Security: with "Self Registration" and "Forgot Password" disabled in the Admin
Panel, the Register (.at-signup-link) and Forgot Password (.at-pwd-link) links
were hidden only by a one-shot jQuery .hide() in userFormsLayout.onRendered.
When a login failed (notably the LDAP "User not Found" path), useraccounts
re-rendered the form and recreated those link nodes without the inline
display:none, so the links reappeared and exposed registration / password-reset
flows that were meant to be off.
The disable state is now also reflected as a class on the stable <body>
ancestor (registration-disabled / forgotpwd-disabled) with matching CSS in
userForm.css. Because the class sits on <body>, the rule re-hides every copy of
the links that useraccounts recreates after a failed login, instead of relying
on a single inline style that the re-render dropped.
Thanks to Alsterdetektive1 and xet7.
On phones body.mobile-mode pins <body> to position:fixed + height:100vh (an
iOS board-view anti-bounce fix). The auth pages (userFormsLayout) have no
inner #content scroller, and .auth-layout/.auth-dialog were sized to the
viewport height, so the page was trapped at 100vh: the content below the
form — the sign-up/sign-in link, legal notice and language selector — could
not be scrolled into view, and the on-screen keyboard covered it.
userFormsLayout now tags <body> with .userform-layout while mounted, and CSS
lets those pages scroll as a normal document on mobile (position:static,
height:auto, min-height:100vh) with the auth layout/dialog growing to their
content. Scoped to .userform-layout so the board-view mobile lock is
unchanged. Removed on destroy.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(Arabic and its variants, Persian/Farsi, Hebrew, Uyghur, Uzbek-Arabic and
Yiddish — the languages flagged `rtl: true` in `imports/i18n/languages.js`).
Previously only some pages flipped. The root `<html>` element now gets a
reactive `dir="rtl"`/`dir="ltr"` attribute that follows the chosen language, so
the whole UI mirrors at once. To make this work on every page rather than a
handful, all directional component CSS was converted to CSS logical properties
(`margin-left`→`margin-inline-start`, `left:`→`inset-inline-start:`,
`text-align: left`→`text-align: start`, `float: left`→`float: inline-start`,
and the mirror-image right/end variants) across 48 stylesheets, which flip
automatically with `dir`. Horizontal-centering rules using
`left: 50%` + `transform: translate(-50%, …)` were intentionally kept physical,
since those already center correctly in both directions. The calendar view also
renders RTL. Thanks to xet7 and Claude.
- Tests for the RTL UI. A fast, server-less `tests/rtl.test.js` (run with
`node tests/rtl.test.js`) checks that exactly the expected languages are
flagged `rtl: true`, that the direction helper maps each language to the right
`dir` value, that the root `<html>` and the client keep `dir` in sync, and —
as a regression guard — that component CSS keeps using logical properties
(no physical `margin-left`/`float: left`/bare `left:` offsets sneak back in).
A Playwright browser spec `tests/playwright/specs/18-rtl-layout.e2e.js` drives
the app in both English (LTR) and Arabic (RTL) and asserts, on the boards list,
board view, card details, my-cards / due-cards / global-search, the admin
settings page and the login page, that the direction is correct, the
translated text is visible, and leading-edge content (the boards menu, the
first board list) sits on the correct side. Thanks to xet7 and Claude.
- Fixed the "Meteor unit tests" CI job hanging until its 45-minute timeout. The
workflow set `TEST_WATCH: '0'`, but meteortesting:mocha computes
`testWatch: TEST_WATCH || …` and the string `'0'` is truthy in JavaScript, so
it turned on watch mode and the process never exited. Removing the env var lets
`meteor test --once` finish and exit with the correct status.
Thanks to xet7 and Claude !
Fixes#6136,
fixes#3376,
fixes#884
Lauri Ojansivu
copilot-swe-agent[bot]andxet7