and 24 . However that wont work , because the right keyword is "True". Hence the proposed change.

You have a point, but if we're going to do it for the Python 2 flavor, we really need to it for Python 3 too before I can merge this

Yes , you are right . It skipped my mind because i generally use just python2 . I have created a new pull request with the changes in both files.


[New Game]: AI Chess Game

DESCRIPTION
The game provides a basic chess interface where a human player can play against an AI opponent. The AI is programmed to make legal chess moves and provide a challenge to the player.
Functionalities 🎮
The game is designed using Html, CSS, and javascript.

Closing this as exists #1075


Use of generic parameter defaults makes other generic parameters fall back to their defaults, too

TypeScript Version: 3.7.2 & vNightly
Search Terms: inference, infer, string literal, generic
Problem
The behaviour can be observed in a generic method using defaults for its type parameters.
If one generic type parameter uses its default (see TType = void), other parameters stop inferring known types (see TGreeting extends string = string) and use the defaults, too.
Code
The method below takes a string-Parameter and treats it as string-literal-type.
function greet<TType = void, TGreeting extends string = string>(
  type: TGreeting
): { greeting: TGreeting; type: TType } {
  return "" as any; // fake implementation
}

// string literal is inferred.
const literalInferred = greet("Hallo");

// string literal is lost.
const literalNotInferred = greet<number>("Hello");

Expected behaviour:
I expected TypeScript to infer as many types as possible.
const literalNotInferred = greet<number>("Hello");
//    ^ property greeting is of type 'Hello' ✅

Actual behaviour:
Currently, Typescript uses the default for each generic parameter unless it would be possible to be more precise.
const literalNotInferred = greet<number>("Hello");
//    ^ property greeting is of type string ❓

Playground Link:
https://www.typescriptlang.org/play/index.html?ts=3.8.0-dev.20200101#code/GYVwdgxgLglg9mABAcwE4FN1QDwBVcCeADuogLyIBucMAJgDSK4DiGWMYyi6AHlOmFoBnREKioOXCmImcAfAAooxdAC4mrTLE4BKdQG8UbbcnUtjkxspJnCJRAF9E+gLAAoRJ8QYoIVEgByAMQAQxEQsAIAbncHd3cAegTRcUlEABsYflQQ9MQYEQ5gdFQMWgA6dwgEMQysktyASTBi0vRaciMtBQCACVz0uACdGLdE5Jk0zOzc-JFBsUq3arBa6Yb0gDk4KGbWss60LWwwEABbACMSxT70dMHhqKA

This is the behavior we shipped with and it can't really be changed now without incurring massive breaks.
Alternatives are at #26242 and #10571

Thank you very much for the answer.
The alternatives look very promising.
I was able to get around this by providing multiple function overloads.
Closing this issue, since this topic is covered by #26242 and #10571.


[Doc] Page titles of the REST API docs need to be rephrased to improve clarity

Background
In order to improve clarity, the page titles of the REST API docs of the following spaces should be updated.

530
540
541
550
560
570
580

Related Mails
[Doc] Identity Server REST API documentation

Updated the page titles and the introductory paragraphs to improve clarity.


"Billing Accounts - List" returns empty list for api version 2020-05-01

Link to sample
https://learn.microsoft.com/en-us/rest/api/billing/billing-accounts/list?view=rest-billing-2020-05-01&viewFallbackFrom=rest-billing-2021-10-01
Library name and version
com.azure.resourcemanager:azure-resourcemanager-billing:1.0.0-beta.3
Language of the Sample

[ ] C#/.NET
[X] Java
[ ] JavaScript/TypedScript
[ ] Python
[ ] Golang
[ ] Other - Please specify in Issue details field

Sample Issue Type

[X] Sample not working
[ ] Sample missing
[ ] Do not understand sample

Issue details
Getting empty billing account list when using api version 2020-05-01, both using REST and the billing sdk.
Able to retrieve account list using version 2019-10-01-preview.
Expected behavior
Expecting to get billing account list when using sdk method and\or HTTP endpoint
Actual behavior
Getting empty billing account list
Reproduction Steps
TokenCredential credential = new ClientSecretCredentialBuilder().clientId(credentials.getClientId())
                                                                            .clientSecret(credentials.getClientSecret())
                                                                            .tenantId(credentials.getTenantId())
                                                                            .build();

            AzureProfile profile = new AzureProfile(credentials.getTenantId(), null, AzureEnvironment.AZURE);

            BillingManager billingManager = BillingManager.authenticate(credential, profile);

            retVal = billingManager.billingAccounts().list().stream().collect(Collectors.toList());

Environment
Java 8 dropwizard

Hi @RaniLinkov , this may be due to lack of permission. See https://github.com/Azure/azure-rest-api-specs/issues/21580#issuecomment-1340448613
2019-10-01-preview might not enforce permission on reading while 2020-05 might have.
Would you try adding sufficient role/permission to your service principal and try again?


Request: Add logic for handling Modifiers

No "issues", this is a great template to get started and save us Developers some time. However, the variant-selector component is coded to handle variant options very well and even renders options for modifiers however it does not handle the fact modifiers are not "available for sale" and also doesnt allow you to add any product to cart that has a modifier.
TLDR;  Please add logic for handling modifiers within variant-selector component and add to cart functionality.

Thanks for the request @ll-r-magner 🙇
I'll bring this back to the team!

hi @ll-r-magner

doesnt allow you to add any product to cart that has a modifier

can you please add more details about this or screen shot? for example I'm able to add this product to cart with options I've selected:


Unclear how the u-root argv override works

Previously, passing uroot.uinitargs to the kernel command line made stboot pick up this exact cmdline argument.
Now, it's the buildsystem passes HOST_CONFIG_ARG and ST_STBOOT_ARGS to the command line, which has precedence over the kernel command line.
This is poorly documented. :-(

My bad, we have merged the last PR #160 without adapting the documentation :/
Adapting the request #154 changed this behavior. Let me check if we could support both ways of setting stboot args and update the documentation.

It looks like migrating the GNU Make Linux kernel to taskfile introduced a regression with a silent error...
PR #160 should fix this issue.
In addition, I added a precondition to prevent defining stboot args via config and kernel parameter simultaneous.

#168 fixed the regression and updated the documentation accordantly.


Pin requirements

requirements.txt is generated using a Python 3 virtualenv to keep the py2 backports of Python 3 stdlib packages (like enum34 and ipaddress) out. This leaves those packages unpinned, but shouldn't cause any issues otherwise.
Reorganize Makefile and requirements files
Renames requirements.txt to requirements-app.txt and requirements_for_test.txt to requirements-dev.txt.
Removes any unused dependencies or dependencies provided by other packages since those will be listed in the full requirements.txt.
Updates Makefile to add freeze-requirements and rename targets to be more consistent with other apps.
(see alphagov/digitalmarketplace-api#615 for details)

I'm a bit confused about the "to keep the py2 backports of Python 3 stdlib packages (like enum34 and ipaddress) out" part.
enum34 is in the requirements.txt, but ipaddress is not. So how does ipaddress get installed for Python 2 now, assuming it's needed?

@galund oh yeah, enum34 is being installed even under python3 because we haven't upgraded the apiclient version (which would make it a conditional requirements) on all frontend apps. Since it seems to run without issues on Travis I'll leave it as is for now until we move the apps to Python 3.
requirements.txt doesn't limit the list of packages that can be installed, it just specifies the ones that MUST be installed. So if there's a dependency that's not listed it will still get installed, but the version will be whatever the package pulling it in asked for (which is usually unpinned). ipaddress is a conditional dependency of one of the app dependencies, so it only gets installed on pyhon2, which is why it's missing from requirements.txt generated from a python3 virtualenv.

What's weird about this is I definitely had problems with enum34 on travis at some point. But there was a specific point version of Python 3 that had the problem, and maybe the travis system has been upgraded now.


Documentation bad on Firefox

📖 Documentation
Thanks for this awesome package.
Unfortunately the UI of the docs is not appropriated to Firefox (107.0) on MX Linux as you can see in the screenshot below:

Icons are too big. Hopefully it's an easy fix.

It looks to me as if no CSS has been loaded at all. Could you check again with all plugins disabled? I suspect that a plugin might block the CSS request (and maybe others).
I'm on Firefox myself and do not see this problem.

Ok it now works. No idea why it was not working earlier.


Fixing inotify notifications for async worker.

Codecov Report

Merging #402 (174ef63) into master (da36bce) will increase coverage by 0.06%.
The diff coverage is 92.30%.

@@            Coverage Diff             @@
##           master     #402      +/-   ##
==========================================
+ Coverage   71.71%   71.77%   +0.06%
==========================================
  Files         463      463
  Lines       15531    15533       +2
==========================================
+ Hits        11138    11149      +11
+ Misses       4393     4384       -9

Impacted Files
Coverage Δ

app/async/Notify.php
18.60% <ø> (+3.38%)
:arrow_up:

app/V1Module/presenters/SubmitPresenter.php
83.33% <75.00%> (-0.76%)
:arrow_down:

app/V1Module/presenters/AsyncJobsPresenter.php
81.25% <100.00%> (-0.39%)
:arrow_down:

app/async/Dispatcher.php
76.19% <100.00%> (+23.80%)
:arrow_up:

app/async/Worker.php
63.01% <100.00%> (ø)

app/async/handlers/PingAsyncJobHandler.php
83.33% <100.00%> (+8.33%)
:arrow_up:

app/async/handlers/ResubmitAllAsyncJobHandler.php
73.68% <100.00%> (+8.97%)
:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update da36bce...174ef63. Read the comment docs.


statically linked custom transforms demo

Not for reviewing or merging, just for demonstrating a working demo of statically linked custom transforms.

Everything demonstrated in this PR has now been landed separately, so it can be closed.


Is dragSelection in the regions plugin supposed to be an object or a boolean? Conflicting examples/docs

In the 2.0.6 regions plugin file, there's this comment:
/**
 * @typedef {Object} RegionsPluginParams
 * @property {?boolean} dragSelection Enable creating regions by dragging wih
 * the mouse
 * @property {?RegionParams[]} regions Regions that should be added upon
 * initialisation
 * @property {number} slop=2 The sensitivity of the mouse dragging
 * @property {?boolean} deferInit Set to true to manually call
 * `initPlugin('regions')`
 */

It says that dragSelection is a boolean. But in this example file (showing how to use the regions plugin), it has this code:
dragSelection: {
  slop: 5
}

The latter syntax is also seen in this file from this page - which I think might be an earlier version of the above app.js file?
Also, slop doesn't seem to be documented here.
These aren't huge issues, just figured I'd let you know. Thanks for the great lib!

@josephrocca thanks for the feedback. Can you make these changes and open a pull request?

@josephrocca see https://github.com/katspaugh/wavesurfer.js/blob/master/src/plugin/regions.js#L680, it's either a boolean (you get all default values) or an object where you can use slop etc.

Will make the necessary changes and send you pull request


Revert "Replace decorate with decorateAction"

Reverts #3538
Sorry, I overlooked this one. The thing is, decorate was introduced and decorateAction deprecated (not formally though) in #3352
@fvilers docs for stable version are here: https://github.com/storybooks/storybook/tree/release/3.4/addons/knobs

@Hypnosphi Sorry about that, I was using the latest version and couldn't find decorate. I should have look  at the source history.


Can be pushed h264 to live stream

Now I try using this library to live stream. Could you give me some advice?

@truongnguyenptit if you want to send clips to h264 then first get clip using getClipAtIndex, change media codec to h264 or 265 then send to rtmp server, use FFMPEG for this, something like bellow -
ffmpeg -re -f lavfi -i mediaClipSource -c:v libx264 -b:v 1600k -preset ultrafast -b 900k -c:a libfdk_aac -b:a 128k -s 1920×1080 -x264opts keyint=50 -g 25 -pix_fmt yuv420p -f flv “rtmp://p.ep246802.i.akamaientrypoint.net/EntryPoint flashver=FMLE/3.020(compatible;20FMSc/1.0) live=true pubUser=username pubPasswd=password playpath=dclive_1_1@246802

change mp4_muxer to rtmp push feature

you need build rtmp library, add cmake build

Thank you @wlanjie , @badcodercpp for your feedback.
I custom Camera1 and I tried to encode from the SurfaceView (TrinityPreviewView). I pushed data to live stream server success. But the viewer can not see any filter applied to the face (only see the face). So could you show me, which method contain byte array has a filter applied?

You need to use the h264 encoded by camera_record.cc to push the stream, not the preview in the preview. The preview stream is the original camera stream and has no effect.

Thank you for your response @wlanjie
I read camera_record.cc and I see it return ByteArray in this method drainEncoderFromNative. Right?

Here the texture is sent to the encoder for encoding

Thank you so much. I try my best

Hi @wlanjie
I follow
        encoder_->Encode(static_cast<uint64_t>((getCurrentTime() - encode_time_) * speed_),
                texture_id);
    }```
in camera_record.cc
I found you wrote callback from c++ to kotin
`drainEncoderFromNative`
in ```int MediaEncodeAdapter::DrainEncodeData() {``` (file media_encode_adapter)

Continue I tried parse sps and pps from ByteArray

`private fun drainEncoderFromNative(data: ByteArray): Int {` in file TrinityRecord.kt

my code decode sps and pps from buffer
```public Pair<ByteBuffer, ByteBuffer> decodeSpsPpsFromBuffer(ByteBuffer outputBuffer, int length) {
    byte[] mSPS = null, mPPS = null;
    byte[] csd = new byte[length];
    outputBuffer.get(csd, 0, length);
    int i = 0;
    int spsIndex = -1;
    int ppsIndex = -1;
    while (i < length - 4) {
      if (csd[i] == 0 && csd[i + 1] == 0 && csd[i + 2] == 0 && csd[i + 3] == 1) {
        if (spsIndex == -1) {
          spsIndex = i;
        } else {
          ppsIndex = i;
          break;
        }
      }
      i++;
    }
    if (spsIndex != -1 && ppsIndex != -1) {
      mSPS = new byte[ppsIndex];
      System.arraycopy(csd, spsIndex, mSPS, 0, ppsIndex);
      mPPS = new byte[length - ppsIndex];
      System.arraycopy(csd, ppsIndex, mPPS, 0, length - ppsIndex);
    }
    if (mSPS != null && mPPS != null) {
      return new Pair<>(ByteBuffer.wrap(mSPS), ByteBuffer.wrap(mPPS));
    }
    return null;
  }```

My purpose gets byteArray (h264 from your library) and then use flv push to stream.

I hope your help. Many thanks.

Why do you want to call back? Can you just use rtmp to push it up in C++?

Writing local files is finally written here

@wlanjie I don't know C++, I code rtmp by kotlin. it works well with the camera.  I tried to dive deep into your code.  Thank you for sharing.

Hi @wlanjie ,
Hope You are doing well !
We are the startup company of India developing short vedio creating app for Android & IOS so trying to integrate trinity vedio editing SDK in our application but facing bugs during integration so can u plz help us in resolving these issue.
So please kindly revert with your positive response at<EMAIL_ADDRESS>Hoping for ur positive reply


[HOLD for payment 2023-08-24] [CHECKLIST TO BE COMPLETED] [$1000] Workspace +N overlay has a smaller border radius than the workspace icon

If you haven’t already, check out our contributing guidelines for onboarding and email<EMAIL_ADDRESS>to request to join our Slack channel!

Action Performed:
Requirement: has >= 5 workspaces

Open Settings
Hover or long-press the Workspaces menu
Notice carefully the +N overlay border radius
To spot it easier, please zoom it

Expected Result:
The overlay border radius is the same as the workspace icon border radius
Actual Result:
The overlay border radius is smaller than the workspace icon border radius
Workaround:
Can the user still use Expensify without this being fixed? Have you informed them of the workaround?
Platforms:

Which of our officially supported platforms is this issue occurring on?

[x] Android / native
[x] Android / Chrome
[x] iOS / native
[x] iOS / Safari
[x] MacOS / Chrome / Safari
[x] MacOS / Desktop

Version Number: 1.3.44-0
Reproducible in staging?: y
Reproducible in production?: y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Notes/Photos/Videos: Any additional supporting documentation

Expensify/Expensify Issue URL:
Issue reported by: @bernhardoj
Slack conversation: https://expensify.slack.com/archives/C049HHMV9SM/p1690036975314749
View all open jobs on GitHub
Upwork Automation - Do Not Edit

Upwork Job URL: https://www.upwork.com/jobs/~01fb51d18c394675da
Upwork Job ID:<PHONE_NUMBER>107907584
        2023-07-24Automatic offers:

bernhardoj | Contributor | 25777355
bernhardoj | Reporter | 25777356

Proposal
Please re-state the problem that we are trying to solve in this issue.
The workspace +N overlay has a smaller border-radius than the workspace icon.
What is the root cause of that problem?
In the code, the workspace icon and the +N overlay have the same border radius, which is 6. They also have the same size, which is 24, but somehow the overlay border radius appears smaller. Here is why:
The workspace icon is a nested view that has 2 border-radius styles with the same value (6). The first border-radius is in MultipleAvatars. This View has a border width of 2.
https://github.com/Expensify/App/blob/b7d17e0fd33b83e9fbd45146b6123b6323ece79e/src/components/MultipleAvatars.js#L170-L183
The second border radius is in Avatar.
https://github.com/Expensify/App/blob/b7d17e0fd33b83e9fbd45146b6123b6323ece79e/src/components/Avatar.js#L93-L104
On the other hand, the overlay only has 1 border radius style. This View also has a border width of 2.
https://github.com/Expensify/App/blob/b7d17e0fd33b83e9fbd45146b6123b6323ece79e/src/components/MultipleAvatars.js#L199-L215
The bigger the value, the bigger the radius. But as we also know, border radius is also affected by the element size. For the workspace icon, the first View has a border width of 2, which means the total width of the element is
24 + 2 (border left) + 2 (border right) = 28.
while the second View width is still 24. This makes the first View radius smaller than the 2nd View.

The image above shows the radius difference between the parent View and the child View.
In the case of the overlay, the width is also 28 (24 + 2 + 2).

The image above also shows the radius difference between the overlay and the workspace icon. Because the radius is different, we can notice the overlay background color.
What changes do you think we should make in order to solve the problem?

Avatar code has a lot of responsibilities and I think the most ideal solution is to refactor the Avatar and MultipleAvatar code so we don't have the nested View with multiple border radius, but I also think that requires a lot of effort.
So, I would like to propose this simple idea (the idea is to mimic the structure of the workspace icon):

Add the border radius style to the overlay child View.
https://github.com/Expensify/App/blob/b7d17e0fd33b83e9fbd45146b6123b6323ece79e/src/components/MultipleAvatars.js#L216-L223
Move the overlay background color to the overlay child View

View diff
```diff
diff --git a/src/components/MultipleAvatars.js b/src/components/MultipleAvatars.js
index 3b20d99fa2..6e4ce933ca 100644
--- a/src/components/MultipleAvatars.js
+++ b/src/components/MultipleAvatars.js
@@ -206,9 +206,7 @@ function MultipleAvatars(props) {
                                             isInReportAction: props.isInReportAction,
                                             shouldUseCardBackground: props.shouldUseCardBackground,
                                         }),
-
-                                        // Set overlay background color with RGBA value so that the text will not inherit opacity
-                                        StyleUtils.getBackgroundColorWithOpacityStyle(themeColors.overlay, variables.overlayOpacity),
+                                        styles.bgTransparent, <- we need to set it to transparent to override the bg from getHorizontalStackedAvatarBorderStyle
                                         StyleUtils.getHorizontalStackedOverlayAvatarStyle(oneAvatarSize, oneAvatarBorderWidth),
                                         props.icons[3].type === CONST.ICON_TYPE_WORKSPACE ? StyleUtils.getAvatarBorderRadius(props.size, props.icons[3].type) : {},
                                     ]}
@@ -219,6 +217,9 @@ function MultipleAvatars(props) {
                                             styles.alignItemsCenter,
                                             StyleUtils.getHeight(oneAvatarSize.height),
                                             StyleUtils.getWidthStyle(oneAvatarSize.width),
+                                            // Set overlay background color with RGBA value so that the text will not inherit opacity
+                                            StyleUtils.getBackgroundColorWithOpacityStyle(themeColors.overlay, variables.overlayOpacity),
+                                            StyleUtils.getAvatarBorderStyle(props.size, props.icons[3].type),
                                         ]}
                                     >

### What alternative solutions did you explore? (Optional)
**Alternative 1**
To have the same radius between the icon parent and the icon itself, we should adjust the parent border radius by taking into account the border width. For example, the workspace icon border width is 2, so we add the current border radius, which is 6, with the border width (6 + 2 = 8). The parent (container) border radius will be 8.
1. Create a new StyleUtils called `getAvatarContainerBorderRadius(size, type, borderWidth)`. It will simply call `getAvatarBorderRadius` and add `borderWidth` to the result.
2. Replace the usage of `getAvatarBorderRadius` (on the icon and overlay) with `getAvatarContainerBorderRadius`

**Alternative 2**
I think this alternative solution is cleaner but requires more changes, but there is a catch.
The idea is to completely remove the border from the overlay. We want just a simple View that sits on top of the workspace icon with the same size and border radius.
1. Remove the overlay child View and move the height and width style to the parent.
https://github.com/Expensify/App/blob/b7d17e0fd33b83e9fbd45146b6123b6323ece79e/src/components/MultipleAvatars.js#L216-L223
2. Remove the border style of the overlay parent View. This will remove the border color and "unused" bg color.
https://github.com/Expensify/App/blob/b7d17e0fd33b83e9fbd45146b6123b6323ece79e/src/components/MultipleAvatars.js#L203-L208
3. Remove the second border style of the overlay parent View. (remove the borderWidth and borderStyle)
https://github.com/Expensify/App/blob/b7d17e0fd33b83e9fbd45146b6123b6323ece79e/src/styles/StyleUtils.js#L920-L928
4. Because we are removing the border from the overlay, we need to adjust the `left` positioning.
Before: `left: -(oneAvatarSize.width * 2 + oneAvatarBorderWidth * 2)`
After: `left: -(oneAvatarSize.width * 2 + oneAvatarBorderWidth)`
`oneAvatarBorderWidth` is the 4th workspace icon's right border width.
5. We need to somehow disable the tooltip of the icon behind the overlay because now the user can hover over the icon border.
, OR if we want, we can also do a change so that user can't hover over the icon border, which I prefer.

Yep, I can repro:

looks like the PR caused this regression https://github.com/Expensify/App/issues/24069, i goofed initially on the labels but should be ready for @bernhardoj to take over when you're online.

Ok, since this caused a regression - here's a Payments summary:

Bug Reporter: @bernhardoj $250
Contributor: @bernhardoj $500 (penalty due to regression)
C+: @thesahindia $500  (penalty due to regression) - request via New.Dot

Upwork job
Let me know if this isn't correct!

@jliexpensify , as @bernhardoj explained here this bug was not generated by the code changes he did. The problem is that the fix for this issue was supposed to be a 2 part fix, and we fixed just one. So I think we should not apply the regression penalty in this situation.

@danieldoglas no worries, I can adjust the Payment for @bernhardoj . What about for @thesahindia ?

Paid in Upworks, job removed. @thesahindia - is a checklist needed? Also, please request $1000 in New.Dot.

@thesahindia bump on checklist  + ND payment request

Bump @thesahindia - do we need a checklist?

Reviewed the details for @thesahindia. $1,000 approved for payment based on the BZ summary above.

Closing this, I think everytihng is sorted!


keyvault t2 config

keyvault t2 config

@msyyc could you help take a look at the track2 update?

@zhenglaizhang Please help merge it. Thank you


Font caching issues

Hi,
I noticed that WebKit browsers (especially Chrome) are brutally caching resources. When I update my Fontello font file, I regularly need to hit CTRL+F5 for Chrome to clear cache and take that new font file.
So it seems every user needs to do this to have new icons.
Can you consider adding one checkbox next to filename input on Fontello front page so that option would add generation timestamp for resources in @font-face that is in fontello.css and in that way force the browser to pick up new file?
@font-face {
  font-family: 'fontello';
  src: url("../font/fontello.eot?1360161745");
/*  src: url("../font/fontello.eot?1360161745#iefix") format('embedded-opentype'), url("../font/fontello.woff?1360161745") format('woff'), url("../font/fontello.ttf") format('truetype'),

...

Hello,
we are using fontello in our project and we are having some issues with this solution to prevent font caching. We are using HTML5 application cache because we want to manage what should be refreshed when. In order to make fontello fonts work with this we have to either remove the generated timestamp or add it to cache manifest. Could it be possible to add a flag and specify during font generation if I want to add this timestamp or not?


Raven crashes after 4(ish) messages

It works great for the first few, then I get this:
USER: yeah I agree I'm looking forward to it
RAVEN:
[000001e2dc4d7890] cache_read stream error: cannot pre fill buffer
[000001e2dc4ddb00] mjpeg demux error: cannot peek
[000001e2dc4cbd00] main input error: Your input can't be opened
[000001e2dc4cbd00] main input error: VLC is unable to open the MRL 'file:///C:/Dev/RAVEN_MVP_Public/output.mp3'. Check the log for details.
I've noticed that file is 0b in size when this happens. Any thoughts on what I might need to tweak?

Yeah looks like an environmental problem. Let me know if that worked for you. I haven't had any problems on my end, so I'm not sure how to reproduce the issue.


RequestTimeout is not passed to HttpClient since v6.8.7

NEST/Elasticsearch.Net version:
Elasticsearch.NET 6.8.9 (.NET 5)
Elasticsearch version:
reproduced with 6.2.4 and 6.8.14
Description of the problem including expected versus actual behavior:
When trying to execute any long-running request there is no way to override HttpClient's default timeout of 100 seconds.
Steps to reproduce:

Specify RequestTimeout greater than 100 seconds in request parameters:

var parameters = new ForceMergeRequestParameters
{
      RequestConfiguration = new RequestConfiguration {RequestTimeout = TimeSpan.FromMinutes(60)}
};

Execute some long-running request with these parameters (make sure ES doesn't process request faster than the timeout) :

client.IndicesForcemerge<StringResponse>(indexName, parameters);

After 100 seconds you'll get exception:

Caused by: System.Threading.Tasks.TaskCanceledException: The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing.
     at System.Net.Http.HttpClient+<SendAsyncCore>d__85.MoveNext()
     at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess()
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification()
     at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
     at Elasticsearch.Net.HttpConnection.Request(C:\Users\SteveGordon\Code\elasticsearch-net\src\Elasticsearch.Net\Connection\HttpConnection-CoreFx.cs:61:5)
   Caused by: System.TimeoutException: The operation was canceled.
     Caused by: System.Threading.Tasks.TaskCanceledException: The operation was canceled.
         at System.Net.Http.HttpConnection+<SendAsyncCore>d__56.MoveNext()
         at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
         at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess()
         at System.Net.Http.HttpConnectionPool+<SendWithRetryAsync>d__72.MoveNext()
         at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
         at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess()
         at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification()
         at System.Net.Http.RedirectHandler+<SendAsync>d__4.MoveNext()
         at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
         at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess()
         at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification()
         at System.Net.Http.HttpClient+<SendAsyncCore>d__85.MoveNext()
       Caused by: System.IO.IOException: Unable to read data from the transport connection: The I/O operation has been aborted because of either a thread exit or an application request..
           at System.Net.Sockets.Socket+AwaitableSocketAsyncEventArgs.ThrowException()
           at System.Net.Sockets.Socket+AwaitableSocketAsyncEventArgs.GetResult()
           at System.Net.Http.HttpConnection+<FillAsync>d__94.MoveNext()
           at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
           at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess()
           at System.Net.Http.HttpConnection+<ReadNextResponseHeaderLineAsync>d__91.MoveNext()
           at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
           at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess()
           at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification()
           at System.Net.Http.HttpConnection+<SendAsyncCore>d__56.MoveNext()
         Caused by: System.Net.Sockets.SocketException: The I/O operation has been aborted because of either a thread exit or an application request.

Expected behavior
HttpClient uses timeout specified in RequestConfiguration.RequestTimeout
This behavior seems to be broken since 6.8.7 (https://github.com/elastic/elasticsearch-net/commit/903bba2236f3fb1555bdf24fe6b7bf72b8ddf652#diff-1bbac8a8fd708132d878b2b0e44ab95fc379fd0d2515e59e7264c5fecabfd061R87)

Seems like this was already fixed for 7.x in https://github.com/elastic/elasticsearch-net/pull/4846, is it possible to backport it to the latest 6.8.x?

Thanks for catching this @aldobrynin and for opening the PR. That's merged now. I'll keep this open until I have a patch release scheduled to include the fix.

Thanks a lot! is there any specific date when you plan to release this patch?

@aldobrynin I've released 6.8.10 to Nuget today so this should soon be available to pull. Thanks again!


Variable Importance Analysis (Q3)

See "Variable Importance (Q3) - John.ipynb". This code is based on the assumption that NN2 is the optimal neural network model (Should be modified if model changes.)

fanshulefanshulefanshule