Merge branch 'develop' of github.com:RocketChat/Rocket.Chat into new/…

…apps_rewrite* 'develop' of github.com:RocketChat/Rocket.Chat: (28 commits) [IMPROVE] Performance editing Admin settings (#17916)  [IMPROVE] React hooks lint rules (#17941)  [FIX] StreamCast stream to server only streamers (#17942)  [FIX] Profile save button not activates properly when changing the username field (#16541)  [FIX] Outgoing webhook: Excessive spacing between trigger words (#17830)  [FIX] Links being escaped twice leading to visible encoded characters (#16481)  [NEW][API] New endpoints to manage User Custom Status `custom-user-status.create`, custom-user-status.delete` and `custom-user-status.update` (#16550)  [FIX] Message action popup doesn't adjust itself on screen resize (#16508)  [FIX] Not possible to translate the label of custom fields in user's Info (#15595)  [FIX] Close the user info context panel does not navigate back to the user's list (#14085)  [FIX] Missing pinned icon indicator for messages pinned (#16448)  Chatpal: limit results to current room (#17718)  Do not build Docker image for fork PRs (#17370)  [IMPROVE] Use REST for DDP calls by default (#17934)  [IMPROVE] Add rate limiter to UiKit endpoints (#17859)  LingoHub based on develop (#17796)  [IMPROVE] Change default upload settings to only block SVG files (#17933)  Update Dockerfile to not depend on custom base image (#17802)  [IMPROVE][Performance] Add new database indexes to improve data query performance (#17839)  [FIX] Undesirable message updates after user saving profile (#17930)  ...

.docker-mongo/Dockerfile

@@ -1,24 +1,40 @@
-FROM rocketchat/base:12.16.1
+FROM node:12.16.1-buster-slim
 
 LABEL maintainer="buildmaster@rocket.chat"
 
+# Install MongoDB and dependencies
 RUN set -x \
- && apt-get update \
- && apt-get install -y wget \
- && wget -qO - https://www.mongodb.org/static/pgp/server-4.0.asc | apt-key add - \
- && echo "deb http://repo.mongodb.org/apt/debian stretch/mongodb-org/4.0 main" | tee /etc/apt/sources.list.d/mongodb-org-4.0.list \
- && apt-get update \
- && apt-get install -y pwgen mongodb-org \
- && apt-get clean my room
+    && apt-get update \
+    && apt-get install -y wget gnupg dirmngr pwgen \
+    && wget -qO - https://www.mongodb.org/static/pgp/server-4.2.asc | apt-key add - \
+    && echo "deb http://repo.mongodb.org/apt/debian buster/mongodb-org/4.2 main" | tee /etc/apt/sources.list.d/mongodb-org-4.2.list \
+    && apt-get update \
+    && apt-get install -y mongodb-org fontconfig \
+    && apt-get clean my room \
+    && groupadd -g 65533 -r rocketchat \
+    && useradd -u 65533 -r -g rocketchat rocketchat \
+    && mkdir -p /app/uploads \
+    && chown rocketchat:rocketchat /app/uploads
 
 ADD . /app
 ADD entrypoint.sh /app/bundle/
 
-RUN set -x \
- && cd /app/bundle/programs/server \
- && npm install \
- && npm cache clear --force \
- && chown -R rocketchat:rocketchat /app
+RUN aptMark="$(apt-mark showmanual)" \
+    && apt-get install -y --no-install-recommends g++ make python ca-certificates \
+    && cd /app/bundle/programs/server \
+    && npm install \
+    && apt-mark auto '.*' > /dev/null \
+    && apt-mark manual $aptMark > /dev/null \
+    && find /usr/local -type f -executable -exec ldd '{}' ';' \
+       | awk '/=>/ { print $(NF-1) }' \
+       | sort -u \
+       | xargs -r dpkg-query --search \
+       | cut -d: -f1 \
+       | sort -u \
+       | xargs -r apt-mark manual \
+    && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
+    && npm cache clear --force \
+    && chown -R rocketchat:rocketchat /app
 
 VOLUME /app/uploads
 

.docker-mongo/entrypoint.sh

@@ -39,7 +39,7 @@ echo """
 ╚═╝  ╚═╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝   ╚═╝╚═╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝       ╚═╝     ╚═╝  ╚═╝╚══════╝  ╚═══╝  ╚═╝╚══════╝ ╚══╝╚══╝
 """
 
-mongod --smallfiles --storageEngine=mmapv1 --fork --replSet rs0 --config /etc/mongod.conf
+mongod --fork --replSet rs0 --config /etc/mongod.conf
 
 until mongo --eval "db" &> /dev/null; do
 	echo "MongoDB still not ready, sleeping"

.docker/Dockerfile

@@ -1,14 +1,33 @@
-FROM rocketchat/base:12.16.1
-
-ADD . /app
+FROM node:12.16.1-buster-slim
 
 LABEL maintainer="buildmaster@rocket.chat"
 
-RUN set -x \
- && cd /app/bundle/programs/server \
- && npm install \
- && npm cache clear --force \
- && chown -R rocketchat:rocketchat /app
+# dependencies
+RUN groupadd -g 65533 -r rocketchat \
+    && useradd -u 65533 -r -g rocketchat rocketchat \
+    && mkdir -p /app/uploads \
+    && chown rocketchat:rocketchat /app/uploads \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends fontconfig
+
+ADD . /app
+
+RUN aptMark="$(apt-mark showmanual)" \
+    && apt-get install -y --no-install-recommends g++ make python ca-certificates \
+    && cd /app/bundle/programs/server \
+    && npm install \
+    && apt-mark auto '.*' > /dev/null \
+    && apt-mark manual $aptMark > /dev/null \
+    && find /usr/local -type f -executable -exec ldd '{}' ';' \
+       | awk '/=>/ { print $(NF-1) }' \
+       | sort -u \
+       | xargs -r dpkg-query --search \
+       | cut -d: -f1 \
+       | sort -u \
+       | xargs -r apt-mark manual \
+    && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
+    && npm cache clear --force \
+    && chown -R rocketchat:rocketchat /app
 
 USER rocketchat
 

.eslintrc

@@ -11,7 +11,8 @@
     "jscolor": false
   },
   "plugins": [
-    "react"
+    "react",
+    "react-hooks"
   ],
   "rules": {
     "jsx-quotes": [
@@ -24,7 +25,9 @@
     "react/jsx-fragments": [
       "error",
       "syntax"
-    ]
+    ],
+    "react-hooks/rules-of-hooks": "error",
+    "react-hooks/exhaustive-deps": "warn"
   },
   "settings": {
     "import/resolver": {

.github/workflows/build_and_test.yml

@@ -19,6 +19,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+
     - name: Github Info
       run: |
         echo "GITHUB_ACTION: $GITHUB_ACTION"
@@ -34,7 +35,15 @@ jobs:
       with:
         node-version: "12.16.1"
 
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
+
+    - name: Free disk space
+      run: |
+        sudo swapoff -a
+        sudo rm -f /swapfile
+        sudo apt clean
+        docker rmi $(docker image ls -aq)
+        df -h
 
     - name: check package-lock
       run: |
@@ -199,7 +208,7 @@ jobs:
         docker exec mongo mongo --eval 'rs.initiate({_id:"rs0", members: [{"_id":1, "host":"localhost:27017"}]})'
         docker exec mongo mongo --eval 'rs.status()'
 
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
 
     - name: Cache cypress
       id: cache-cypress
@@ -245,10 +254,10 @@ jobs:
 
   build-image-pr:
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
+    if: github.event.pull_request.head.repo.full_name == github.repository
 
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
 
     - name: Free disk space
       run: |
@@ -356,7 +365,7 @@ jobs:
     needs: test
 
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
 
     - name: Restore build
       uses: actions/download-artifact@v1
@@ -409,7 +418,7 @@ jobs:
       IMAGE: "rocketchat/rocket.chat"
 
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
 
     - name: Restore build
       uses: actions/download-artifact@v1

.storybook/hooks.js

@@ -9,7 +9,7 @@ export const useAutoToggle = (initialValue = false, ms = 1000) => {
 		return () => {
 			clearInterval(timer);
 		};
-	}, []);
+	}, [ms]);
 
 	return value;
 };

README.md

@@ -358,7 +358,7 @@ Prerequisites:
 * [Git](http://git-scm.com/book/en/v2/Getting-Started-Installing-Git)
 * [Meteor](https://www.meteor.com/install)
 
-> Meteor automatically installs a hidden [NodeJS v8](https://nodejs.org/download/release/v8.9.3/), [Python v2.7](https://www.python.org/downloads/release/python-270/) and [MongoDB v3.6](https://www.mongodb.com/mongodb-3.6) to be used when you run your app in development mode using the `meteor` command.
+> Meteor automatically installs a hidden [NodeJS v12](https://nodejs.org/download/release/v12.16.1/) and [MongoDB v4.2](https://docs.mongodb.com/manual/introduction/) to be used when you run your app in development mode using the `meteor` command.
 
 Now just clone and start the app:
 
@@ -368,6 +368,7 @@ cd Rocket.Chat
 meteor npm install
 meteor npm start
 ```
+For more detailed step-by-step, see our [quick start for developers](https://docs.rocket.chat/guides/developer/quick-start) docs.
 
 To debug the server part, use [meteor debugging](https://docs.meteor.com/commandline.html#meteordebug). You should use Chrome for best debugging experience:
 

app/api/server/settings.js

@@ -12,10 +12,9 @@ settings.addGroup('General', function() {
 		this.add('API_Enable_CORS', false, { type: 'boolean', public: false });
 		this.add('API_CORS_Origin', '*', { type: 'string', public: false, enableQuery: { _id: 'API_Enable_CORS', value: true } });
 
-		this.add('API_Use_REST_For_DDP_Calls', false, {
+		this.add('API_Use_REST_For_DDP_Calls', true, {
 			type: 'boolean',
 			public: true,
-			alert: 'API_Use_REST_For_DDP_Calls_Alert',
 		});
 	});
 });

app/api/server/v1/custom-user-status.js

@@ -1,3 +1,7 @@
+import { Meteor } from 'meteor/meteor';
+import { Match, check } from 'meteor/check';
+
+import { CustomUserStatus } from '../../../models';
 import { API } from '../api';
 import { findCustomUserStatus } from '../lib/custom-user-status';
 
@@ -16,3 +20,69 @@ API.v1.addRoute('custom-user-status.list', { authRequired: true }, {
 		})));
 	},
 });
+
+API.v1.addRoute('custom-user-status.create', { authRequired: true }, {
+	post() {
+		check(this.bodyParams, {
+			name: String,
+			statusType: Match.Maybe(String),
+		});
+
+		const userStatusData = {
+			name: this.bodyParams.name,
+			statusType: this.bodyParams.statusType,
+		};
+
+		Meteor.runAsUser(this.userId, () => {
+			Meteor.call('insertOrUpdateUserStatus', userStatusData);
+		});
+
+		return API.v1.success({
+			customUserStatus: CustomUserStatus.findOneByName(userStatusData.name),
+		});
+	},
+});
+
+API.v1.addRoute('custom-user-status.delete', { authRequired: true }, {
+	post() {
+		const { customUserStatusId } = this.bodyParams;
+		if (!customUserStatusId) {
+			return API.v1.failure('The "customUserStatusId" params is required!');
+		}
+
+		Meteor.runAsUser(this.userId, () => Meteor.call('deleteCustomUserStatus', customUserStatusId));
+
+		return API.v1.success();
+	},
+});
+
+API.v1.addRoute('custom-user-status.update', { authRequired: true }, {
+	post() {
+		check(this.bodyParams, {
+			_id: String,
+			name: String,
+			statusType: Match.Maybe(String),
+		});
+
+		const userStatusData = {
+			_id: this.bodyParams._id,
+			name: this.bodyParams.name,
+			statusType: this.bodyParams.statusType,
+		};
+
+		const customUserStatus = CustomUserStatus.findOneById(userStatusData._id);
+
+		// Ensure the message exists
+		if (!customUserStatus) {
+			return API.v1.failure(`No custom user status found with the id of "${ userStatusData._id }".`);
+		}
+
+		Meteor.runAsUser(this.userId, () => {
+			Meteor.call('insertOrUpdateUserStatus', userStatusData);
+		});
+
+		return API.v1.success({
+			customUserStatus: CustomUserStatus.findOneById(userStatusData._id),
+		});
+	},
+});

app/api/server/v1/invites.js

@@ -35,6 +35,7 @@ API.v1.addRoute('removeInvite/:_id', { authRequired: true }, {
 API.v1.addRoute('useInviteToken', { authRequired: true }, {
 	post() {
 		const { token } = this.bodyParams;
+		// eslint-disable-next-line react-hooks/rules-of-hooks
 		const result = useInviteToken(this.userId, token);
 
 		return API.v1.success(result);

app/apps/server/communication/uikit.js

@@ -1,8 +1,11 @@
 import express from 'express';
+import rateLimit from 'express-rate-limit';
+import { Meteor } from 'meteor/meteor';
 import { WebApp } from 'meteor/webapp';
 import { UIKitIncomingInteractionType } from '@rocket.chat/apps-engine/definition/uikit';
 
 import { Users } from '../../../models/server';
+import { settings } from '../../../settings/server';
 
 const apiServer = express();
 
@@ -13,11 +16,22 @@ WebApp.connectHandlers.use(apiServer);
 // eslint-disable-next-line new-cap
 const router = express.Router();
 
-const unauthorized = (res) =>
-	res.status(401).send({
-		status: 'error',
-		message: 'You must be logged in to do this.',
+const unauthorized = (res) => res.status(401).send({
+	status: 'error',
+	message: 'You must be logged in to do this.',
+});
+
+Meteor.startup(() => {
+	// use specific rate limit of 600 (which is 60 times the default limits) requests per minute (around 10/second)
+	const apiLimiter = rateLimit({
+		windowMs: settings.get('API_Enable_Rate_Limiter_Limit_Time_Default'),
+		max: settings.get('API_Enable_Rate_Limiter_Limit_Calls_Default') * 60,
+		skip: () =>
+			settings.get('API_Enable_Rate_Limiter') !== true
+			|| (process.env.NODE_ENV === 'development' && settings.get('API_Enable_Rate_Limiter_Dev') !== true),
 	});
+	router.use(apiLimiter);
+});
 
 router.use((req, res, next) => {
 	const {