Merge branch 'devel' into release-1.4.2

meteor

@@ -113,17 +113,17 @@ fi
 DEV_BUNDLE="$SCRIPT_DIR/dev_bundle"
 METEOR="$SCRIPT_DIR/tools/index.js"
 
+# Set the nofile ulimit as high as permitted by the hard-limit/kernel
+if [ "$(ulimit -Sn)" != "unlimited" ]; then
+    if [ "$(uname -s)" = "Darwin" ]; then
+        maxfilesuse="$(sysctl -n kern.maxfilesperproc)"
+    else
+        maxfilesuse="$(ulimit -Hn)"
+    fi
 
-# Bump our file descriptor ulimit as high as it will go. This is a
-# temporary workaround for dependancy watching holding open too many
-# files: https://app.asana.com/0/364581412985/472479912325
-if [ "$(ulimit -n)" != "unlimited" ] ; then
-    ulimit -n 16384 > /dev/null 2>&1 || \
-    ulimit -n 8192 > /dev/null 2>&1 || \
-    ulimit -n 4096 > /dev/null 2>&1 || \
-    ulimit -n 2048 > /dev/null 2>&1 || \
-    ulimit -n 1024 > /dev/null 2>&1 || \
-    ulimit -n 512 > /dev/null 2>&1
+    if [ -n "${maxfilesuse}" ] && [ "${maxfilesuse}" != "unlimited" ]; then
+        ulimit -Sn ${maxfilesuse} > /dev/null 2>&1
+    fi
 fi
 
 # We used to set $NODE_PATH here to include the node_modules from the dev

packages/boilerplate-generator/boilerplate_web.cordova.html

@@ -4,7 +4,7 @@
   <meta name="format-detection" content="telephone=no">
   <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width, height=device-height">
   <meta name="msapplication-tap-highlight" content="no">
-  <meta http-equiv="Content-Security-Policy" content="default-src * data: blob: 'unsafe-inline' 'unsafe-eval' ws: wss:;">
+  <meta http-equiv="Content-Security-Policy" content="default-src * gap: data: blob: 'unsafe-inline' 'unsafe-eval' ws: wss:;">
 
 {{! We are explicitly not using bundledJsCssUrlRewriteHook: in cordova we serve assets up directly from disk, so rewriting the URL does not make sense }}
 

packages/browser-policy-content/browser-policy-content.js

@@ -102,19 +102,26 @@ var addSourceForDirective = function (directive, src) {
   if (_.contains(_.values(keywords), src)) {
     cspSrcs[directive].push(src);
   } else {
-    src = src.toLowerCase();
-
-    // Trim trailing slashes.
-    src = src.replace(/\/+$/, '');
-
     var toAdd = [];
-    // If there is no protocol, add both http:// and https://.
-    if (! /^([a-z0-9.+-]+:)/.test(src)) {
-      toAdd.push("http://" + src);
-      toAdd.push("https://" + src);
+
+    //Only add single quotes to CSP2 script digests
+    if (/^(sha(256|384|512)-)/i.test(src)) {
+      toAdd.push("'" + src + "'");
     } else {
-      toAdd.push(src);
+      src = src.toLowerCase();
+
+      // Trim trailing slashes.
+      src = src.replace(/\/+$/, '');
+
+      // If there is no protocol, add both http:// and https://.
+      if (! /^([a-z0-9.+-]+:)/.test(src)) {
+        toAdd.push("http://" + src);
+        toAdd.push("https://" + src);
+      } else {
+        toAdd.push(src);
+      }
     }
+
     _.each(toAdd, function (s) {
       cspSrcs[directive].push(s);
     });

packages/mongo/collection.js

@@ -704,7 +704,7 @@ Mongo.Collection.prototype._createCappedCollection = function (byteSize, maxDocu
 };
 
 /**
- * @summary Returns the [`Collection`](http://mongodb.github.io/node-mongodb-native/1.4/api-generated/collection.html) object corresponding to this collection from the [npm `mongodb` driver module](https://www.npmjs.com/package/mongodb) which is wrapped by `Mongo.Collection`.
+ * @summary Returns the [`Collection`](http://mongodb.github.io/node-mongodb-native/2.2/api/Collection.html) object corresponding to this collection from the [npm `mongodb` driver module](https://www.npmjs.com/package/mongodb) which is wrapped by `Mongo.Collection`.
  * @locus Server
  */
 Mongo.Collection.prototype.rawCollection = function () {
@@ -716,7 +716,7 @@ Mongo.Collection.prototype.rawCollection = function () {
 };
 
 /**
- * @summary Returns the [`Db`](http://mongodb.github.io/node-mongodb-native/1.4/api-generated/db.html) object corresponding to this collection's database connection from the [npm `mongodb` driver module](https://www.npmjs.com/package/mongodb) which is wrapped by `Mongo.Collection`.
+ * @summary Returns the [`Db`](http://mongodb.github.io/node-mongodb-native/2.2/api/Db.html) object corresponding to this collection's database connection from the [npm `mongodb` driver module](https://www.npmjs.com/package/mongodb) which is wrapped by `Mongo.Collection`.
  * @locus Server
  */
 Mongo.Collection.prototype.rawDatabase = function () {

packages/mongo/connection_options.js

@@ -1,6 +1,6 @@
 /**
  * @summary Allows for user specified connection options
- * @example http://mongodb.github.io/node-mongodb-native/2.1/reference/connecting/connection-settings/
+ * @example http://mongodb.github.io/node-mongodb-native/2.2/reference/connecting/connection-settings/
  * @locus Server
  * @param {Object} options User specified Mongo connection options
  */

packages/oauth1/oauth1_server.js

@@ -1,5 +1,26 @@
 var url = Npm.require("url");
 
+OAuth._queryParamsWithAuthTokenUrl = function (authUrl, oauthBinding, params, whitelistedQueryParams) {
+  params = params || {};
+  var redirectUrlObj = url.parse(authUrl, true);
+
+  _.extend(
+    redirectUrlObj.query,
+    _.pick(params.query, whitelistedQueryParams),
+    {
+      oauth_token: oauthBinding.requestToken,
+    }
+  );
+
+  // Clear the `search` so it is rebuilt by Node's `url` from the `query` above.
+  // Using previous versions of the Node `url` module, this was just set to ""
+  // However, Node 6 docs seem to indicate that this should be `undefined`.
+  delete redirectUrlObj.search;
+
+  // Reconstruct the URL back with provided query parameters merged with oauth_token
+  return url.format(redirectUrlObj);
+};
+
 // connect middleware
 OAuth._requestHandlers['1'] = function (service, query, res) {
   var config = ServiceConfiguration.configurations.findOne({service: service.serviceName});
@@ -30,19 +51,19 @@ OAuth._requestHandlers['1'] = function (service, query, res) {
       oauthBinding.requestTokenSecret);
 
     // support for scope/name parameters
-    var redirectUrl = undefined;
+    var redirectUrl;
+    var authParams = {
+      query: query
+    };
+
     if(typeof urls.authenticate === "function") {
-      redirectUrl = urls.authenticate(oauthBinding, {
-        query: query
-      });
+      redirectUrl = urls.authenticate(oauthBinding, authParams);
     } else {
-      // Parse the URL to support additional query parameters in urls.authenticate
-      var redirectUrlObj = url.parse(urls.authenticate, true);
-      redirectUrlObj.query = redirectUrlObj.query || {};
-      redirectUrlObj.query.oauth_token = oauthBinding.requestToken;
-      redirectUrlObj.search = '';
-      // Reconstruct the URL back with provided query parameters merged with oauth_token
-      redirectUrl = url.format(redirectUrlObj);
+      redirectUrl = OAuth._queryParamsWithAuthTokenUrl(
+        urls.authenticate,
+        oauthBinding,
+        authParams
+      );
     }
 
     // redirect to provider login, which will redirect back to "step 2" below

packages/twitter/package.js

@@ -18,6 +18,8 @@ Package.onUse(function(api) {
     ['twitter_configure.html', 'twitter_configure.js'],
     'client');
 
+  api.addFiles('twitter_common.js', ['server', 'client']);
+
   api.addFiles('twitter_server.js', 'server');
   api.addFiles('twitter_client.js', 'client');
 });

packages/twitter/twitter_client.js

@@ -1,5 +1,3 @@
-Twitter = {};
-
 // Request Twitter credentials for the user
 // @param options {optional}  XXX support options.requestPermissions
 // @param credentialRequestCompleteCallback {Function} Callback function to call on
@@ -38,9 +36,14 @@ Twitter.requestCredential = function (options, credentialRequestCompleteCallback
     }
   }
 
-  // Handle force login (request the user to enter their credentials)
-  if (options && options.force_login) {
-    loginPath += "&force_login=true";
+  // Support additional, permitted parameters
+  if (options) {
+    var hasOwn = Object.prototype.hasOwnProperty;
+    Twitter.validParamsAuthenticate.forEach(function (param) {
+      if (hasOwn.call(options, param)) {
+        loginPath += "&" + param + "=" + encodeURIComponent(options[param]);
+      }
+    });
   }
 
   var loginUrl = Meteor.absoluteUrl(loginPath);

packages/twitter/twitter_common.js

@@ -0,0 +1,6 @@
+Twitter = {};
+
+Twitter.validParamsAuthenticate = [
+  'force_login',
+  'screen_name'
+];

packages/twitter/twitter_server.js

@@ -1,13 +1,17 @@
-Twitter = {};
-
 var urls = {
   requestToken: "https://api.twitter.com/oauth/request_token",
   authorize: "https://api.twitter.com/oauth/authorize",
   accessToken: "https://api.twitter.com/oauth/access_token",
-  authenticate: "https://api.twitter.com/oauth/authenticate"
+  authenticate: function (oauthBinding, params) {
+    return OAuth._queryParamsWithAuthTokenUrl(
+      "https://api.twitter.com/oauth/authenticate",
+      oauthBinding,
+      params,
+      Twitter.validParamsAuthenticate
+    );
+  }
 };
 
-
 // https://dev.twitter.com/docs/api/1.1/get/account/verify_credentials
 Twitter.whitelistedFields = ['profile_image_url', 'profile_image_url_https', 'lang', 'email'];