134 Commits

Author SHA1 Message Date
Oliver Günther ad4549847b Fix env name SSRF by using the actual defined value 2026-03-17 15:03:26 +01:00
Markus Kahl 05602f1542 rubocop 2026-03-09 13:33:12 +00:00
Markus Kahl 9e7833ce46 prevent timing attacks in ssrf protected test email 2026-03-09 12:27:54 +00:00
Markus Kahl 885e9ce5f5 safe_ip -> safe_ip?
Co-authored-by: Klaus Zanders <klaustopher@users.noreply.github.com>
2026-03-09 11:31:38 +00:00
Markus Kahl 2a56b3beea rubocop 2026-03-07 13:51:58 +00:00
Markus Kahl 42d97005e2 add OpenProject::SsrfProtection, use it when sending test email to prevent attack 2026-03-05 12:15:35 +00:00
Oliver Günther 14192a74c3 Replace confirm with turbo-confirm, method with turbo-method 2025-09-26 09:15:04 +02:00
Alexander Brandon Coles f15be6e07f Freeze string literals in app/controllers
rubocop -A --only Style/FrozenStringLiteralComment,Layout/EmptyLineAfterMagicComment,Style/RedundantFreeze app/controllers
2025-07-18 17:51:00 +01:00
Henriette Darge ee8452282a [63485] Remove show_local_breadcrumb and default_breadcrumb (#18663)
* add a new helper for breadcrumb in wiki page

* set page header in destroy page

* set page header in edit page

* set page header in history and rename and edit parent pages

* change toolbar items into page header items

* add new wiki action to sub header

* remove version edit page which is not in use any more

* add export as a menu item of the header

* fix rubocup errors

* fix failing tests

* replace page header in annotate page

* replace page header in diff page

* add page header in select menu page

* fix rubocup errors

* fix errors on rename test

* fix errors on selecting items from toolbar

* fix errors on tests for child pages

* set correct permission for configure menu item

* replace page header in summary page

* replace page header in summary details page

* edit docs of sub header

* add page header in wiki new page

* remove controller and a route for edit method

* undo changes for docs of sub header

* extract header in show page into a new component

* use helper method in header component

* add wiki module to the breadcrumb

* rename page header component for wiki page

* simplify how lock and lock implemented

* extract sub header

* remove wiki title from header of history page

* fix page header in new page

* use page.find_test_selector in test

* fix failing test for summary page

* fix failing test for wiki child pages

* change the summary test

* use test selector for page header title

* undo changes for activate user in admin

* use test selector in adding editing history test

* use test selector in attachment upload test

* use test selector in child pages tests

* use test selector in wiki menu items tests

* change test selector for breadcrumbs

* extract conditions to show edit button into a method

* extract conditions to show rollback action menu item into a method

* extract conditions to show create button into a method

* fix duplicated code in test

* Remove outdated `show_local_breadcrumb` method which is replaced by the Primer::PageHeader breadcrumb

* Remove `default_breadcrumb` method as it serves no prupose any more

* Remove the old breadcrumb and its hook completely

* remove breadcrumbs path from rename

* fix translations errors in storages

* undo changes on translations

* remove default breadcrumbs in time tracking controller

---------

Co-authored-by: Behrokh Satarnejad <b.satarnejad@openproject.com>
Co-authored-by: Behrokh Satarnejad <62008897+bsatarnejad@users.noreply.github.com>
2025-04-23 10:40:43 +02:00
Ivan Kuchin 9a547a42a4 fix calling menu item condtion without project argument in admin controller 2025-01-16 15:11:38 +01:00
Alexander ecc7765381 Merge branch 'use_jemalloc' of github.com:top4ek/openproject into use_jemalloc
* 'use_jemalloc' of github.com:top4ek/openproject: (1771 commits)
  [57927] Primerise the Notification badge in the top header (#16742)
  add test for WorkPackageEagerLoadingWrapper text formatting; addresses https://github.com/opf/openproject/pull/16542#discussion_r1736049674
  chore(deps): bump md-to-pdf to v0.1.2
  [57347] Fixed NextcloudConnectionValidator specs
  Remove special mobile scrolling behavior that we introduced to collapse the adress bar on iOS Safari. It somehow conflicts with the positioning of the ActionMenu
  [57347] Restructured NextcloudConnectionValidator
  [57347] Added test for failing files query on NextcloudConnectionValidator
  [57347] Added test for unexpected files validation for Nextcloud storage
  [57347] Added unexpected content validation to NextcloudConnectionValidator
  build(deps): bump fog-aws from 3.26.0 to 3.27.0
  build(deps-dev): bump rubocop-performance from 1.21.1 to 1.22.0
  add a trailing arrow-down icon for add button in meeting module
  update locales from crowdin [ci skip]
  update locales from crowdin [ci skip]
  update locales from crowdin [ci skip]
  update locales from crowdin [ci skip]
  update locales from crowdin [ci skip]
  [57911] Improve participants side panel phrasing and spacing
  [#53620] add feature flag for buit-in apps
  Add technical notes to lookbook forms page
  ...
2024-09-17 21:24:26 +03:00
Alexander 05fea4088c rubocop 2024-09-17 21:23:14 +03:00
Alexander 48bff067d2 Merge branch 'dev' into use_jemalloc 2024-09-17 21:20:32 +03:00
Alexander b9642fb4bb Rubocop 2024-09-17 20:25:27 +03:00
Alexander 4dab37f426 Show state at info page 2024-09-17 19:34:00 +03:00
Ivan Kuchin 4911b8a149 remove years from copyrights (except for COPYRIGHT file) 2024-07-31 15:02:49 +02:00
Henriette Darge 89b6af8a9c Introduce PageHeader in some Admin modules 2024-07-25 09:12:43 +02:00
ulferts 3b2121f733 Revert "Merge remote-tracking branch 'origin/release/13.4' into dev"
This reverts commit 40b2bbeb09, reversing
changes made to b4c6cb17cc.
2024-03-21 11:31:17 +01:00
Ivan Kuchin 7787e457a3 Revert "Merge branch 'dev' into release/13.4"
This reverts commit a901541269, reversing
changes made to e573ca00b7.
2024-03-20 20:19:08 +01:00
Ivan Kuchin 9e4934cd0a change quotes using rubocop --only Style/StringLiterals,Style/QuotedSymbols -a 2024-03-20 18:05:22 +01:00
Oliver Günther 23d49f9d38 Hide bundled plugins 2024-03-13 09:26:22 +01:00
Christophe Bliard 8fa8584538 Run rubocop --autocorrect on all files
Only the safe cops have run. rubocop version is 1.59.0.
2024-01-05 15:27:09 +01:00
Christophe Bliard c795874f7f Update copyright year for 2024
command used: `rg -l 'Copyright \(C\) 2012-202\d the OpenProject' | xargs -n 100 sed -i -r 's/Copyright \(C\) 2012-202. the OpenProject/Copyright (C) 2012-2024 the OpenProject/'`
2024-01-02 16:23:54 +01:00
Aaron Contreras 3c4a7de6f1 Remove #force_user_language action
Cleaning up the no-longer used action.
2023-06-13 08:29:38 -05:00
Christophe Bliard 0d7a20bc08 Fix 500 error on POST /admin/force_user_language 2023-06-08 15:27:29 +02:00
Christophe Bliard 21a696ef9b Update copyright information for 2023 2022-12-30 15:51:26 +01:00
Eric Schubert 81d526c2c5 [#41945] fixed rubocop issues 2022-04-22 11:16:59 +02:00
Christophe Bliard a33524ef6d remove ruby magic comment for utf-8
ruby interprets source encoding as utf-8 since 2.0.0, making magic comment redundant and useless
2022-03-10 19:36:58 +01:00
Christophe Bliard bc8d423ec2 update copyright information for 2022 2022-03-01 17:05:59 +01:00
Oliver Günther ccfa29c728 Move license and copyright docs to root, fix names and references 2021-09-02 21:50:46 +02:00
Oliver Günther 34f8e9dff8 Validate admin guard for all settings writers (#9012)
* Validate admin guard for all settings writers

* Add spec to test access to all links under admin

* Fix broken specs

* Keep only UpdateContract and add spec

* Move admin settings under their own namespace for clarity

Move all admin related settings under ::Admin::SettingsController

* Fix more paths and views for settings

Adds another spec to ensure all links in admin can be viewed by admin

* Fix wrongly changed settings path for repositories page

* Use plugin name for plugin settings
2021-02-22 20:46:27 +01:00
ulferts 244eae534e display postgresql version
No longer displaying the database name as that will always be the same
2021-02-16 21:17:13 +01:00
ulferts 1bdd2ab9ae safe automatic fixes by rubocop (#8994) 2021-02-11 16:02:18 +01:00
Oliver Günther 3c9be3bdbe [35507] Allow global permission to add and edit users (#8937)
* Add global permission for add_user

* Rename fieldset for global roles to "Global"

* Add permission to admin actions

* Add index action to add_user permission

* Redirect to first admin item if only one

* Hide status action for non admins

* Break down user form into partials for easier rendering

* Disable some user form tabs for non-admins

* Make users API and services conformant with endpoints

* Fix references to DeleteService#deletion_allowed?

* Authorize add_user on show as well

* Only show invite user toolbar item with permission

* Fix Delete Service spec

* Fix the way user prefs are handled in service

* Ensure session_id is treated as string

This causes a cast error otherwise as it passes rack session locally

* Fix service call on onboarding controller

* Fix service call on users controller

* Add delete spec for global user

* Hide login attribute again when adding a new user

* Render auth source correctly in simple form

* Fix creating invited users through service

The invitation requires the mail attribute to be present.

Previously, there was a manual error added to the mail.

As the errors are now determined by the contract + model, we now

end up with all missing properties as errors.

* Properly constraint attributes for non-admins

* Add specs for global user

* Start working on how to update password from UsersController

that code is a mess...

* Change permitted_params spec to include non-admin params

* Fix create user service spec

* Remove mail_notification param from users controller

It's not part of the contract/params passed to user

* Remove todos

* Extend docs

* Correct the way backlogs patches into the user settings

* Remove superfluous UpdateUserService

* Rewrite duplicated update service examples into common shared example

* Remove duplicate password writable check

* Base Users::DeleteContract on base delete contract

* Move checks for active users into the UserAllowedService

* Restore password writable check as it is not an attribute

* Fix menus for global user

* Allow global users to add custom fields

* Allow global user add permission to reinvite user

* Fix changed var name in update service spec

* Ensure also invited or registered users can be authroized

This ensure that e.g., invited users can also be set as watchers

* fix typo

Co-authored-by: ulferts <jens.ulferts@googlemail.com>
2021-02-01 10:45:13 +01:00
ulferts 6140f4c7e9 update copyright to 2021 (#8925)
Updates the copyright to 2021 for all files that have a copyright. Files in our source code without the copyright header still do not receive one automatically. Additionally, backlisted files are also excluded.

Previously the copyright of chiliproject which references redmine stated a copyright of redmine up to and including 2017 which is not true for the code we have in here. Because of that I changed that to 2013
2021-01-13 17:47:45 +01:00
Markus Kahl 652dbcc1ad handle missing ImageMagick convert binary 2021-01-09 19:52:19 +00:00
Wieland Lindenthal 06cc0ec588 Optimize memory usage for pdf exports with attachments (#8854)
https://community.openproject.com/wp/35327

- Installs Imagemagick package for image conversion.
- converts all attachments to a smaller size before
  printing them to the PDF file.
- Ads a installation check to the _Admin -> Information_
  screen.
2020-11-24 13:35:40 +00:00
ulferts 3e4d21e052 extract email settings into own menu item 2020-02-07 14:37:31 +01:00
ulferts 690dc1a36e adapt specs to implementation 2020-01-22 14:35:43 +01:00
ulferts a8a274ae7a linting 2020-01-22 14:03:41 +01:00
Henriette Dinger cbc3d2ea8d Merge remote-tracking branch 'origin/dev' into bim-dev 2020-01-16 09:55:27 +01:00
Henriette Dinger bd7f4e4814 Update copyright notice 2020-01-15 11:31:26 +01:00
Oliver Günther 699e19965f Add view converter service 2019-12-03 10:37:52 +01:00
Oliver Günther ee0bbcd043 Use deliver_now in test mail
[ci skip]
2019-11-05 14:51:18 +01:00
Oliver Günther 3aa3dea512 Allow deliver_later using a custom ApplicationJob
We're getting more and more reports on synchronous Timeouts and SMTP
errors causing internal errors for users when trying to send mail in the
request of the browser.

With rails 5.2, we can assign a custom job that handles the
`deliver_later` delayed sending. We can hook this into the
ApplicationJob with delayed_job.

Since rails now also has GlobalID serialization of ActiveRecord, we
don't even need to do the serialization ourselves!
2019-10-25 09:09:45 +02:00
Markus Kahl 444afb25b0 hide menu items both from side menu and overview panel 2019-09-23 13:36:02 +01:00
Henriette Dinger 3cd0926590 Hide EE menu node on the overview page for the Cloud edition && fix menu highlighting for WP settings 2019-08-21 15:14:18 +02:00
Henriette Dinger 8a620b8852 Move admin_controller spec from legacy to spec && rename admin index page to "index" && adapt view spec 2019-07-08 09:53:31 +02:00
Henriette Dinger ed43b9ba04 Add admin overview page with links to submenus 2019-07-04 13:43:21 +02:00
Oliver Günther e0a0be419b [30360] Allow configuration of storage path display
Use `show_storage_information` to toggle display of storage information
in backend.

[ci skip]
2019-06-11 07:48:45 +02:00