Matthias Fischmann

Use `Content-Security-Policy` header

1

- https://de.wikipedia.org/wiki/Content_Security_Policy - https://content-security-policy.com/ thanks @tarleb!

``` DONE! error occured in daemon [logger] thread blocked indefinitely in an STM transaction ``` I think this is not serious; everything the script is supposed to do happens, and...

As of #920, browser caching is universally disabled. This is bad for scalability and for people coming through bad networks. What we want is something more like this: - cache...

Move Arbitrary module from src to tests

1

Make sure that quickcheck deps are removed from the library completely. There is subtle stuff going on with it all over the place, and we probably don't want any of...

Problem: If no avatar image is provided in user profile edit, we get an error instead of a `Nothing`. Workaround: We treat all errors as "no avatar image provided for...

i18n

6

- transifex interoperability - make it easy to change wording in the UI without touching the code - NTH: support for multiple languages

we are setting cookies, but we are not doing the obnoxious EU-required warning. not sure that's a problem? we are not a public application, but by-invitation only in closed organisations,...

deleted users are leaking.

1

We should mark all occurrances of `User` where we expect a non-deleted user, and find a way to enforce `isActiveUser` in those places on the type level somehow. I'm just...

in #615, we currently implement the delegation logic, and we ran into a weirdness in the fringe case where N voters delegate to each other in a cycle and then...

it's hard to find users when you're not an admin

1

i imagine students will want to have a list of all people in their class somewhere, or at least a way to get to the profile if they know the...