Merge shark, including shark-isolate-helpers work

Author: dgreensp

History.md

@@ -7,6 +7,20 @@
   functions that are done when returning a cursor from a publish function or
   using `{{#each}}`.
 
+* Patch Underscore to not treat plain objects (`x.constructor === Object`)
+  with numeric `length` fields as arrays.  Among other things, this allows you
+  to use documents with numeric `length` fields with Mongo.  #594 #1737
+
+* Fix races when calling login and/or logoutOtherClients from multiple
+  tabs. #1616
+
+* Upgrade `jquery-waypoints` package from 1.1.7 to 2.0.3. (Contains
+  backward-incompatible changes).
+
+* Add `frame-src` to `browser-policy-content` and account for
+  cross-browser CSP disparities.
+
+
 ## v0.7.0.1
 
 * Two fixes to `meteor run` Mongo startup bugs that could lead to hangs with the

LICENSE.txt

@@ -285,7 +285,6 @@ optimist: https://github.com/substack/node-optimist
 mkdirp: https://github.com/substack/node-mkdirp
 wordwrap: https://github.com/substack/node-wordwrap
 archy: https://github.com/substack/node-archy
-shell-quote: https://github.com/substack/node-shell-quote
 deep-equal: https://github.com/substack/node-deep-equal
 editor: https://github.com/substack/node-editor
 minimist: https://github.com/substack/minimist

docs/client/api.html

@@ -586,23 +586,30 @@ <h2 id="collections"><span>Collections</span></h2>
 
 Specifically, when you pass a `name`, here's what happens:
 
-* On the server, a collection with that name is created on a backend
-Mongo server. When you call methods on that collection on the server,
-they translate directly into normal Mongo operations (after checking that
-they match your [access control rules](#allow)).
-
-* On the client, a Minimongo instance is
-created. Minimongo is essentially an in-memory, non-persistent
-implementation of Mongo in pure JavaScript. It serves as a local cache
-that stores just the subset of the database that this client is working
-with. Queries on the client ([`find`](#find)) are served directly out of
-this cache, without talking to the server.
+* On the server (if you do not specify a `connection`), a collection with that
+name is created on a backend Mongo server. When you call methods on that
+collection on the server, they translate directly into normal Mongo operations
+(after checking that they match your [access control rules](#allow)).
+
+* On the client (and on the server if you specify a `connection`), a Minimongo
+instance is created. Minimongo is essentially an in-memory, non-persistent
+implementation of Mongo in pure JavaScript. It serves as a local cache that
+stores just the subset of the database that this client is working with. Queries
+([`find`](#find)) on these collections are served directly out of this cache,
+without talking to the server.
 
 * When you write to the database on the client ([`insert`](#insert),
-[`update`](#update), [`remove`](#remove)), the command is executed
-immediately on the client, and, simultaneously, it's shipped up to the
-server and executed there too.  The `livedata` package is
-responsible for this.
+[`update`](#update), [`remove`](#remove)), the command is executed locally
+immediately, and, simultaneously, it's sent to the server and executed
+there too. This happens via [stubs](#meteor_methods), because writes are
+implemented as methods.
+
+{{#note}}
+When, on the server, you write to a collection which has a specified
+`connection` to another server, it sends the corresponding method to the other
+server and receives the changed values back from it over DDP. Unlike on the
+client, it does not execute the write locally first.
+{{/note}}
 
 If you pass `null` as the `name`, then you're creating a local
 collection. It's not synchronized anywhere; it's just a local scratchpad
@@ -678,8 +685,6 @@ <h2 id="collections"><span>Collections</span></h2>
 
 * `$pull` in modifiers can only accept certain kinds
 of selectors.
-* `$` to denote the matched array position is not
-supported in modifier.
 * `findAndModify`, aggregate functions, and
 map/reduce aren't supported.
 
@@ -1932,7 +1937,7 @@ <h2 id="templates_api"><span>Templates</span></h2>
 
 {{> api_box template_events}}
 
-Declare event handers for instances of this template. Multiple calls add
+Declare event handlers for instances of this template. Multiple calls add
 new event handlers in addition to the existing ones.
 
 See [Event Maps](#eventmaps) for a detailed description of the event

docs/client/concepts.html

@@ -558,8 +558,9 @@ <h2 id="templates">Templates</h2>
 machinery to efficiently add and move DOM nodes as new results enter
 the query.
 
-Helpers can take arguments, and they receive the current template data
-in `this`:
+Helpers can take arguments, and they receive the current template context data
+in `this`. Note that some block helpers change the current context (notably
+`each` and `with`):
 
     // in a JavaScript file
     Template.players.leagueIs = function (league) {
@@ -825,10 +826,11 @@ <h3 class="nosection">Running on your own infrastructure</h3>
 This command will generate a fully-contained Node.js application in the form of
 a tarball.  To run this application, you need to provide Node.js 0.10 and a
 MongoDB server.  (The current release of Meteor has been tested with Node
-0.10.22, and is recommended for use with 0.10.22 through 0.10.24 only.) You can
-then run the application by invoking node, specifying the HTTP port for the
-application to listen on, and the MongoDB endpoint.  If you don't already have a
-MongoDB server, we can recommend our friends at [MongoHQ](http://mongohq.com).
+0.10.25; older versions contain a serious bug that can cause production servers
+to stall.) You can then run the application by invoking node, specifying the
+HTTP port for the application to listen on, and the MongoDB endpoint.  If
+you don't already have a MongoDB server, we can recommend our friends at
+[MongoHQ](http://mongohq.com).
 
     $ PORT=3000 MONGO_URL=mongodb://localhost:27017/myapp node bundle/main.js
 

docs/client/docs.js

@@ -46,10 +46,17 @@ Meteor.startup(function () {
   }
 
   var ignore_waypoints = false;
-  $('body').delegate('h1, h2, h3', 'waypoint.reached', function (evt, dir) {
+  var lastTimeout = null;
+  $('h1, h2, h3').waypoint(function (evt, dir) {
     if (!ignore_waypoints) {
       var active = (dir === "up") ? this.prev : this;
-      Session.set("section", active.id);
+      if (active.id) {
+        if (lastTimeout)
+          Meteor.clearTimeout(lastTimeout);
+        lastTimeout = Meteor.setTimeout(function () {
+          Session.set("section", active.id);
+        }, 200);
+      }
     }
   });
 

docs/client/packages/browser-policy.html

@@ -111,16 +111,19 @@
 
 Finally, you can configure a whitelist of allowed requests that various types of
 content can make. The following functions are defined for the content types
-script, object, image, media, font, and connect.
+script, object, image, media, font, frame, and connect.
 
 <dl class="callbacks">
 {{#dtdd "BrowserPolicy.content.allow&lt;ContentType&gt;Origin(origin)"}}
 Allows this type of content to be loaded from the given origin. `origin` is a
 string and can include an optional scheme (such as `http` or `https`), an
 optional wildcard at the beginning, and an optional port which can be a
 wildcard. Examples include `example.com`, `https://*.example.com`, and
-`example.com:*`. You can call these functions multiple times with different
-origins to specify a whitelist of allowed origins.
+`example.com:*`. You can call these functions multiple times with
+different origins to specify a whitelist of allowed origins. Origins
+that don't specify a protocol will allow content over both HTTP and
+HTTPS: passing `example.com` will allow content from both
+`http://example.com` and `https://example.com`.
 {{/dtdd}}
 
 {{#dtdd "BrowserPolicy.content.allow&lt;ContentType&gt;DataUrl()"}}
@@ -159,6 +162,12 @@
 `https://example.com`.
 * `BrowserPolicy.content.allowConnectOrigin("https://example.com")` allows XMLHttpRequest
 and WebSocket connections to `https://example.com`.
+* `BrowserPolicy.content.allowFrameOrigin("https://example.com")` allows
+your site to load the origin `https://example.com` in a frame or
+iframe. The `BrowserPolicy.framing` API allows you to control which
+sites can frame your site, while
+`BrowserPolicy.content.allowFrameOrigin` allows you to control which
+sites can be loaded inside frames on your site.
 
 
 {{/markdown}}

docs/client/packages/coffeescript.html

@@ -8,8 +8,8 @@
 equivalent JS, and there is no interpretation at runtime.
 
 CoffeeScript is supported on both the client and the server. Files
-ending with `.coffee` or `.litcoffee` are automatically compiled to
-JavaScript.
+ending with `.coffee`, `.litcoffee`, or `.coffee.md` are automatically
+compiled to JavaScript.
 
 ### Namespacing and CoffeeScript
 

docs/client/packages/underscore.html

@@ -18,6 +18,17 @@
 package as we will remove the default underscore in the future.
 {{/warning}}
 
+{{#warning}}
+We have slightly modified the way Underscore differentiates between
+objects and arrays in [collection functions](http://underscorejs.org/#each).
+The original Underscore logic is to treat any object with a numeric `length`
+property as an array (which helps it work properly on
+[`NodeList`s](https://developer.mozilla.org/en-US/docs/Web/API/NodeList)).
+In Meteor's version of Underscore, objects with a numeric `length` property
+are treated as objects if they have no prototype (specifically, if
+`x.constructor === Object`.
+{{/warning}}
+
 
 {{/markdown}}
 </template>

examples/unfinished/accounts-ui-viewer/accounts-ui-viewer.less

@@ -1,5 +1,3 @@
-
-* { padding: 0; margin: 0; }
 html, body { height: 100%; }
 
 #controlpane {

meteor

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-BUNDLE_VERSION=0.3.26
+BUNDLE_VERSION=0.3.28
 
 # OS Check. Put here because here is where we download the precompiled
 # bundles that are arch specific.
@@ -51,15 +51,25 @@ function install_dev_bundle {
     rm -rf "$BUNDLE_TMPDIR"
     mkdir "$BUNDLE_TMPDIR"
 
+    # fyi: URL duplicated in packages/dev-bundle-fetcher/dev-bundle
+    DEV_BUNDLE_URL_ROOT="https://d3sqy0vbqsdhku.cloudfront.net/"
+    # If you set $USE_TEST_DEV_BUNDLE_SERVER then we will download
+    # dev bundles copied by copy-dev-bundle-from-jenkins.sh without --prod.
+    # It still only does this if the version number has changed
+    # (setting it won't cause it to automatically delete a prod dev bundle).
+    if [ -n "$USE_TEST_DEV_BUNDLE_SERVER" ] ; then
+        DEV_BUNDLE_URL_ROOT="https://com.meteor.static.s3.amazonaws.com/test/"
+    fi
+
     if [ -f "$SCRIPT_DIR/$TARBALL" ] ; then
         echo "Skipping download and installing kit from $SCRIPT_DIR/$TARBALL" >&2
         tar -xzf "$SCRIPT_DIR/$TARBALL" -C "$BUNDLE_TMPDIR"
     elif [ -n "$SAVE_DEV_BUNDLE_TARBALL" ] ; then
         # URL duplicated in tools/server/target.sh.in
-        curl -# "https://d3sqy0vbqsdhku.cloudfront.net/$TARBALL" >"$SCRIPT_DIR/$TARBALL"
+        curl -# "$DEV_BUNDLE_URL_ROOT$TARBALL" >"$SCRIPT_DIR/$TARBALL"
         tar -xzf "$SCRIPT_DIR/$TARBALL" -C "$BUNDLE_TMPDIR"
     else
-        curl -# "https://d3sqy0vbqsdhku.cloudfront.net/$TARBALL" | tar -xzf - -C "$BUNDLE_TMPDIR"
+        curl -# "$DEV_BUNDLE_URL_ROOT$TARBALL" | tar -xzf - -C "$BUNDLE_TMPDIR"
     fi
 
     test -x "${BUNDLE_TMPDIR}/bin/node" # bomb out if it didn't work, eg no net