Since the only things we used it for were:
* editing users - but that doesn't work any more (bug 1346740) so
requires a manual DB edit as is it, and we won't need to edit users
at all once LDAP groups are used for permissions (bug 1273092)
* marking pending Hawk credentials as approved - however we're not
accepting any new requests for Hawk credentials (bug 1433011)
* resetting the secret key for Hawk credentials - however we've not
used this feature once in the entire time we've used Hawk - and its
trivial via MySQLWorkbench.
As as added bonus removing Django admin:
* reduces the work required to add a CSP header
* speeds up `collectstatic` (which is run during deploy) by 30%
* reduces the risk of giving `is_staff` permissions (which have to be
given to sheriffs, but also allowed admin access)
* reduces attack surface in general
In addition to the Django admin app, `django.contrib.messages` app
and the auth/messages context processors have been removed, since
after bug 1433011, admin was the only remaining consumer of them:
https://docs.djangoproject.com/en/1.11/ref/contrib/admin/
Now that we're using MySQL 5.7, we can specify `REQUIRE SSL` on the
`CREATE USER` statement, rather than having to do so on the individual
GRANTs. Compare:
https://dev.mysql.com/doc/refman/5.6/en/create-user.htmlhttps://dev.mysql.com/doc/refman/5.7/en/create-user.html
Prevents:
```
1 warning(s): 1287 Using GRANT statement to modify existing user's
properties other than privileges is deprecated and will be removed
in future release. Use ALTER USER statement for this operation.
```
Generated using the approach documented at the end of the page:
https://treeherder.readthedocs.io/admin.html#direct-database-access
The changes are required since bug 1373008 added the `group` and
`group_failure_lines` tables and #2532 removed `text_log_summary`
and `text_log_summary_line`.
In `configureStore.js` the same object was being exported twice, once
as the default export and once as a named export. Since default exports
are preferred if there is only one export in a file, I've removed the
named import and left the default one.
In `Groups.jsx` the `Groups` class was exported but unused, so has
been adjusted to no longer be exported, so the `App.jsx` import
doesn't trigger the warning:
`import Groups from './Groups';`
See:
https://github.com/benmosher/eslint-plugin-import/blob/master/docs/rules/no-named-as-default.md
Previously only 65 rules were enabled, since the `eslint:recommended`
and `plugin:react/recommended` entries in `extends` had no effect,
since when using ESLint's API rather than CLI, the options must be
passed inside the `baseConfig` property instead.
This commit corrects the usage of `extends` and switches us to AirBnb's
React ESLint preset rather than manually opting into rules:
https://github.com/airbnb/javascript
Even with the temporarily disabled rules (which can be gradually fixed
in the future), there are now over 200 ESLint rules enabled, giving
a significant increase in coverage.
Note: We're having to use v15 of `eslint-config-airbnb` rather than v16
until we update to newer Neutrino, since the latest preset has dropped
support for the ESLint v3 that comes with Neutrino 4.
With the changes in previous commits, all of the assets that were
originally manually copied to `dist/img/` are now correctly handled
by webpack as dependencies (and so emitted to `dist/` automatically).
As such, this leaves only three files that need copying from `src/`,
so they are now listed explicitly to avoid having to continually
update `ignore` to prevent extra files from sneaking in:
https://webpack.js.org/plugins/copy-webpack-plugin/
As a result of this change, the following assets are no longer
needlessly created under `dist/` as part of `yarn build`:
```
img/dancing_cat.gif
img/line_chart.png
img/logviewerIcon.png
img/logviewerIcon.svg
img/logviewerIconHelp.svg
img/tip.png
img/tip-locked.png
img/tree.xcf
img/tree_closed.png
img/tree_open.png
img/treeherder-logo.png
```
To confirm that this would not break anything, the JS and HTML files
under `dist/` were grepped for the string `img/`, and there are no
references remaining.
Currently `revision.txt` only exists on Heroku, since it's generated
by the Heroku-only `post_compile` script, just prior to `yarn build`.
However this means:
* HTTP 404s of `revision.txt` are seen in the browser console when
developing locally, which gives the appearance of something being
broken, even though it's not.
* when we convert the wildcard `CopyPlugin` rule to an explicit list
of files to copy (in a later commit), it will cause errors when
building locally, since `CopyPlugin` expects all declared files
to exist.
Adding a placeholder file prevents both of the above.
This ensures that webpack knows they are a dependency, meaning:
* no need to manually copy them to `dist/img/` using `CopyPlugin`
(the wildcard copy rules will be cleaned up in a later commit)
* they are inlined as a base64 encoded data URI by `url-loader`.
The changes to `thFaviconLink` are required to prevent:
```
Error: [$interpolate:interr] Can't interpolate: {{favicon}}
Error: [$sce:insecurl] Blocked loading resource from url not allowed
by $sceDelegate policy. URL: data:image/png;base64,...
```
Which are due to AngularJS not trusting data URIs by default. See:
https://docs.angularjs.org/error/$sce/insecurl
Previously `html-loader` only parsed `<img src="...">` tags when
looking for assets/dependencies. Now the `<link href="...">` tags
for favicons are processed too, which means `img/tree_open.png`
and friends will be included in the webpack build and not need to
be manually copied into `dist/img/`:
https://webpack.js.org/loaders/html-loader/
This does not visible change the number of hashed images output to
`dist/`, since the favicons are small enough that `url-loader` inlines
them in the HTML as base64 encoded data URIs (this is adjustable if
not desired later):
https://webpack.js.org/loaders/url-loader/
pyup.io bot
William Lachance
renovate[bot]
Ed Morley
Stephen Donner
Jonathan French
Balaji.G
ionutgoldan