67 Commits

Author SHA1 Message Date
Alexander Brandon Coles e8767481e9 [#70166] Fix accessibility errors found by ERB Lint (#21503)
* Fix GitHub/NoTitleAttribute, LinkHasHref errors

- Replaces `title` attribute with `aria-label` for interactive elements.
- Removes `title` from non-interactive elements.
- Converts `<a>` tags without proper `href` to `<button>` elements,
  using Primer `Button`/`IconButton` where possible.

# Conflicts:
#	app/views/custom_fields/_custom_options.html.erb
#	spec/features/admin/custom_fields/shared_custom_field_expectations.rb
#	spec/features/admin/custom_fields/work_packages/list_spec.rb

* Fix Autocomplete missing errors

* Fix GitHub/NoPositiveTabIndex errors

Removes all positive `tabindex` values.

* Fix Rails/LinkToBlank errors

* Replace toast with Primer Banner on LDAP form

* Add frozen_string_literal

* Ignore erb lint for deprecated files

* Fix linting errors in repository module

* Fix linting errors in budgets and custom actions

* Fix linting errors in member form and 2fa

* Fix linting errors in mcost types and wiki help and storages

* Fix linting errors in multi select filters, ifc viewer, and unsupported browser banner

* Fix failing spec

* Use Primer banner instead of op-toast where ever it is possible

* Use octicon instead of op_icon

* Fix failing tests

* Use no-decoration-on-hover for button links and change the button with only an icon to primer icon button

* Keep webhook response modal activation selector class-based

* use icon button for edit of hourly rate

---------

Co-authored-by: Behrokh Satarnejad <b.satarnejad@openproject.com>
2026-05-07 10:31:10 +02:00
Oliver Günther 10a59c3f10 Remove fastimage for content type checking 2026-04-15 14:18:42 +02:00
Jan Sandbrink f9d8bc6614 Introduce SubclassResponsibility error
This error is intended for cases when a method is
intentionally not implemented, because the module/class defining
it expects a subclass (or class including the module) to implement
the method.

This is intended to distinguish it from other cases, such as:
* feature not implemented yet
* edge case of a method call not yet supported

Notably it avoids the misuse of the Ruby-defined NotImplementedError,
which is only intended for much more specific scenarios:

> Raised when a feature is not implemented on the current platform. For example, methods depending on the fsync or fork system calls may raise this exception [...]

Also see https://docs.ruby-lang.org/en/master/NotImplementedError.html
2026-03-27 08:14:56 +01:00
Oliver Günther 4d731dcab6 Replace raw and explicit html_safe calls 2026-03-20 09:49:10 +01:00
Klaus Zanders c212df5b81 Use more visible scoping for users 2026-02-09 15:07:45 +01:00
Jan Sandbrink 0728d07ad1 Self-test basic schema compliance for a few API models
Those self-tests are "basic" in the sense that they only validate
their compliance with our documented schema in one representation.

These test cases don't yet cover/validate whether the generated
representation also fulfills the schema under different circumstances,
for example when rendering for a user with fewer privileges, not allowed
to see certain fields.

Where necessary, the schema was changed to reflect the reality, e.g.
when those tests revealed that a "required" field might be missing due to
a lack of permissions.

In a few cases the implementation was adapted to allow for stricter guarantees
of the specified schema, for example links allowed to leave out the title key
already, so its not necessary to emit `title: nil` in cases where a title is
not known.
2025-12-15 11:10:34 +01:00
Behrokh Satarnejad a93c851288 [64225] [Accessibility] Provide alternative text for images (#21183)
* add an input for the principal component to pass an alt text of avatar image

* Add avatar alt text in user menu for the user avatar

* Add alt text for assignee in wp single card

* add some description for the canvas

* add alt for images

* Show the summary of chart on it

* change the method parameters

* Hide the gantt chart from screen reader because it doesnt add any value for the screen reader user

* Use better name for inputs and improve the methods definitions

* fix eslint errors

* fix rubocup errors

* remove alt for bcf snapshot

* better structure for avatar in user menu
2025-11-26 16:07:58 +01:00
Oliver Günther 14192a74c3 Replace confirm with turbo-confirm, method with turbo-method 2025-09-26 09:15:04 +02:00
Dombi Attila 10dc5538a2 [#63386] Use rescue_from ActiveRecord::RecordNotFound
https://community.openproject.org/work_packages/63386
2025-04-14 13:44:28 +03:00
Ivan Kuchin 0f6a12da3a erb_lint auto fix layout 2025-02-11 18:49:20 +01:00
Ivan Kuchin fb715f21b9 erb_lint auto fix quotes 2025-02-11 18:49:19 +01:00
Ivan Kuchin 0b1f73ec79 erb_lint auto except rubocop linter 2025-02-11 18:49:19 +01:00
Tobias Dillmann 263b12cf3f [#61126] remove unneeded hover-card-target logic 2025-02-04 13:55:27 +01:00
Tobias Dillmann 52f64f8722 [#55581] allow disabling the hover card 2024-11-29 15:19:50 +01:00
Tobias Dillmann 52cdcdd9f2 [#55581] make user hover card opt-out
By default, it will now be shown. Since we want to have it almost
anywhere on the page, it makes sense that `true` is the default setting.
2024-11-29 15:19:50 +01:00
Tobias Dillmann 9a9e7b2a91 [#55581] reduce ABC in avatar helper 2024-11-29 15:19:46 +01:00
Tobias Dillmann d83fb1a389 [#55581] small polishing fixes 2024-11-29 15:19:43 +01:00
Tobias Dillmann d3345689fa [#55581] only show hovercard if set active 2024-11-29 15:19:37 +01:00
Tobias Dillmann 3bef3eb36d [#55581] allow hovercards in auto completer and share dialog 2024-11-29 15:19:37 +01:00
Tobias Dillmann b096073433 [#55581] set position & close delay of card by data-attr 2024-11-29 15:19:35 +01:00
Tobias Dillmann 4f6fd0d7d4 [#55581] attach hover card attributes to avatar image
Previously, it was attached to the wrapper, which led to weird behavior.
With the new approach, it looks more natural while fitting the design
better.

Sneaked in some improvements such as using the hover card path helper.
2024-11-29 15:19:34 +01:00
Tobias Dillmann fe106c3396 [#55581] Users::HoverCardComponent 2024-11-29 15:19:30 +01:00
Tobias Dillmann 32495036c4 [#55581] enforce hover card in project member list for now 2024-11-29 15:19:29 +01:00
Henriette Darge bd87fd5901 Pass PageHeader information to plugin partial 2024-10-16 08:59:58 +02:00
Oliver Günther ac39406347 Replace dynamic bootstrapped components with angular elements 2024-08-16 19:16:13 +02:00
Behrokh Satarnejad 6c6ba1e08a [53807] Update PageHeaders & SubHeaders in the My account pages (#16141)
* replace page header in profile, settings,sessions, password pages

* replace page header in user email reminder page

* replace page header in user access token page

* fix layout error on access token

* add page header component to two factor authentication page

* remove toolbar for email reminder

* use page header component in change avatar page

* unify menu entry and page header title for avatar page

* add page header for delete account pages

* add users and permissions to the breadcrumb of delete account from admin side

* create a separate component for page header in delete account page

* use page header component in n notifications settings and remove toolbar component in notification settings component and reminder settings component

* add page header component to 2fa new page

* add page header component to 2fa new pages and chnage the name of delete account page header component

* change user path in breadcrumb of delete account page

* remove show_toolbar of the component from reminders pages

* move page header to the top of the page in 2fa devices page

* remove the container element from access token page

* remove new type html and use action menu instead

* add description to menu item and change descriptions and titles

* Remove inline create button at the bottom of table

* fix failing specs

* fix failing spec

* fix rubocop error

* undo removing the page that is used for creating a new 2fa device in a state that is enforced by admin

* fix specs for selecting a device from action menu

* set the correct breadcrumb for add a new device

* undo changes for tests of forced registration

* undo changes for tests of new method when reverting deleted file

* add page header to the 2fa add new device page

* change html title in the 2fa add new device page

* change breadcrumbs in 2fa new device page

* use test selector helper in specs

* add page header to backup codes page

* shorten title an breadcrumb in backup code page

* remove closed tag
2024-08-14 10:30:16 +02:00
Ivan Kuchin 4911b8a149 remove years from copyrights (except for COPYRIGHT file) 2024-07-31 15:02:49 +02:00
Henriette Darge b8c8977d67 Introduce PageHeader component in plugin settings pages (e.g avatar or cost settings) 2024-07-15 12:25:42 +02:00
Henriette Darge 7d4a30fdc5 Use tabNav element of the pageHeader in Admin -> Users -> Edit user 2024-07-15 10:53:33 +02:00
Henriette Darge f7eccde66a Introduce PageHeader in Administration / Roles 2024-07-15 08:40:34 +02:00
ulferts fdbd6b6d5a forcing to specify allowed actions when forfeiting authorization check 2024-06-11 10:29:22 +02:00
ulferts 088329d508 attempt to focus on explicitly allowing no_authorization_required! 2024-06-10 22:42:58 +02:00
ulferts ed5a162230 allow actions to be called on those not using default authorization before_actions 2024-06-07 16:55:40 +02:00
Aaron Dewes b9d3a9647d fix: Openproject / Open Project -> OpenProject
This fixes the spelling of OpenProject in a few places
2024-04-26 12:06:51 +02:00
ulferts 3b2121f733 Revert "Merge remote-tracking branch 'origin/release/13.4' into dev"
This reverts commit 40b2bbeb09, reversing
changes made to b4c6cb17cc.
2024-03-21 11:31:17 +01:00
Ivan Kuchin 7787e457a3 Revert "Merge branch 'dev' into release/13.4"
This reverts commit a901541269, reversing
changes made to e573ca00b7.
2024-03-20 20:19:08 +01:00
Ivan Kuchin 9e4934cd0a change quotes using rubocop --only Style/StringLiterals,Style/QuotedSymbols -a 2024-03-20 18:05:22 +01:00
Christophe Bliard 8fa8584538 Run rubocop --autocorrect on all files
Only the safe cops have run. rubocop version is 1.59.0.
2024-01-05 15:27:09 +01:00
Christophe Bliard c795874f7f Update copyright year for 2024
command used: `rg -l 'Copyright \(C\) 2012-202\d the OpenProject' | xargs -n 100 sed -i -r 's/Copyright \(C\) 2012-202. the OpenProject/Copyright (C) 2012-2024 the OpenProject/'`
2024-01-02 16:23:54 +01:00
Klaus Zanders ba7f27c9f5 Merge branch 'dev' into replace-remaining-allowed-calls 2023-11-06 16:29:08 +01:00
Behrokh Satarnejad 17480df26c [50307] Timestamp overflows the BorderBox on Storages index page (#13923)
* add x-scroll when the content is overflew

* exchange the Provider and the Creator columns

* change the layout of file storage list page based on new design for different breakpoints

* remove unnecessary class

* add a new class to hide an element for tablet and mini laptops

* clean style sheet file from unnecessary rules

* add an input for setting classes to the name of principal component

* remove extra avatar component and use a class instead, to hide the name of avatar for mini laptop and tablet

* fix specs for avatar helper

* Update frontend/src/global_styles/layout/_base_mobile.sass

Co-authored-by: Henriette Darge <h.darge@openproject.com>

* make the class name optional and use two classes for hiding name of avatar for tablet and small screen laptop

* fix eslint errors

* fix spec failing

* use one class for hiding element in tablet and small laptop mode

---------

Co-authored-by: Henriette Darge <h.darge@openproject.com>
2023-11-02 15:40:00 +01:00
Klaus Zanders 53255f8d1a Use existing permissions for editing avatars 2023-11-02 11:09:11 +01:00
Oliver Günther e3f28b9e04 Add Users::AvatarComponent 2023-09-20 09:51:29 +02:00
Klaus Zanders 26cee2729e Fixes Performance/RegexpMatch offenses 2023-09-06 12:50:32 +02:00
Mir Bhatia 512e1bcbd2 Update the look of activity items 2023-01-23 17:52:22 +01:00
Christophe Bliard 21a696ef9b Update copyright information for 2023 2022-12-30 15:51:26 +01:00
ulferts 28c64edc8e avoid call to super removed in fb6d85d50b 2022-11-08 09:19:26 +01:00
Oliver Günther 4d097daceb Replace separate https and force_ssl flags with https + hsts
By default, https will be enabled in production in OpenProject 12.2. Right now, a separate flag exists called

rails_force_ssl that needs to be controlled separately, but the two settings are intermingled.

This PR fixes this so that:

HTTPS setting controls the secure cookies and generating links with
https throughout the application

HSTS setting is only active by default when HTTPS is enabled and
controls the HSTS headers as well as the HTTP->HTTPS request upgrade for
transport-security.
2022-08-15 19:48:51 +02:00
Christophe Bliard b50855a955 Use ServiceResult factory methods where possible
All was automatic through the use of `rubocop --autocorrect --only
OpenProject/UseServiceResultFactoryMethods app lib lib_static modules
spec`.
2022-06-16 10:01:57 +02:00
Christophe Bliard 48a4f1b6ad lint with rubocop --autocorrect (safe cops only) 2022-06-02 10:40:10 +02:00