Changed User.create signature to accept a hash, added a couple of utilit...

[akhoury]

...y functions as well, also added a new hook filter:user.create .

EDIT: also added a new config use_proxy - I wasn't sure where exactly you would prefer that config to live, feel free to either move it or suggest a better place (db maybe?) - but it does require a restart, so I figured the config.json is not a bad idea.

[akhoury]

oops - this commit's message should read: " password should NOT be passed ... "

[julianlam]

Awesome -- we're going to merge this in after 0.3.0 lands, since it does not fix any pressing issues.

[psychobunny]

ping (just a reminder)

[barisusakli]

What is the || '' for? If their pwd is undefined they should just be rejected?

[akhoury]

I remember hitting this statement with a NULL password somehow, if the pwd is null, bcrypt.compare crashed NodeBB.. but now that I look at it again, I think that was caused by a bug that I introduced then fixed with the before-last commit.

I'll take that out

[julianlam]

Am I right in assuming that trust proxy being enabled just means that req.ip is accessible if connections to NodeBB are proxied? Didn't know that was a problem, so nice catch 👍

[julianlam]

Food for thought, it is possible that "trust proxy" could be inferred from the existing config values:

if (port !== '80' && port !== '8080' && use_port === false)

Let me know if I'm wrong 😄

[akhoury]

actually i think you're right. but why 8080 is a condition?

[julianlam]

8080 is "HTTP Alternate", I assume because it's > 1024, so it is not restricted like low-number ports are. I've noticed that when I try to connect to an IP with port 8080, my browser sometimes just transparently redirects it to 80.

Perhaps I'm wrong, so I suppose let's take out the 8080 conditional for now... could we actually remove the use_proxy option now?

[akhoury]

Oh ok, i think it's safe to take out the use_proxy option, and probably the 8080 condition too.

I know I wasn't in love with adding another option in config.json. if you don't beat me to it, I'll clean it up tonight (with the prompt question and the block of comments)

[akhoury]

oh what about 443

[julianlam]

You know, I'd prefer if people didn't simply set up NodeBB with port 80 or 443 and run it as root, but what can you do?

We should add the 443 there as well.

No rush -- I'll wait for your PR tonight.